Merge lp:~fwereade/juju-core/fix-1089289-for-1.16 into lp:juju-core/1.16

[William Reade]

fix lp:1089289 for 1.16

involves trunk revisions:

2015, 2025 for destroy-machine and destroy-unit over the API
2045 for force-destroy-machine in state
2050, 2051 for force-destroy-machine in api

...and a tweak to cmd/jujud/machine_test.go to revert functionality in r2045
that depends on post-1.16 address-handling code.

https://codereview.appspot.com/26100043/

fix lp:1089289 for 1.16

involves trunk revisions:

2015, 2025 for destroy-machine and destroy-unit over the API
2045 for force-destroy-machine in state
2050, 2051 for force-destroy-machine in api

...and a tweak to cmd/jujud/machine_test.go to revert functionality in r2045
that depends on post-1.16 address-handling code.

https://codereview.appspot.com/26100043/

[William Reade (fwereade)]

Reviewers: mp+195088_code.launchpad.net,

Message:
Please take a look.

Description:
fix lp:1089289 for 1.16

involves trunk revisions:

2015, 2025 for destroy-machine and destroy-unit over the API
2045 for force-destroy-machine in state
2050, 2051 for force-destroy-machine in api

...and a tweak to cmd/jujud/machine_test.go to revert functionality in
r2045
that depends on post-1.16 address-handling code.

https://code.launchpad.net/~fwereade/juju-core/fix-1089289-for-1.16/+merge/195088

Requires:
https://code.launchpad.net/~fwereade/juju-core/fix-1233457-for-1.16/+merge/195003

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/26100043/

Affected files (+905, -483 lines):
   A [revision details]
   M cmd/juju/destroymachine.go
   M cmd/juju/destroymachine_test.go
   M cmd/juju/destroyunit.go
   M cmd/jujud/machine_test.go
   M state/api/client.go
   M state/api/params/params.go
   M state/apiserver/client/client.go
   M state/apiserver/client/client_test.go
   M state/apiserver/client/perm_test.go
   A state/cleanup.go
   A state/cleanup_test.go
   M state/life.go
   M state/life_test.go
   M state/machine.go
   M state/machine_test.go
   M state/relationunit_test.go
   M state/service_test.go
   M state/state.go
   M state/state_test.go
   D state/statecmd/destroyunit.go
   M state/unit_test.go

[Roger Peppe (rogpeppe)]

On 2013/11/13 16:04:22, fwereade wrote:
> Please take a look.

LGTM assuming it all works live.

Although this is obviously not a thorough review - it's too
much to take in at one sitting, especially with respect
to the subtly different 1.16 code.

https://codereview.appspot.com/26100043/

[Go Bot (go-bot)]

The attempt to merge lp:~fwereade/juju-core/fix-1089289-for-1.16 into lp:juju-core/1.16 failed. Below is the output from the failed tests.

ok launchpad.net/juju-core/agent 0.261s
ok launchpad.net/juju-core/agent/tools 0.265s
ok launchpad.net/juju-core/bzr 6.595s
ok launchpad.net/juju-core/cert 3.998s
ok launchpad.net/juju-core/charm 0.544s
? launchpad.net/juju-core/charm/hooks [no test files]
ok launchpad.net/juju-core/cloudinit 0.026s
ok launchpad.net/juju-core/cmd 0.201s
? launchpad.net/juju-core/cmd/charmd [no test files]
? launchpad.net/juju-core/cmd/charmload [no test files]
FAIL launchpad.net/juju-core/cmd/juju [build failed]
ok launchpad.net/juju-core/cmd/jujud 47.906s
ok launchpad.net/juju-core/cmd/plugins/juju-metadata 2.375s
ok launchpad.net/juju-core/constraints 0.028s
ok launchpad.net/juju-core/container/lxc 0.378s
? launchpad.net/juju-core/container/lxc/mock [no test files]
ok launchpad.net/juju-core/downloader 5.282s
ok launchpad.net/juju-core/environs 3.357s
ok launchpad.net/juju-core/environs/bootstrap 5.141s
ok launchpad.net/juju-core/environs/cloudinit 0.543s
ok launchpad.net/juju-core/environs/config 0.745s
ok launchpad.net/juju-core/environs/configstore 0.041s
ok launchpad.net/juju-core/environs/filestorage 0.030s
ok launchpad.net/juju-core/environs/httpstorage 0.950s
ok launchpad.net/juju-core/environs/imagemetadata 0.507s
ok launchpad.net/juju-core/environs/instances 0.052s
ok launchpad.net/juju-core/environs/jujutest 0.225s
ok launchpad.net/juju-core/environs/manual 4.287s
ok launchpad.net/juju-core/environs/simplestreams 0.331s
? launchpad.net/juju-core/environs/simplestreams/testing [no test files]
ok launchpad.net/juju-core/environs/sshstorage 1.265s
ok launchpad.net/juju-core/environs/storage 1.189s
ok launchpad.net/juju-core/environs/sync 37.033s
ok launchpad.net/juju-core/environs/testing 0.211s
ok launchpad.net/juju-core/environs/tools 6.799s
? launchpad.net/juju-core/environs/tools/testing [no test files]
ok launchpad.net/juju-core/errors 0.015s
ok launchpad.net/juju-core/instance 0.022s
? launchpad.net/juju-core/instance/testing [no test files]
ok launchpad.net/juju-core/juju 17.913s
ok launchpad.net/juju-core/juju/osenv 0.018s
? launchpad.net/juju-core/juju/testing [no test files]
ok launchpad.net/juju-core/log 0.015s
ok launchpad.net/juju-core/log/syslog 0.029s
ok launchpad.net/juju-core/names 0.026s
? launchpad.net/juju-core/provider [no test files]
? launchpad.net/juju-core/provider/all [no test files]
ok launchpad.net/juju-core/provider/azure 6.210s
ok launchpad.net/juju-core/provider/common 0.329s
ok launchpad.net/juju-core/provider/dummy 21.076s
ok launchpad.net/juju-core/provider/ec2 5.488s
ok launchpad.net/juju-core/provider/ec2/httpstorage 0.188s
ok launchpad.net/juju-core/provider/local 2.189s
ok launchpad.net/juju-core/provider/maas 9.946s
ok launchpad.net/juju-core/provider/null 1.200s
ok launchpad.net/juju-core/provider/openstack 13.454s
ok launchpad.net/juju-core/rpc 0.081s
ok launchpad.net/juju-core/rpc/jsoncodec 0.027s
? launchpad.net/juju-core/rpc/rpcreflect [no test ...

=== modified file 'cmd/juju/destroymachine.go'
--- cmd/juju/destroymachine.go	2013-08-13 19:07:35 +0000
+++ cmd/juju/destroymachine.go	2013-11-15 11:35:17 +0000
@@ -6,6 +6,8 @@
 import (
 	"fmt"
 
+	"launchpad.net/gnuflag"
+
 	"launchpad.net/juju-core/cmd"
 	"launchpad.net/juju-core/juju"
 	"launchpad.net/juju-core/names"
@@ -15,18 +17,31 @@
 type DestroyMachineCommand struct {
 	cmd.EnvCommandBase
 	MachineIds []string
+	Force      bool
 }
 
+const destroyMachineDoc = `
+Machines that are responsible for the environment cannot be destroyed. Machines
+running units or containers can only be destroyed with the --force flag; doing
+so will also destroy all those units and containers without giving them any
+opportunity to shut down cleanly.
+`
+
 func (c *DestroyMachineCommand) Info() *cmd.Info {
 	return &cmd.Info{
 		Name:    "destroy-machine",
 		Args:    "<machine> ...",
 		Purpose: "destroy machines",
-		Doc:     "Machines that have assigned units, or are responsible for the environment, cannot be destroyed.",
+		Doc:     destroyMachineDoc,
 		Aliases: []string{"terminate-machine"},
 	}
 }
 
+func (c *DestroyMachineCommand) SetFlags(f *gnuflag.FlagSet) {
+	c.EnvCommandBase.SetFlags(f)
+	f.BoolVar(&c.Force, "force", false, "completely remove machine and all dependencies")
+}
+
 func (c *DestroyMachineCommand) Init(args []string) error {
 	if len(args) == 0 {
 		return fmt.Errorf("no machines specified")
@@ -41,10 +56,13 @@
 }
 
 func (c *DestroyMachineCommand) Run(_ *cmd.Context) error {
-	conn, err := juju.NewConnFromName(c.EnvName)
+	apiclient, err := juju.NewAPIClientFromName(c.EnvName)
 	if err != nil {
 		return err
 	}
-	defer conn.Close()
-	return conn.State.DestroyMachines(c.MachineIds...)
+	defer apiclient.Close()
+	if c.Force {
+		return apiclient.ForceDestroyMachines(c.MachineIds...)
+	}
+	return apiclient.DestroyMachines(c.MachineIds...)
 }

=== modified file 'cmd/juju/destroymachine_test.go'
--- cmd/juju/destroymachine_test.go	2013-09-27 07:05:45 +0000
+++ cmd/juju/destroymachine_test.go	2013-11-15 11:35:17 +0000
@@ -6,9 +6,11 @@
 import (
 	gc "launchpad.net/gocheck"
 
+	"launchpad.net/juju-core/errors"
 	jujutesting "launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/testing"
+	jc "launchpad.net/juju-core/testing/checkers"
 )
 
 type DestroyMachineSuite struct {
@@ -22,7 +24,7 @@
 	return err
 }
 
-func (s *DestroyMachineSuite) TestDestroyMachine(c *gc.C) {
+func (s *DestroyMachineSuite) TestDestroyMachineWithUnit(c *gc.C) {
 	// Create a machine running a unit.
 	testing.Charms.BundlePath(s.SeriesPath, "riak")
 	err := runDeploy(c, "local:riak", "riak")
@@ -38,19 +40,16 @@
 	// Try to destroy the machine and fail.
 	err = runDestroyMachine(c, "0")
 	c.Assert(err, gc.ErrorMatches, `no machines were destroyed: machine 0 has unit "riak/0" assigned`)
+}
 
-	// Remove the unit, and try to destroy the machine along with another that
-	// doesn't exist; check that the machine is destroyed, but the missing one
-	// is warned about.
-	err = u.Destroy()
-	c.Assert(err, gc.IsNil)
-	err = u.EnsureDead()
-	c.Assert(err, gc.IsNil)
-	err = u.Remove()
+func (s *DestroyMachineSuite) TestDestroyEmptyMachine(c *gc.C) {
+	// Destroy an empty machine alongside a state server; only the empty machine
+	// gets destroyed.
+	m0, err := s.State.AddMachine("quantal", state.JobHostUnits)
 	c.Assert(err, gc.IsNil)
 	err = runDestroyMachine(c, "0", "1")
 	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 1 does not exist`)
-	m0, err := s.State.Machine("0")
+	err = m0.Refresh()
 	c.Assert(err, gc.IsNil)
 	c.Assert(m0.Life(), gc.Equals, state.Dying)
 
