@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-data-rights-files.js

@@ -0,0 +1,4628 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductDataRightsFiles = renderProductDataRightsFiles;
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+const PENDING_EXPORT_CLEANUP_REPORT_BOUND = 1_000;
+const PENDING_EXPORT_CLEANUP_REPORT_BOUND_LITERAL = String(PENDING_EXPORT_CLEANUP_REPORT_BOUND).replace(/\B(?=(?:\d{3})+$)/gu, '_');
+/** @internal */
+function renderProductDataRightsFiles(name, pascalName) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return {
+        'data/data-rights-shared.ts': `import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleAuditRecord,
+  createDataLifecyclePseudonymousReference,
+  evaluateDataLifecycleHolds,
+  type DataLifecycleAuditAction,
+  type DataLifecycleEvidenceOutcome,
+  type DataLifecycleRuntimeHoldV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import type { Client as PgClient } from 'pg';
+import {
+  approvalReference,
+  productRecordReference,
+} from './pseudonymous-reference.js';
+import {
+  ${pascalName}DataLifecycleRuntimePolicy,
+} from './runtime-policy.cjs';
+
+export const DATA_RIGHTS_POLICY_VERSION =
+  ${pascalName}DataLifecycleRuntimePolicy.policyVersion;
+export const DATA_RIGHTS_AUDIT_RETENTION_DAYS = 400;
+
+export function canonicalDataRightsNow(now?: string): string {
+  const value = now ?? new Date().toISOString();
+  if (new Date(value).toISOString() !== value) {
+    throw new Error('Data-rights time must be a canonical ISO-8601 timestamp.');
+  }
+  return value;
+}
+
+export function plusDataRightsDays(value: string, days: number): string {
+  const result = new Date(value);
+  result.setUTCDate(result.getUTCDate() + days);
+  return result.toISOString();
+}
+
+export function plusDataRightsHours(value: string, hours: number): string {
+  return new Date(Date.parse(value) + hours * 60 * 60 * 1_000).toISOString();
+}
+
+export function dataRightsSubjectReference(subjectId: string): string {
+  return createDataLifecyclePseudonymousReference({
+    categoryId: 'authorization-subject',
+    slice: '${name}',
+    value: subjectId,
+  });
+}
+
+export function dataRightsCorrelationReference(correlationId: string): string {
+  return createDataLifecyclePseudonymousReference({
+    categoryId: 'correlation',
+    slice: '${name}',
+    value: correlationId,
+  });
+}
+
+export function dataRightsArtifactReference(value: string): string {
+  return createDataLifecyclePseudonymousReference({
+    categoryId: 'subject-export',
+    slice: '${name}',
+    value,
+  });
+}
+
+export function requireDirectHuman(
+  principal: AuthorizationPrincipal,
+): AuthorizationPrincipal {
+  if (
+    principal.actor.type !== 'user' ||
+    principal.subject.type !== 'user' ||
+    principal.authority.mode !== 'direct'
+  ) {
+    throw new Error('Data-rights request requires a direct human principal.');
+  }
+  return principal;
+}
+
+export function requireDirectAdmin(
+  principal: AuthorizationPrincipal,
+): AuthorizationPrincipal {
+  requireDirectHuman(principal);
+  if (principal.kind !== 'admin') {
+    throw new Error('Data-rights administration requires a direct admin.');
+  }
+  return principal;
+}
+
+export function requireExportCleanupAuthority(
+  principal: AuthorizationPrincipal,
+): AuthorizationPrincipal {
+  if (
+    principal.kind === 'agent' &&
+    principal.actor.type === 'service' &&
+    principal.actor.id === '${name}:data-export-cleanup' &&
+    principal.audience === '${name}:data-export-cleanup' &&
+    principal.subject.type === 'service' &&
+    principal.subject.id === '${name}:data-export-cleanup' &&
+    principal.authority.mode === 'machine' &&
+    principal.authority.machineIdentityId ===
+      '${name}:data-export-cleanup' &&
+    principal.scopes.length === 0
+  ) {
+    return principal;
+  }
+  return requireDirectAdmin(principal);
+}
+
+export function effectiveRecordOwner(
+  principal: AuthorizationPrincipal,
+): string {
+  if (principal.authority.mode === 'machine') {
+    throw new Error('Machine authority cannot mutate a subject-owned record.');
+  }
+  return principal.authority.mode === 'delegated'
+    ? principal.authority.delegatedBy.id
+    : principal.actor.id;
+}
+
+export async function loadActiveRecordHolds(
+  client: PgClient,
+  recordId: string,
+  now: string,
+  operation: 'deletion' | 'export',
+): Promise<readonly DataLifecycleRuntimeHoldV1[]> {
+  const scopeRef = productRecordReference(recordId);
+  const result = await client.query<{
+    holdJson: DataLifecycleRuntimeHoldV1;
+  }>(
+    \`SELECT hold_json AS "holdJson"
+     FROM data_lifecycle_holds
+     WHERE category_id = 'product-record'
+       AND scope_ref = $1
+       AND status = 'active'
+     ORDER BY hold_id
+     FOR UPDATE\`,
+    [scopeRef],
+  );
+  const holds = [
+    ...${pascalName}DataLifecycleRuntimePolicy.declaredHolds,
+    ...result.rows.map(({ holdJson }) => holdJson),
+  ];
+  evaluateDataLifecycleHolds({
+    categoryId: 'product-record',
+    holds,
+    now,
+    operation,
+    scopeRef,
+  });
+  return holds;
+}
+
+export async function writeDataRightsAudit(
+  client: PgClient,
+  input: {
+    action: DataLifecycleAuditAction;
+    approvalRequestId?: string;
+    correlationId: string;
+    now: string;
+    outcome: DataLifecycleEvidenceOutcome;
+    principal: AuthorizationPrincipal;
+    purposeCode: string;
+    recordId?: string;
+    resourceReference?: string;
+    summary: string;
+  },
+): Promise<void> {
+  const resourceReference =
+    input.resourceReference ??
+    (input.recordId ? productRecordReference(input.recordId) : undefined);
+  if (!resourceReference) {
+    throw new Error('Data-rights audit requires a resource reference.');
+  }
+  const audit = createDataLifecycleAuditRecord({
+    action: input.action,
+    actorRef: dataRightsSubjectReference(input.principal.actor.id),
+    authorityCode: input.principal.authority.mode,
+    correlationRef: dataRightsCorrelationReference(input.correlationId),
+    outcome: input.outcome,
+    policyVersion: DATA_RIGHTS_POLICY_VERSION,
+    purposeCode: input.purposeCode,
+    summary: input.summary,
+    targetCategoryId: 'product-record',
+    timestamp: input.now,
+  });
+  await client.query(
+    \`INSERT INTO data_lifecycle_audit
+       (action, actor_ref, approval_reference, audit_json, authority_code,
+        correlation_ref, expires_at, outcome, policy_version, principal_kind,
+        purpose_code, resource_reference, slice, stage, subject_type,
+        target_category_id, occurred_at)
+     VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8, $9, $10, $11, $12,
+             $13, $14, $15, $16, $17)\`,
+    [
+      audit.action,
+      audit.actorRef,
+      input.approvalRequestId
+        ? approvalReference(input.approvalRequestId)
+        : null,
+      JSON.stringify(audit),
+      audit.authorityCode,
+      audit.correlationRef,
+      plusDataRightsDays(input.now, DATA_RIGHTS_AUDIT_RETENTION_DAYS),
+      audit.outcome,
+      audit.policyVersion,
+      input.principal.kind,
+      audit.purposeCode,
+      resourceReference,
+      '${name}',
+      process.env.EBK_STAGE ?? 'development',
+      input.principal.actor.type,
+      audit.targetCategoryId,
+      audit.timestamp,
+    ],
+  );
+}
+`,
+        'data/record-holds.ts': `import { randomUUID } from 'node:crypto';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import {
+  evaluateDataLifecycleHolds,
+  type DataLifecycleRuntimeHoldEffect,
+  type DataLifecycleRuntimeHoldPurpose,
+  type DataLifecycleRuntimeHoldV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { productRecordReference } from './pseudonymous-reference.js';
+import {
+  canonicalDataRightsNow,
+  requireDirectAdmin,
+  writeDataRightsAudit,
+} from './data-rights-shared.js';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+
+const MAXIMUM_HOLD_LIFETIME_MS = 90 * 24 * 60 * 60 * 1_000;
+
+function holdId(): string {
+  return 'hold.' + randomUUID().replaceAll('-', '');
+}
+
+function requireBoundedHoldInterval(
+  startsAt: string,
+  reviewAt: string,
+  expiresAt: string,
+): void {
+  const start = Date.parse(startsAt);
+  const review = Date.parse(reviewAt);
+  const expiry = Date.parse(expiresAt);
+  if (
+    !Number.isFinite(start) ||
+    !Number.isFinite(review) ||
+    !Number.isFinite(expiry) ||
+    start >= review ||
+    review > expiry ||
+    expiry - start > MAXIMUM_HOLD_LIFETIME_MS
+  ) {
+    throw new Error(
+      'Record hold requires a future review and a lifetime of at most 90 days.',
+    );
+  }
+}
+
+export function createRecordHold(
+  input: {
+    effects: readonly DataLifecycleRuntimeHoldEffect[];
+    expiresAt: string;
+    principal: AuthorizationPrincipal;
+    purpose: DataLifecycleRuntimeHoldPurpose;
+    recordId: string;
+    reviewAt: string;
+  },
+  now = canonicalDataRightsNow(),
+): DataLifecycleRuntimeHoldV1 {
+  requireDirectAdmin(input.principal);
+  requireBoundedHoldInterval(now, input.reviewAt, input.expiresAt);
+  const hold: DataLifecycleRuntimeHoldV1 = {
+    categoryId: 'product-record',
+    effects: [...input.effects],
+    expiresAt: input.expiresAt,
+    holdId: holdId(),
+    issuerCode: 'direct-admin',
+    purpose: input.purpose,
+    reviewAt: input.reviewAt,
+    scopeRef: productRecordReference(input.recordId),
+    startsAt: now,
+    status: 'active',
+  };
+  for (const operation of ['deletion', 'export'] as const) {
+    evaluateDataLifecycleHolds({
+      categoryId: hold.categoryId,
+      holds: [hold],
+      now,
+      operation,
+      scopeRef: hold.scopeRef,
+    });
+  }
+  return hold;
+}
+
+export async function issueRecordHold(input: {
+  correlationId: string;
+  effects: readonly DataLifecycleRuntimeHoldEffect[];
+  expiresAt: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  purpose: DataLifecycleRuntimeHoldPurpose;
+  recordId: string;
+  reviewAt: string;
+}): Promise<DataLifecycleRuntimeHoldV1> {
+  const now = canonicalDataRightsNow(input.now);
+  const hold = createRecordHold(input, now);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const record = await client.query(
+          'SELECT 1 FROM records WHERE id = $1::uuid FOR UPDATE',
+          [input.recordId],
+        );
+        if (record.rowCount !== 1) {
+          throw new Error('The held record was not found.');
+        }
+        await client.query(
+          \`INSERT INTO data_lifecycle_holds
+             (hold_id, scope_ref, category_id, hold_json, status, expires_at,
+              review_at)
+           VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7)\`,
+          [
+            hold.holdId,
+            hold.scopeRef,
+            hold.categoryId,
+            JSON.stringify(hold),
+            hold.status,
+            hold.expiresAt,
+            hold.reviewAt,
+          ],
+        );
+        await writeDataRightsAudit(client, {
+          action: 'hold',
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'hold-issue',
+          recordId: input.recordId,
+          summary: 'A bounded record hold was issued.',
+        });
+        await client.query('COMMIT');
+        return hold;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+async function lockedRecordHold(
+  client: import('pg').Client,
+  recordId: string,
+  holdIdValue: string,
+): Promise<DataLifecycleRuntimeHoldV1> {
+  const result = await client.query<{
+    holdJson: DataLifecycleRuntimeHoldV1;
+  }>(
+    \`SELECT hold_json AS "holdJson"
+     FROM data_lifecycle_holds
+     WHERE hold_id = $1
+       AND category_id = 'product-record'
+       AND scope_ref = $2
+     FOR UPDATE\`,
+    [holdIdValue, productRecordReference(recordId)],
+  );
+  const hold = result.rows[0]?.holdJson;
+  if (!hold) throw new Error('The record hold was not found.');
+  return hold;
+}
+
+async function persistRecordHold(
+  client: import('pg').Client,
+  hold: DataLifecycleRuntimeHoldV1,
+): Promise<void> {
+  const result = await client.query(
+    \`UPDATE data_lifecycle_holds
+     SET hold_json = $2::jsonb,
+         status = $3,
+         expires_at = $4,
+         review_at = $5
+     WHERE hold_id = $1\`,
+    [
+      hold.holdId,
+      JSON.stringify(hold),
+      hold.status,
+      hold.expiresAt,
+      hold.reviewAt,
+    ],
+  );
+  if (result.rowCount !== 1) throw new Error('Record hold update was lost.');
+}
+
+export async function reviewRecordHold(input: {
+  correlationId: string;
+  expiresAt: string;
+  holdId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+  reviewAt: string;
+}): Promise<DataLifecycleRuntimeHoldV1> {
+  requireDirectAdmin(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const current = await lockedRecordHold(
+          client,
+          input.recordId,
+          input.holdId,
+        );
+        if (
+          current.status !== 'active' ||
+          Date.parse(now) >= Date.parse(current.expiresAt)
+        ) {
+          throw new Error('Only an unexpired active hold can be reviewed.');
+        }
+        requireBoundedHoldInterval(
+          current.startsAt,
+          input.reviewAt,
+          input.expiresAt,
+        );
+        if (Date.parse(input.reviewAt) <= Date.parse(now)) {
+          throw new Error('Reviewed hold must set a future review time.');
+        }
+        const hold: DataLifecycleRuntimeHoldV1 = {
+          ...current,
+          expiresAt: input.expiresAt,
+          reviewAt: input.reviewAt,
+        };
+        evaluateDataLifecycleHolds({
+          categoryId: hold.categoryId,
+          holds: [hold],
+          now,
+          operation: 'export',
+          scopeRef: hold.scopeRef,
+        });
+        await persistRecordHold(client, hold);
+        await writeDataRightsAudit(client, {
+          action: 'hold',
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'hold-review',
+          recordId: input.recordId,
+          summary: 'A bounded record hold was reviewed.',
+        });
+        await client.query('COMMIT');
+        return hold;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function releaseRecordHold(input: {
+  correlationId: string;
+  holdId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<DataLifecycleRuntimeHoldV1> {
+  requireDirectAdmin(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const current = await lockedRecordHold(
+          client,
+          input.recordId,
+          input.holdId,
+        );
+        if (
+          current.status !== 'active' ||
+          Date.parse(now) > Date.parse(current.expiresAt)
+        ) {
+          throw new Error('Only an active record hold can be released.');
+        }
+        const hold: DataLifecycleRuntimeHoldV1 = {
+          ...current,
+          releasedAt: now,
+          status: 'released',
+        };
+        evaluateDataLifecycleHolds({
+          categoryId: hold.categoryId,
+          holds: [hold],
+          now,
+          operation: 'export',
+          scopeRef: hold.scopeRef,
+        });
+        await persistRecordHold(client, hold);
+        await writeDataRightsAudit(client, {
+          action: 'hold',
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'hold-release',
+          recordId: input.recordId,
+          summary: 'A bounded record hold was released.',
+        });
+        await client.query('COMMIT');
+        return hold;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function expireRecordHold(input: {
+  correlationId: string;
+  holdId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<DataLifecycleRuntimeHoldV1> {
+  requireDirectAdmin(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const current = await lockedRecordHold(
+          client,
+          input.recordId,
+          input.holdId,
+        );
+        if (
+          current.status !== 'active' ||
+          Date.parse(now) < Date.parse(current.expiresAt)
+        ) {
+          throw new Error('Record hold is not due for expiry.');
+        }
+        const hold: DataLifecycleRuntimeHoldV1 = {
+          ...current,
+          releasedAt: current.expiresAt,
+          status: 'released',
+        };
+        evaluateDataLifecycleHolds({
+          categoryId: hold.categoryId,
+          holds: [hold],
+          now,
+          operation: 'export',
+          scopeRef: hold.scopeRef,
+        });
+        await persistRecordHold(client, hold);
+        await writeDataRightsAudit(client, {
+          action: 'hold',
