First, stop the bleeding
Cancel the subscriptions, the retainers and the guest-post contracts. This sounds obvious and is routinely skipped, because cancelling feels like admitting the money was wasted. It was. Continuing to spend it does not change that and does make the pattern longer.
Then inventory, honestly
Write down every link you paid for, in money or in kind: the URL, the vendor, the date, what you paid. Include the ones you think probably do not count — free products for reviews, the link exchange with a friend's site, the directory bundle from three years ago.
This document is the whole project. You cannot remove, disavow or explain what you have not written down, and if a reconsideration request ever becomes necessary, this is what it is built from.
Removal before disavowal
Ask for removal first, vendor by vendor. A removed link is unambiguously gone; a disavowed one is a request to ignore something that is still there. Keep the correspondence, including the refusals — "we asked, they refused, here is the email" is a materially stronger position than silence.
Only then build the disavow file, and only with what genuinely could not be removed. Over-disavowing is a real and common self-inflicted injury: people dump every unfamiliar referring domain into the file and discard honest links in the process.
What recovery actually looks like
If there is a manual action in Search Console, there is a defined path: fix it, document it, file reconsideration, wait. If there is no manual action and traffic is simply flat or declining, there is no path and no confirmation — automated demotion comes with no notification and no all-clear.
That second case is the common one, and the honest version of the advice is unsatisfying: clean up, then build the site you would have built anyway, and judge it on new work rather than waiting for a recovery signal that may never arrive in a legible form. Anyone offering you a timeline is guessing.