---
id: ADR-PFM-MTD-009
title: Transactional deletion with dependent events
product_area: platform
module: metadata
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: Endpoint deletion applies link policy in the deleting transaction, bounds custom-record cascades to depth
  ten and records dependant deletion facts before their originating record.
constrains:
- DOM-PFM-MTD-005
- DOM-PFM-MTD-006
- WF-PFM-MTD-007
- WF-PFM-MTD-008
- SVC-PFM-MTD-associations
- SVC-PFM-MTD-custom-objects
origin: 'PLAT-M5 B1 (Andrew, 2026-10-19: dependants first), CRM-M1 owner delete (relayed 2026-10-19); PLAT-M6 assumptions
  A1 and A2 (plan approved 2026-10-21)'
alternatives:
- option: Removing only permitted members of a cascade
  why_not: Partial deletion would leave relationships and register content inconsistent with the chosen policy.
- option: Cascading into native records
  why_not: Platform has no authority to delete CRM’s contact or organization aggregates.
- option: Removing links after an endpoint commits deletion
  why_not: A restriction would be discovered too late to prevent the endpoint removal.
consequences:
- Endpoint owners call database functions within the removal transaction.
- A lock or policy refusal in a reached dependant stops every deletion effect.
- Cross-service cascades do not consult the optional direct-store external deletion check.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/associations/services/persistence/associations.ts (applyEndpointDeletion);
  modules/custom-objects/services/persistence/custom-object-records.ts (deleteWithRules, inEventOrder); docs/associations.md
  §6'
---

# Transactional deletion with dependent events

## Context

Links can connect native owners to Platform records. Removal policy must remain transactional across that database boundary.

## Decision

Endpoint deletion applies link policy in the deleting transaction, bounds custom-record cascades to depth ten and records dependant deletion facts before their originating record.

## Alternatives Considered

Removing only permitted members of a cascade: Partial deletion would leave relationships and register content inconsistent with the chosen policy. Cascading into native records: Platform has no authority to delete CRM’s contact or organization aggregates. Removing links after an endpoint commits deletion: A restriction would be discovered too late to prevent the endpoint removal.

## Consequences

Endpoint owners call database functions within the removal transaction. A lock or policy refusal in a reached dependant stops every deletion effect. Cross-service cascades do not consult the optional direct-store external deletion check.