With children - do you mean by way of context_id? This field is according to the kernel docs explicitely _only_ for security purposes (and should have been called security_context_id propably). So I wouldn't deduce any further child/parent relationships from it, at least that's what I remember from earlier discussions on this topic.

When you delete an object, you need to update all objects which use the object_id as their context_id, probably setting it to (What is the default now? -4?). This was discussed a while back, has acs_object.delete been changed to do this yet? Of course you also have rel_segments and permissions to delete as well.