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'hold-expiry',
+          recordId: input.recordId,
+          summary: 'An expired record hold was closed.',
+        });
+        await client.query('COMMIT');
+        return hold;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+`,
+        'data/record-correction.ts': `import {
+  EventBridgeClient,
+  PutEventsCommand,
+  type PutEventsRequestEntry,
+} from '@aws-sdk/client-eventbridge';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleLedgerEntry,
+  lifecycleIdempotencyKey,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import { buildEventEntry } from '@empire-builder-kit/runtime/events';
+import {
+  ${pascalName}DataLifecycleChanged,
+} from '../contracts/events.js';
+import {
+  create${pascalName}DataLifecycleChanged,
+} from './lifecycle-event.js';
+import { productRecordReference } from './pseudonymous-reference.js';
+import {
+  canonicalDataRightsNow,
+  DATA_RIGHTS_POLICY_VERSION,
+  effectiveRecordOwner,
+  plusDataRightsDays,
+  writeDataRightsAudit,
+} from './data-rights-shared.js';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+
+const eventBridge = new EventBridgeClient({});
+
+export interface RecordCorrectionInput {
+  correlationId: string;
+  name: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+  runScope: string;
+  testExpiresAt?: string;
+}
+
+export function createRecordCorrectionArtifacts(input: RecordCorrectionInput) {
+  const now = canonicalDataRightsNow(input.now);
+  const recordRef = productRecordReference(input.recordId);
+  const requestRef = lifecycleIdempotencyKey('record-correction', [
+    recordRef,
+    input.correlationId,
+    input.name,
+    input.runScope,
+    input.testExpiresAt ?? 'none',
+  ]);
+  const ledger = createDataLifecycleLedgerEntry({
+    action: 'correction',
+    categoryId: 'product-record',
+    effectiveAt: now,
+    expiresAt: plusDataRightsDays(now, 400),
+    policyVersion: DATA_RIGHTS_POLICY_VERSION,
+    pseudonymousKey: recordRef,
+  });
+  const data = create${pascalName}DataLifecycleChanged({
+    action: 'correction',
+    occurredAt: now,
+    policyVersion: DATA_RIGHTS_POLICY_VERSION,
+    recordId: input.recordId,
+    requestRef,
+  });
+  const built = buildEventEntry(${pascalName}DataLifecycleChanged, data, {
+    busName: process.env.EVENT_BUS_NAME ?? '',
+    context: { correlationId: input.correlationId },
+    eventId: requestRef,
+    occurredAt: now,
+    stage: process.env.EBK_STAGE ?? 'development',
+  });
+  const event: PutEventsRequestEntry = {
+    Detail: built.entry.detail,
+    DetailType: built.entry.detailType,
+    EventBusName: built.entry.eventBusName,
+    Source: built.entry.source,
+  };
+  return { event, ledger, now, recordRef, requestRef };
+}
+
+export async function correctRecordWithLifecycle(
+  input: RecordCorrectionInput,
+): Promise<{
+  id: string;
+  name: string;
+  propagation: 'pending';
+  requestRef: string;
+  runScope: string;
+}> {
+  const artifacts = createRecordCorrectionArtifacts(input);
+  const ownerId = effectiveRecordOwner(input.principal);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const recorded = await client.query(
+          \`INSERT INTO data_lifecycle_ledger
+             (entry_id, action, category_id, effective_at, expires_at,
+              idempotency_key, policy_version, pseudonymous_key)
+           VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+           ON CONFLICT (idempotency_key) DO NOTHING
+           RETURNING entry_id\`,
+          [
+            artifacts.ledger.entryId,
+            artifacts.ledger.action,
+            artifacts.ledger.categoryId,
+            artifacts.ledger.effectiveAt,
+            artifacts.ledger.expiresAt,
+            artifacts.requestRef,
+            artifacts.ledger.policyVersion,
+            artifacts.ledger.pseudonymousKey,
+          ],
+        );
+        const result =
+          recorded.rowCount === 1
+            ? await client.query<{
+                id: string;
+                name: string;
+                runScope: string;
+              }>(
+                \`UPDATE records
+               SET name = $2,
+                   run_scope = $3,
+                   last_activity_at = $4,
+                   test_expires_at =
+                     CASE WHEN $5::boolean
+                       THEN $6::timestamptz
+                       ELSE test_expires_at
+                     END
+               WHERE id = $1::uuid AND owner_id = $7
+               RETURNING id::text, name, run_scope AS "runScope"\`,
+                [
+                  input.recordId,
+                  input.name,
+                  input.runScope,
+                  artifacts.now,
+                  input.testExpiresAt !== undefined,
+                  input.testExpiresAt ?? null,
+                  ownerId,
+                ],
+              )
+            : await client.query<{
+                id: string;
+                name: string;
+                runScope: string;
+              }>(
+                \`SELECT id::text, name, run_scope AS "runScope"
+               FROM records
+               WHERE id = $1::uuid AND owner_id = $2\`,
+                [input.recordId, ownerId],
+              );
+        const record = result.rows[0];
+        if (!record) {
+          throw new Error('The correction target was not found.');
+        }
+        await client.query(
+          \`INSERT INTO data_lifecycle_outbox
+             (idempotency_key, event_json, expires_at)
+           VALUES ($1, $2::jsonb, $3)
+           ON CONFLICT (idempotency_key) DO NOTHING\`,
+          [
+            artifacts.requestRef,
+            JSON.stringify(artifacts.event),
+            plusDataRightsDays(artifacts.now, 30),
+          ],
+        );
+        if (recorded.rowCount === 1) {
+          await writeDataRightsAudit(client, {
+            action: 'correction',
+            correlationId: input.correlationId,
+            now: artifacts.now,
+            outcome: 'succeeded',
+            principal: input.principal,
+            purposeCode: 'record-correction',
+            recordId: input.recordId,
+            summary:
+              'A record correction and its downstream event were committed.',
+          });
+        }
+        await client.query('COMMIT');
+        return {
+          ...record,
+          propagation: 'pending' as const,
+          requestRef: artifacts.requestRef,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function publishRecordCorrection(
+  correlationId: string,
+  requestRef: string,
+): Promise<'published' | 'retry-required'> {
+  const pending = await withPrimaryDatabase(
+    { correlationId },
+    'api-database-records',
+    (client) =>
+      client.query<{ eventJson: PutEventsRequestEntry; publishedAt: Date | null }>(
+        \`SELECT event_json AS "eventJson", published_at AS "publishedAt"
+         FROM data_lifecycle_outbox
+         WHERE idempotency_key = $1\`,
+        [requestRef],
+      ),
+  );
+  const row = pending.rows[0];
+  if (!row) throw new Error('The correction outbox record was not found.');
+  if (row.publishedAt) return 'published';
+  try {
+    const response = await eventBridge.send(
+      new PutEventsCommand({ Entries: [row.eventJson] }),
+    );
+    if ((response.FailedEntryCount ?? 0) !== 0) {
+      throw new Error('event-entry-rejected');
+    }
+    await withPrimaryDatabase(
+      { correlationId },
+      'api-database-records',
+      (client) =>
+        client.query(
+          \`UPDATE data_lifecycle_outbox
+           SET attempts = attempts + 1,
+               last_error_code = NULL,
+               published_at = now()
+           WHERE idempotency_key = $1 AND published_at IS NULL\`,
+          [requestRef],
+        ),
+    );
+    return 'published';
+  } catch {
+    await withPrimaryDatabase(
+      { correlationId },
+      'api-database-records',
+      (client) =>
+        client.query(
+          \`UPDATE data_lifecycle_outbox
+           SET attempts = attempts + 1,
+               last_error_code = 'event-publication-failed'
+           WHERE idempotency_key = $1 AND published_at IS NULL\`,
+          [requestRef],
+        ),
+    );
+    return 'retry-required';
+  }
+}
+`,
+        'data/record-export.ts': renderRecordExportSource(name, pascalName),
+        'integration/data-rights-deadline-lock-order.spec.ts': renderDataRightsDeadlineLockOrderIntegrationSource(name),
+        'jobs/data-export-cleanup.ts': `import { randomUUID } from 'node:crypto';
+import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import {
+  createMetricEmitter,
+  type MetricEmitter,
+} from '@empire-builder-kit/runtime/observability';
+import {
+  ${identifierPrefix}AuthorizationActions,
+} from '../authorization/policy.js';
+import { authorize${pascalName}InternalOperation } from '../authorization/runtime.js';
+import {
+  cleanupDueRecordExports,
+  reportExportCleanupDeadlineBreaches,
+} from '../data/record-export.js';
+
+const WORKLOAD_IDENTITY = '${name}:data-export-cleanup';
+const MINIMUM_REMAINING_TIME_MS = 30_000;
+
+export interface DataExportCleanupDependencies {
+  authorize: typeof authorize${pascalName}InternalOperation;
+  cleanup: typeof cleanupDueRecordExports;
+  metrics: MetricEmitter;
+  report: typeof reportExportCleanupDeadlineBreaches;
+}
+
+function cleanupPrincipal(): AuthorizationPrincipal {
+  const configured = process.env.EBK_WORKLOAD_IDENTITY ?? '';
+  if (configured !== WORKLOAD_IDENTITY) {
+    throw new Error('Data export cleanup workload identity is invalid.');
+  }
+  return {
+    actor: { id: configured, type: 'service' },
+    audience: configured,
+    authority: { machineIdentityId: configured, mode: 'machine' },
+    kind: 'agent',
+    roles: [],
+    scopes: [],
+    subject: { id: configured, type: 'service' },
+  };
+}
+
+function emitCleanupDeadlineBreaches(
+  metrics: MetricEmitter,
+  value: number,
+) {
+  return metrics.emit({
+    dimensions: {
+      component: 'data-export-cleanup',
+      feature: 'data-lifecycle',
+      operation: 'expiry-cleanup',
+      slice: '${name}',
+      stage: process.env.EBK_STAGE ?? 'local',
+    },
+    metricName: 'DataExportCleanupDeadlineBreaches',
+    namespace: 'EBK/DataLifecycle',
+    unit: 'Count',
+    value,
+  });
+}
+
+export function createDataExportCleanupHandler(
+  dependencies: DataExportCleanupDependencies,
+) {
+  return async (
+    event: { id?: string } = {},
+    context: { getRemainingTimeInMillis(): number },
+  ) => {
+    const correlationId = event.id ?? randomUUID();
+    const principal = cleanupPrincipal();
+    await dependencies.authorize({
+      action: ${identifierPrefix}AuthorizationActions.dataExportCleanup,
+      correlationId,
+      operationId: '${name}.cleanup-due-record-exports',
+      workloadIdentity: principal.actor.id,
+    });
+    let reportedDeadlineBreaches = 0;
+    let reportContinuationRequired = false;
+    let reportFailure: unknown;
+    const reportPendingBreaches = async () => {
+      try {
+        const reported = await dependencies.report({
+          correlationId,
+          report: (value) =>
+            emitCleanupDeadlineBreaches(dependencies.metrics, value) !==
+            undefined,
+        });
+        reportedDeadlineBreaches += reported.reported;
+        reportContinuationRequired ||= reported.continuationRequired;
+      } catch (error) {
+        reportFailure ??= error;
+      }
+    };
+    await reportPendingBreaches();
+    let result: Awaited<ReturnType<typeof cleanupDueRecordExports>> | undefined;
+    let cleanupFailure: unknown;
+    try {
+      result = await dependencies.cleanup({
+        correlationId,
+        maximumBatches: 1,
+        principal,
+        shouldContinue: () =>
+          context.getRemainingTimeInMillis() > MINIMUM_REMAINING_TIME_MS,
+      });
+    } catch (error) {
+      cleanupFailure = error;
+    }
+    await reportPendingBreaches();
+    if (reportFailure !== undefined) {
+      throw reportFailure;
+    }
+    if (reportedDeadlineBreaches > 0 || reportContinuationRequired) {
+      throw new Error('confidential-export-cleanup-deadline-breached');
+    }
+    if (cleanupFailure !== undefined) {
+      throw cleanupFailure;
+    }
+    if (!result) {
+      throw new Error('Confidential export cleanup returned no result.');
+    }
+    if (result.continuationRequired) {
+      throw new Error(
+        'Confidential export cleanup requires scheduled retry continuation.',
+      );
+    }
+    return result;
+  };
+}
+
+export const handler = createDataExportCleanupHandler({
+  authorize: authorize${pascalName}InternalOperation,
+  cleanup: cleanupDueRecordExports,
+  metrics: createMetricEmitter(),
+  report: reportExportCleanupDeadlineBreaches,
+});
+`,
+        'testing/data-rights-workflows.spec.ts': renderDataRightsTestSource(name, pascalName),
+    };
+}
+function renderRecordExportSource(name, pascalName) {
+    const identifierPrefix = (0, built_in_plan_shared_js_1.lowerCamelIdentifier)(pascalName);
+    return `import {
+  DeleteObjectsCommand,
+  GetObjectCommand,
+  HeadObjectCommand,
+  ListObjectVersionsCommand,
+  PutObjectCommand,
+  S3Client,
+} from '@aws-sdk/client-s3';
+import {
+  assertAuthorizationAllowed,
+  beginApprovalExecution,
+  completeApprovalExecution,
+  createApprovalRequest,
+  decideApprovalRequest,
+  type ApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  createDataLifecycleExportRequest,
+  evaluateDataLifecycleHolds,
+  transitionDataLifecycleExport,
+  type DataLifecycleExportRequestV1,
+} from '@empire-builder-kit/runtime/data-lifecycle';
+import type { Client as PgClient } from 'pg';
+import {
+  ${identifierPrefix}AuthorizationPolicy,
+  type ${pascalName}AuthorizationAction,
+} from '../authorization/policy.js';
+import {
+  approvalReference,
+  productRecordReference,
+} from './pseudonymous-reference.js';
+import {
+  canonicalDataRightsNow,
+  DATA_RIGHTS_POLICY_VERSION,
+  dataRightsArtifactReference,
+  dataRightsSubjectReference,
+  loadActiveRecordHolds,
+  plusDataRightsHours,
+  requireDirectAdmin,
+  requireExportCleanupAuthority,
+  requireDirectHuman,
+  writeDataRightsAudit,
+} from './data-rights-shared.js';
+import { withPrimaryDatabase } from '../database/runtime-client.js';
+
+const EXPORT_ACTION = '${name}:record-export' as ${pascalName}AuthorizationAction;
+const EXPORT_SOURCE_COPY = 'primary-database';
+const CONFIDENTIAL_EXPORT_CLEANUP_FEATURE =
+  'confidential-export';
+const DEFAULT_EXPORT_CLEANUP_PAGE_SIZE = 25;
+const DEFAULT_EXPORT_CLEANUP_REPORT_PAGE_SIZE = 100;
+const MAXIMUM_PENDING_EXPORT_CLEANUP_REPORTS = ${PENDING_EXPORT_CLEANUP_REPORT_BOUND_LITERAL};
+const MAXIMUM_EXPORTS_PER_SUBJECT_PER_DAY = 5;
+const MAXIMUM_OUTSTANDING_CONFIDENTIAL_EXPORTS = 20;
+const APPROVAL_POLICY_VERSION =
+  ${identifierPrefix}AuthorizationPolicy.version;
+const s3 = new S3Client({});
+
+if (
+  MAXIMUM_OUTSTANDING_CONFIDENTIAL_EXPORTS >=
+  DEFAULT_EXPORT_CLEANUP_PAGE_SIZE
+) {
+  throw new Error(
+    'The global confidential-export bound must fit inside one cleanup page.',
+  );
+}
+
+export interface RecordExportObjectStore {
+  send(command: unknown): Promise<unknown>;
+}
+
+const defaultRecordExportObjectStore: RecordExportObjectStore = {
+  send: (command) => s3.send(command as never),
+};
+
+type ProductApproval = ApprovalRequest<${pascalName}AuthorizationAction>;
+
+interface ExportWorkflow {
+  approval: ProductApproval;
+  artifactRef: string | null;
+  cleanupDeadlineAt: Date | null;
+  cleanupState: string;
+  currentVersionId: string | null;
+  expiresAt: Date | null;
+  lifecycle: DataLifecycleExportRequestV1;
+  objectKey: string;
+  recordRef: string;
+  subjectRef: string;
+  uploadStartedAt: Date | null;
+}
+
+function exportCommand(recordId: string) {
+  return {
+    format: 'application/json',
+    recordRef: productRecordReference(recordId),
+  };
+}
+
+export function recordExportObjectKey(approvalRequestId: string): string {
+  if (!/^[0-9a-f-]{36}$/i.test(approvalRequestId)) {
+    throw new Error('Export object key requires an approval UUID.');
+  }
+  return 'confidential-exports/' + approvalRequestId + '/record.json';
+}
+
+export function recordExportExpiresAt(now: string): string {
+  // Leave bounded intervals for the hourly scan, EventBridge delivery retry,
+  // and Lambda asynchronous execution retry inside the 24-hour maximum.
