I think we should assume the ESM wont give us false negatives. we should code to protect against that if we can (maybe querying the cloud about the instance state?), but the main path should be assuming the ESM reports the correct state.

Also, in the case i described above, the cloud driver probably will not throw an exception, but will just take a long time and perhaps corrupt some data, so the storage cleanup will take place anyway.