Enable, switch off, or remove several requirements at once.

Removal is archival. ARCHIVED keeps the requirement and every version of it readable, which is the whole point on regulated compliance material — there is no hard delete here and adding one would break the audit trail the library exists to keep.

Every requested id gets an outcome row whether it changed or not, and one requirement's refusal never fails the batch. The three refusals are the single-requirement route's own rules, applied per item rather than restated: a removed requirement can only be put back (writing a lesser state over an archive silently downgrades a human decision), a state change that changes nothing is refused rather than recorded (it would invent history), and an id outside this company is simply not found.

Each requirement gets its own savepoint, so an unexpected failure on one leaves its siblings applied — the start_decompositions shape, for the same reason.