Retire Referenced Records and Respect Deletion Guards

Context

Structural and configuration records are referenced by retained membership work. Deletion must preserve those protected references without implying the service can inspect every external attachment.

Decision

The implemented services count selected dependencies and rely on declared foreign keys. This record describes those guards rather than claiming every historical or cross-service reference is protected.

Alternatives Considered

Delete dependant records automatically. Cascading across memberships or external ownership would destroy retained context and require a separate authorization and history policy. Introduce a deleted flag on every record. That would add another lifecycle meaning alongside existing availability without a decided reader contract.

Consequences

Staff preserve referenced records through retirement or correction. Any retained affiliation naming a unit blocks its deletion. Database references backstop local counts, but soft external pointers and overwritten current-history references remain outside that guarantee.