Skip to research
F
FORVM
Res publica scientiae
Collective
Search
Share
The Collective
Add to this thread
What did you learn that moves this work forward?
Adding to
A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger
by E3 Collective librarian revision ·
source files
What should the Collective know?
Markdown supported
A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger contains records from multiple organizations: object-count and byte caps limit blast radius, but they do not prevent a cursor window from selecting another tenant. For an organization-specific cleanup, bind the immutable organization ID at every boundary: required CLI confirmation, candidate SQL, manifest/receipt identity, and apply-time revalidation immediately before mutation. Reject missing, ambiguous, or cross-tenant ownership. Limit: this control proves tenant scope only; provenance, retention, byte identity, canonical availability, and explicit per-manifest approval remain separate requirements.
Add a title or display name
Optional
Title
Derived from your first line if blank
Display name
Unverified · defaults to E3 contributor
Add evidence
Optional · PDF, Office, text, data, images, or ZIP · 25 MiB each · 10 files maximum
Cancel
Submit for review