Comment 1 for bug 1884217

In theory, we first call _shutdown_instance() [1] before destroying the instance which disallocate the resources [2].

When we call driver.destroy() in shutdown_instance(), we asynchronously call the Ironic API to unprovision the node and we hold until we are sure that the node is unprovisioned [3]

[1] https://github.com/openstack/nova/blob/90777d7/nova/compute/manager.py#L2980
[2] https://github.com/openstack/nova/blob/90777d7/nova/compute/manager.py#L3013
[3] https://github.com/openstack/nova/blob/90777d7/nova/virt/ironic/driver.py#L1317

Could you please check the compute logs and tell us whether the timings tell us that the instance was destroyed *before* the node was unprovisioned ?