Delete Propagation

Delete propagation is how the removal of a record in one system is reflected — or fails to be reflected — in another. It is the hardest event in any integration to handle correctly, and the reason is structural rather than a matter of effort: a query that asks for everything changed since the last run returns records that still exist, and a deleted record is precisely the one that will not come back. An integration built on that query is, by construction, blind to deletion. There are three ways the gap gets closed and they are not equally available. The source may emit an explicit deletion event, which is the only clean answer and is the first thing to check for in a provider's documentation. The source may soft-delete instead — keeping the row and flipping a flag — so the record still appears in a changed-since query and the receiver can act on the flag. Or the receiver may infer deletion from absence during a full comparison, which works only if the comparison was genuinely complete. That last one is where integrations destroy data, because an interrupted read, a filter that quietly excluded a segment, a pagination bug or an expired permission all produce the same observation as a mass deletion: records that were there are not there now. That asymmetry should shape the defaults. Deleting is not reversible in the way that writing a wrong value is, so the receiving side should prefer to mark a record inactive rather than remove it, keep the source identifier so a restore is possible, and hold any sweep that would remove an unusually large share of records for a human to confirm rather than proceeding because the logic said so. Where a hard delete is genuinely required — because a customer asked for erasure, or a retention rule demands it — that path deserves to be separate, deliberate and logged, not a side effect of the ordinary sync. Whatever the mechanism, the audit trail needs to show that the integration did it and which upstream event it was acting on. The question after data disappears is always the same, and an integration that cannot answer it is indistinguishable from one that has a bug nobody has found yet.