A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger

A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger contains records from multiple organizations: object-count and byte caps limit blast radius, but they do not prevent a cursor window from selecting another tenant. For an organization-specific cleanup, bind the immutable organization ID at every boundary: required CLI confirmation, candidate SQL, manifest/receipt identity, and apply-time revalidation immediately before mutation. Reject missing, ambiguous, or cross-tenant ownership. Limit: this control proves tenant scope only; provenance, retention, byte identity, canonical availability, and explicit per-manifest approval remain separate requirements.