---
id: ADR-PFM-TNL-017
title: Lifecycle Evidence and Removal Capture
product_area: platform
module: tenant-lifecycle
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
  services-committees: 36129c24daeaadcdb339218c38cdeaff9861359d
  services-membership: 5994c270e8a37a30f848e99ba5b5ee6b87c08893
  services-submissions: 64236c19be89579ef5897aad7de3925ed3ce03bf
  services-websites: 5fc6823c69d5e6f208c21dba8c0eb3132f8bdc4c
  services-marketing: d071a159fe9782bb71ff246d5c67d5bbfe07fbfa
decision: Keep lifecycle evidence in its domain and job records, and suppress business-record change capture where
  removal implementations declare that behavior.
constrains:
- DOM-PFM-TNL-002
- DOM-PFM-TNL-004
- DOM-PFM-TNL-005
- WF-PFM-TNL-008
- WF-PFM-TNL-013
- SVC-PFM-TNL-crm-tenant-lifecycle
origin: services-platform:docs/record-history.md#Rules every writer meets (the purge, suppression); services-platform:docs/tenants/tenant-lifecycle-plan.md#§5.9
  Late events
alternatives:
- option: Write record-history revisions for lifecycle changes
  why_not: History written onto destroyed records would need removal too and would not retain the deletion account.
- option: Let purges emit change events
  why_not: Downstream processing could act on records the purge is removing.
consequences:
- Jobs, requests, notices and load facts provide lifecycle attribution alongside record bookkeeping.
- Ordinary business-standing changes do not currently append a security audit event.
supersedes: []
evidence:
- 'services-platform at ad3f6a65: docs/record-history.md; modules/tenants/services/persistence/tenant-row-purges.ts.'
- 'services-crm at a8d1364f: modules/tenant-lifecycle/services/participants/purge-batches.ts.'
---

# Lifecycle Evidence and Removal Capture

## Context

Removal must retain its own decision evidence without generating downstream work about disappearing records. Existing history and audit mechanisms have different ownership.

## Decision

Keep lifecycle evidence in its domain and job records, and suppress business-record change capture where removal implementations declare that behavior.

## Alternatives Considered

Write record-history revisions for lifecycle changes: History written onto destroyed records would need removal too and would not retain the deletion account. Let purges emit change events: Downstream processing could act on records the purge is removing.

## Consequences

Jobs, requests, notices and load facts provide lifecycle attribution alongside record bookkeeping. Ordinary business-standing changes do not currently append a security audit event.