+  // The S3 lifecycle rule remains defense in depth, not the deadline.
+  return plusDataRightsHours(canonicalDataRightsNow(now), 21);
+}
+
+export function recordExportCleanupDeadlineAt(now: string): string {
+  return plusDataRightsHours(canonicalDataRightsNow(now), 24);
+}
+
+export function recordExportSchedule(
+  uploadStartedAt: string,
+  persisted: {
+    cleanupDeadlineAt?: string | null;
+    expiresAt?: string | null;
+    uploadStartedAt?: string | null;
+  } = {},
+): {
+  cleanupDeadlineAt: string;
+  expiresAt: string;
+  uploadStartedAt: string;
+} {
+  const persistedScheduleProvided =
+    persisted.uploadStartedAt != null ||
+    persisted.expiresAt != null ||
+    persisted.cleanupDeadlineAt != null;
+  if (
+    persistedScheduleProvided &&
+    (typeof persisted.uploadStartedAt !== 'string' ||
+      typeof persisted.expiresAt !== 'string' ||
+      typeof persisted.cleanupDeadlineAt !== 'string')
+  ) {
+    throw new Error(
+      'Persisted confidential-export cleanup schedule is incomplete.',
+    );
+  }
+  uploadStartedAt = canonicalDataRightsNow(
+    persisted.uploadStartedAt ?? uploadStartedAt,
+  );
+  const expectedExpiresAt = recordExportExpiresAt(uploadStartedAt);
+  const expectedCleanupDeadlineAt =
+    recordExportCleanupDeadlineAt(uploadStartedAt);
+  const expiresAt = persisted.expiresAt ?? expectedExpiresAt;
+  const cleanupDeadlineAt =
+    persisted.cleanupDeadlineAt ?? expectedCleanupDeadlineAt;
+  if (
+    expiresAt !== expectedExpiresAt ||
+    cleanupDeadlineAt !== expectedCleanupDeadlineAt
+  ) {
+    throw new Error(
+      'Persisted confidential-export cleanup schedule is inconsistent.',
+    );
+  }
+  return { cleanupDeadlineAt, expiresAt, uploadStartedAt };
+}
+
+function exactRecordExportSchedule(
+  workflow: ExportWorkflow,
+  fallbackUploadStartedAt: string,
+): ReturnType<typeof recordExportSchedule> {
+  return recordExportSchedule(
+    fallbackUploadStartedAt,
+    {
+      cleanupDeadlineAt: workflow.cleanupDeadlineAt?.toISOString() ?? null,
+      expiresAt: workflow.expiresAt?.toISOString() ?? null,
+      uploadStartedAt: workflow.uploadStartedAt?.toISOString() ?? null,
+    },
+  );
+}
+
+function exportResources(): { bucketName: string; kmsKeyArn: string } {
+  const bucketName = process.env.DATA_EXPORT_BUCKET_NAME?.trim();
+  const kmsKeyArn = process.env.DATA_EXPORT_KMS_KEY_ARN?.trim();
+  if (!bucketName || !kmsKeyArn || !kmsKeyArn.startsWith('arn:aws:kms:')) {
+    throw new Error(
+      'Confidential export requires linked DATA_EXPORT_BUCKET_NAME and DATA_EXPORT_KMS_KEY_ARN.',
+    );
+  }
+  return { bucketName, kmsKeyArn };
+}
+
+async function loadExportWorkflow(
+  client: PgClient,
+  approvalRequestId: string,
+): Promise<ExportWorkflow | undefined> {
+  const result = await client.query<ExportWorkflow>(
+    \`SELECT a.request_json AS approval,
+            d.request_json AS lifecycle,
+            e.artifact_ref AS "artifactRef",
+            e.cleanup_deadline_at AS "cleanupDeadlineAt",
+            e.cleanup_state AS "cleanupState",
+            e.current_version_id AS "currentVersionId",
+            e.expires_at AS "expiresAt",
+            e.object_key AS "objectKey",
+            e.record_ref AS "recordRef",
+            e.subject_ref AS "subjectRef",
+            e.upload_started_at AS "uploadStartedAt"
+     FROM approval_requests a
+     JOIN data_lifecycle_requests d
+       ON d.approval_request_id = a.id
+     JOIN data_lifecycle_export_artifacts e
+       ON e.approval_request_id = a.id
+     WHERE a.id = $1::uuid
+     FOR UPDATE OF a, d, e\`,
+    [approvalRequestId],
+  );
+  return result.rows[0];
+}
+
+async function persistApproval(
+  client: PgClient,
+  previousRevision: number,
+  approval: ProductApproval,
+): Promise<void> {
+  const result = await client.query(
+    \`UPDATE approval_requests
+     SET expires_at = $3,
+         policy_version = $4,
+         request_digest = $5,
+         request_json = $6::jsonb,
+         revision = $7,
+         status = $8
+     WHERE id = $1::uuid AND revision = $2\`,
+    [
+      approval.id,
+      previousRevision,
+      approval.expiresAt,
+      approval.policyVersion,
+      approval.requestDigest,
+      JSON.stringify(approval),
+      approval.revision,
+      approval.status,
+    ],
+  );
+  if (result.rowCount !== 1) throw new Error('Approval compare-and-set failed.');
+}
+
+async function persistExportState(
+  client: PgClient,
+  approvalRequestId: string,
+  state: DataLifecycleExportRequestV1,
+): Promise<void> {
+  const result = await client.query(
+    \`UPDATE data_lifecycle_requests
+     SET request_json = $2::jsonb,
+         revision = revision + 1,
+         status = $3,
+         updated_at = $4
+     WHERE approval_request_id = $1::uuid\`,
+    [
+      approvalRequestId,
+      JSON.stringify(state),
+      state.status,
+      state.updatedAt,
+    ],
+  );
+  if (result.rowCount !== 1) {
+    throw new Error('Export lifecycle compare-and-set failed.');
+  }
+}
+
+export async function requestAuthorizedRecordExport(input: {
+  correlationId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<{
+  approvalRequestId: string;
+  expiresAt: string;
+  requestDigest: string;
+  status: 'pending';
+}> {
+  requireDirectHuman(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  const recordRef = productRecordReference(input.recordId);
+  const subjectRef = dataRightsSubjectReference(input.principal.actor.id);
+  const approval = createApprovalRequest<${pascalName}AuthorizationAction>({
+    action: EXPORT_ACTION,
+    author: input.principal,
+    command: exportCommand(input.recordId),
+    expiresAt: plusDataRightsHours(now, 1),
+    now,
+    policyVersion: APPROVAL_POLICY_VERSION,
+    resource: { id: recordRef, type: 'record' },
+    slice: '${name}',
+  });
+  const lifecycle = createDataLifecycleExportRequest({
+    approvalRequirement: 'required',
+    categoryId: 'product-record',
+    createdAt: now,
+    policyVersion: DATA_RIGHTS_POLICY_VERSION,
+    requestRef: approvalReference(approval.id),
+    scopeRef: recordRef,
+    sourceCopyIds: [EXPORT_SOURCE_COPY],
+  });
+  await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        await client.query(
+          \`SELECT pg_advisory_xact_lock(
+             hashtextextended('data-export-outstanding', 0)
+           )\`,
+        );
+        await client.query(
+          \`SELECT pg_advisory_xact_lock(
+             hashtextextended('data-export-rate:' || $1, 0)
+           )\`,
+          [subjectRef],
+        );
+        const record = await client.query(
+          \`SELECT 1
+           FROM records
+           WHERE id = $1::uuid AND owner_id = $2
+           FOR UPDATE\`,
+          [input.recordId, input.principal.actor.id],
+        );
+        if (record.rowCount !== 1) {
+          throw new Error('The export target was not found.');
+        }
+        const outstanding = await client.query<{ count: string }>(
+          \`SELECT count(*)::text AS count
+           FROM data_lifecycle_export_artifacts
+           WHERE cleanup_state <> 'completed'\`,
+        );
+        if (
+          Number(outstanding.rows[0]?.count ?? 0) >=
+          MAXIMUM_OUTSTANDING_CONFIDENTIAL_EXPORTS
+        ) {
+          throw new Error(
+            'The bounded global confidential-export capacity was exceeded.',
+          );
+        }
+        const rate = await client.query<{ count: string }>(
+          \`SELECT count(*)::text AS count
+           FROM data_lifecycle_export_artifacts
+           WHERE subject_ref = $1
+             AND created_at >= $2::timestamptz - INTERVAL '24 hours'\`,
+          [subjectRef, now],
+        );
+        if (
+          Number(rate.rows[0]?.count ?? 0) >=
+          MAXIMUM_EXPORTS_PER_SUBJECT_PER_DAY
+        ) {
+          throw new Error('The bounded subject export rate was exceeded.');
+        }
+        await client.query(
+          \`INSERT INTO approval_requests
+             (id, author_reference, expires_at, policy_version,
+              request_digest, request_json, revision, status)
+           VALUES ($1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8)\`,
+          [
+            approval.id,
+            subjectRef,
+            approval.expiresAt,
+            approval.policyVersion,
+            approval.requestDigest,
+            JSON.stringify(approval),
+            approval.revision,
+            approval.status,
+          ],
+        );
+        await client.query(
+          \`INSERT INTO data_lifecycle_requests
+             (id, approval_request_id, request_json, revision, status,
+              updated_at)
+           VALUES (gen_random_uuid(), $1::uuid, $2::jsonb, 0, $3, $4)\`,
+          [approval.id, JSON.stringify(lifecycle), lifecycle.status, now],
+        );
+        await client.query(
+          \`INSERT INTO data_lifecycle_export_artifacts
+             (approval_request_id, cleanup_state, object_key, record_ref,
+              subject_ref, updated_at)
+           VALUES ($1::uuid, 'requested', $2, $3, $4, $5)\`,
+          [
+            approval.id,
+            recordExportObjectKey(approval.id),
+            recordRef,
+            subjectRef,
+            now,
+          ],
+        );
+        await writeDataRightsAudit(client, {
+          action: 'export',
+          approvalRequestId: approval.id,
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'export-request',
+          recordId: input.recordId,
+          summary: 'A subject-scoped confidential export was requested.',
+        });
+        await client.query('COMMIT');
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+  return {
+    approvalRequestId: approval.id,
+    expiresAt: approval.expiresAt,
+    requestDigest: approval.requestDigest,
+    status: 'pending',
+  };
+}
+
+export async function decideRecordExport(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  expectedRequestDigest: string;
+  now?: string;
+  outcome: 'approved' | 'rejected';
+  principal: AuthorizationPrincipal;
+  reasonReference: string;
+  recordId: string;
+}): Promise<{ status: 'approved' | 'rejected' }> {
+  requireDirectAdmin(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  const status = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadExportWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        if (
+          !workflow ||
+          workflow.approval.action !== EXPORT_ACTION ||
+          workflow.recordRef !== productRecordReference(input.recordId)
+        ) {
+          throw new Error('The export approval was not found.');
+        }
+        const transition = decideApprovalRequest(workflow.approval, {
+          approver: input.principal,
+          expectedRequestDigest: input.expectedRequestDigest,
+          now,
+          outcome: input.outcome,
+          reasonReference: input.reasonReference,
+          requiredPolicyVersion: APPROVAL_POLICY_VERSION,
+        });
+        assertAuthorizationAllowed(transition.decision);
+        await persistApproval(
+          client,
+          workflow.approval.revision,
+          transition.request,
+        );
+        if (transition.request.status === 'rejected') {
+          const lifecycle = transitionDataLifecycleExport(
+            workflow.lifecycle,
+            {
+              at: now,
+              reasonCode: 'approval-rejected',
+              type: 'reject',
+            },
+          );
+          await persistExportState(
+            client,
+            input.approvalRequestId,
+            lifecycle,
+          );
+          const artifact = await client.query(
+            \`UPDATE data_lifecycle_export_artifacts
+             SET cleanup_state = 'completed',
+                 last_error_code = NULL,
+                 updated_at = $2
+             WHERE approval_request_id = $1::uuid
+               AND cleanup_state = 'requested'
+               AND upload_started_at IS NULL
+               AND current_version_id IS NULL\`,
+            [input.approvalRequestId, now],
+          );
+          if (artifact.rowCount !== 1) {
+            throw new Error(
+              'Rejected export artifact lost compare-and-set.',
+            );
+          }
+        }
+        await writeDataRightsAudit(client, {
+          action: 'export',
+          approvalRequestId: input.approvalRequestId,
+          correlationId: input.correlationId,
+          now,
+          outcome:
+            transition.request.status === 'approved'
+              ? 'succeeded'
+              : 'rejected',
+          principal: input.principal,
+          purposeCode: 'export-decision',
+          recordId: input.recordId,
+          summary: 'A non-author decided a confidential export request.',
+        });
+        await client.query('COMMIT');
+        return transition.request.status;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+  return { status: status as 'approved' | 'rejected' };
+}
+
+interface PreparedRecordExport {
+  approval: ProductApproval;
+  cleanupDeadlineAt: string;
+  expiresAt: string;
+  lifecycle: DataLifecycleExportRequestV1;
+  objectKey: string;
+  uploadStartedAt: string;
+}
+
+async function prepareRecordExport(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  now: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<PreparedRecordExport | { held: true }> {
+  requireDirectHuman(input.principal);
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadExportWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        if (
+          !workflow ||
+          workflow.approval.action !== EXPORT_ACTION ||
+          workflow.recordRef !== productRecordReference(input.recordId) ||
+          workflow.approval.author.actorId !== input.principal.actor.id
+        ) {
+          throw new Error('The export workflow was not found.');
+        }
+        if (
+          workflow.lifecycle.status === 'ready' &&
+          workflow.approval.status === 'executed'
+        ) {
+          const schedule = exactRecordExportSchedule(workflow, input.now);
+          if (
+            workflow.lifecycle.artifact?.expiresAt !== schedule.expiresAt
+          ) {
+            throw new Error(
+              'Published confidential-export expiry is inconsistent.',
+            );
+          }
+          await client.query('COMMIT');
+          return {
+            approval: workflow.approval,
+            cleanupDeadlineAt: schedule.cleanupDeadlineAt,
+            expiresAt: schedule.expiresAt,
+            lifecycle: workflow.lifecycle,
+            objectKey: workflow.objectKey,
+            uploadStartedAt: schedule.uploadStartedAt,
+          };
+        }
+        const record = await client.query(
+          \`SELECT 1
+           FROM records
+           WHERE id = $1::uuid AND owner_id = $2
+           FOR UPDATE\`,
+          [input.recordId, workflow.approval.author.actorId],
+        );
+        if (record.rowCount !== 1) {
+          throw new Error('The export target was not found.');
+        }
+        let lifecycle = workflow.lifecycle;
+        if (lifecycle.status === 'requested' || lifecycle.status === 'held') {
+          const holds = await loadActiveRecordHolds(
+            client,
+            input.recordId,
+            input.now,
+            'export',
+          );
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            approvalRef: approvalReference(input.approvalRequestId),
+            at: input.now,
+            authorityRef: dataRightsSubjectReference(
+              input.principal.actor.id,
+            ),
+            holds,
+            type: 'verify',
+          });
+          await persistExportState(
+            client,
+            input.approvalRequestId,
+            lifecycle,
+          );
+          if (lifecycle.status === 'held') {
+            await writeDataRightsAudit(client, {
+              action: 'export',
+              approvalRequestId: input.approvalRequestId,
+              correlationId: input.correlationId,
+              now: input.now,
+              outcome: 'held',
+              principal: input.principal,
+              purposeCode: 'export-execution',
+              recordId: input.recordId,
+              summary: 'An active record hold blocked confidential export.',
+            });
+            await client.query('COMMIT');
+            return { held: true };
+          }
+        }
+        const executionId = 'export:' + input.approvalRequestId;
+        let approval = workflow.approval;
+        if (approval.status === 'approved') {
+          const begun = beginApprovalExecution(approval, {
+            action: EXPORT_ACTION,
+            command: exportCommand(input.recordId),
+            executionId,
+            now: input.now,
+            requiredPolicyVersion: APPROVAL_POLICY_VERSION,
+            resource: {
+              id: productRecordReference(input.recordId),
+              type: 'record',
+            },
