Purge A Workspace And Prove It Is Gone
What It Does
Remove declared participant resources, verify reported leftovers and retain deletion completion evidence. Repeated batches work toward empty resources. Completed request replay can finish external work, but failure after workspace removal and before completion is not recoverable through ordinary retry.
The Flow
When Something Fails
Refuse mismatched order and apply failure consequences. Earlier attempts can already have removed resources. Use the flush service’s logged failure handling. Previously cached authority can survive until its own expiry. Retry eligible faults; a blocked response refuses the purge. Committed batches remain removed, and lost results can understate totals. Return participant errors to the purge task. The participant can remain partly removed. Fail with resource counts when the sweep bound is reached. Declared leftovers remain; omitted resources are outside this proof. A later failure can make retry refuse the already-missing workspace. The workspace can be gone while its decision, counts and customer work remain unfinished. Retry the task; exhausted ledger failure leaves completed request standing untouched. The completed deletion can lack its external ledger with no ordinary recovery route. Ignore stale consequences and log notice delivery errors. Partial destruction remains and the workspace is not reopened.
Open Design Questions
Complete deletion cannot be claimed for disabled or unimplemented resources. Finalization needs recovery for missing-workspace and missing-ledger failure windows.