Status: IN
Data preservation through deletion is enforced by two independent mechanisms: preconditions prevent premature deletion (empty-bucket requirements, trash-first workflows) and the deletion operation itself preserves data (append-only tombstones, delete markers, version entries) — neither alone suffices, but together they guarantee no data is irrecoverably lost through a delete operation at any distribution level.
Guards prevent accidental deletion while append-only semantics prevent intentional deletion from destroying data — independent mechanisms, joint guarantee
Depends on (SL): deletion-is-cautious-at-every-level, deletion-is-append-only-across-all-contexts