@@ -60,9 +59,13 @@
 	err = m0.Refresh()
 	c.Assert(err, gc.IsNil)
 	c.Assert(m0.Life(), gc.Equals, state.Dying)
+}
 
-	// As is destroying a Dead machine; destroying it alongside a JobManageEnviron
-	// machine complains only about the JMA machine.
+func (s *DestroyMachineSuite) TestDestroyDeadMachine(c *gc.C) {
+	// Destroying a Dead machine is a no-op; destroying it alongside a JobManageEnviron
+	// machine complains only about the JME machine.
+	m0, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
 	err = m0.EnsureDead()
 	c.Assert(err, gc.IsNil)
 	m1, err := s.State.AddMachine("quantal", state.JobManageEnviron)
@@ -75,10 +78,51 @@
 	err = m1.Refresh()
 	c.Assert(err, gc.IsNil)
 	c.Assert(m1.Life(), gc.Equals, state.Alive)
-
+}
+
+func (s *DestroyMachineSuite) TestForce(c *gc.C) {
+	// Create a machine running a unit.
+	testing.Charms.BundlePath(s.SeriesPath, "riak")
+	err := runDeploy(c, "local:riak", "riak")
+	c.Assert(err, gc.IsNil)
+
+	// Get the state entities to allow sane testing.
+	u, err := s.State.Unit("riak/0")
+	c.Assert(err, gc.IsNil)
+	m0, err := s.State.Machine("0")
+	c.Assert(err, gc.IsNil)
+
+	// Create a manager machine.
+	m1, err := s.State.AddMachine("quantal", state.JobManageEnviron)
+	c.Assert(err, gc.IsNil)
+
+	// Try to force-destroy the machines.
+	err = runDestroyMachine(c, "0", "1", "--force")
+	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 1 is required by the environment`)
+
+	// Clean up, check state.
+	err = s.State.Cleanup()
+	c.Assert(err, gc.IsNil)
+	err = m0.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+	err = u.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+	err = m1.Refresh()
+	c.Assert(err, gc.IsNil)
+	c.Assert(m1.Life(), gc.Equals, state.Alive)
+}
+
+func (s *DestroyMachineSuite) TestBadArgs(c *gc.C) {
 	// Check invalid args.
-	err = runDestroyMachine(c)
+	err := runDestroyMachine(c)
 	c.Assert(err, gc.ErrorMatches, `no machines specified`)
 	err = runDestroyMachine(c, "1", "2", "nonsense", "rubbish")
 	c.Assert(err, gc.ErrorMatches, `invalid machine id "nonsense"`)
 }
+
+func (s *DestroyMachineSuite) TestEnvironmentArg(c *gc.C) {
+	_, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
+	err = runDestroyMachine(c, "0", "-e", "dummyenv")
+	c.Assert(err, gc.IsNil)
+}

=== modified file 'cmd/juju/destroyunit.go'
--- cmd/juju/destroyunit.go	2013-08-13 19:07:35 +0000
+++ cmd/juju/destroyunit.go	2013-11-15 11:35:17 +0000
@@ -10,8 +10,6 @@
 	"launchpad.net/juju-core/cmd"
 	"launchpad.net/juju-core/juju"
 	"launchpad.net/juju-core/names"
-	"launchpad.net/juju-core/state/api/params"
-	"launchpad.net/juju-core/state/statecmd"
 )
 
 // DestroyUnitCommand is responsible for destroying service units.
@@ -45,13 +43,10 @@
 // Run connects to the environment specified on the command line and destroys
 // units therein.
 func (c *DestroyUnitCommand) Run(_ *cmd.Context) error {
-	conn, err := juju.NewConnFromName(c.EnvName)
+	client, err := juju.NewAPIClientFromName(c.EnvName)
 	if err != nil {
 		return err
 	}
-	defer conn.Close()
-	params := params.DestroyServiceUnits{
-		UnitNames: c.UnitNames,
-	}
-	return statecmd.DestroyServiceUnits(conn.State, params)
+	defer client.Close()
+	return client.DestroyServiceUnits(c.UnitNames...)
 }

=== modified file 'cmd/jujud/machine_test.go'
--- cmd/jujud/machine_test.go	2013-10-03 00:52:29 +0000
+++ cmd/jujud/machine_test.go	2013-11-15 11:35:17 +0000
@@ -78,7 +78,19 @@
 	err = m.SetPassword(initialMachinePassword)
 	c.Assert(err, gc.IsNil)
 	tag := names.MachineTag(m.Id())
-	if m.IsStateServer() {
+
+	// NOTE(fwereade): this used to use IsManager() which used to be spelled
+	// IsStateServer and mean "has JobManageState"; and now means "has any
+	// Manage job"; IsManager works correctly given addressing changes in
+	// trunk, post-1.16, but primes the agent incorrectly in 1.16-based code.
+	var isStateManager bool
+	for _, job := range m.Jobs() {
+		if job == state.JobManageState {
+			isStateManager = true
+			break
+		}
+	}
+	if isStateManager {
 		err = m.SetMongoPassword(initialMachinePassword)
 		c.Assert(err, gc.IsNil)
 		config, tools = s.agentSuite.primeStateAgent(c, tag, initialMachinePassword)

=== modified file 'state/api/client.go'
--- state/api/client.go	2013-08-28 07:19:00 +0000
+++ state/api/client.go	2013-11-15 11:35:17 +0000
@@ -84,6 +84,18 @@
 	return c.st.Call("Client", "", "DestroyRelation", params, nil)
 }
 
+// DestroyMachines removes a given set of machines.
+func (c *Client) DestroyMachines(machines ...string) error {
+	params := params.DestroyMachines{MachineNames: machines}
+	return c.st.Call("Client", "", "DestroyMachines", params, nil)
+}
+
+// ForceDestroyMachines removes a given set of machines and all associated units.
+func (c *Client) ForceDestroyMachines(machines ...string) error {
+	params := params.DestroyMachines{Force: true, MachineNames: machines}
+	return c.st.Call("Client", "", "DestroyMachines", params, nil)
+}
+
 // ServiceExpose changes the juju-managed firewall to expose any ports that
 // were also explicitly marked by units as open.
 func (c *Client) ServiceExpose(service string) error {
@@ -141,7 +153,7 @@
 }
 
 // DestroyServiceUnits decreases the number of units dedicated to a service.
-func (c *Client) DestroyServiceUnits(unitNames []string) error {
+func (c *Client) DestroyServiceUnits(unitNames ...string) error {
 	params := params.DestroyServiceUnits{unitNames}
 	return c.st.Call("Client", "", "DestroyServiceUnits", params, nil)
 }

=== modified file 'state/api/params/params.go'
--- state/api/params/params.go	2013-10-31 09:39:00 +0000
+++ state/api/params/params.go	2013-11-15 11:35:17 +0000
@@ -59,6 +59,12 @@
 	Endpoints []string
 }
 
+// DestroyMachines holds parameters for the DestroyMachines call.
+type DestroyMachines struct {
+	MachineNames []string
+	Force        bool
+}
+
 // ServiceDeploy holds the parameters for making the ServiceDeploy call.
 type ServiceDeploy struct {
 	ServiceName   string

=== modified file 'state/apiserver/client/client.go'
--- state/apiserver/client/client.go	2013-09-11 08:56:44 +0000
+++ state/apiserver/client/client.go	2013-11-15 11:35:17 +0000
@@ -6,8 +6,10 @@
 import (
 	"errors"
 	"fmt"
+	"strings"
 
 	"launchpad.net/juju-core/charm"
+	coreerrors "launchpad.net/juju-core/errors"
 	"launchpad.net/juju-core/juju"
 	"launchpad.net/juju-core/state"
 	"launchpad.net/juju-core/state/api"
@@ -300,7 +302,25 @@
 
 // DestroyServiceUnits removes a given set of service units.
 func (c *Client) DestroyServiceUnits(args params.DestroyServiceUnits) error {
-	return statecmd.DestroyServiceUnits(c.api.state, args)
+	var errs []string
+	for _, name := range args.UnitNames {
+		unit, err := c.api.state.Unit(name)
+		switch {
+		case coreerrors.IsNotFoundError(err):
+			err = fmt.Errorf("unit %q does not exist", name)
+		case err != nil:
+		case unit.Life() != state.Alive:
+			continue
+		case unit.IsPrincipal():
+			err = unit.Destroy()
+		default:
+			err = fmt.Errorf("unit %q is a subordinate", name)
+		}
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+	}
+	return destroyErr("units", args.UnitNames, errs)
 }
 
 // ServiceDestroy destroys a given service.
@@ -328,6 +348,29 @@
 	return statecmd.DestroyRelation(c.api.state, args)
 }
 
+// DestroyMachines removes a given set of machines.
+func (c *Client) DestroyMachines(args params.DestroyMachines) error {
+	var errs []string
+	for _, id := range args.MachineNames {
+		machine, err := c.api.state.Machine(id)
+		switch {
+		case coreerrors.IsNotFoundError(err):
+			err = fmt.Errorf("machine %s does not exist", id)
+		case err != nil:
+		case args.Force:
+			err = machine.ForceDestroy()
+		case machine.Life() != state.Alive:
+			continue
+		default:
+			err = machine.Destroy()
+		}
+		if err != nil {
+			errs = append(errs, err.Error())
+		}
+	}
+	return destroyErr("machines", args.MachineNames, errs)
+}
+
 // CharmInfo returns information about the requested charm.
 func (c *Client) CharmInfo(args params.CharmInfo) (api.CharmInfo, error) {
 	curl, err := charm.ParseURL(args.CharmURL)
@@ -436,3 +479,15 @@
 	}
 	return changes, nil
 }
+
+func destroyErr(desc string, ids, errs []string) error {
+	if len(errs) == 0 {
+		return nil
+	}
+	msg := "some %s were not destroyed"
+	if len(errs) == len(ids) {
+		msg = "no %s were destroyed"
+	}
+	msg = fmt.Sprintf(msg, desc)
+	return fmt.Errorf("%s: %s", msg, strings.Join(errs, "; "))
+}

=== modified file 'state/apiserver/client/client_test.go'
--- state/apiserver/client/client_test.go	2013-09-27 07:05:45 +0000
+++ state/apiserver/client/client_test.go	2013-11-15 11:35:17 +0000
@@ -355,6 +355,145 @@
 	c.Assert(service.Life(), gc.Not(gc.Equals), state.Alive)
 }
 