+          });
+          assertAuthorizationAllowed(begun.decision);
+          await persistApproval(client, approval.revision, begun.request);
+          approval = begun.request;
+        } else if (
+          approval.status !== 'executing' ||
+          approval.execution?.executionId !== executionId
+        ) {
+          throw new Error('The exact export approval is not executable.');
+        }
+        if (lifecycle.status === 'verified') {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: input.now,
+            type: 'start-gathering',
+          });
+        }
+        const copy = lifecycle.sourceCopies.find(
+          ({ copyId }) => copyId === EXPORT_SOURCE_COPY,
+        );
+        if (copy?.status === 'pending' || copy?.status === 'failed') {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: input.now,
+            copyId: EXPORT_SOURCE_COPY,
+            type: 'start-copy',
+          });
+        }
+        await persistExportState(
+          client,
+          input.approvalRequestId,
+          lifecycle,
+        );
+        const schedule = exactRecordExportSchedule(workflow, input.now);
+        await client.query(
+          \`UPDATE data_lifecycle_export_artifacts
+           SET cleanup_state = 'gathering',
+               updated_at = $2,
+               upload_started_at = COALESCE(upload_started_at, $2),
+               expires_at = COALESCE(expires_at, $3),
+               cleanup_deadline_at = COALESCE(cleanup_deadline_at, $4)
+           WHERE approval_request_id = $1::uuid\`,
+          [
+            input.approvalRequestId,
+            input.now,
+            schedule.expiresAt,
+            schedule.cleanupDeadlineAt,
+          ],
+        );
+        await client.query('COMMIT');
+        return {
+          approval,
+          cleanupDeadlineAt: schedule.cleanupDeadlineAt,
+          expiresAt: schedule.expiresAt,
+          lifecycle,
+          objectKey: workflow.objectKey,
+          uploadStartedAt: schedule.uploadStartedAt,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function putEncryptedExport(
+  objectKey: string,
+  body: string,
+  objectStore: RecordExportObjectStore = defaultRecordExportObjectStore,
+): Promise<string> {
+  const resources = exportResources();
+  try {
+    const result = (await objectStore.send(
+      new PutObjectCommand({
+        Body: body,
+        Bucket: resources.bucketName,
+        BucketKeyEnabled: true,
+        ContentType: 'application/json',
+        IfNoneMatch: '*',
+        Key: objectKey,
+        ServerSideEncryption: 'aws:kms',
+        SSEKMSKeyId: resources.kmsKeyArn,
+      }),
+    )) as { VersionId?: string };
+    if (!result.VersionId) {
+      throw new Error('Versioned export put returned no version identifier.');
+    }
+    return result.VersionId;
+  } catch (error) {
+    const status = (error as { $metadata?: { httpStatusCode?: number } })
+      .$metadata?.httpStatusCode;
+    if (status !== 412) throw error;
+    const existing = (await objectStore.send(
+      new HeadObjectCommand({
+        Bucket: resources.bucketName,
+        Key: objectKey,
+      }),
+    )) as {
+      SSEKMSKeyId?: string;
+      ServerSideEncryption?: string;
+      VersionId?: string;
+    };
+    if (
+      !existing.VersionId ||
+      existing.ServerSideEncryption !== 'aws:kms' ||
+      existing.SSEKMSKeyId !== resources.kmsKeyArn
+    ) {
+      throw new Error('Existing export object failed encryption validation.');
+    }
+    return existing.VersionId;
+  }
+}
+
+export async function executeApprovedRecordExport(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<
+  | { status: 'held' }
+  | {
+      artifactRef: string;
+      expiresAt: string;
+      status: 'ready';
+    }
+> {
+  const now = canonicalDataRightsNow(input.now);
+  const prepared = await prepareRecordExport({ ...input, now });
+  if ('held' in prepared) return { status: 'held' };
+  if (
+    prepared.lifecycle.status === 'ready' &&
+    prepared.lifecycle.artifact
+  ) {
+    return {
+      artifactRef: prepared.lifecycle.artifact.artifactRef,
+      expiresAt: prepared.lifecycle.artifact.expiresAt,
+      status: 'ready',
+    };
+  }
+  const expiresAt = prepared.expiresAt;
+  if (Date.parse(expiresAt) <= Date.parse(now)) {
+    throw new Error(
+      'The confidential export expired before durable publication.',
+    );
+  }
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadExportWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        if (
+          !workflow ||
+          workflow.approval.status !== 'executing' ||
+          workflow.approval.execution?.executionId !==
+            'export:' + input.approvalRequestId ||
+          workflow.lifecycle.status !== 'gathering' ||
+          workflow.cleanupState !== 'gathering' ||
+          workflow.expiresAt?.toISOString() !== expiresAt ||
+          workflow.cleanupDeadlineAt?.toISOString() !==
+            prepared.cleanupDeadlineAt
+        ) {
+          throw new Error('The executing export approval changed.');
+        }
+        const record = await client.query<{
+          id: string;
+          name: string;
+          runScope: string;
+        }>(
+          \`SELECT id::text, name, run_scope AS "runScope"
+           FROM records
+           WHERE id = $1::uuid AND owner_id = $2
+           FOR UPDATE\`,
+          [input.recordId, workflow.approval.author.actorId],
+        );
+        const value = record.rows[0];
+        if (!value) throw new Error('The export target was not found.');
+        const holds = await loadActiveRecordHolds(
+          client,
+          input.recordId,
+          now,
+          'export',
+        );
+        const holdEvaluation = evaluateDataLifecycleHolds({
+          categoryId: 'product-record',
+          holds,
+          now,
+          operation: 'export',
+          scopeRef: productRecordReference(input.recordId),
+        });
+        if (holdEvaluation.blocked) {
+          throw new Error('An active record hold blocks export publication.');
+        }
+        // Keep the workflow row locked across the versioned put. If the put
+        // succeeds but a later database write fails, the durable gathering
+        // row and its pre-persisted deadline remain available to cleanup.
+        const versionId = await putEncryptedExport(
+          prepared.objectKey,
+          JSON.stringify(value),
+        );
+        const artifactRef = dataRightsArtifactReference(
+          input.approvalRequestId + ':' + versionId,
+        );
+        let lifecycle = workflow.lifecycle;
+        const activeCopy = lifecycle.sourceCopies.find(
+          ({ copyId }) => copyId === EXPORT_SOURCE_COPY,
+        );
+        if (activeCopy?.status === 'in-progress') {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: now,
+            copyId: EXPORT_SOURCE_COPY,
+            outcomeCode: 'gathered',
+            type: 'complete-copy',
+          });
+        }
+        lifecycle = transitionDataLifecycleExport(lifecycle, {
+            artifactRef,
+            at: now,
+            encryption: 'approved-profile',
+            expiresAt,
+            type: 'publish',
+        });
+        const completed = completeApprovalExecution(workflow.approval, {
+          executionId: 'export:' + input.approvalRequestId,
+          now,
+          requiredPolicyVersion: APPROVAL_POLICY_VERSION,
+        });
+        assertAuthorizationAllowed(completed.decision);
+        await persistApproval(
+          client,
+          workflow.approval.revision,
+          completed.request,
+        );
+        await persistExportState(
+          client,
+          input.approvalRequestId,
+          lifecycle,
+        );
+        await client.query(
+          \`UPDATE data_lifecycle_export_artifacts
+           SET artifact_ref = $2,
+               cleanup_state = 'ready',
+               current_version_id = $3,
+               expires_at = $4,
+               updated_at = $5
+           WHERE approval_request_id = $1::uuid\`,
+          [input.approvalRequestId, artifactRef, versionId, expiresAt, now],
+        );
+        await client.query(
+          \`INSERT INTO data_lifecycle_export_versions
+             (approval_request_id, is_delete_marker, object_key, status,
+              version_id)
+           VALUES ($1::uuid, false, $2, 'available', $3)
+           ON CONFLICT (approval_request_id, version_id)
+           DO UPDATE SET status = 'available'\`,
+          [input.approvalRequestId, prepared.objectKey, versionId],
+        );
+        await writeDataRightsAudit(client, {
+          action: 'export',
+          approvalRequestId: input.approvalRequestId,
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'export-execution',
+          recordId: input.recordId,
+          summary:
+            'A KMS-encrypted subject export was created with bounded expiry.',
+        });
+        await client.query('COMMIT');
+        return { artifactRef, expiresAt, status: 'ready' as const };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+interface DeliveredRecordExport {
+  artifactRef: string;
+  deliveredAt: string;
+  expiresAt: string;
+  record: {
+    id: string;
+    name: string;
+    runScope: string;
+  };
+}
+
+function parseDeliveredRecordExport(
+  value: string,
+  recordId: string,
+): DeliveredRecordExport['record'] {
+  if (value.length > 64 * 1_024) {
+    throw new Error('The confidential export artifact exceeds its bound.');
+  }
+  const candidate = JSON.parse(value) as {
+    id?: unknown;
+    name?: unknown;
+    runScope?: unknown;
+  };
+  if (
+    candidate.id !== recordId ||
+    typeof candidate.name !== 'string' ||
+    candidate.name.length < 1 ||
+    candidate.name.length > 128 ||
+    typeof candidate.runScope !== 'string' ||
+    candidate.runScope.length < 1 ||
+    candidate.runScope.length > 128
+  ) {
+    throw new Error('The confidential export artifact is invalid.');
+  }
+  return {
+    id: candidate.id,
+    name: candidate.name,
+    runScope: candidate.runScope,
+  };
+}
+
+/**
+ * Delivers an export through the authenticated API instead of exposing a
+ * durable object URL. The workflow row, record, active holds, expiry, object
+ * version, and author boundary are revalidated under one transaction, and the
+ * successful download is committed to the Slice audit ledger before return.
+ */
+export async function deliverReadyRecordExport(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId: string;
+}): Promise<DeliveredRecordExport> {
+  requireDirectHuman(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  const resources = exportResources();
+  return withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    'api-database-records',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadExportWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        const artifact = workflow?.lifecycle.artifact;
+        if (
+          !workflow ||
+          workflow.approval.action !== EXPORT_ACTION ||
+          workflow.recordRef !== productRecordReference(input.recordId) ||
+          workflow.approval.author.actorId !== input.principal.actor.id
+        ) {
+          throw new Error('The export artifact was not found.');
+        }
+        if (
+          workflow.approval.status !== 'executed' ||
+          workflow.lifecycle.status !== 'ready' ||
+          workflow.cleanupState !== 'ready' ||
+          artifact?.status !== 'available' ||
+          !workflow.currentVersionId ||
+          !workflow.artifactRef
+        ) {
+          throw new Error('The export artifact is not ready for delivery.');
+        }
+        if (Date.parse(artifact.expiresAt) <= Date.parse(now)) {
+          throw new Error('The export artifact has expired.');
+        }
+        const record = await client.query(
+          \`SELECT 1
+           FROM records
+           WHERE id = $1::uuid AND owner_id = $2
+           FOR UPDATE\`,
+          [input.recordId, input.principal.actor.id],
+        );
+        if (record.rowCount !== 1) {
+          throw new Error('The export target was not found.');
+        }
+        const holds = await loadActiveRecordHolds(
+          client,
+          input.recordId,
+          now,
+          'export',
+        );
+        const holdEvaluation = evaluateDataLifecycleHolds({
+          categoryId: 'product-record',
+          holds,
+          now,
+          operation: 'export',
+          scopeRef: productRecordReference(input.recordId),
+        });
+        if (holdEvaluation.blocked) {
+          throw new Error('An active record hold blocks export delivery.');
+        }
+        const object = await s3.send(
+          new GetObjectCommand({
+            Bucket: resources.bucketName,
+            Key: workflow.objectKey,
+            VersionId: workflow.currentVersionId,
+          }),
+        );
+        if (
+          object.ContentLength === undefined ||
+          object.ContentLength > 64 * 1_024 ||
+          object.ContentType !== 'application/json' ||
+          !object.Body
+        ) {
+          throw new Error('The confidential export artifact is invalid.');
+        }
+        const deliveredRecord = parseDeliveredRecordExport(
+          await object.Body.transformToString(),
+          input.recordId,
+        );
+        await writeDataRightsAudit(client, {
+          action: 'export',
+          approvalRequestId: input.approvalRequestId,
+          correlationId: input.correlationId,
+          now,
+          outcome: 'succeeded',
+          principal: input.principal,
+          purposeCode: 'export-download',
+          recordId: input.recordId,
+          summary:
+            'An authorized subject downloaded an unexpired confidential export.',
+        });
+        await client.query('COMMIT');
+        return {
+          artifactRef: workflow.artifactRef,
+          deliveredAt: now,
+          expiresAt: artifact.expiresAt,
+          record: deliveredRecord,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export interface ExportObjectVersion {
+  isDeleteMarker: boolean;
+  key: string;
+  versionId: string;
+}
+
+async function listExactExportVersions(
+  objectKey: string,
+  objectStore: RecordExportObjectStore,
+): Promise<readonly ExportObjectVersion[]> {
+  const { bucketName } = exportResources();
+  const versions: ExportObjectVersion[] = [];
+  let keyMarker: string | undefined;
+  let versionIdMarker: string | undefined;
+  do {
+    const page = (await objectStore.send(
+      new ListObjectVersionsCommand({
+        Bucket: bucketName,
+        KeyMarker: keyMarker,
+        Prefix: objectKey,
+        VersionIdMarker: versionIdMarker,
+      }),
+    )) as {
+      DeleteMarkers?: Array<{ Key?: string; VersionId?: string }>;
+      IsTruncated?: boolean;
+      NextKeyMarker?: string;
+      NextVersionIdMarker?: string;
+      Versions?: Array<{ Key?: string; VersionId?: string }>;
+    };
+    for (const version of page.Versions ?? []) {
+      if (version.Key === objectKey && version.VersionId) {
+        versions.push({
+          isDeleteMarker: false,
+          key: objectKey,
+          versionId: version.VersionId,
+        });
+      }
+    }
+    for (const marker of page.DeleteMarkers ?? []) {
+      if (marker.Key === objectKey && marker.VersionId) {
+        versions.push({
+          isDeleteMarker: true,
+          key: objectKey,
+          versionId: marker.VersionId,
+        });
+      }
+    }
+    keyMarker = page.IsTruncated ? page.NextKeyMarker : undefined;
+    versionIdMarker = page.IsTruncated
+      ? page.NextVersionIdMarker
+      : undefined;
+  } while (keyMarker || versionIdMarker);
+  return versions;
+}
+
+async function deleteExactExportVersions(
+  versions: readonly ExportObjectVersion[],
+  objectStore: RecordExportObjectStore,
+): Promise<ReadonlySet<string>> {
+  const { bucketName } = exportResources();
+  const failed = new Set<string>();
+  for (let offset = 0; offset < versions.length; offset += 1_000) {
+    const batch = versions.slice(offset, offset + 1_000);
+    const batchVersionIds = new Set(batch.map(({ versionId }) => versionId));
+    const result = (await objectStore.send(
+      new DeleteObjectsCommand({
+        Bucket: bucketName,
+        Delete: {
+          Objects: batch.map(({ key, versionId }) => ({
+            Key: key,
+            VersionId: versionId,
+          })),
+          Quiet: true,
+        },
+      }),
+    )) as {
+      Errors?: Array<{ Key?: string; VersionId?: string }>;
+    };
+    for (const error of result.Errors ?? []) {
+      if (error.VersionId && batchVersionIds.has(error.VersionId)) {
+        failed.add(error.VersionId);
+      } else {
+        // S3 does not require DeleteError.VersionId. An unmatched or
+        // identifier-free error cannot be attributed safely when every
+        // version shares one key, so fail the whole submitted batch closed.
