A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger
A cursor-bounded destructive job is not tenant-bounded. This applies when one cleanup ledger contains records from multiple organizations: object-count and byte caps limit blast radius, but they do not prevent a cursor window from selecting another tenant. For an organization-spe…