+func assertLife(c *gc.C, entity state.Living, life state.Life) {
+	err := entity.Refresh()
+	c.Assert(err, gc.IsNil)
+	c.Assert(entity.Life(), gc.Equals, life)
+}
+
+func assertRemoved(c *gc.C, entity state.Living) {
+	err := entity.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+}
+
+func (s *clientSuite) setupDestroyMachinesTest(c *gc.C) (*state.Machine, *state.Machine, *state.Machine, *state.Unit) {
+	m0, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
+	m1, err := s.State.AddMachine("quantal", state.JobManageEnviron)
+	c.Assert(err, gc.IsNil)
+	m2, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
+
+	sch := s.AddTestingCharm(c, "wordpress")
+	wordpress, err := s.State.AddService("wordpress", sch)
+	c.Assert(err, gc.IsNil)
+	u, err := wordpress.AddUnit()
+	c.Assert(err, gc.IsNil)
+	err = u.AssignToMachine(m0)
+	c.Assert(err, gc.IsNil)
+
+	return m0, m1, m2, u
+}
+
+func (s *clientSuite) TestDestroyMachines(c *gc.C) {
+	m0, m1, m2, u := s.setupDestroyMachinesTest(c)
+
+	err := s.APIState.Client().DestroyMachines("0", "1", "2")
+	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 0 has unit "wordpress/0" assigned; machine 1 is required by the environment`)
+	assertLife(c, m0, state.Alive)
+	assertLife(c, m1, state.Alive)
+	assertLife(c, m2, state.Dying)
+
+	err = u.UnassignFromMachine()
+	c.Assert(err, gc.IsNil)
+	err = s.APIState.Client().DestroyMachines("0", "1", "2")
+	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 1 is required by the environment`)
+	assertLife(c, m0, state.Dying)
+	assertLife(c, m1, state.Alive)
+	assertLife(c, m2, state.Dying)
+}
+
+func (s *clientSuite) TestForceDestroyMachines(c *gc.C) {
+	m0, m1, m2, u := s.setupDestroyMachinesTest(c)
+
+	err := s.APIState.Client().ForceDestroyMachines("0", "1", "2")
+	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 1 is required by the environment`)
+	assertLife(c, m0, state.Alive)
+	assertLife(c, m1, state.Alive)
+	assertLife(c, m2, state.Alive)
+	assertLife(c, u, state.Alive)
+
+	err = s.State.Cleanup()
+	c.Assert(err, gc.IsNil)
+	assertRemoved(c, m0)
+	assertLife(c, m1, state.Alive)
+	assertRemoved(c, m2)
+	assertRemoved(c, u)
+}
+
+func (s *clientSuite) TestDestroyPrincipalUnits(c *gc.C) {
+	wordpress, err := s.State.AddService("wordpress", s.AddTestingCharm(c, "wordpress"))
+	c.Assert(err, gc.IsNil)
+	units := make([]*state.Unit, 5)
+	for i := range units {
+		unit, err := wordpress.AddUnit()
+		c.Assert(err, gc.IsNil)
+		err = unit.SetStatus(params.StatusStarted, "", nil)
+		c.Assert(err, gc.IsNil)
+		units[i] = unit
+	}
+
+	// Destroy 2 of them; check they become Dying.
+	err = s.APIState.Client().DestroyServiceUnits("wordpress/0", "wordpress/1")
+	c.Assert(err, gc.IsNil)
+	assertLife(c, units[0], state.Dying)
+	assertLife(c, units[1], state.Dying)
+
+	// Try to destroy an Alive one and a Dying one; check
+	// it destroys the Alive one and ignores the Dying one.
+	err = s.APIState.Client().DestroyServiceUnits("wordpress/2", "wordpress/0")
+	c.Assert(err, gc.IsNil)
+	assertLife(c, units[2], state.Dying)
+
+	// Try to destroy an Alive one along with a nonexistent one; check that
+	// the valid instruction is followed but the invalid one is warned about.
+	err = s.APIState.Client().DestroyServiceUnits("boojum/123", "wordpress/3")
+	c.Assert(err, gc.ErrorMatches, `some units were not destroyed: unit "boojum/123" does not exist`)
+	assertLife(c, units[3], state.Dying)
+
+	// Make one Dead, and destroy an Alive one alongside it; check no errors.
+	wp0, err := s.State.Unit("wordpress/0")
+	c.Assert(err, gc.IsNil)
+	err = wp0.EnsureDead()
+	c.Assert(err, gc.IsNil)
+	err = s.APIState.Client().DestroyServiceUnits("wordpress/0", "wordpress/4")
+	c.Assert(err, gc.IsNil)
+	assertLife(c, units[0], state.Dead)
+	assertLife(c, units[4], state.Dying)
+}
+
+func (s *clientSuite) TestDestroySubordinateUnits(c *gc.C) {
+	wordpress, err := s.State.AddService("wordpress", s.AddTestingCharm(c, "wordpress"))
+	c.Assert(err, gc.IsNil)
+	wordpress0, err := wordpress.AddUnit()
+	c.Assert(err, gc.IsNil)
+	_, err = s.State.AddService("logging", s.AddTestingCharm(c, "logging"))
+	c.Assert(err, gc.IsNil)
+	eps, err := s.State.InferEndpoints([]string{"logging", "wordpress"})
+	c.Assert(err, gc.IsNil)
+	rel, err := s.State.AddRelation(eps...)
+	c.Assert(err, gc.IsNil)
+	ru, err := rel.Unit(wordpress0)
+	c.Assert(err, gc.IsNil)
+	err = ru.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+	logging0, err := s.State.Unit("logging/0")
+	c.Assert(err, gc.IsNil)
+
+	// Try to destroy the subordinate alone; check it fails.
+	err = s.APIState.Client().DestroyServiceUnits("logging/0")
+	c.Assert(err, gc.ErrorMatches, `no units were destroyed: unit "logging/0" is a subordinate`)
+	assertLife(c, logging0, state.Alive)
+
+	// Try to destroy the principal and the subordinate together; check it warns
+	// about the subordinate, but destroys the one it can. (The principal unit
+	// agent will be resposible for destroying the subordinate.)
+	err = s.APIState.Client().DestroyServiceUnits("wordpress/0", "logging/0")
+	c.Assert(err, gc.ErrorMatches, `some units were not destroyed: unit "logging/0" is a subordinate`)
+	assertLife(c, wordpress0, state.Dying)
+	assertLife(c, logging0, state.Alive)
+}
+
 func (s *clientSuite) TestClientUnitResolved(c *gc.C) {
 	// Setup:
 	s.setUpScenario(c)

=== modified file 'state/apiserver/client/perm_test.go'
--- state/apiserver/client/perm_test.go	2013-09-27 07:05:45 +0000
+++ state/apiserver/client/perm_test.go	2013-11-15 11:35:17 +0000
@@ -336,7 +336,7 @@
 }
 
 func opClientDestroyServiceUnits(c *gc.C, st *api.State, mst *state.State) (func(), error) {
-	err := st.Client().DestroyServiceUnits([]string{"wordpress/99"})
+	err := st.Client().DestroyServiceUnits("wordpress/99")
 	if err != nil && strings.HasPrefix(err.Error(), "no units were destroyed") {
 		err = nil
 	}

=== added file 'state/cleanup.go'
--- state/cleanup.go	1970-01-01 00:00:00 +0000
+++ state/cleanup.go	2013-11-15 11:35:17 +0000
@@ -0,0 +1,208 @@
+package state
+
+import (
+	"fmt"
+
+	"labix.org/v2/mgo/bson"
+	"labix.org/v2/mgo/txn"
+
+	"launchpad.net/juju-core/errors"
+)
+
+// cleanupDoc represents a potentially large set of documents that should be
+// removed.
+type cleanupDoc struct {
+	Id     bson.ObjectId `bson:"_id"`
+	Kind   string
+	Prefix string
+}
+
+// newCleanupOp returns a txn.Op that creates a cleanup document with a unique
+// id and the supplied kind and prefix.
+func (st *State) newCleanupOp(kind, prefix string) txn.Op {
+	doc := &cleanupDoc{
+		Id:     bson.NewObjectId(),
+		Kind:   kind,
+		Prefix: prefix,
+	}
+	return txn.Op{
+		C:      st.cleanups.Name,
+		Id:     doc.Id,
+		Insert: doc,
+	}
+}
+
+// NeedsCleanup returns true if documents previously marked for removal exist.
+func (st *State) NeedsCleanup() (bool, error) {
+	count, err := st.cleanups.Count()
+	if err != nil {
+		return false, err
+	}
+	return count > 0, nil
+}
+
+// Cleanup removes all documents that were previously marked for removal, if
+// any such exist. It should be called periodically by at least one element
+// of the system.
+func (st *State) Cleanup() error {
+	doc := cleanupDoc{}
+	iter := st.cleanups.Find(nil).Iter()
+	for iter.Next(&doc) {
+		var err error
+		logger.Debugf("running %q cleanup: %q", doc.Kind, doc.Prefix)
+		switch doc.Kind {
+		case "settings":
+			err = st.cleanupSettings(doc.Prefix)
+		case "units":
+			err = st.cleanupUnits(doc.Prefix)
+		case "machine":
+			err = st.cleanupMachine(doc.Prefix)
+		default:
+			err = fmt.Errorf("unknown cleanup kind %q", doc.Kind)
+		}
+		if err != nil {
+			logger.Warningf("cleanup failed: %v", err)
+			continue
+		}
+		ops := []txn.Op{{
+			C:      st.cleanups.Name,
+			Id:     doc.Id,
+			Remove: true,
+		}}
+		if err := st.runTransaction(ops); err != nil {
+			logger.Warningf("cannot remove empty cleanup document: %v", err)
+		}
+	}
+	if err := iter.Err(); err != nil {
+		return fmt.Errorf("cannot read cleanup document: %v", err)
+	}
+	return nil
+}
+
+func (st *State) cleanupSettings(prefix string) error {
+	// Documents marked for cleanup are not otherwise referenced in the
+	// system, and will not be under watch, and are therefore safe to
+	// delete directly.
+	sel := D{{"_id", D{{"$regex", "^" + prefix}}}}
+	if count, err := st.settings.Find(sel).Count(); err != nil {
+		return fmt.Errorf("cannot detect cleanup targets: %v", err)
+	} else if count != 0 {
+		if _, err := st.settings.RemoveAll(sel); err != nil {
+			return fmt.Errorf("cannot remove documents marked for cleanup: %v", err)
+		}
+	}
+	return nil
+}
+
+// cleanupUnits sets all units with the given prefix to Dying, if they are not
+// already Dying or Dead. It's expected to be used when a service is destroyed.
+func (st *State) cleanupUnits(prefix string) error {
+	// This won't miss units, because a Dying service cannot have units added
+	// to it. But we do have to remove the units themselves via individual
+	// transactions, because they could be in any state at all.
+	unit := &Unit{st: st}
+	sel := D{{"_id", D{{"$regex", "^" + prefix}}}, {"life", Alive}}
+	iter := st.units.Find(sel).Iter()
+	for iter.Next(&unit.doc) {
+		if err := unit.Destroy(); err != nil {
+			return err
+		}
+	}
+	if err := iter.Err(); err != nil {
+		return fmt.Errorf("cannot read unit document: %v", err)
+	}
+	return nil
+}
+
+// cleanupMachine systematically destroys and removes all entities that
+// depend upon the supplied machine, and removes the machine from state. It's
+// expected to be used in response to destroy-machine --force.
+func (st *State) cleanupMachine(machineId string) error {
+	machine, err := st.Machine(machineId)
+	if errors.IsNotFoundError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	// In an ideal world, we'd call machine.Destroy() here, and thus prevent
+	// new dependencies being added while we clean up the ones we know about.
+	// But machine destruction is unsophisticated, and doesn't allow for
+	// destruction while dependencies exist; so we just have to deal with that
+	// possibility below.
+	if err := st.cleanupContainers(machine); err != nil {
+		return err
+	}
+	for _, unitName := range machine.doc.Principals {
+		if err := st.obliterateUnit(unitName); err != nil {
+			return err
+		}
+	}
+	// We need to refresh the machine at this point, because the local copy
+	// of the document will not reflect changes caused by the unit cleanups
+	// above, and may thus fail immediately.
+	if err := machine.Refresh(); errors.IsNotFoundError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	// TODO(fwereade): 2013-11-11 bug 1250104
+	// If this fails, it's *probably* due to a race in which new dependencies
+	// were added while we cleaned up the old ones. If the cleanup doesn't run
+	// again -- which it *probably* will anyway -- the issue can be resolved by
+	// force-destroying the machine again; that's better than adding layer
+	// upon layer of complication here.
+	if err := machine.EnsureDead(); err != nil {
+		return err
+	}
+	return machine.Remove()
+}
+
+// cleanupContainers recursively calls cleanupMachine on the supplied
+// machine's containers.
+func (st *State) cleanupContainers(machine *Machine) error {
+	containerIds, err := machine.Containers()
+	if errors.IsNotFoundError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	for _, containerId := range containerIds {
+		if err := st.cleanupMachine(containerId); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// obliterateUnit removes a unit from state completely. It is not safe or
+// sane to obliterate any unit in isolation; its only reasonable use is in
+// the context of machine obliteration, in which we can be sure that unclean
+// shutdown of units is not going to leave a machine in a difficult state.
+func (st *State) obliterateUnit(unitName string) error {
+	unit, err := st.Unit(unitName)
+	if errors.IsNotFoundError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	// Unlike the machine, we *can* always destroy the unit, and (at least)
+	// prevent further dependencies being added. If we're really lucky, the
+	// unit will be removed immediately.
+	if err := unit.Destroy(); err != nil {
+		return err
+	}
+	if err := unit.Refresh(); errors.IsNotFoundError(err) {
+		return nil
+	} else if err != nil {
+		return err
+	}
+	for _, subName := range unit.SubordinateNames() {
+		if err := st.obliterateUnit(subName); err != nil {
+			return err
+		}
+	}
+	if err := unit.EnsureDead(); err != nil {
+		return err
+	}
+	return unit.Remove()
+}

