---
id: ADR-MBR-STR-018
title: Remove Protected Versions Through the Owner Function
product_area: membership
module: structure
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Structural version removal uses the owner's function after ordinary data removal; reset retains unit and
  relationship kinds, while purge removes their configuration too.
constrains:
  - WF-MBR-STR-007
  - DOM-MBR-STR-001
  - DOM-MBR-STR-002
  - SVC-MBR-STR-structure
origin: >-
  services-membership:modules/structure/services/lifecycle/structure-participant.ts (version tables declared
  definer-function); Platform workspace lifecycle plan as cited there
alternatives:
  - option: Grant ordinary application code direct version deletion.
    why_not: That would weaken the declared protection against rewriting structural audit evidence.
  - option: Keep all structural versions after workspace deletion.
    why_not: That would retain deleted-workspace data beyond the declared lifecycle removal contract.
consequences:
  - 'Ordinary application access cannot rewrite unit, link or parentage versions.'
  - Removal is constrained by declared workspace lifecycle states and continues in batches.
  - 'Purge retains applied seed-ledger entries, which affects reuse of a workspace identity.'
supersedes: []
evidence:
  - >-
    services-membership at 5994c270: modules/structure/services/lifecycle/structure-participant.ts;
    services/persistence/structure-tenant-rows.ts
---

# Remove Protected Versions Through the Owner Function

## Context

Versions retain structural changes and attribution. Their protection must coexist with complete workspace removal and the narrower reset contract.

## Decision

The participant declares owner-function version removal rather than ordinary row deletion. Reset reaches that step after data removal without deleting kinds; purge removes kind configuration first as well.

## Alternatives Considered

Grant ordinary application code direct version deletion. That would weaken the declared protection against rewriting structural audit evidence. Keep all structural versions after workspace deletion. That would retain deleted-workspace data beyond the declared lifecycle removal contract.

## Consequences

Ordinary application access cannot rewrite unit, link or parentage versions. Removal is constrained by declared workspace lifecycle states and continues in batches. Purge retains applied seed-ledger entries, which affects reuse of a workspace identity.