+        for (const { versionId } of batch) failed.add(versionId);
+      }
+    }
+  }
+  return failed;
+}
+
+function mergeExportVersions(
+  ...collections: ReadonlyArray<readonly ExportObjectVersion[]>
+): readonly ExportObjectVersion[] {
+  const versions = new Map<string, ExportObjectVersion>();
+  for (const collection of collections) {
+    for (const version of collection) {
+      versions.set(version.versionId, version);
+    }
+  }
+  return [...versions.values()].sort((left, right) =>
+    left.versionId < right.versionId
+      ? -1
+      : left.versionId > right.versionId
+        ? 1
+        : 0,
+  );
+}
+
+export interface ExportObjectCleanupResult {
+  attemptedVersions: readonly ExportObjectVersion[];
+  failedVersionIds: readonly string[];
+  remainingVersions: readonly ExportObjectVersion[];
+}
+
+/**
+ * Runs one idempotent exact-version cleanup attempt. Fresh S3 discovery is
+ * durably recorded before deletion, while durable unfinished inventory is
+ * retried even when a prior successful S3 delete was followed by database
+ * rollback. A second exact listing is the completion proof.
+ */
+export async function runExportObjectCleanupAttempt<Result>(input: {
+  finalize(result: ExportObjectCleanupResult): Promise<Result>;
+  objectKey: string;
+  objectStore?: RecordExportObjectStore;
+  recordDiscovered(
+    versions: readonly ExportObjectVersion[],
+  ): Promise<void>;
+  trackedVersions: readonly ExportObjectVersion[];
+}): Promise<Result> {
+  const objectStore = input.objectStore ?? defaultRecordExportObjectStore;
+  const discovered = await listExactExportVersions(
+    input.objectKey,
+    objectStore,
+  );
+  await input.recordDiscovered(discovered);
+  const attemptedVersions = mergeExportVersions(
+    input.trackedVersions,
+    discovered,
+  );
+  const failed = new Set(
+    await deleteExactExportVersions(attemptedVersions, objectStore),
+  );
+  const remainingVersions = await listExactExportVersions(
+    input.objectKey,
+    objectStore,
+  );
+  await input.recordDiscovered(remainingVersions);
+  for (const { versionId } of remainingVersions) failed.add(versionId);
+  return input.finalize({
+    attemptedVersions: mergeExportVersions(
+      attemptedVersions,
+      remainingVersions,
+    ),
+    failedVersionIds: [...failed].sort(),
+    remainingVersions,
+  });
+}
+
+async function loadTrackedExportVersions(
+  client: PgClient,
+  approvalRequestId: string,
+): Promise<readonly ExportObjectVersion[]> {
+  const result = await client.query<{
+    isDeleteMarker: boolean;
+    key: string;
+    versionId: string;
+  }>(
+    \`SELECT is_delete_marker AS "isDeleteMarker",
+            object_key AS key,
+            version_id AS "versionId"
+     FROM data_lifecycle_export_versions
+     WHERE approval_request_id = $1::uuid
+       AND status <> 'deleted'
+     ORDER BY version_id\`,
+    [approvalRequestId],
+  );
+  return result.rows;
+}
+
+async function recordDiscoveredExportVersions(
+  client: PgClient,
+  approvalRequestId: string,
+  versions: readonly ExportObjectVersion[],
+): Promise<void> {
+  for (const version of versions) {
+    await client.query(
+      \`INSERT INTO data_lifecycle_export_versions
+         (approval_request_id, is_delete_marker, object_key, status,
+          version_id)
+       VALUES ($1::uuid, $2, $3, 'deletion-in-progress', $4)
+       ON CONFLICT (approval_request_id, version_id)
+       DO UPDATE SET is_delete_marker = EXCLUDED.is_delete_marker,
+                     object_key = EXCLUDED.object_key,
+                     status = 'deletion-in-progress'\`,
+      [
+        approvalRequestId,
+        version.isDeleteMarker,
+        version.key,
+        version.versionId,
+      ],
+    );
+  }
+}
+
+async function recordExportCleanupDeadlineReport(
+  client: PgClient,
+  input: {
+    approvalRequestId: string;
+    cleanupDeadlineAt: string;
+    observedAt: string;
+  },
+): Promise<void> {
+  if (Date.parse(input.cleanupDeadlineAt) > Date.parse(input.observedAt)) {
+    return;
+  }
+  const capacity = await client.query<{ maximumPending: number }>(
+    \`SELECT maximum_pending AS "maximumPending"
+     FROM cleanup_deadline_report_capacity
+     WHERE feature = $1
+     FOR UPDATE\`,
+    [CONFIDENTIAL_EXPORT_CLEANUP_FEATURE],
+  );
+  if (
+    capacity.rowCount !== 1 ||
+    capacity.rows[0]?.maximumPending !==
+      MAXIMUM_PENDING_EXPORT_CLEANUP_REPORTS
+  ) {
+    throw new Error(
+      'Confidential-export cleanup deadline report capacity is invalid.',
+    );
+  }
+  const inserted = await client.query(
+    \`INSERT INTO cleanup_deadline_reports
+       (deadline_at, feature, resource_ref)
+     SELECT $1, $2, $3
+     WHERE (
+       SELECT count(*)
+       FROM (
+         SELECT 1
+         FROM cleanup_deadline_reports
+         WHERE feature = $2
+         LIMIT $4
+       ) AS bounded_pending_reports
+     ) < $4
+     ON CONFLICT (feature, resource_ref) DO NOTHING\`,
+    [
+      input.cleanupDeadlineAt,
+      CONFIDENTIAL_EXPORT_CLEANUP_FEATURE,
+      input.approvalRequestId,
+      MAXIMUM_PENDING_EXPORT_CLEANUP_REPORTS,
+    ],
+  );
+  const persistedDeadline = await client.query<{ deadlineAt: Date }>(
+    \`SELECT deadline_at AS "deadlineAt"
+     FROM cleanup_deadline_reports
+     WHERE feature = $1 AND resource_ref = $2
+     FOR UPDATE\`,
+    [CONFIDENTIAL_EXPORT_CLEANUP_FEATURE, input.approvalRequestId],
+  );
+  const persisted = persistedDeadline.rows[0];
+  if (persisted === undefined) {
+    // The reporter acknowledged and deleted this row concurrently, or the
+    // bounded inventory is saturated. Retained deletion authority must not
+    // depend on the observability path; the next scan re-observes an
+    // unresolved breach.
+    if (inserted.rowCount === 1) {
+      throw new Error(
+        'Persisted confidential-export cleanup deadline report is inconsistent.',
+      );
+    }
+    return;
+  }
+  if (persisted.deadlineAt.toISOString() !== input.cleanupDeadlineAt) {
+    throw new Error(
+      'Persisted confidential-export cleanup deadline report is inconsistent.',
+    );
+  }
+}
+
+export async function recordPreparedExportCleanupDeadlineReport(
+  client: PgClient,
+  input: {
+    approvalRequestId: string;
+    cleanupDeadlineAt: Date | null;
+    expiresAt: Date | null;
+    lifecycleStatus: string;
+    now: string;
+    uploadStartedAt: Date | null;
+  },
+): Promise<void> {
+  if (input.lifecycleStatus === 'completed') return;
+  if (!input.uploadStartedAt || !input.cleanupDeadlineAt || !input.expiresAt) {
+    throw new Error(
+      'Persisted confidential-export cleanup schedule is incomplete.',
+    );
+  }
+  const exactSchedule = recordExportSchedule(input.now, {
+    cleanupDeadlineAt: input.cleanupDeadlineAt.toISOString(),
+    expiresAt: input.expiresAt.toISOString(),
+    uploadStartedAt: input.uploadStartedAt.toISOString(),
+  });
+  await recordExportCleanupDeadlineReport(client, {
+    approvalRequestId: input.approvalRequestId,
+    cleanupDeadlineAt: exactSchedule.cleanupDeadlineAt,
+    observedAt: input.now,
+  });
+}
+
+export async function recordFinalizedExportCleanupDeadlineReport(
+  client: PgClient,
+  input: {
+    approvalRequestId: string;
+    cleanupDeadlineAt: Date | null;
+    expiresAt: Date | null;
+    now: string;
+    uploadStartedAt: Date | null;
+  },
+): Promise<void> {
+  if (!input.uploadStartedAt || !input.cleanupDeadlineAt || !input.expiresAt) {
+    throw new Error(
+      'Persisted confidential-export cleanup schedule is incomplete.',
+    );
+  }
+  const exactSchedule = recordExportSchedule(input.now, {
+    cleanupDeadlineAt: input.cleanupDeadlineAt.toISOString(),
+    expiresAt: input.expiresAt.toISOString(),
+    uploadStartedAt: input.uploadStartedAt.toISOString(),
+  });
+  const databaseClock = await client.query<{ observedAt: Date }>(
+    \`SELECT clock_timestamp() AS "observedAt"\`,
+  );
+  const observedAt = databaseClock.rows[0]?.observedAt;
+  if (!observedAt) {
+    throw new Error(
+      'Confidential export cleanup database clock is unavailable.',
+    );
+  }
+  await recordExportCleanupDeadlineReport(client, {
+    approvalRequestId: input.approvalRequestId,
+    cleanupDeadlineAt: exactSchedule.cleanupDeadlineAt,
+    observedAt: observedAt.toISOString(),
+  });
+}
+
+export async function cleanupExpiredRecordExport(input: {
+  approvalRequestId: string;
+  correlationId: string;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  recordId?: string;
+  recordReference?: string;
+}): Promise<{ deletedVersions: number; status: 'completed' | 'retry-required' }> {
+  requireExportCleanupAuthority(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  if ((input.recordId === undefined) === (input.recordReference === undefined)) {
+    throw new Error(
+      'Export cleanup requires exactly one record identifier or reference.',
+    );
+  }
+  const expectedRecordRef =
+    input.recordReference ?? productRecordReference(input.recordId!);
+  const databaseWorkload =
+    input.principal.kind === 'agent'
+      ? ('data-export-cleanup' as const)
+      : ('api-database-records' as const);
+  const prepared = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    databaseWorkload,
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const workflow = await loadExportWorkflow(
+          client,
+          input.approvalRequestId,
+        );
+        if (
+          !workflow ||
+          workflow.recordRef !== expectedRecordRef
+        ) {
+          throw new Error('The export artifact was not found.');
+        }
+        if (workflow.lifecycle.status === 'completed') {
+          await client.query('COMMIT');
+          return {
+            alreadyCompleted: true as const,
+            objectKey: workflow.objectKey,
+          };
+        }
+        if (
+          !workflow.expiresAt ||
+          Date.parse(workflow.expiresAt.toISOString()) > Date.parse(now)
+        ) {
+          throw new Error('The export artifact is not due for cleanup.');
+        }
+        await recordPreparedExportCleanupDeadlineReport(client, {
+          approvalRequestId: input.approvalRequestId,
+          cleanupDeadlineAt: workflow.cleanupDeadlineAt,
+          expiresAt: workflow.expiresAt,
+          lifecycleStatus: workflow.lifecycle.status,
+          now,
+          uploadStartedAt: workflow.uploadStartedAt,
+        });
+        let lifecycle = workflow.lifecycle;
+        if (lifecycle.status === 'ready') {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: now,
+            type: 'expire',
+          });
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: now,
+            type: 'start-artifact-deletion',
+          });
+        } else if (
+          lifecycle.status === 'failed' &&
+          (lifecycle.failurePhase === 'artifact-deletion' ||
+            lifecycle.failurePhase ===
+              'unpublished-artifact-deletion')
+        ) {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: now,
+            type: 'retry',
+          });
+        } else if (lifecycle.status === 'gathering') {
+          lifecycle = transitionDataLifecycleExport(lifecycle, {
+            at: now,
+            type: 'start-unpublished-artifact-deletion',
+          });
+        } else if (
+          lifecycle.status !== 'artifact-deletion-in-progress' &&
+          lifecycle.status !==
+            'unpublished-artifact-deletion-in-progress'
+        ) {
+          throw new Error('The export artifact is not due for cleanup.');
+        }
+        await persistExportState(
+          client,
+          input.approvalRequestId,
+          lifecycle,
+        );
+        await client.query(
+          \`UPDATE data_lifecycle_export_artifacts
+           SET cleanup_state = 'deletion-in-progress', updated_at = $2
+           WHERE approval_request_id = $1::uuid\`,
+          [input.approvalRequestId, now],
+        );
+        await client.query('COMMIT');
+        return {
+          alreadyCompleted: false as const,
+          objectKey: workflow.objectKey,
+          unpublished: lifecycle.artifact === undefined,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+  if (prepared.alreadyCompleted) {
+    return { deletedVersions: 0, status: 'completed' };
+  }
+  const trackedVersions = await withPrimaryDatabase(
+    { correlationId: input.correlationId },
+    databaseWorkload,
+    (client) =>
+      loadTrackedExportVersions(client, input.approvalRequestId),
+  );
+  return runExportObjectCleanupAttempt({
+    objectKey: prepared.objectKey,
+    trackedVersions,
+    recordDiscovered: (versions) =>
+      withPrimaryDatabase(
+        { correlationId: input.correlationId },
+        databaseWorkload,
+        async (client) => {
+          await client.query('BEGIN');
+          try {
+            await recordDiscoveredExportVersions(
+              client,
+              input.approvalRequestId,
+              versions,
+            );
+            await client.query('COMMIT');
+          } catch (error) {
+            await client.query('ROLLBACK').catch(() => undefined);
+            throw error;
+          }
+        },
+      ),
+    finalize: ({ attemptedVersions, failedVersionIds }) =>
+      withPrimaryDatabase(
+        { correlationId: input.correlationId },
+        databaseWorkload,
+        async (client) => {
+          await client.query('BEGIN');
+          try {
+            const workflow = await loadExportWorkflow(
+              client,
+              input.approvalRequestId,
+            );
+            if (!workflow) {
+              throw new Error('The export workflow was not found.');
+            }
+            if (workflow.lifecycle.status === 'completed') {
+              await client.query('COMMIT');
+              return { deletedVersions: 0, status: 'completed' as const };
+            }
+            await recordFinalizedExportCleanupDeadlineReport(client, {
+              approvalRequestId: input.approvalRequestId,
+              cleanupDeadlineAt: workflow.cleanupDeadlineAt,
+              expiresAt: workflow.expiresAt,
+              now,
+              uploadStartedAt: workflow.uploadStartedAt,
+            });
+            const failed = new Set(failedVersionIds);
+            for (const version of attemptedVersions) {
+              await client.query(
+                \`UPDATE data_lifecycle_export_versions
+                 SET deleted_at = CASE WHEN $3 THEN NULL ELSE $4 END,
+                     status = CASE WHEN $3 THEN 'failed' ELSE 'deleted' END
+                 WHERE approval_request_id = $1::uuid AND version_id = $2\`,
+                [
+                  input.approvalRequestId,
+                  version.versionId,
+                  failed.has(version.versionId),
+                  now,
+                ],
+              );
+            }
+            let lifecycle = workflow.lifecycle;
+            const unpublished = lifecycle.artifact === undefined;
+            if (
+              lifecycle.status === 'failed' &&
+              (lifecycle.failurePhase === 'artifact-deletion' ||
+                lifecycle.failurePhase ===
+                  'unpublished-artifact-deletion')
+            ) {
+              lifecycle = transitionDataLifecycleExport(lifecycle, {
+                at: now,
+                type: 'retry',
+              });
+            }
+            if (
+              lifecycle.status !== 'artifact-deletion-in-progress' &&
+              lifecycle.status !==
+                'unpublished-artifact-deletion-in-progress'
+            ) {
+              throw new Error('The export cleanup attempt changed.');
+            }
+            if (failed.size > 0) {
+              lifecycle = transitionDataLifecycleExport(lifecycle, {
+                at: now,
+                errorCode: 'object-version-delete-failed',
+                type: 'fail-artifact-deletion',
+              });
+            } else {
+              lifecycle = transitionDataLifecycleExport(lifecycle, {
+                at: now,
+                outcomeCode:
+                  attemptedVersions.length === 0 ? 'not-found' : 'deleted',
+                type: 'complete-artifact-deletion',
+              });
+            }
+            await persistExportState(
+              client,
+              input.approvalRequestId,
+              lifecycle,
+            );
+            if (failed.size === 0 && unpublished) {
+              const completed = completeApprovalExecution(
+                workflow.approval,
+                {
+                  executionId: 'export:' + input.approvalRequestId,
+                  now,
+                  requiredPolicyVersion: APPROVAL_POLICY_VERSION,
+                },
+              );
+              assertAuthorizationAllowed(completed.decision);
+              await persistApproval(
+                client,
+                workflow.approval.revision,
+                completed.request,
+              );
+            }
+            await client.query(
+              \`UPDATE data_lifecycle_export_artifacts
+               SET cleanup_state = $2,
+                   last_error_code = $3,
+                   updated_at = $4
+               WHERE approval_request_id = $1::uuid\`,
+              [
+                input.approvalRequestId,
+                failed.size > 0 ? 'failed' : 'completed',
+                failed.size > 0
+                  ? 'object-version-delete-failed'
+                  : null,
+                now,
+              ],
+            );
+            await writeDataRightsAudit(client, {
+              action: 'export',
+              approvalRequestId: input.approvalRequestId,
+              correlationId: input.correlationId,
+              now,
+              outcome:
+                failed.size > 0 ? 'retry-required' : 'succeeded',
+              principal: input.principal,
+              purposeCode: 'export-expiry',
+              ...(input.recordId
+                ? { recordId: input.recordId }
+                : { resourceReference: expectedRecordRef }),
+              summary:
+                failed.size > 0
+                  ? 'Confidential export version cleanup requires retry.'