=== added file 'state/cleanup_test.go'
--- state/cleanup_test.go	1970-01-01 00:00:00 +0000
+++ state/cleanup_test.go	2013-11-15 11:35:17 +0000
@@ -0,0 +1,229 @@
+package state_test
+
+import (
+	"fmt"
+
+	gc "launchpad.net/gocheck"
+
+	"launchpad.net/juju-core/charm"
+	"launchpad.net/juju-core/errors"
+	"launchpad.net/juju-core/instance"
+	"launchpad.net/juju-core/state"
+	jc "launchpad.net/juju-core/testing/checkers"
+)
+
+type CleanupSuite struct {
+	ConnSuite
+}
+
+var _ = gc.Suite(&CleanupSuite{})
+
+func (s *CleanupSuite) TestCleanupDyingServiceUnits(c *gc.C) {
+	s.assertDoesNotNeedCleanup(c)
+
+	// Create a service with some units.
+	mysql, err := s.State.AddService("mysql", s.AddTestingCharm(c, "mysql"))
+	c.Assert(err, gc.IsNil)
+	units := make([]*state.Unit, 3)
+	for i := range units {
+		unit, err := mysql.AddUnit()
+		c.Assert(err, gc.IsNil)
+		units[i] = unit
+	}
+	preventUnitDestroyRemove(c, units[0])
+	s.assertDoesNotNeedCleanup(c)
+
+	// Destroy the service and check the units are unaffected, but a cleanup
+	// has been scheduled.
+	err = mysql.Destroy()
+	c.Assert(err, gc.IsNil)
+	for _, unit := range units {
+		err := unit.Refresh()
+		c.Assert(err, gc.IsNil)
+	}
+	s.assertNeedsCleanup(c)
+
+	// Run the cleanup, and check that units are all destroyed as appropriate.
+	s.assertCleanupRuns(c)
+	s.assertDoesNotNeedCleanup(c)
+	err = units[0].Refresh()
+	c.Assert(err, gc.IsNil)
+	c.Assert(units[0].Life(), gc.Equals, state.Dying)
+	err = units[1].Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+	err = units[2].Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+}
+
+func (s *CleanupSuite) TestCleanupRelationSettings(c *gc.C) {
+	s.assertDoesNotNeedCleanup(c)
+
+	// Create a relation with a unit in scope.
+	pr := NewPeerRelation(c, s.State)
+	rel := pr.ru0.Relation()
+	err := pr.ru0.EnterScope(map[string]interface{}{"some": "settings"})
+	c.Assert(err, gc.IsNil)
+	s.assertDoesNotNeedCleanup(c)
+
+	// Destroy the service, check the relation's still around.
+	err = pr.svc.Destroy()
+	c.Assert(err, gc.IsNil)
+	s.assertNeedsCleanup(c)
+	s.assertCleanupRuns(c)
+	err = rel.Refresh()
+	c.Assert(err, gc.IsNil)
+	c.Assert(rel.Life(), gc.Equals, state.Dying)
+	s.assertDoesNotNeedCleanup(c)
+
+	// The unit leaves scope, triggering relation removal.
+	err = pr.ru0.LeaveScope()
+	c.Assert(err, gc.IsNil)
+	s.assertNeedsCleanup(c)
+
+	// Settings are not destroyed yet...
+	settings, err := pr.ru1.ReadSettings("riak/0")
+	c.Assert(err, gc.IsNil)
+	c.Assert(settings, gc.DeepEquals, map[string]interface{}{"some": "settings"})
+
+	// ...but they are on cleanup.
+	s.assertCleanupRuns(c)
+	s.assertDoesNotNeedCleanup(c)
+	_, err = pr.ru1.ReadSettings("riak/0")
+	c.Assert(err, gc.ErrorMatches, `cannot read settings for unit "riak/0" in relation "riak:ring": settings not found`)
+}
+
+func (s *CleanupSuite) testForceDestroyManagerError(c *gc.C, job state.MachineJob) {
+	manager, err := s.State.AddMachine("quantal", job)
+	c.Assert(err, gc.IsNil)
+	s.assertDoesNotNeedCleanup(c)
+	err = manager.ForceDestroy()
+	expect := fmt.Sprintf("machine %s is required by the environment", manager.Id())
+	c.Assert(err, gc.ErrorMatches, expect)
+	s.assertDoesNotNeedCleanup(c)
+	assertLife(c, manager, state.Alive)
+}
+
+func (s *CleanupSuite) TestForceDestroyMachineErrors(c *gc.C) {
+	s.testForceDestroyManagerError(c, state.JobManageState)
+	s.testForceDestroyManagerError(c, state.JobManageEnviron)
+}
+
+func (s *CleanupSuite) TestCleanupForceDestroyedMachineUnit(c *gc.C) {
+	s.assertDoesNotNeedCleanup(c)
+
+	// Create a machine.
+	machine, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
+
+	// Create a relation with a unit in scope and assigned to the machine.
+	pr := NewPeerRelation(c, s.State)
+	err = pr.u0.AssignToMachine(machine)
+	c.Assert(err, gc.IsNil)
+	err = pr.ru0.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+	s.assertDoesNotNeedCleanup(c)
+
+	// Force machine destruction, check cleanup queued.
+	err = machine.ForceDestroy()
+	c.Assert(err, gc.IsNil)
+	s.assertNeedsCleanup(c)
+
+	// Clean up, and check that the machine has been removed...
+	s.assertCleanupRuns(c)
+	s.assertDoesNotNeedCleanup(c)
+	err = machine.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+
+	// ...and so has the unit...
+	assertRemoved(c, pr.u0)
+
+	// ...and the unit has departed relation scope.
+	assertNotInScope(c, pr.ru0)
+}
+
+func (s *CleanupSuite) TestCleanupForceDestroyedMachineWithContainer(c *gc.C) {
+	s.assertDoesNotNeedCleanup(c)
+
+	// Create a machine with a container.
+	machine, err := s.State.AddMachine("quantal", state.JobHostUnits)
+	c.Assert(err, gc.IsNil)
+	container, err := s.State.AddMachineWithConstraints(&state.AddMachineParams{
+		Series:        "quantal",
+		ParentId:      machine.Id(),
+		ContainerType: instance.LXC,
+		Jobs:          []state.MachineJob{state.JobHostUnits},
+	})
+	c.Assert(err, gc.IsNil)
+
+	// Create active units (in relation scope, with subordinates).
+	prr := NewProReqRelation(c, &s.ConnSuite, charm.ScopeContainer)
+	err = prr.pru0.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+	err = prr.pru1.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+	err = prr.rru0.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+	err = prr.rru1.EnterScope(nil)
+	c.Assert(err, gc.IsNil)
+
+	// Assign the various units to machines.
+	err = prr.pu0.AssignToMachine(machine)
+	c.Assert(err, gc.IsNil)
+	err = prr.pu1.AssignToMachine(container)
+	c.Assert(err, gc.IsNil)
+	s.assertDoesNotNeedCleanup(c)
+
+	// Force removal of the top-level machine.
+	err = machine.ForceDestroy()
+	c.Assert(err, gc.IsNil)
+	s.assertNeedsCleanup(c)
+
+	// And do it again, just to check that the second cleanup doc for the same
+	// machine doesn't cause problems down the line.
+	err = machine.ForceDestroy()
+	c.Assert(err, gc.IsNil)
+	s.assertNeedsCleanup(c)
+
+	// Clean up, and check that all the machines have been removed...
+	s.assertCleanupRuns(c)
+	s.assertDoesNotNeedCleanup(c)
+	err = machine.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+	err = container.Refresh()
+	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
+
+	// ...and so have all the units...
+	assertRemoved(c, prr.pu0)
+	assertRemoved(c, prr.pu1)
+	assertRemoved(c, prr.ru0)
+	assertRemoved(c, prr.ru1)
+
+	// ...and none of the units have left relation scopes occupied.
+	assertNotInScope(c, prr.pru0)
+	assertNotInScope(c, prr.pru1)
+	assertNotInScope(c, prr.rru0)
+	assertNotInScope(c, prr.rru1)
+}
+
+func (s *CleanupSuite) TestNothingToCleanup(c *gc.C) {
+	s.assertDoesNotNeedCleanup(c)
+	s.assertCleanupRuns(c)
+	s.assertDoesNotNeedCleanup(c)
+}
+
+func (s *CleanupSuite) assertCleanupRuns(c *gc.C) {
+	err := s.State.Cleanup()
+	c.Assert(err, gc.IsNil)
+}
+
+func (s *CleanupSuite) assertNeedsCleanup(c *gc.C) {
+	actual, err := s.State.NeedsCleanup()
+	c.Assert(err, gc.IsNil)
+	c.Assert(actual, jc.IsTrue)
+}
+
+func (s *CleanupSuite) assertDoesNotNeedCleanup(c *gc.C) {
+	actual, err := s.State.NeedsCleanup()
+	c.Assert(err, gc.IsNil)
+	c.Assert(actual, jc.IsFalse)
+}

