I would solve this with a shopping-cart entity and a and a shopping-cart-item entity.
ShoppingCart (customer, status, date, xxx)
Customer – ShoppingCart (1:n)
ShoppingCart – ShoppingCartItem (1:n)
Product – ShoppingCartItem (1:n)
Now in your step2 (after getting or creating a shoppingcart) select the products that are not yet in the shopping cart. You can do this by using a datasource microflow as long as you didnt commit anythig yet. Once the ShoppingCart & item would be commited you could also retrieve the selectable items using an xpath.
You could add an association from shoppingcart to session and delete behaviour. But then you have to make sure you remove the association when the customer does confirm his shoppingcart. Otherwise the shoppingcart would be removed during session cleanup.