---
id: ADR-PFM-TNL-011
title: Retained Evidence and Restore Reapplication
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
decision: Retain deletion evidence independently of the workspace and write a versioned external ledger for identifier
  retirement and restore reapplication.
constrains:
- DOM-PFM-TNL-005
- WF-PFM-TNL-013
- WF-PFM-TNL-015
- WF-PFM-TNL-016
- SVC-PFM-TNL-tenants
origin: services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.10, §9, §13 D7 (approved 2026-10-09)
alternatives:
- option: Keep the history on the workspace record
  why_not: Workspace-held history would disappear with finalization.
- option: Rely on the database alone after a restore
  why_not: A restored database cannot establish that a later deletion already completed.
consequences:
- Staff retain access to the deletion account after the workspace disappears.
- The retained contract excludes member business data and keeps decision and aggregate removal facts.
- The availability gate does not consult the ledger, and post-completion ledger failure lacks a product recovery
  route.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: modules/tenants/services/deletion/{deletion-ledger, reapply-deletions, orphan-report}.ts;
  db/row-level-security.ts; aws/resources/tenant-deletion-ledger.s3.ts.'
---

# Retained Evidence and Restore Reapplication

## Context

Removing the workspace must not remove the account of why and when it was destroyed. Database restore also needs evidence outside the restored database.

## Decision

Retain deletion evidence independently of the workspace and write a versioned external ledger for identifier retirement and restore reapplication.

## Alternatives Considered

Keep the history on the workspace record: Workspace-held history would disappear with finalization. Rely on the database alone after a restore: A restored database cannot establish that a later deletion already completed.

## Consequences

Staff retain access to the deletion account after the workspace disappears. The retained contract excludes member business data and keeps decision and aggregate removal facts. The availability gate does not consult the ledger, and post-completion ledger failure lacks a product recovery route.