=== modified file 'state/life.go'
--- state/life.go	2013-07-09 10:32:23 +0000
+++ state/life.go	2013-11-15 11:35:17 +0000
@@ -38,8 +38,15 @@
 type Living interface {
 	Life() Life
 	Destroy() error
+	Refresh() error
+}
+
+// AgentLiving describes state entities with a lifecycle and an agent that
+// manages it.
+type AgentLiving interface {
+	Living
 	EnsureDead() error
-	Refresh() error
+	Remove() error
 }
 
 func isAlive(coll *mgo.Collection, id interface{}) (bool, error) {

=== modified file 'state/life_test.go'
--- state/life_test.go	2013-09-27 07:05:45 +0000
+++ state/life_test.go	2013-11-15 11:35:17 +0000
@@ -81,8 +81,7 @@
 
 type lifeFixture interface {
 	id() (coll string, id interface{})
-	setup(s *LifeSuite, c *gc.C) state.Living
-	teardown(s *LifeSuite, c *gc.C)
+	setup(s *LifeSuite, c *gc.C) state.AgentLiving
 }
 
 type unitLife struct {
@@ -93,7 +92,7 @@
 	return "units", l.unit.Name()
 }
 
-func (l *unitLife) setup(s *LifeSuite, c *gc.C) state.Living {
+func (l *unitLife) setup(s *LifeSuite, c *gc.C) state.AgentLiving {
 	unit, err := s.svc.AddUnit()
 	c.Assert(err, gc.IsNil)
 	preventUnitDestroyRemove(c, unit)
@@ -101,11 +100,6 @@
 	return l.unit
 }
 
-func (l *unitLife) teardown(s *LifeSuite, c *gc.C) {
-	err := l.unit.Remove()
-	c.Assert(err, gc.IsNil)
-}
-
 type machineLife struct {
 	machine *state.Machine
 }
@@ -114,18 +108,13 @@
 	return "machines", l.machine.Id()
 }
 
-func (l *machineLife) setup(s *LifeSuite, c *gc.C) state.Living {
+func (l *machineLife) setup(s *LifeSuite, c *gc.C) state.AgentLiving {
 	var err error
 	l.machine, err = s.State.AddMachine("quantal", state.JobHostUnits)
 	c.Assert(err, gc.IsNil)
 	return l.machine
 }
 
-func (l *machineLife) teardown(s *LifeSuite, c *gc.C) {
-	err := l.machine.Remove()
-	c.Assert(err, gc.IsNil)
-}
-
 func (s *LifeSuite) prepareFixture(living state.Living, lfix lifeFixture, cached, dbinitial state.Life, c *gc.C) {
 	collName, id := lfix.id()
 	coll := s.MgoSuite.Session.DB("juju").C(collName)
@@ -165,7 +154,8 @@
 			c.Assert(living.Life(), gc.Equals, v.dbfinal)
 			err = living.EnsureDead()
 			c.Assert(err, gc.IsNil)
-			lfix.teardown(s, c)
+			err = living.Remove()
+			c.Assert(err, gc.IsNil)
 		}
 	}
 }

=== modified file 'state/machine.go'
--- state/machine.go	2013-10-02 13:14:49 +0000
+++ state/machine.go	2013-11-15 11:35:17 +0000
@@ -181,10 +181,11 @@
 	return m.doc.Jobs
 }
 
-// IsStateServer returns true if the machine has a JobManageState job.
-func (m *Machine) IsStateServer() bool {
+// IsManager returns true if the machine has JobManageState or JobManageEnviron.
+func (m *Machine) IsManager() bool {
 	for _, job := range m.doc.Jobs {
-		if job == JobManageState {
+		switch job {
+		case JobManageEnviron, JobManageState:
 			return true
 		}
 	}
@@ -269,6 +270,22 @@
 	return m.advanceLifecycle(Dying)
 }
 
+// ForceDestroy queues the machine for complete removal, including the
+// destruction of all units and containers on the machine.
+func (m *Machine) ForceDestroy() error {
+	if !m.IsManager() {
+		ops := []txn.Op{{
+			C:      m.st.machines.Name,
+			Id:     m.doc.Id,
+			Assert: D{{"jobs", D{{"$nin", []MachineJob{JobManageState}}}}},
+		}, m.st.newCleanupOp("machine", m.doc.Id)}
+		if err := m.st.runTransaction(ops); err != txn.ErrAborted {
+			return err
+		}
+	}
+	return fmt.Errorf("machine %s is required by the environment", m.doc.Id)
+}
+
 // EnsureDead sets the machine lifecycle to Dead if it is Alive or Dying.
 // It does nothing otherwise. EnsureDead will fail if the machine has
 // principal units assigned, or if the machine has JobManageEnviron.

=== modified file 'state/machine_test.go'
--- state/machine_test.go	2013-10-02 13:14:49 +0000
+++ state/machine_test.go	2013-11-15 11:35:17 +0000
@@ -57,15 +57,17 @@
 	c.Assert(ok, gc.Equals, true)
 }
 
-func (s *MachineSuite) TestMachineIsStateServer(c *gc.C) {
+func (s *MachineSuite) TestMachineIsManager(c *gc.C) {
 	tests := []struct {
 		isStateServer bool
 		jobs          []state.MachineJob
 	}{
 		{false, []state.MachineJob{state.JobHostUnits}},
-		{false, []state.MachineJob{state.JobHostUnits, state.JobManageEnviron}},
+		{true, []state.MachineJob{state.JobManageState}},
+		{true, []state.MachineJob{state.JobManageEnviron}},
+		{true, []state.MachineJob{state.JobHostUnits, state.JobManageState}},
+		{true, []state.MachineJob{state.JobHostUnits, state.JobManageEnviron}},
 		{true, []state.MachineJob{state.JobHostUnits, state.JobManageState, state.JobManageEnviron}},
-		{true, []state.MachineJob{state.JobManageState}},
 	}
 	for _, test := range tests {
 		params := state.AddMachineParams{
@@ -74,7 +76,7 @@
 		}
 		m, err := s.State.AddMachineWithConstraints(&params)
 		c.Assert(err, gc.IsNil)
-		c.Assert(m.IsStateServer(), gc.Equals, test.isStateServer)
+		c.Assert(m.IsManager(), gc.Equals, test.isStateServer)
 	}
 }
 
@@ -84,6 +86,8 @@
 	c.Assert(err, gc.IsNil)
 	err = m.Destroy()
 	c.Assert(err, gc.ErrorMatches, "machine 1 is required by the environment")
+	err = m.ForceDestroy()
+	c.Assert(err, gc.ErrorMatches, "machine 1 is required by the environment")
 	err = m.EnsureDead()
 	c.Assert(err, gc.ErrorMatches, "machine 1 is required by the environment")
 }
@@ -208,41 +212,6 @@
 	c.Assert(err, gc.IsNil)
 }
 
-func (s *MachineSuite) TestDestroyMachines(c *gc.C) {
-	m0 := s.machine
-	m1, err := s.State.AddMachine("quantal", state.JobManageEnviron)
-	c.Assert(err, gc.IsNil)
-	m2, err := s.State.AddMachine("quantal", state.JobHostUnits)
-	c.Assert(err, gc.IsNil)
-
-	sch := s.AddTestingCharm(c, "wordpress")
-	wordpress, err := s.State.AddService("wordpress", sch)
-	c.Assert(err, gc.IsNil)
-	u, err := wordpress.AddUnit()
-	c.Assert(err, gc.IsNil)
-	err = u.AssignToMachine(m0)
-	c.Assert(err, gc.IsNil)
-
-	err = s.State.DestroyMachines("0", "1", "2")
-	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 0 has unit "wordpress/0" assigned; machine 1 is required by the environment`)
-	assertLife := func(m *state.Machine, life state.Life) {
-		err := m.Refresh()
-		c.Assert(err, gc.IsNil)
-		c.Assert(m.Life(), gc.Equals, life)
-	}
-	assertLife(m0, state.Alive)
-	assertLife(m1, state.Alive)
-	assertLife(m2, state.Dying)
-
-	err = u.UnassignFromMachine()
-	c.Assert(err, gc.IsNil)
-	err = s.State.DestroyMachines("0", "1", "2")
-	c.Assert(err, gc.ErrorMatches, `some machines were not destroyed: machine 1 is required by the environment`)
-	assertLife(m0, state.Dying)
-	assertLife(m1, state.Alive)
-	assertLife(m2, state.Dying)
-}
-
 func (s *MachineSuite) TestMachineSetAgentAlive(c *gc.C) {
 	alive, err := s.machine.AgentAlive()
 	c.Assert(err, gc.IsNil)
@@ -611,11 +580,11 @@
 func (s *MachineSuite) TestWatchDiesOnStateClose(c *gc.C) {
 	// This test is testing logic in watcher.entityWatcher, which
 	// is also used by:
-	//	Machine.WatchHardwareCharacteristics
-	//	Service.Watch
-	//	Unit.Watch
-	//	State.WatchForEnvironConfigChanges
-	//	Unit.WatchConfigSettings
+	//  Machine.WatchHardwareCharacteristics
+	//  Service.Watch
+	//  Unit.Watch
+	//  State.WatchForEnvironConfigChanges
+	//  Unit.WatchConfigSettings
 	testWatcherDiesWhenStateCloses(c, func(c *gc.C, st *state.State) waiter {
 		m, err := st.Machine(s.machine.Id())
 		c.Assert(err, gc.IsNil)

=== modified file 'state/relationunit_test.go'
--- state/relationunit_test.go	2013-09-08 09:23:01 +0000
+++ state/relationunit_test.go	2013-11-15 11:35:17 +0000
@@ -27,10 +27,16 @@
 
 var _ = gc.Suite(&RelationUnitSuite{})
 
