Multiple remove node calls must reach consistent state

Issue is that during self-healing, if node detects fault domain violations then it may attempt to remove one or more nodes from the system.  If it needs to remove more than 1 node then the remove node calls must be made synchronously, one after the other.  Otherwise, if two nodes are removed without reaching a stable state then system can reach undefined state.