Batched Removal and Declared-Resource Verification

Context

Long removal needs bounded transactions and an independent check of declared leftovers. A partly removed workspace cannot be safely reopened.

Decision

Remove resources in participant batches, recheck purge ownership and deleting standing, verify empty removable inventories within the bounded sweep policy and recover forward after failure.

Alternatives Considered

One transaction per participant or per workspace: An oversized transaction would retain locks and lose progress on timeout. Restore a partly destroyed workspace on failure: Failure recovery cannot reconstruct resources already destroyed. Trust each participant's done: A participant’s completion answer is insufficient without the declared-resource inventory.

Consequences

Linked retry carries completed work while revisiting unfinished removal. Superseded executions refuse further guarded work. Participant commits precede count recording, so lost results can understate totals.