+                  : 'Every discovered confidential export version was deleted.',
+            });
+            await client.query('COMMIT');
+            return {
+              deletedVersions: attemptedVersions.length - failed.size,
+              status:
+                failed.size > 0
+                  ? ('retry-required' as const)
+                  : ('completed' as const),
+            };
+          } catch (error) {
+            await client.query('ROLLBACK').catch(() => undefined);
+            throw error;
+          }
+        },
+      ),
+  });
+}
+
+export interface RecordExportCleanupDependencies {
+  cleanupExpiredRecordExport: typeof cleanupExpiredRecordExport;
+  withDatabase: typeof withPrimaryDatabase;
+}
+
+export async function reportExportCleanupDeadlineBreaches(
+  input: {
+    correlationId: string;
+    pageSize?: number;
+    report(value: number): boolean;
+  },
+  dependencies: Pick<RecordExportCleanupDependencies, 'withDatabase'> = {
+    withDatabase: withPrimaryDatabase,
+  },
+): Promise<{ continuationRequired: boolean; reported: number }> {
+  const pageSize =
+    input.pageSize ?? DEFAULT_EXPORT_CLEANUP_REPORT_PAGE_SIZE;
+  if (!Number.isSafeInteger(pageSize) || pageSize < 1 || pageSize > 100) {
+    throw new Error(
+      'Export cleanup deadline report page size must be from 1 through 100.',
+    );
+  }
+  return dependencies.withDatabase(
+    { correlationId: input.correlationId },
+    'data-export-cleanup',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const pending = await client.query<{ resourceRef: string }>(
+          \`SELECT resource_ref AS "resourceRef"
+           FROM cleanup_deadline_reports
+           WHERE feature = $1
+           ORDER BY resource_ref::uuid
+           LIMIT $2
+           FOR UPDATE\`,
+          [CONFIDENTIAL_EXPORT_CLEANUP_FEATURE, pageSize + 1],
+        );
+        const selected = pending.rows.slice(0, pageSize);
+        if (!input.report(selected.length)) {
+          throw new Error(
+            'Confidential export cleanup deadline metric delivery failed.',
+          );
+        }
+        if (selected.length > 0) {
+          await client.query(
+            \`DELETE FROM cleanup_deadline_reports
+             WHERE feature = $1 AND resource_ref = ANY($2::text[])\`,
+            [
+              CONFIDENTIAL_EXPORT_CLEANUP_FEATURE,
+              selected.map(({ resourceRef }) => resourceRef),
+            ],
+          );
+        }
+        await client.query('COMMIT');
+        return {
+          continuationRequired: pending.rows.length > pageSize,
+          reported: selected.length,
+        };
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+}
+
+export async function cleanupDueRecordExports(input: {
+  correlationId: string;
+  limit?: number;
+  maximumBatches?: number;
+  now?: string;
+  principal: AuthorizationPrincipal;
+  shouldContinue?: () => boolean;
+}, dependencies: Partial<RecordExportCleanupDependencies> = {}): Promise<{
+  batches: number;
+  completed: number;
+  continuationRequired: boolean;
+  deadlineBreached: boolean;
+  processed: number;
+  remainingDeadlineBreaches: number;
+  remainingDue: number;
+  retryRequired: number;
+}> {
+  requireExportCleanupAuthority(input.principal);
+  const now = canonicalDataRightsNow(input.now);
+  const nowEpochMilliseconds = Date.parse(now);
+  const limit = input.limit ?? DEFAULT_EXPORT_CLEANUP_PAGE_SIZE;
+  const maximumBatches = input.maximumBatches ?? 100;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) {
+    throw new Error('Export cleanup batch size must be from 1 through 100.');
+  }
+  if (
+    !Number.isSafeInteger(maximumBatches) ||
+    maximumBatches < 1 ||
+    maximumBatches > 100
+  ) {
+    throw new Error(
+      'Export cleanup batch count must be from 1 through 100.',
+    );
+  }
+  const cleanupExpired =
+    dependencies.cleanupExpiredRecordExport ?? cleanupExpiredRecordExport;
+  const withDatabase = dependencies.withDatabase ?? withPrimaryDatabase;
+  const shouldContinue = input.shouldContinue ?? (() => true);
+  let batches = 0;
+  let completed = 0;
+  let cursorApprovalRequestId: string | null = null;
+  let cursorExpiresAt: string | null = null;
+  let observedDeadlineBreach = await withDatabase(
+    { correlationId: input.correlationId },
+    'data-export-cleanup',
+    async (client) => {
+      await client.query('BEGIN');
+      try {
+        const activeSchedules = await client.query<{
+          approvalRequestId: string;
+          cleanupDeadlineAt: Date | null;
+          expiresAt: Date | null;
+          uploadStartedAt: Date | null;
+        }>(
+          \`SELECT approval_request_id::text AS "approvalRequestId",
+                  cleanup_deadline_at AS "cleanupDeadlineAt",
+                  expires_at AS "expiresAt",
+                  upload_started_at AS "uploadStartedAt"
+           FROM data_lifecycle_export_artifacts
+           WHERE cleanup_state IN (
+             'gathering',
+             'ready',
+             'deletion-in-progress',
+             'failed'
+           )
+           ORDER BY approval_request_id
+           LIMIT $1
+           FOR UPDATE\`,
+          [MAXIMUM_OUTSTANDING_CONFIDENTIAL_EXPORTS + 1],
+        );
+        if (
+          activeSchedules.rows.length >
+          MAXIMUM_OUTSTANDING_CONFIDENTIAL_EXPORTS
+        ) {
+          throw new Error(
+            'The bounded confidential-export cleanup inventory was exceeded.',
+          );
+        }
+        let observed = false;
+        for (const schedule of activeSchedules.rows) {
+          if (
+            schedule.uploadStartedAt === null ||
+            schedule.expiresAt === null ||
+            schedule.cleanupDeadlineAt === null
+          ) {
+            throw new Error(
+              'Persisted confidential-export cleanup schedule is incomplete.',
+            );
+          }
+          const exactSchedule = recordExportSchedule(now, {
+            cleanupDeadlineAt: schedule.cleanupDeadlineAt.toISOString(),
+            expiresAt: schedule.expiresAt.toISOString(),
+            uploadStartedAt: schedule.uploadStartedAt.toISOString(),
+          });
+          if (
+            Date.parse(exactSchedule.cleanupDeadlineAt) <=
+            nowEpochMilliseconds
+          ) {
+            observed = true;
+            await recordExportCleanupDeadlineReport(client, {
+              approvalRequestId: schedule.approvalRequestId,
+              cleanupDeadlineAt: exactSchedule.cleanupDeadlineAt,
+              observedAt: now,
+            });
+          }
+        }
+        await client.query('COMMIT');
+        return observed;
+      } catch (error) {
+        await client.query('ROLLBACK').catch(() => undefined);
+        throw error;
+      }
+    },
+  );
+  let processed = 0;
+  let retryRequired = 0;
+  while (batches < maximumBatches && shouldContinue()) {
+    const due = await withDatabase(
+      { correlationId: input.correlationId },
+      'data-export-cleanup',
+      (client) =>
+        client.query<{
+          approvalRequestId: string;
+          cleanupDeadlineAt: Date | null;
+          expiresAt: Date;
+          recordReference: string;
+          uploadStartedAt: Date | null;
+        }>(
+          \`SELECT approval_request_id::text AS "approvalRequestId",
+                  cleanup_deadline_at AS "cleanupDeadlineAt",
+                  expires_at AS "expiresAt",
+                  record_ref AS "recordReference",
+                  upload_started_at AS "uploadStartedAt"
+           FROM data_lifecycle_export_artifacts
+           WHERE cleanup_state IN (
+             'gathering',
+             'ready',
+             'deletion-in-progress',
+             'failed'
+           )
+             AND expires_at IS NOT NULL
+             AND expires_at <= $1
+             AND (
+               $3::timestamptz IS NULL OR
+               (expires_at, approval_request_id) >
+                 ($3::timestamptz, $4::uuid)
+             )
+           ORDER BY expires_at, approval_request_id
+           LIMIT $2\`,
+          [now, limit, cursorExpiresAt, cursorApprovalRequestId],
+        ),
+    );
+    if (due.rows.length === 0) {
+      break;
+    }
+    batches += 1;
+    for (const candidate of due.rows) {
+      if (
+        candidate.uploadStartedAt === null ||
+        candidate.cleanupDeadlineAt === null
+      ) {
+        throw new Error(
+          'Persisted confidential-export cleanup schedule is incomplete.',
+        );
+      }
+      const exactSchedule = recordExportSchedule(now, {
+        cleanupDeadlineAt: candidate.cleanupDeadlineAt.toISOString(),
+        expiresAt: candidate.expiresAt.toISOString(),
+        uploadStartedAt: candidate.uploadStartedAt.toISOString(),
+      });
+      processed += 1;
+      if (Date.parse(exactSchedule.cleanupDeadlineAt) <= nowEpochMilliseconds) {
+        observedDeadlineBreach = true;
+      }
+      try {
+        const result = await cleanupExpired({
+          approvalRequestId: candidate.approvalRequestId,
+          correlationId: input.correlationId,
+          now,
+          principal: input.principal,
+          recordReference: candidate.recordReference,
+        });
+        if (result.status === 'completed') completed += 1;
+        else retryRequired += 1;
+      } catch {
+        retryRequired += 1;
+      }
+    }
+    const cursor = due.rows.at(-1);
+    cursorApprovalRequestId = cursor?.approvalRequestId ?? null;
+    cursorExpiresAt = cursor?.expiresAt.toISOString() ?? null;
+    if (due.rows.length < limit) {
+      break;
+    }
+  }
+  const finalState = await withDatabase(
+    { correlationId: input.correlationId },
+    'data-export-cleanup',
+    (client) =>
+      client.query<{
+        remainingDeadlineBreaches: string;
+        remainingDue: string;
+      }>(
+        \`SELECT
+           count(*) FILTER (
+             WHERE expires_at IS NOT NULL AND expires_at <= $1
+           )::text AS "remainingDue",
+           count(*) FILTER (
+             WHERE cleanup_deadline_at IS NULL
+                OR cleanup_deadline_at <= $1
+           )::text AS "remainingDeadlineBreaches"
+         FROM data_lifecycle_export_artifacts
+         WHERE cleanup_state IN (
+           'gathering',
+           'ready',
+           'deletion-in-progress',
+           'failed'
+         )\`,
+        [now],
+      ),
+  );
+  const remainingDeadlineBreaches = Number(
+    finalState.rows[0]?.remainingDeadlineBreaches ?? 0,
+  );
+  const remainingDue = Number(finalState.rows[0]?.remainingDue ?? 0);
+  return {
+    batches,
+    completed,
+    continuationRequired: retryRequired > 0 || remainingDue > 0,
+    deadlineBreached:
+      observedDeadlineBreach || remainingDeadlineBreaches > 0,
+    processed,
+    remainingDeadlineBreaches,
+    remainingDue,
+    retryRequired,
+  };
+}
+`;
+}
+function renderDataRightsDeadlineLockOrderIntegrationSource(name) {
+    return `import type { AuthorizationPrincipal } from '@empire-builder-kit/runtime/authorization';
+import { Client } from 'pg';
+import { describe, expect, it } from 'vitest';
+import {
+  cleanupDueRecordExports,
+  recordPreparedExportCleanupDeadlineReport,
+  reportExportCleanupDeadlineBreaches,
+} from '../data/record-export.js';
+
+const databaseUrl = process.env.DATABASE_URL;
+if (!databaseUrl) {
+  throw new Error(
+    'DATABASE_URL is required for ${name} deadline lock-order proof.',
+  );
+}
+
+const cleanupPrincipal: AuthorizationPrincipal = {
+  actor: { id: '${name}:data-export-cleanup', type: 'service' },
+  audience: '${name}:data-export-cleanup',
+  authority: {
+    machineIdentityId: '${name}:data-export-cleanup',
+    mode: 'machine',
+  },
+  kind: 'agent',
+  roles: [],
+  scopes: [],
+  subject: { id: '${name}:data-export-cleanup', type: 'service' },
+};
+
+function deferred(): { promise: Promise<void>; resolve(): void } {
+  let resolvePromise = () => undefined;
+  const promise = new Promise<void>((resolve) => {
+    resolvePromise = resolve;
+  });
+  return { promise, resolve: resolvePromise };
+}
+
+// Time bounds in this proof are loaded-host budgets: hosted runners share
+// four cores between Vitest, the proof registry, and the dockerized
+// database, so idle-host margins intermittently fail under saturation.