-func (s *RelationUnitSuite) assertInScope(c *gc.C, ru *state.RelationUnit, inScope bool) {
-	ok, err := ru.InScope()
-	c.Assert(err, gc.IsNil)
-	c.Assert(ok, gc.Equals, inScope)
+func assertInScope(c *gc.C, ru *state.RelationUnit) {
+	ok, err := ru.InScope()
+	c.Assert(err, gc.IsNil)
+	c.Assert(ok, jc.IsTrue)
+}
+
+func assertNotInScope(c *gc.C, ru *state.RelationUnit) {
+	ok, err := ru.InScope()
+	c.Assert(err, gc.IsNil)
+	c.Assert(ok, jc.IsFalse)
 }
 
 func (s *RelationUnitSuite) TestReadSettingsErrors(c *gc.C) {
@@ -66,7 +72,7 @@
 	}
 
 	// Add settings for one RU.
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err := pr.ru0.EnterScope(map[string]interface{}{"gene": "kelly"})
 	c.Assert(err, gc.IsNil)
 	node, err := pr.ru0.Settings()
@@ -88,7 +94,7 @@
 		}
 	}
 	assertSettings(pr.u0, normal)
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// Check that EnterScope when scope already entered does not touch
 	// settings at all.
@@ -96,37 +102,37 @@
 	err = pr.ru0.EnterScope(changed)
 	c.Assert(err, gc.IsNil)
 	assertSettings(pr.u0, normal)
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// Leave scope, check settings are still as accessible as before.
 	err = pr.ru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	assertSettings(pr.u0, normal)
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 
 	// Re-enter scope wih changed settings, and check they completely overwrite
 	// the old ones.
 	err = pr.ru0.EnterScope(changed)
 	c.Assert(err, gc.IsNil)
 	assertSettings(pr.u0, changed)
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// Leave and re-enter with nil nettings, and check they overwrite to become
 	// an empty map.
 	err = pr.ru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err = pr.ru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	assertSettings(pr.u0, map[string]interface{}{})
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// Check that entering scope for the first time with nil settings works correctly.
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 	err = pr.ru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	assertSettings(pr.u1, map[string]interface{}{})
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 }
 
 func (s *RelationUnitSuite) TestProReqSettings(c *gc.C) {
@@ -140,7 +146,7 @@
 	}
 
 	// Add settings for one RU.
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 	err := prr.pru0.EnterScope(map[string]interface{}{"gene": "simmons"})
 	c.Assert(err, gc.IsNil)
 	node, err := prr.pru0.Settings()
@@ -148,7 +154,7 @@
 	node.Set("meme", "foul-bachelor-frog")
 	_, err = node.Write()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 
 	// Check settings can be read by every RU.
 	for _, ru := range rus {
@@ -170,7 +176,7 @@
 	}
 
 	// Add settings for one RU.
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 	err := prr.pru0.EnterScope(map[string]interface{}{"gene": "hackman"})
 	c.Assert(err, gc.IsNil)
 	node, err := prr.pru0.Settings()
@@ -178,7 +184,7 @@
 	node.Set("meme", "foul-bachelor-frog")
 	_, err = node.Write()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 
 	// Check settings can be read by RUs in the same container.
 	rus0 := RUs{prr.pru0, prr.rru0}
@@ -221,27 +227,27 @@
 	assertSubCount(0)
 
 	// Enter principal's scope and check a subordinate was created.
-	s.assertInScope(c, pru, false)
+	assertNotInScope(c, pru)
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	assertSubCount(1)
-	s.assertInScope(c, pru, true)
+	assertInScope(c, pru)
 
 	// Enter principal scope again and check no more subordinates created.
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	assertSubCount(1)
-	s.assertInScope(c, pru, true)
+	assertInScope(c, pru)
 
 	// Leave principal scope, then re-enter, and check that still no further
 	// subordinates are created.
 	err = pru.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pru, false)
+	assertNotInScope(c, pru)
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	runits := assertSubCount(1)
-	s.assertInScope(c, pru, true)
+	assertInScope(c, pru)
 
 	// Set the subordinate to Dying, and enter scope again; because the scope
 	// is already entered, no error is returned.
@@ -250,15 +256,15 @@
 	c.Assert(err, gc.IsNil)
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pru, true)
+	assertInScope(c, pru)
 
 	// Leave scope, then try to enter again with the Dying subordinate.
 	err = pru.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pru, false)
+	assertNotInScope(c, pru)
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.Equals, state.ErrCannotEnterScopeYet)
-	s.assertInScope(c, pru, false)
+	assertNotInScope(c, pru)
 
 	// Remove the subordinate, and enter scope again; this should work, and
 	// create a new subordinate.
@@ -267,11 +273,11 @@
 	err = runit.Remove()
 	c.Assert(err, gc.IsNil)
 	assertSubCount(0)
-	s.assertInScope(c, pru, false)
+	assertNotInScope(c, pru)
 	err = pru.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	assertSubCount(1)
-	s.assertInScope(c, pru, true)
+	assertInScope(c, pru)
 }
 
 func (s *RelationUnitSuite) TestDestroyRelationWithUnitsInScope(c *gc.C) {
@@ -280,14 +286,14 @@
 
 	// Enter two units, and check that Destroying the service sets the
 	// relation to Dying (rather than removing it directly).
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err := pr.ru0.EnterScope(map[string]interface{}{"some": "settings"})
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, true)
-	s.assertInScope(c, pr.ru1, false)
+	assertInScope(c, pr.ru0)
+	assertNotInScope(c, pr.ru1)
 	err = pr.ru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 	err = pr.svc.Destroy()
 	c.Assert(err, gc.IsNil)
 	err = rel.Refresh()
@@ -295,20 +301,20 @@
 	c.Assert(rel.Life(), gc.Equals, state.Dying)
 
 	// Check that we can't add a new unit now.
-	s.assertInScope(c, pr.ru2, false)
+	assertNotInScope(c, pr.ru2)
 	err = pr.ru2.EnterScope(nil)
 	c.Assert(err, gc.Equals, state.ErrCannotEnterScope)
-	s.assertInScope(c, pr.ru2, false)
+	assertNotInScope(c, pr.ru2)
 
 	// Check that we created no settings for the unit we failed to add.
 	_, err = pr.ru0.ReadSettings("riak/2")
 	c.Assert(err, gc.ErrorMatches, `cannot read settings for unit "riak/2" in relation "riak:ring": settings not found`)
 
 	// ru0 leaves the scope; check that service Destroy is still a no-op.
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 	err = pr.ru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err = pr.svc.Destroy()
 	c.Assert(err, gc.IsNil)
 
@@ -324,10 +330,10 @@
 	assertSettings()
 
 	// The final unit leaves the scope, and cleans up after itself.
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 	err = pr.ru1.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 	err = rel.Refresh()
 	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
 
@@ -339,11 +345,6 @@
 	c.Assert(err, gc.IsNil)
 	_, err = pr.ru1.ReadSettings("riak/0")
 	c.Assert(err, gc.ErrorMatches, `cannot read settings for unit "riak/0" in relation "riak:ring": settings not found`)
-
-	// Because this is the only sensible place, check that a further call
-	// to Cleanup does not error out.
-	err = s.State.Cleanup()
-	c.Assert(err, gc.IsNil)
 }
 
 func (s *RelationUnitSuite) TestAliveRelationScope(c *gc.C) {
@@ -351,14 +352,14 @@
 	rel := pr.ru0.Relation()
 
 	// Two units enter...
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err := pr.ru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, true)
-	s.assertInScope(c, pr.ru1, false)
+	assertInScope(c, pr.ru0)
+	assertNotInScope(c, pr.ru1)
 	err = pr.ru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 
 	// One unit becomes Dying, then re-enters the scope; this is not an error,
 	// because the state is already as requested.
@@ -366,15 +367,15 @@
 	c.Assert(err, gc.IsNil)
 	err = pr.ru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// Two units leave...
 	err = pr.ru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err = pr.ru1.LeaveScope()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 
 	// The relation scope is empty, but the relation is still alive...
 	err = rel.Refresh()
@@ -382,18 +383,18 @@
 	c.Assert(rel.Life(), gc.Equals, state.Alive)
 
 	// ...and new units can still join it...
-	s.assertInScope(c, pr.ru2, false)
+	assertNotInScope(c, pr.ru2)
 	err = pr.ru2.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru2, true)
+	assertInScope(c, pr.ru2)
 
 	// ...but Dying units cannot.
 	err = pr.u3.Destroy()
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru3, false)
+	assertNotInScope(c, pr.ru3)
 	err = pr.ru3.EnterScope(nil)
 	c.Assert(err, gc.Equals, state.ErrCannotEnterScope)
-	s.assertInScope(c, pr.ru3, false)
+	assertNotInScope(c, pr.ru3)
 }
 
 func (s *StateSuite) TestWatchWatchScopeDiesOnStateClose(c *gc.C) {
@@ -415,35 +416,35 @@
 	s.assertNoScopeChange(c, w0)
 
 	// ru0 enters; check no change, but settings written.
-	s.assertInScope(c, pr.ru0, false)
+	assertNotInScope(c, pr.ru0)
 	err := pr.ru0.EnterScope(map[string]interface{}{"foo": "bar"})
 	c.Assert(err, gc.IsNil)
 	s.assertNoScopeChange(c, w0)
 	node, err := pr.ru0.Settings()
 	c.Assert(err, gc.IsNil)
 	c.Assert(node.Map(), gc.DeepEquals, map[string]interface{}{"foo": "bar"})
-	s.assertInScope(c, pr.ru0, true)
+	assertInScope(c, pr.ru0)
 
 	// ru1 enters; check change is observed.
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 	err = pr.ru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, w0, []string{"riak/1"}, nil)
 	s.assertNoScopeChange(c, w0)
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 
 	// ru1 enters again, check no problems and no changes.
 	err = pr.ru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	s.assertNoScopeChange(c, w0)
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 
 	// Stop watching; ru2 enters.
 	testing.AssertStop(c, w0)
-	s.assertInScope(c, pr.ru2, false)
+	assertNotInScope(c, pr.ru2)
 	err = pr.ru2.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, pr.ru2, true)
+	assertInScope(c, pr.ru2)
 
 	// Start watch again, check initial event.
 	w0 = pr.ru0.WatchScope()
@@ -452,18 +453,18 @@
 	s.assertNoScopeChange(c, w0)
 
 	// ru1 leaves; check event.
-	s.assertInScope(c, pr.ru1, true)
+	assertInScope(c, pr.ru1)
 	err = pr.ru1.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, w0, nil, []string{"riak/1"})
 	s.assertNoScopeChange(c, w0)
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 
 	// ru1 leaves again; check no problems and no changes.
 	err = pr.ru1.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	s.assertNoScopeChange(c, w0)
-	s.assertInScope(c, pr.ru1, false)
+	assertNotInScope(c, pr.ru1)
 }
 
 func (s *RelationUnitSuite) TestProReqWatchScope(c *gc.C) {
@@ -480,7 +481,7 @@
 	s.assertNoScopeChange(c, ws...)
 
