---
id: ADR-MBR-STR-014
title: Retire Referenced Records and Respect Deletion Guards
product_area: membership
module: structure
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Deletion respects counted dependencies and database foreign keys, while retirement retains used records;
  soft external references do not establish universal deletion protection.
constrains:
  - DOM-MBR-STR-001
  - DOM-MBR-STR-002
  - DOM-MBR-STR-006
  - SVC-MBR-STR-structure
  - SVC-MBR-STR-configuration
  - WF-MBR-STR-003
  - WF-MBR-STR-005
origin: >-
  services-membership:modules/configuration/services/persistence/configuration-store.ts (a record another
  record names is never deleted); services-membership:docs/migrations/unit-merge/README.md#The behaviour (a
  member's history must not dangle)
alternatives:
  - option: Delete dependant records automatically.
    why_not: >-
      Cascading across memberships or external ownership would destroy retained context and require a separate
      authorization and history policy.
  - option: Introduce a deleted flag on every record.
    why_not: >-
      That would add another lifecycle meaning alongside existing availability without a decided reader
      contract.
consequences:
  - Staff preserve referenced records through retirement or correction.
  - Any retained affiliation naming a unit blocks its deletion.
  - >-
    Database references backstop local counts, but soft external pointers and overwritten current-history
    references remain outside that guarantee.
supersedes: []
evidence:
  - >-
    services-membership at 5994c270: modules/structure/services/tree/tree-edits.ts (deleteUnit);
    services/persistence/organizational-unit-types.ts;
    modules/configuration/services/persistence/configuration-store.ts
---

# Retire Referenced Records and Respect Deletion Guards

## Context

Structural and configuration records are referenced by retained membership work. Deletion must preserve those protected references without implying the service can inspect every external attachment.

## Decision

The implemented services count selected dependencies and rely on declared foreign keys. This record describes those guards rather than claiming every historical or cross-service reference is protected.

## Alternatives Considered

Delete dependant records automatically. Cascading across memberships or external ownership would destroy retained context and require a separate authorization and history policy. Introduce a deleted flag on every record. That would add another lifecycle meaning alongside existing availability without a decided reader contract.

## Consequences

Staff preserve referenced records through retirement or correction. Any retained affiliation naming a unit blocks its deletion. Database references backstop local counts, but soft external pointers and overwritten current-history references remain outside that guarantee.