Retirement boundary and forward recovery

Context

Retirement’s structured workflow carries the waiting and boundary rules. The ledger is a separate external effect, so a completed request without its ledger is a documented recovery gap.

The proposed policy retains its cited product origin and outstanding defaults; this examination grants no additional approval.

Decision

Preserve a request-time waiting policy and gating notices, recheck protections and requester authority under locks at the destructive boundary, and recover partial purge by moving forward.

Alternatives Considered

Allow immediate staff deletion. The planning decision requires a deliberate cancellable period before irreversible removal.

Restore operational status when purge fails. Removed resources cannot be reconstructed by a status update, so returning partial data to use would hide destruction.

Consequences

Cancellation is available only before the destructive boundary.

Loss of requester authority places the request on hold for human decision.

Job recovery cannot shorten eligibility or replace the decision to retire.

The external ledger supplies deletion evidence for restored-database reapplication.