 	// pru0 enters; check detected only by req RUs.
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 	err := prr.pru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	rws := func() []*state.RelationScopeWatcher {
@@ -490,10 +491,10 @@
 		s.assertScopeChange(c, w, []string{"mysql/0"}, nil)
 	}
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 
 	// req0 enters; check detected only by pro RUs.
-	s.assertInScope(c, prr.rru0, false)
+	assertNotInScope(c, prr.rru0)
 	err = prr.rru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	pws := func() []*state.RelationScopeWatcher {
@@ -503,20 +504,20 @@
 		s.assertScopeChange(c, w, []string{"wordpress/0"}, nil)
 	}
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.rru0, true)
+	assertInScope(c, prr.rru0)
 
 	// Stop watches; remaining RUs enter.
 	for _, w := range ws {
 		testing.AssertStop(c, w)
 	}
-	s.assertInScope(c, prr.pru1, false)
+	assertNotInScope(c, prr.pru1)
 	err = prr.pru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, prr.pru1, true)
-	s.assertInScope(c, prr.rru1, false)
+	assertInScope(c, prr.pru1)
+	assertNotInScope(c, prr.rru1)
 	err = prr.rru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, prr.rru0, true)
+	assertInScope(c, prr.rru0)
 
 	// Start new watches, check initial events.
 	ws = prr.watches()
@@ -532,24 +533,24 @@
 	s.assertNoScopeChange(c, ws...)
 
 	// pru0 leaves; check detected only by req RUs.
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 	err = prr.pru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	for _, w := range rws() {
 		s.assertScopeChange(c, w, nil, []string{"mysql/0"})
 	}
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 
 	// rru0 leaves; check detected only by pro RUs.
-	s.assertInScope(c, prr.rru0, true)
+	assertInScope(c, prr.rru0)
 	err = prr.rru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	for _, w := range pws() {
 		s.assertScopeChange(c, w, nil, []string{"wordpress/0"})
 	}
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.rru0, false)
+	assertNotInScope(c, prr.rru0)
 }
 
 func (s *RelationUnitSuite) TestContainerWatchScope(c *gc.C) {
@@ -566,29 +567,29 @@
 	s.assertNoScopeChange(c, ws...)
 
 	// pru0 enters; check detected only by same-container req.
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 	err := prr.pru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, ws[2], []string{"mysql/0"}, nil)
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 
 	// req1 enters; check detected only by same-container pro.
-	s.assertInScope(c, prr.rru1, false)
+	assertNotInScope(c, prr.rru1)
 	err = prr.rru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, ws[1], []string{"logging/1"}, nil)
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.rru1, true)
+	assertInScope(c, prr.rru1)
 
 	// Stop watches; remaining RUs enter scope.
 	for _, w := range ws {
 		testing.AssertStop(c, w)
 	}
-	s.assertInScope(c, prr.pru1, false)
+	assertNotInScope(c, prr.pru1)
 	err = prr.pru1.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
-	s.assertInScope(c, prr.rru0, false)
+	assertNotInScope(c, prr.rru0)
 	err = prr.rru0.EnterScope(nil)
 	c.Assert(err, gc.IsNil)
 
@@ -602,24 +603,24 @@
 	s.assertScopeChange(c, ws[2], []string{"mysql/0"}, nil)
 	s.assertScopeChange(c, ws[3], []string{"mysql/1"}, nil)
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.pru1, true)
-	s.assertInScope(c, prr.rru0, true)
+	assertInScope(c, prr.pru1)
+	assertInScope(c, prr.rru0)
 
 	// pru0 leaves; check detected only by same-container req.
-	s.assertInScope(c, prr.pru0, true)
+	assertInScope(c, prr.pru0)
 	err = prr.pru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, ws[2], nil, []string{"mysql/0"})
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.pru0, false)
+	assertNotInScope(c, prr.pru0)
 
 	// rru0 leaves; check detected only by same-container pro.
-	s.assertInScope(c, prr.rru0, true)
+	assertInScope(c, prr.rru0)
 	err = prr.rru0.LeaveScope()
 	c.Assert(err, gc.IsNil)
 	s.assertScopeChange(c, ws[0], nil, []string{"logging/0"})
 	s.assertNoScopeChange(c, ws...)
-	s.assertInScope(c, prr.rru0, false)
+	assertNotInScope(c, prr.rru0)
 }
 
 func (s *RelationUnitSuite) assertScopeChange(c *gc.C, w *state.RelationScopeWatcher, entered, left []string) {

=== modified file 'state/service_test.go'
--- state/service_test.go	2013-09-27 19:20:20 +0000
+++ state/service_test.go	2013-11-15 11:35:17 +0000
@@ -1090,7 +1090,7 @@
 	err = s.mysql.Destroy()
 	c.Assert(err, gc.IsNil)
 	for _, unit := range units {
-		assertUnitLife(c, unit, state.Alive)
+		assertLife(c, unit, state.Alive)
 	}
 
 	// Check a cleanup doc was added.
@@ -1103,9 +1103,9 @@
 	c.Assert(err, gc.IsNil)
 	for i, unit := range units {
 		if i%2 != 0 {
-			assertUnitLife(c, unit, state.Dying)
+			assertLife(c, unit, state.Dying)
 		} else {
-			assertUnitRemoved(c, unit)
+			assertRemoved(c, unit)
 		}
 	}
 

=== modified file 'state/state.go'
--- state/state.go	2013-09-27 19:20:20 +0000
+++ state/state.go	2013-11-15 11:35:17 +0000
@@ -947,63 +947,6 @@
 	return newUnit(st, &doc), nil
 }
 
-// DestroyUnits destroys the units with the specified names.
-func (st *State) DestroyUnits(names ...string) (err error) {
-	// TODO(rog) make this a transaction?
-	var errs []string
-	for _, name := range names {
-		unit, err := st.Unit(name)
-		switch {
-		case errors.IsNotFoundError(err):
-			err = fmt.Errorf("unit %q does not exist", name)
-		case err != nil:
-		case unit.Life() != Alive:
-			continue
-		case unit.IsPrincipal():
-			err = unit.Destroy()
-		default:
-			err = fmt.Errorf("unit %q is a subordinate", name)
-		}
-		if err != nil {
-			errs = append(errs, err.Error())
-		}
-	}
-	return destroyErr("units", names, errs)
-}
-
-// DestroyMachines destroys the machines with the specified ids.
-func (st *State) DestroyMachines(ids ...string) (err error) {
-	var errs []string
-	for _, id := range ids {
-		machine, err := st.Machine(id)
-		switch {
-		case errors.IsNotFoundError(err):
-			err = fmt.Errorf("machine %s does not exist", id)
-		case err != nil:
-		case machine.Life() != Alive:
-			continue
-		default:
-			err = machine.Destroy()
-		}
-		if err != nil {
-			errs = append(errs, err.Error())
-		}
-	}
-	return destroyErr("machines", ids, errs)
-}
-
-func destroyErr(desc string, ids, errs []string) error {
-	if len(errs) == 0 {
-		return nil
-	}
-	msg := "some %s were not destroyed"
-	if len(errs) == len(ids) {
-		msg = "no %s were destroyed"
-	}
-	msg = fmt.Sprintf(msg, desc)
-	return fmt.Errorf("%s: %s", msg, strings.Join(errs, "; "))
-}
-
 // AssignUnit places the unit on a machine. Depending on the policy, and the
 // state of the environment, this may lead to new instances being launched
 // within the environment.
@@ -1077,106 +1020,6 @@
 	return nil
 }
 
-// cleanupDoc represents a potentially large set of documents that should be
-// removed.
-type cleanupDoc struct {
-	Id     bson.ObjectId `bson:"_id"`
-	Kind   string
-	Prefix string
-}
-
-// newCleanupOp returns a txn.Op that creates a cleanup document with a unique
-// id and the supplied kind and prefix.
-func (st *State) newCleanupOp(kind, prefix string) txn.Op {
-	doc := &cleanupDoc{
-		Id:     bson.NewObjectId(),
-		Kind:   kind,
-		Prefix: prefix,
-	}
-	return txn.Op{
-		C:      st.cleanups.Name,
-		Id:     doc.Id,
-		Insert: doc,
-	}
-}
-
-// NeedsCleanup returns true if documents previously marked for removal exist.
-func (st *State) NeedsCleanup() (bool, error) {
-	count, err := st.cleanups.Count()
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-// Cleanup removes all documents that were previously marked for removal, if
-// any such exist. It should be called periodically by at least one element
-// of the system.
-func (st *State) Cleanup() error {
-	doc := cleanupDoc{}
-	iter := st.cleanups.Find(nil).Iter()
-	for iter.Next(&doc) {
-		var err error
-		switch doc.Kind {
-		case "settings":
-			err = st.cleanupSettings(doc.Prefix)
-		case "units":
-			err = st.cleanupUnits(doc.Prefix)
-		default:
-			err = fmt.Errorf("unknown cleanup kind %q", doc.Kind)
-		}
-		if err != nil {
-			logger.Warningf("cleanup failed: %v", err)
-			continue
-		}
-		ops := []txn.Op{{
-			C:      st.cleanups.Name,
-			Id:     doc.Id,
-			Remove: true,
-		}}
-		if err := st.runTransaction(ops); err != nil {
-			return fmt.Errorf("cannot remove empty cleanup document: %v", err)
-		}
-	}
-	if err := iter.Err(); err != nil {
-		return fmt.Errorf("cannot read cleanup document: %v", err)
-	}
-	return nil
-}
-
-func (st *State) cleanupSettings(prefix string) error {
-	// Documents marked for cleanup are not otherwise referenced in the
-	// system, and will not be under watch, and are therefore safe to
-	// delete directly.
-	sel := D{{"_id", D{{"$regex", "^" + prefix}}}}
-	if count, err := st.settings.Find(sel).Count(); err != nil {
-		return fmt.Errorf("cannot detect cleanup targets: %v", err)
-	} else if count != 0 {
-		if _, err := st.settings.RemoveAll(sel); err != nil {
-			return fmt.Errorf("cannot remove documents marked for cleanup: %v", err)
-		}
-	}
-	return nil
-}
-
-func (st *State) cleanupUnits(prefix string) error {
-	// This won't miss units, because a Dying service cannot have units added
-	// to it. But we do have to remove the units themselves via individual
-	// transactions, because they could be in any state at all.
-	unit := &Unit{st: st}
-	sel := D{{"_id", D{{"$regex", "^" + prefix}}}, {"life", Alive}}
-	iter := st.units.Find(sel).Iter()
-	for iter.Next(&unit.doc) {
-		if err := unit.Destroy(); err != nil {
-			return err
-		}
-	}
-	if err := iter.Err(); err != nil {
-		return fmt.Errorf("cannot read unit document: %v", err)
-	}
-	return nil
-}
-
 // ResumeTransactions resumes all pending transactions.
 func (st *State) ResumeTransactions() error {
 	return st.runner.ResumeAll()

