# WP-48 — Stamdata deletion protection (referential integrity)

Status: done
Phase: 8 — platform/DX/showcase

## Why

Deleting a stamdata row that something relies on (e.g. a `professions.program` a diploma maps
through) would silently break behaviour. Stamdata is config-as-code (PR-applied, CI-gated), so the
authoritative guard belongs at the build gate; the editor gets a fast-feedback nudge.

## Decisions (locked with the user)

- **CI gate (authoritative) + editor warning (fast feedback).**
- **Steer temporal rows toward expiring** (set `geldigTot`) over hard delete.

## Outcome

- **CI gate:** generalized the dangling-reference test in `StamdataValidationTests` into a declared,
  extensible reference list (`StamdataRef` records) — "every declared reference into a stamdata key
  resolves against the currently-valid stamdata." Today one entry: `Diploma.Opleiding →
professions.program (valid today)`. Resolvers use the "valid today" view (`Professions.ByProgram`),
  so removing/renaming a referenced program OR expiring it while current data still references it
  **fails the PR build**; expiring once nothing current relies on it passes. Adding a future FK is
  one list entry.
- **Editor (fast feedback):** `stamdata-table-editor` now confirms before delete (`@@beheer.removeConfirm`
  — warns that a referenced row fails CI and, for a dated table, to close validity instead) and, for
  **temporal** tables, adds a **"Sluiten per vandaag"** action that sets `geldigTot` to today
  (reusing `CellEdited`) — steering to expire over hard delete. CI stays the authority.

## Acceptance criteria

- [x] A delete/expire that orphans a declared reference fails the build gate (existing seed passes).
- [x] Editor confirms deletes and offers expire (close validity) for temporal tables.
- [x] `npm run ci` green (backend `dotnet test`, localized build).

## Deferred (noted)

A per-row "referenced" hint in the editor DTO (server-computed usage) — would let the editor warn on
the _specific_ referenced rows rather than a generic confirm. Not needed for the authoritative gate.