Retained Evidence and Restore Reapplication

Context

Removing the workspace must not remove the account of why and when it was destroyed. Database restore also needs evidence outside the restored database.

Decision

Retain deletion evidence independently of the workspace and write a versioned external ledger for identifier retirement and restore reapplication.

Alternatives Considered

Keep the history on the workspace record: Workspace-held history would disappear with finalization. Rely on the database alone after a restore: A restored database cannot establish that a later deletion already completed.

Consequences

Staff retain access to the deletion account after the workspace disappears. The retained contract excludes member business data and keeps decision and aggregate removal facts. The availability gate does not consult the ledger, and post-completion ledger failure lacks a product recovery route.