+async function bounded<Result>(
+  promise: Promise<Result>,
+  label: string,
+  timeoutMilliseconds = 15_000,
+): Promise<Result> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      promise,
+      new Promise<never>((_resolve, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(label + ' exceeded its time bound.')),
+          timeoutMilliseconds,
+        );
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+async function query(
+  client: Client,
+  text: string,
+  values?: readonly unknown[],
+) {
+  return values === undefined
+    ? client.query(text)
+    : client.query(text, [...values]);
+}
+
+async function waitForExpectedBlocker(
+  observer: Client,
+  blockedProcessId: number,
+  blockerProcessId: number,
+): Promise<void> {
+  const deadline = Date.now() + 10_000;
+  while (Date.now() < deadline) {
+    const result = await observer.query<{ blockedByExpected: boolean }>(
+      \`SELECT $2::integer = ANY(pg_blocking_pids($1))
+         AS "blockedByExpected"\`,
+      [blockedProcessId, blockerProcessId],
+    );
+    if (result.rows[0]?.blockedByExpected === true) return;
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  }
+  throw new Error('Backend did not reach the expected database blocker.');
+}
+
+function databaseErrorCode(reason: unknown): string | undefined {
+  if (!reason || typeof reason !== 'object' || !('code' in reason)) {
+    return undefined;
+  }
+  return typeof reason.code === 'string' ? reason.code : undefined;
+}
+
+describe('${name} confidential-export cleanup deadline lock order', () => {
+  it('settles concurrent cleanup observation and metric acknowledgement in UUID order', async () => {
+    const lowerResourceRef = '00000000-0000-4000-8000-000000000101';
+    const higherResourceRef = '00000000-0000-4000-8000-000000000102';
+    const resourceRefs = [lowerResourceRef, higherResourceRef] as const;
+    const cleanupDeadlineAt = '2026-08-02T12:00:00.000Z';
+    const expiresAt = '2026-08-02T09:00:00.000Z';
+    const uploadStartedAt = '2026-08-01T12:00:00.000Z';
+    const cleanup = new Client({ connectionString: databaseUrl });
+    const reporter = new Client({ connectionString: databaseUrl });
+    const observer = new Client({ connectionString: databaseUrl });
+    try {
+      await Promise.all([
+        cleanup.connect(),
+        reporter.connect(),
+        observer.connect(),
+      ]);
+      await cleanup.query("SET lock_timeout = '10s'");
+      // The reporter is deliberately blocked by cleanup. Its query therefore
+      // cannot share the observer's deadline: equal time bounds race under a
+      // loaded scheduler before the observer can prove the blocker identity.
+      await reporter.query("SET lock_timeout = '0'");
+      for (const client of [cleanup, reporter]) {
+        await client.query("SET statement_timeout = '20s'");
+        await client.query("SET deadlock_timeout = '100ms'");
+      }
+      await observer.query(
+        \`DELETE FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'
+           AND resource_ref = ANY($1::text[])\`,
+        [resourceRefs],
+      );
+      await observer.query(
+        'DELETE FROM data_lifecycle_export_artifacts WHERE approval_request_id = ANY($1::uuid[])',
+        [resourceRefs],
+      );
+      await observer.query(
+        'DELETE FROM approval_requests WHERE id = ANY($1::uuid[])',
+        [resourceRefs],
+      );
+      for (const resourceRef of resourceRefs) {
+        await observer.query(
+          \`INSERT INTO approval_requests
+             (id, author_reference, expires_at, policy_version,
+              request_digest, request_json, revision, status)
+           VALUES ($1::uuid, 'lock-order-proof', $2, 'lock-order-proof',
+                   'lock-order-proof', '{}'::jsonb, 0, 'approved')\`,
+          [resourceRef, cleanupDeadlineAt],
+        );
+        await observer.query(
+          \`INSERT INTO data_lifecycle_export_artifacts
+             (approval_request_id, cleanup_deadline_at, cleanup_state,
+              expires_at, object_key, record_ref, subject_ref,
+              upload_started_at)
+           VALUES ($1::uuid, $2, 'ready', $3, $4, $5, $6, $7)\`,
+          [
+            resourceRef,
+            cleanupDeadlineAt,
+            expiresAt,
+            'exports/' + resourceRef,
+            'opaque:record:' + resourceRef,
+            'opaque:subject:' + resourceRef,
+            uploadStartedAt,
+          ],
+        );
+      }
+      await observer.query(
+        \`INSERT INTO cleanup_deadline_reports
+           (deadline_at, feature, observed_at, resource_ref)
+         VALUES
+           ($1, 'confidential-export', $2, $3),
+           ($1, 'confidential-export', $4, $5)\`,
+        [
+          cleanupDeadlineAt,
+          '2026-08-02T12:00:01.000Z',
+          lowerResourceRef,
+          '2026-08-02T12:00:00.000Z',
+          higherResourceRef,
+        ],
+      );
+      const persistedOrder = await observer.query<{
+        resourceRef: string;
+      }>(
+        \`SELECT resource_ref AS "resourceRef"
+         FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'
+           AND resource_ref = ANY($1::text[])
+         ORDER BY observed_at, resource_ref\`,
+        [resourceRefs],
+      );
+      expect(persistedOrder.rows.map(({ resourceRef }) => resourceRef)).toEqual([
+        higherResourceRef,
+        lowerResourceRef,
+      ]);
+
+      const [cleanupBackend, reporterBackend] = await Promise.all([
+        cleanup.query<{ processId: number }>(
+          'SELECT pg_backend_pid() AS "processId"',
+        ),
+        reporter.query<{ processId: number }>(
+          'SELECT pg_backend_pid() AS "processId"',
+        ),
+      ]);
+      const cleanupProcessId = cleanupBackend.rows[0]?.processId;
+      const reporterProcessId = reporterBackend.rows[0]?.processId;
+      if (!cleanupProcessId || !reporterProcessId) {
+        throw new Error('Database process identity is unavailable.');
+      }
+      const firstCleanupReportLocked = deferred();
+      const reporterWaitingForCleanup = deferred();
+      const cleanupCommitCompleted = deferred();
+      let cleanupReportLocks = 0;
+      let cleanupObservationCommitted = false;
+      const cleanupDatabase = {
+        query: async (text: string, values?: readonly unknown[]) => {
+          const result = await query(cleanup, text, values);
+          if (
+            text.includes('SELECT deadline_at AS "deadlineAt"') &&
+            text.includes('FOR UPDATE')
+          ) {
+            cleanupReportLocks += 1;
+            if (cleanupReportLocks === 1) {
+              firstCleanupReportLocked.resolve();
+              await bounded(
+                reporterWaitingForCleanup.promise,
+                'Reporter lock-order rendezvous',
+              );
+            }
+          }
+          if (text === 'COMMIT') {
+            cleanupObservationCommitted = true;
+            cleanupCommitCompleted.resolve();
+          }
+          return result;
+        },
+      };
+      const reporterDatabase = {
+        query: async (text: string, values?: readonly unknown[]) => {
+          if (
+            text.includes('SELECT resource_ref AS "resourceRef"') &&
+            text.includes('FOR UPDATE')
+          ) {
+            await bounded(
+              firstCleanupReportLocked.promise,
+              'Cleanup lock-order rendezvous',
+            );
+            const pending = query(reporter, text, values);
+            void pending.catch(() => undefined);
+            await waitForExpectedBlocker(
+              observer,
+              reporterProcessId,
+              cleanupProcessId,
+            );
+            reporterWaitingForCleanup.resolve();
+            const result = await pending;
+            // PostgreSQL releases the row lock before the pg client's COMMIT
+            // continuation is necessarily scheduled. Join that continuation
+            // before the synchronous metric callback observes test state.
+            await bounded(
+              cleanupCommitCompleted.promise,
+              'Cleanup commit observation',
+            );
+            return result;
+          }
+          return query(reporter, text, values);
+        },
+      };
+      const reportedValues: number[] = [];
+      const settled = await bounded(
+        Promise.allSettled([
+          cleanupDueRecordExports(
+            {
+              correlationId: 'cleanup-deadline-lock-order',
+              maximumBatches: 1,
+              now: cleanupDeadlineAt,
+              principal: cleanupPrincipal,
+              shouldContinue: () => false,
+            },
+            { withDatabase: async (_context, _workload, operation) =>
+              operation(cleanupDatabase as never) },
+          ),
+          reportExportCleanupDeadlineBreaches(
+            {
+              correlationId: 'report-deadline-lock-order',
+              report: (value) => {
+                expect(cleanupObservationCommitted).toBe(true);
+                reportedValues.push(value);
+                return true;
+              },
+            },
+            { withDatabase: async (_context, _workload, operation) =>
+              operation(reporterDatabase as never) },
+          ),
+        ]),
+        'Concurrent confidential-export deadline operations',
+        30_000,
+      );
+      const rejectionCodes = settled.flatMap((result) =>
+        result.status === 'rejected'
+          ? [databaseErrorCode(result.reason)]
+          : [],
+      );
+      expect(rejectionCodes).not.toContain('40P01');
+      expect(rejectionCodes).not.toContain('55P03');
+      expect(settled.map(({ status }) => status)).toEqual([
+        'fulfilled',
+        'fulfilled',
+      ]);
+      if (settled[0]?.status !== 'fulfilled') throw settled[0]?.reason;
+      if (settled[1]?.status !== 'fulfilled') throw settled[1]?.reason;
+      expect(settled[0].value).toMatchObject({
+        batches: 0,
+        deadlineBreached: true,
+        processed: 0,
+        remainingDeadlineBreaches: 2,
+        remainingDue: 2,
+      });
+      expect(settled[1].value).toEqual({
+        continuationRequired: false,
+        reported: 2,
+      });
+      expect(reportedValues).toEqual([2]);
+
+      const durableReports = await observer.query<{ resourceRef: string }>(
+        \`SELECT resource_ref AS "resourceRef"
+         FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'
+           AND resource_ref = ANY($1::text[])
+         ORDER BY resource_ref\`,
+        [resourceRefs],
+      );
+      expect(durableReports.rows).toEqual([]);
+      const activeArtifacts = await observer.query<{ approvalRequestId: string }>(
+        \`SELECT approval_request_id::text AS "approvalRequestId"
+         FROM data_lifecycle_export_artifacts
+         WHERE approval_request_id = ANY($1::uuid[])
+         ORDER BY approval_request_id\`,
+        [resourceRefs],
+      );
+      expect(
+        activeArtifacts.rows.map(({ approvalRequestId }) => approvalRequestId),
+      ).toEqual(resourceRefs);
+    } finally {
+      await observer
+        .query(
+          \`DELETE FROM cleanup_deadline_reports
+           WHERE feature = 'confidential-export'
+             AND resource_ref = ANY($1::text[])\`,
+          [resourceRefs],
+        )
+        .catch(() => undefined);
+      await observer
+        .query(
+          'DELETE FROM data_lifecycle_export_artifacts WHERE approval_request_id = ANY($1::uuid[])',
+          [resourceRefs],
+        )
+        .catch(() => undefined);
+      await observer
+        .query(
+          'DELETE FROM approval_requests WHERE id = ANY($1::uuid[])',
+          [resourceRefs],
+        )
+        .catch(() => undefined);
+      await Promise.all([
+        cleanup.end().catch(() => undefined),
+        reporter.end().catch(() => undefined),
+        observer.end().catch(() => undefined),
+      ]);
+    }
+  });
+
+  it('serializes concurrent capacity decisions at the 1,000-report boundary', async () => {
+    const deadlineAt = new Date('2026-08-02T12:00:00.000Z');
+    const writerRefs = [
+      'capacity-proof-writer-a',
+      'capacity-proof-writer-b',
+    ] as const;
+    const first = new Client({ connectionString: databaseUrl });
+    const second = new Client({ connectionString: databaseUrl });
+    const observer = new Client({ connectionString: databaseUrl });
+    const firstCapacityLocked = deferred();
+    const releaseFirstCapacity = deferred();
+    try {
+      await Promise.all([first.connect(), second.connect(), observer.connect()]);
+      await first.query("SET lock_timeout = '10s'");
+      await second.query("SET lock_timeout = '0'");
+      for (const client of [first, second]) {
+        await client.query("SET statement_timeout = '20s'");
+      }
+      await observer.query(
+        \`DELETE FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'
+           AND resource_ref LIKE 'capacity-proof-%'\`,
+      );
+      const existing = await observer.query<{ count: string }>(
+        \`SELECT count(*)::text AS count
+         FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'\`,
+      );
+      const existingCount = Number(existing.rows[0]?.count ?? 0);
+      if (existingCount > 999) {
+        throw new Error(
+          'Capacity proof requires at most 999 pre-existing reports.',
+        );
+      }
+      const seedCount = 999 - existingCount;
+      await observer.query(
+        \`INSERT INTO cleanup_deadline_reports
+           (deadline_at, feature, resource_ref)
+         SELECT $1, 'confidential-export',
+                'capacity-proof-seed-' || generate_series
+         FROM generate_series(1, $2::integer)\`,
+        [deadlineAt.toISOString(), seedCount],
+      );
+      const [firstBackend, secondBackend] = await Promise.all([
+        first.query<{ processId: number }>(
+          'SELECT pg_backend_pid() AS "processId"',
+        ),
+        second.query<{ processId: number }>(
+          'SELECT pg_backend_pid() AS "processId"',
+        ),
+      ]);
+      const firstProcessId = firstBackend.rows[0]?.processId;
+      const secondProcessId = secondBackend.rows[0]?.processId;
+      if (!firstProcessId || !secondProcessId) {
+        throw new Error('Writer database process identity is unavailable.');
+      }
+
+      const writeReport = async (
+        client: Client,
+        resourceRef: string,
+        pauseAfterCapacityLock = false,
+      ) => {
+        await client.query('BEGIN');
+        const database = {
+          query: async (text: string, values?: readonly unknown[]) => {
+            const result = await query(client, text, values);
+            if (
+              pauseAfterCapacityLock &&
+              text.includes('FROM cleanup_deadline_report_capacity') &&
+              text.includes('FOR UPDATE')
+            ) {
+              firstCapacityLocked.resolve();
+              await bounded(
+                releaseFirstCapacity.promise,
+                'Capacity serialization release',
+              );
+            }
+            return result;
+          },
+        };
+        try {
+          await recordPreparedExportCleanupDeadlineReport(database as never, {
+            approvalRequestId: resourceRef,
+            cleanupDeadlineAt: deadlineAt,
+            expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+            lifecycleStatus: 'artifact-deletion-in-progress',
+            now: deadlineAt.toISOString(),
+            uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+          });
+          await client.query('COMMIT');
+        } catch (error) {
+          await client.query('ROLLBACK').catch(() => undefined);
+          throw error;
+        }
+      };
+
+      const firstWrite = writeReport(first, writerRefs[0], true);
+      await bounded(firstCapacityLocked.promise, 'First capacity lock');
+      const secondWrite = writeReport(second, writerRefs[1]);
+      await waitForExpectedBlocker(
+        observer,
+        secondProcessId,
+        firstProcessId,
+      );
+      releaseFirstCapacity.resolve();
+      await bounded(
+        Promise.all([firstWrite, secondWrite]),