=== modified file 'state/state_test.go'
--- state/state_test.go	2013-10-02 13:14:49 +0000
+++ state/state_test.go	2013-11-15 11:35:17 +0000
@@ -1608,39 +1608,6 @@
 	c.Assert(err, gc.IsNil)
 }
 
-func (s *StateSuite) TestCleanup(c *gc.C) {
-	needed, err := s.State.NeedsCleanup()
-	c.Assert(err, gc.IsNil)
-	c.Assert(needed, gc.Equals, false)
-
-	_, err = s.State.AddService("wordpress", s.AddTestingCharm(c, "wordpress"))
-	c.Assert(err, gc.IsNil)
-	_, err = s.State.AddService("mysql", s.AddTestingCharm(c, "mysql"))
-	c.Assert(err, gc.IsNil)
-	eps, err := s.State.InferEndpoints([]string{"wordpress", "mysql"})
-	c.Assert(err, gc.IsNil)
-	relM, err := s.State.AddRelation(eps...)
-	c.Assert(err, gc.IsNil)
-
-	needed, err = s.State.NeedsCleanup()
-	c.Assert(err, gc.IsNil)
-	c.Assert(needed, gc.Equals, false)
-
-	err = relM.Destroy()
-	c.Assert(err, gc.IsNil)
-
-	needed, err = s.State.NeedsCleanup()
-	c.Assert(err, gc.IsNil)
-	c.Assert(needed, gc.Equals, true)
-
-	err = s.State.Cleanup()
-	c.Assert(err, gc.IsNil)
-
-	needed, err = s.State.NeedsCleanup()
-	c.Assert(err, gc.IsNil)
-	c.Assert(needed, gc.Equals, false)
-}
-
 func (s *StateSuite) TestWatchCleanups(c *gc.C) {
 	// Check initial event.
 	w := s.State.WatchCleanups()

=== removed file 'state/statecmd/destroyunit.go'
--- state/statecmd/destroyunit.go	2013-05-02 15:55:42 +0000
+++ state/statecmd/destroyunit.go	1970-01-01 00:00:00 +0000
@@ -1,16 +0,0 @@
-// Copyright 2013 Canonical Ltd.
-// Licensed under the AGPLv3, see LICENCE file for details.
-
-// Code shared by the CLI and API for the DestroyServiceUnits function.
-
-package statecmd
-
-import (
-	"launchpad.net/juju-core/state"
-	"launchpad.net/juju-core/state/api/params"
-)
-
-// DestroyServiceUnits removes the specified units.
-func DestroyServiceUnits(st *state.State, args params.DestroyServiceUnits) error {
-	return st.DestroyUnits(args.UnitNames...)
-}

=== modified file 'state/unit_test.go'
--- state/unit_test.go	2013-11-13 08:47:41 +0000
+++ state/unit_test.go	2013-11-15 11:35:17 +0000
@@ -435,49 +435,12 @@
 	c.Assert(err, gc.ErrorMatches, `unit "wordpress/0" is dead`)
 }
 
-func (s *UnitSuite) TestDestroyPrincipalUnits(c *gc.C) {
-	preventUnitDestroyRemove(c, s.unit)
-	for i := 0; i < 4; i++ {
-		unit, err := s.service.AddUnit()
-		c.Assert(err, gc.IsNil)
-		preventUnitDestroyRemove(c, unit)
-	}
-
-	// Destroy 2 of them; check they become Dying.
-	err := s.State.DestroyUnits("wordpress/0", "wordpress/1")
-	c.Assert(err, gc.IsNil)
-	s.assertUnitLife(c, "wordpress/0", state.Dying)
-	s.assertUnitLife(c, "wordpress/1", state.Dying)
-
-	// Try to destroy an Alive one and a Dying one; check
-	// it destroys the Alive one and ignores the Dying one.
-	err = s.State.DestroyUnits("wordpress/2", "wordpress/0")
-	c.Assert(err, gc.IsNil)
-	s.assertUnitLife(c, "wordpress/2", state.Dying)
-
-	// Try to destroy an Alive one along with a nonexistent one; check that
-	// the valid instruction is followed but the invalid one is warned about.
-	err = s.State.DestroyUnits("boojum/123", "wordpress/3")
-	c.Assert(err, gc.ErrorMatches, `some units were not destroyed: unit "boojum/123" does not exist`)
-	s.assertUnitLife(c, "wordpress/3", state.Dying)
-
-	// Make one Dead, and destroy an Alive one alongside it; check no errors.
-	wp0, err := s.State.Unit("wordpress/0")
-	c.Assert(err, gc.IsNil)
-	err = wp0.EnsureDead()
-	c.Assert(err, gc.IsNil)
-	err = s.State.DestroyUnits("wordpress/0", "wordpress/4")
-	c.Assert(err, gc.IsNil)
-	s.assertUnitLife(c, "wordpress/0", state.Dead)
-	s.assertUnitLife(c, "wordpress/4", state.Dying)
-}
-
 func (s *UnitSuite) TestDestroySetStatusRetry(c *gc.C) {
 	defer state.SetRetryHooks(c, s.State, func() {
 		err := s.unit.SetStatus(params.StatusStarted, "", nil)
 		c.Assert(err, gc.IsNil)
 	}, func() {
-		assertUnitLife(c, s.unit, state.Dying)
+		assertLife(c, s.unit, state.Dying)
 	}).Check()
 	err := s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
@@ -488,7 +451,7 @@
 		err := s.unit.SetCharmURL(s.charm.URL())
 		c.Assert(err, gc.IsNil)
 	}, func() {
-		assertUnitRemoved(c, s.unit)
+		assertRemoved(c, s.unit)
 	}).Check()
 	err := s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
@@ -505,7 +468,7 @@
 		err := s.unit.SetCharmURL(newCharm.URL())
 		c.Assert(err, gc.IsNil)
 	}, func() {
-		assertUnitRemoved(c, s.unit)
+		assertRemoved(c, s.unit)
 	}).Check()
 	err = s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
@@ -519,7 +482,7 @@
 		err := s.unit.AssignToMachine(machine)
 		c.Assert(err, gc.IsNil)
 	}, func() {
-		assertUnitRemoved(c, s.unit)
+		assertRemoved(c, s.unit)
 		// Also check the unit ref was properly removed from the machine doc --
 		// if it weren't, we wouldn't be able to make the machine Dead.
 		err := machine.EnsureDead()
@@ -539,7 +502,7 @@
 		err := s.unit.UnassignFromMachine()
 		c.Assert(err, gc.IsNil)
 	}, func() {
-		assertUnitRemoved(c, s.unit)
+		assertRemoved(c, s.unit)
 	}).Check()
 	err = s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
@@ -550,7 +513,7 @@
 	err := s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
 	c.Assert(s.unit.Life(), gc.Equals, state.Dying)
-	assertUnitRemoved(c, s.unit)
+	assertRemoved(c, s.unit)
 }
 
 func (s *UnitSuite) TestCannotShortCircuitDestroyWithSubordinates(c *gc.C) {
@@ -568,7 +531,7 @@
 	err = s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
 	c.Assert(s.unit.Life(), gc.Equals, state.Dying)
-	assertUnitLife(c, s.unit, state.Dying)
+	assertLife(c, s.unit, state.Dying)
 }
 
 func (s *UnitSuite) TestCannotShortCircuitDestroyWithStatus(c *gc.C) {
@@ -592,7 +555,7 @@
 		err = unit.Destroy()
 		c.Assert(err, gc.IsNil)
 		c.Assert(unit.Life(), gc.Equals, state.Dying)
-		assertUnitLife(c, unit, state.Dying)
+		assertLife(c, unit, state.Dying)
 	}
 }
 
@@ -610,56 +573,25 @@
 	err = s.unit.Destroy()
 	c.Assert(err, gc.IsNil)
 	c.Assert(s.unit.Life(), gc.Equals, state.Dying)
-	assertUnitRemoved(c, s.unit)
-}
-
-func (s *UnitSuite) TestDestroySubordinateUnits(c *gc.C) {
-	lgsch := s.AddTestingCharm(c, "logging")
-	_, err := s.State.AddService("logging", lgsch)
-	c.Assert(err, gc.IsNil)
-	eps, err := s.State.InferEndpoints([]string{"logging", "wordpress"})
-	c.Assert(err, gc.IsNil)
-	rel, err := s.State.AddRelation(eps...)
-	c.Assert(err, gc.IsNil)
-	ru, err := rel.Unit(s.unit)
-	c.Assert(err, gc.IsNil)
-	err = ru.EnterScope(nil)
-	c.Assert(err, gc.IsNil)
-
-	// Try to destroy the subordinate alone; check it fails.
-	err = s.State.DestroyUnits("logging/0")
-	c.Assert(err, gc.ErrorMatches, `no units were destroyed: unit "logging/0" is a subordinate`)
-	s.assertUnitLife(c, "logging/0", state.Alive)
-
-	// Try to destroy the principal and the subordinate together; check it warns
-	// about the subordinate, but destroys the one it can. (The principal unit
-	// agent will be resposible for destroying the subordinate.)
-	err = s.State.DestroyUnits("wordpress/0", "logging/0")
-	c.Assert(err, gc.ErrorMatches, `some units were not destroyed: unit "logging/0" is a subordinate`)
-	s.assertUnitLife(c, "wordpress/0", state.Dying)
-	s.assertUnitLife(c, "logging/0", state.Alive)
-}
-
-func (s *UnitSuite) assertUnitLife(c *gc.C, name string, life state.Life) {
-	unit, err := s.State.Unit(name)
-	c.Assert(err, gc.IsNil)
-	assertUnitLife(c, unit, life)
-}
-
-func assertUnitLife(c *gc.C, unit *state.Unit, life state.Life) {
-	c.Assert(unit.Refresh(), gc.IsNil)
-	c.Assert(unit.Life(), gc.Equals, life)
-}
-
-func assertUnitRemoved(c *gc.C, unit *state.Unit) {
-	err := unit.Refresh()
+	assertRemoved(c, s.unit)
+}
+
+func assertLife(c *gc.C, entity state.Living, life state.Life) {
+	c.Assert(entity.Refresh(), gc.IsNil)
+	c.Assert(entity.Life(), gc.Equals, life)
+}
+
+func assertRemoved(c *gc.C, entity state.Living) {
+	err := entity.Refresh()
 	c.Assert(err, jc.Satisfies, errors.IsNotFoundError)
-	err = unit.Destroy()
-	c.Assert(err, gc.IsNil)
-	err = unit.EnsureDead()
-	c.Assert(err, gc.IsNil)
-	err = unit.Remove()
-	c.Assert(err, gc.IsNil)
+	err = entity.Destroy()
+	c.Assert(err, gc.IsNil)
+	if entity, ok := entity.(state.AgentLiving); ok {
+		err = entity.EnsureDead()
+		c.Assert(err, gc.IsNil)
+		err = entity.Remove()
+		c.Assert(err, gc.IsNil)
+	}
 }
 
 func (s *UnitSuite) TestTag(c *gc.C) {