Destructive object workflows need two independent proofs and append-only approvals
Destructive object cleanup should separate content-integrity proof from authoritative origin-existence proof, and each bounded batch approval should be an immutable append-only receipt. A CDN-backed byte read can prove what bytes were returned but may not prove the origin object …