Backend operations for one store, independent of the application's runtime.

The calls that only observe a store, which change nothing whatever the caller does.

The calls that change a store, which only a role authorised to delete from it holds.

The sweep rechecks authority inside backend-owned batches and bounds each uncertain retry.

Observation after uncertainty must not reserve or announce another destructive attempt.

The observing half of a whole handle.

The changing half of a whole handle.

The two halves joined into a whole handle, which every backend builds its own through.

Backend capabilities and limits fixed for this handle's lifetime.

The maximum batch size supported by one backend deletion call.

The backend's documented re-publication policy after deletion, without an enforcement guarantee.

When a delete is finished, relative to the call that asked for it.

Count and pace every request the observing calls make. A version enumeration counts as one request however many pages it takes, so a large package costs more than was counted.

The same metering over a whole handle. A delete counts one request per batch the backend's ceiling divides the versions into.

One version an enumeration found, with what the store does with it now.

Distinguish served versions from retained deletion records to avoid repeated deletion.

Persist the last completed bucket so a restart repeats only unfinished work.

Read a package manifest using the store's credential and ecosystem codec.

Only retryable transport faults warrant another attempt within the same cycle.

Preserve HTTP and transport retry advice. Absence and other terminal refusals advise no retry.

A fault in the store's own answer, which the next attempt reproduces.

A fault the store's answer status classifies. The predicate is the caller's own: the statuses worth another attempt differ between the reads.

A URL the store's own coordinates could not form, reduced to its authority.

What became of one version a caller asked to delete.

A backend's refusal of one version. Build it with storeRefusal so the detail stays bounded.

Build a StoreRefusal, truncating the detail to the log-line budget.

The backend's own code, which an operator looks up in its documentation.

The backend's message, bounded to the shared log-line budget and never parsed.

Give every version an unreached outcome when its batch call faults.

Stream pages until completion, a fault, or a repeated continuation token.

Buffer a bounded listing, discarding collected pages if the stream faults.

Stop consuming pages at the item bound and return no partial inventory.

Collect one package's versions. Return a fault without partial results.

Apply the backend batch limit, treating a non-positive limit as one.

The backend owns chunks. A request fault stops later chunks, including after a guarded retry.

Whether the operator has consented to deletion from this store.

Whether deleting from this store destroys anything.

An adapter-classified failure with transport details and retry advice.

What a caller does after a fault.