Bound the size of atomic merges

Context

A single large transaction can hold many records against concurrent editing.

Decision

Merges exceeding the configured ceiling of one hundred thousand related rows or organization affiliations are refused; plans above ten thousand rows warn about duration and lock waits.

Alternatives Considered

Increase the ceiling. The measured lock duration would expose more ordinary edits to timeouts.

Move records in committed batches. Staff would see a partially combined organization.

Consequences

Duration estimates and size warnings do not affect approval hashes. The merge task has a fifteen-minute limit; production timing still depends on its workload.