+        'Concurrent capacity-bound report writes',
+        30_000,
+      );
+
+      const finalInventory = await observer.query<{
+        count: string;
+      }>(
+        \`SELECT count(*)::text AS count
+         FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'\`,
+      );
+      expect(Number(finalInventory.rows[0]?.count)).toBe(1_000);
+      const persistedWriters = await observer.query<{ resourceRef: string }>(
+        \`SELECT resource_ref AS "resourceRef"
+         FROM cleanup_deadline_reports
+         WHERE feature = 'confidential-export'
+           AND resource_ref = ANY($1::text[])
+         ORDER BY resource_ref\`,
+        [writerRefs],
+      );
+      expect(persistedWriters.rows).toHaveLength(1);
+    } finally {
+      releaseFirstCapacity.resolve();
+      await Promise.all([
+        first.query('ROLLBACK').catch(() => undefined),
+        second.query('ROLLBACK').catch(() => undefined),
+      ]);
+      await observer
+        .query(
+          \`DELETE FROM cleanup_deadline_reports
+           WHERE feature = 'confidential-export'
+             AND resource_ref LIKE 'capacity-proof-%'\`,
+        )
+        .catch(() => undefined);
+      await Promise.all([
+        first.end().catch(() => undefined),
+        second.end().catch(() => undefined),
+        observer.end().catch(() => undefined),
+      ]);
+    }
+  });
+});
+`;
+}
+function renderDataRightsTestSource(name, pascalName) {
+    return `import {
+  DeleteObjectsCommand,
+  ListObjectVersionsCommand,
+  PutObjectCommand,
+} from '@aws-sdk/client-s3';
+import {
+  beginApprovalExecution,
+  createApprovalRequest,
+  decideApprovalRequest,
+  type AuthorizationPrincipal,
+} from '@empire-builder-kit/runtime/authorization';
+import { parseDataLifecycleChangeEvent } from '@empire-builder-kit/runtime/data-lifecycle';
+import { describe, expect, it, vi } from 'vitest';
+import { createRecordCorrectionArtifacts } from '../data/record-correction.js';
+import {
+  cleanupDueRecordExports,
+  putEncryptedExport,
+  recordExportCleanupDeadlineAt,
+  recordExportExpiresAt,
+  recordExportObjectKey,
+  recordExportSchedule,
+  recordFinalizedExportCleanupDeadlineReport,
+  recordPreparedExportCleanupDeadlineReport,
+  reportExportCleanupDeadlineBreaches,
+  runExportObjectCleanupAttempt,
+  type ExportObjectCleanupResult,
+  type ExportObjectVersion,
+  type RecordExportObjectStore,
+} from '../data/record-export.js';
+import { createRecordHold } from '../data/record-holds.js';
+import { createDataExportCleanupHandler } from '../jobs/data-export-cleanup.js';
+import {
+  DATA_RIGHTS_POLICY_VERSION,
+  dataRightsSubjectReference,
+  requireDirectAdmin,
+} from '../data/data-rights-shared.js';
+
+const directAdmin: AuthorizationPrincipal = {
+  actor: { id: 'admin-1', type: 'user' },
+  authority: { mode: 'direct' },
+  kind: 'admin',
+  roles: ['${name}-admin'],
+  scopes: [],
+  subject: { id: 'admin-1', type: 'user' },
+};
+
+const directOwner: AuthorizationPrincipal = {
+  actor: { id: 'record-owner', type: 'user' },
+  authority: { mode: 'direct' },
+  kind: 'customer',
+  roles: [],
+  scopes: [],
+  subject: { id: 'record-owner', type: 'user' },
+};
+
+const cleanupAgent: AuthorizationPrincipal = {
+  actor: { id: '${name}:data-export-cleanup', type: 'service' },
+  audience: '${name}:data-export-cleanup',
+  authority: {
+    machineIdentityId: '${name}:data-export-cleanup',
+    mode: 'machine',
+  },
+  kind: 'agent',
+  roles: [],
+  scopes: [],
+  subject: { id: '${name}:data-export-cleanup', type: 'service' },
+};
+
+interface CleanupCandidate {
+  approvalRequestId: string;
+  cleanupDeadlineAt: Date | null;
+  expiresAt: Date;
+  recordReference: string;
+  uploadStartedAt: Date | null;
+}
+
+class FakeCleanupDatabase {
+  clockTimestamp = new Date('2026-08-02T12:00:00.000Z');
+  failCommitOnce = false;
+  maximumPendingReports = ${PENDING_EXPORT_CLEANUP_REPORT_BOUND};
+  readonly pendingReports = new Set<string>();
+  readonly queries: string[] = [];
+  readonly reportDeadlines = new Map<string, Date>();
+  private reportDeadlineTransactionSnapshot: Map<string, Date> | null =
+    null;
+  private reportTransactionSnapshot: Set<string> | null = null;
+
+  constructor(readonly candidates: CleanupCandidate[]) {}
+
+  async query<Row>(
+    text: string,
+    values: readonly unknown[] = [],
+  ): Promise<{ rowCount: number; rows: Row[] }> {
+    this.queries.push(text);
+    if (text === 'BEGIN') {
+      this.reportTransactionSnapshot = new Set(this.pendingReports);
+      this.reportDeadlineTransactionSnapshot = new Map(
+        this.reportDeadlines,
+      );
+      return { rowCount: 0, rows: [] };
+    }
+    if (text === 'COMMIT') {
+      if (this.failCommitOnce) {
+        this.failCommitOnce = false;
+        throw new Error('simulated post-emission commit failure');
+      }
+      this.reportDeadlineTransactionSnapshot = null;
+      this.reportTransactionSnapshot = null;
+      return { rowCount: 0, rows: [] };
+    }
+    if (text === 'ROLLBACK') {
+      if (this.reportTransactionSnapshot) {
+        this.pendingReports.clear();
+        for (const resourceRef of this.reportTransactionSnapshot) {
+          this.pendingReports.add(resourceRef);
+        }
+      }
+      if (this.reportDeadlineTransactionSnapshot) {
+        this.reportDeadlines.clear();
+        for (const [resourceRef, deadlineAt] of
+          this.reportDeadlineTransactionSnapshot) {
+          this.reportDeadlines.set(resourceRef, deadlineAt);
+        }
+      }
+      this.reportDeadlineTransactionSnapshot = null;
+      this.reportTransactionSnapshot = null;
+      return { rowCount: 0, rows: [] };
+    }
+    if (
+      text.includes('FROM cleanup_deadline_report_capacity') &&
+      text.includes('FOR UPDATE')
+    ) {
+      return {
+        rowCount: 1,
+        rows: [
+          {
+            maximumPending: this.maximumPendingReports,
+          } as Row,
+        ],
+      };
+    }
+    if (
+      text.includes('SELECT resource_ref AS "resourceRef"') &&
+      text.includes('FROM cleanup_deadline_reports')
+    ) {
+      const limit = Number(values[1]);
+      const rows = [...this.pendingReports]
+        .sort()
+        .slice(0, limit)
+        .map((resourceRef) => ({ resourceRef })) as Row[];
+      return { rowCount: rows.length, rows };
+    }
+    if (text.includes('DELETE FROM cleanup_deadline_reports')) {
+      for (const resourceRef of values[1] as readonly string[]) {
+        this.pendingReports.delete(resourceRef);
+        this.reportDeadlines.delete(resourceRef);
+      }
+      return { rowCount: 0, rows: [] };
+    }
+    if (text.includes('INSERT INTO cleanup_deadline_reports')) {
+      const deadlineAt = new Date(String(values[0]));
+      const resourceRef = String(values[2]);
+      const bound = Number(values[3]);
+      if (this.reportDeadlines.has(resourceRef)) {
+        return { rowCount: 0, rows: [] };
+      }
+      if (Number.isFinite(bound) && this.pendingReports.size >= bound) {
+        return { rowCount: 0, rows: [] };
+      }
+      this.reportDeadlines.set(resourceRef, deadlineAt);
+      this.pendingReports.add(resourceRef);
+      return { rowCount: 1, rows: [] };
+    }
+    if (text.includes('SELECT deadline_at AS "deadlineAt"')) {
+      const resourceRef = String(values[1]);
+      const deadlineAt = this.reportDeadlines.get(resourceRef);
+      return {
+        rowCount: deadlineAt ? 1 : 0,
+        rows: deadlineAt ? ([{ deadlineAt }] as Row[]) : [],
+      };
+    }
+    if (text.includes('SELECT clock_timestamp() AS "observedAt"')) {
+      return {
+        rowCount: 1,
+        rows: [{ observedAt: this.clockTimestamp } as Row],
+      };
+    }
+    if (text.includes('bounded_pending_reports')) {
+      return {
+        rowCount: 1,
+        rows: [{ count: String(this.pendingReports.size) } as Row],
+      };
+    }
+    if (
+      text.includes('ORDER BY approval_request_id') &&
+      text.includes('upload_started_at AS "uploadStartedAt"')
+    ) {
+      const limit = Number(values[0]);
+      return {
+        rowCount: Math.min(this.candidates.length, limit),
+        rows: this.candidates.slice(0, limit) as Row[],
+      };
+    }
+    if (
+      text.includes('ORDER BY expires_at, approval_request_id') &&
+      text.includes('cleanup_deadline_at AS "cleanupDeadlineAt"')
+    ) {
+      const now = Date.parse(String(values[0]));
+      const limit = Number(values[1]);
+      const cursorExpiresAt = values[2]
+        ? Date.parse(String(values[2]))
+        : null;
+      const cursorApprovalRequestId = values[3]
+        ? String(values[3])
+        : null;
+      const rows = this.candidates
+        .filter(({ approvalRequestId, expiresAt }) => {
+          if (expiresAt.getTime() > now) return false;
+          if (cursorExpiresAt === null) return true;
+          return (
+            expiresAt.getTime() > cursorExpiresAt ||
+            (expiresAt.getTime() === cursorExpiresAt &&
+              approvalRequestId > (cursorApprovalRequestId ?? ''))
+          );
+        })
+        .sort(
+          (left, right) =>
+            left.expiresAt.getTime() - right.expiresAt.getTime() ||
+            (left.approvalRequestId < right.approvalRequestId
+              ? -1
+              : left.approvalRequestId > right.approvalRequestId
+                ? 1
+                : 0),
+        )
+        .slice(0, limit);
+      return { rowCount: rows.length, rows: rows as Row[] };
+    }
+    if (
+      text.includes('count(*) FILTER') &&
+      text.includes('AS "remainingDeadlineBreaches"')
+    ) {
+      const now = Date.parse(String(values[0]));
+      const remainingDue = this.candidates.filter(
+        ({ expiresAt }) => expiresAt.getTime() <= now,
+      ).length;
+      const remainingDeadlineBreaches = this.candidates.filter(
+        ({ cleanupDeadlineAt }) =>
+          cleanupDeadlineAt === null ||
+          cleanupDeadlineAt.getTime() <= now,
+      ).length;
+      return {
+        rowCount: 1,
+        rows: [
+          {
+            remainingDeadlineBreaches:
+              String(remainingDeadlineBreaches),
+            remainingDue: String(remainingDue),
+          } as Row,
+        ],
+      };
+    }
+    throw new Error('Unexpected fake cleanup database query.');
+  }
+}
+
+function cleanupDependencies(
+  database: FakeCleanupDatabase,
+  cleanup: (candidate: CleanupCandidate) => Promise<'completed' | 'failed'>,
+) {
+  return {
+    cleanupExpiredRecordExport: (async (input: {
+      approvalRequestId: string;
+    }) => {
+      const candidate = database.candidates.find(
+        ({ approvalRequestId }) =>
+          approvalRequestId === input.approvalRequestId,
+      );
+      if (!candidate) throw new Error('Cleanup candidate is absent.');
+      const status = await cleanup(candidate);
+      if (status === 'completed') {
+        database.candidates.splice(
+          database.candidates.indexOf(candidate),
+          1,
+        );
+      }
+      return { deletedVersions: 1, status };
+    }) as never,
+    withDatabase: (async (
+      _context: unknown,
+      _workload: unknown,
+      operation: (client: unknown) => Promise<unknown>,
+    ) => operation(database)) as never,
+  };
+}
+
+class FakeExportObjectStore implements RecordExportObjectStore {
+  ambiguousDeleteError = false;
+  private nextVersion = 0;
+  readonly versions = new Map<
+    string,
+    { isDeleteMarker: boolean; key: string }
+  >();
+
+  async send(command: unknown): Promise<unknown> {
+    if (command instanceof PutObjectCommand) {
+      const versionId = 'version-' + String(++this.nextVersion);
+      this.versions.set(versionId, {
+        isDeleteMarker: false,
+        key: command.input.Key ?? '',
+      });
+      return { VersionId: versionId };
+    }
+    if (command instanceof ListObjectVersionsCommand) {
+      const prefix = command.input.Prefix ?? '';
+      return {
+        IsTruncated: false,
+        Versions: [...this.versions.entries()]
+          .filter(([, value]) => value.key === prefix)
+          .map(([VersionId, value]) => ({
+            Key: value.key,
+            VersionId,
+          })),
+      };
+    }
+    if (command instanceof DeleteObjectsCommand) {
+      const objects = command.input.Delete?.Objects ?? [];
+      for (const object of objects) {
+        if (object.VersionId) this.versions.delete(object.VersionId);
+      }
+      return this.ambiguousDeleteError && objects.length > 0
+        ? {
+            Errors: [
+              {
+                Code: 'InternalError',
+                Key: objects[0]?.Key,
+              },
+            ],
+          }
+        : { Errors: [] };
+    }
+    throw new Error('Unexpected fake export object-store command.');
+  }
+}
+
+type DurableVersion = ExportObjectVersion & {
+  status: 'deleted' | 'deletion-in-progress' | 'failed';
+};
+
+function cleanupAttempt<Result>(
+  objectKey: string,
+  objectStore: FakeExportObjectStore,
+  durable: Map<string, DurableVersion>,
+  finalize: (result: ExportObjectCleanupResult) => Promise<Result>,
+): Promise<Result> {
+  return runExportObjectCleanupAttempt({
+    finalize,
+    objectKey,
+    objectStore,
+    recordDiscovered: async (versions) => {
+      for (const version of versions) {
+        durable.set(version.versionId, {
+          ...version,
+          status: 'deletion-in-progress',
+        });
+      }
+    },
+    trackedVersions: [...durable.values()].filter(
+      ({ status }) => status !== 'deleted',
+    ),
+  });
+}
+
+describe('${pascalName} generated data-rights workflows', () => {
+  it('requires direct admin authority for hold and approval administration', () => {
+    expect(requireDirectAdmin(directAdmin)).toBe(directAdmin);
+    expect(() =>
+      requireDirectAdmin({
+        ...directAdmin,
+        audience: 'admin-1',
+        authority: {
+          delegatedBy: { id: 'admin-1', type: 'user' },
+          delegationId: 'delegation-1',
+          mode: 'delegated',
+        },
+      }),
+    ).toThrow(/direct human principal/i);
+    expect(() => requireDirectAdmin(directOwner)).toThrow(/direct admin/i);
+  });
+
+  it('builds an exact pseudonymous record hold with bounded effects', () => {
+    const hold = createRecordHold(
+      {
+        effects: ['block-deletion', 'block-export'],
+        expiresAt: '2026-08-20T12:00:00.000Z',
+        principal: directAdmin,
+        purpose: 'legal',
+        recordId: '00000000-0000-4000-8000-000000000001',
+        reviewAt: '2026-08-10T12:00:00.000Z',
+      },
+      '2026-08-01T12:00:00.000Z',
+    );
+    expect(hold).toMatchObject({
+      categoryId: 'product-record',
+      effects: ['block-deletion', 'block-export'],
+      purpose: 'legal',
+      status: 'active',
+    });
+    expect(hold.scopeRef).toMatch(/^opaque:/);
+    expect(JSON.stringify(hold)).not.toContain(
+      '00000000-0000-4000-8000-000000000001',
+    );
+  });
+
+  it('leaves scan and retry intervals inside the one-day maximum', () => {
+    expect(recordExportExpiresAt('2026-08-01T12:00:00.000Z')).toBe(
+      '2026-08-02T09:00:00.000Z',
+    );
+    expect(
+      recordExportCleanupDeadlineAt('2026-08-01T12:00:00.000Z'),
+    ).toBe('2026-08-02T12:00:00.000Z');
+    expect(
+      recordExportSchedule('2026-08-01T12:00:00.000Z'),
+    ).toEqual({
+      cleanupDeadlineAt: '2026-08-02T12:00:00.000Z',
+      expiresAt: '2026-08-02T09:00:00.000Z',
+      uploadStartedAt: '2026-08-01T12:00:00.000Z',
+    });
+    expect(() =>
+      recordExportSchedule('2026-08-01T12:00:00.000Z', {
+        cleanupDeadlineAt: '2026-08-02T12:00:00.000Z',
+        expiresAt: '2026-08-02T08:59:59.999Z',
+        uploadStartedAt: '2026-08-01T12:00:00.000Z',
+      }),
+    ).toThrow(/schedule is inconsistent/i);
+    expect(() =>
+      recordExportSchedule('2026-08-01T12:00:00.000Z', {
+        cleanupDeadlineAt: '2026-08-02T12:00:00.000Z',
+        expiresAt: '2026-08-02T09:00:00.000Z',
+      }),
+    ).toThrow(/schedule is incomplete/i);
+    expect(
+      recordExportObjectKey('00000000-0000-4000-8000-000000000001'),
+    ).toBe(
+      'confidential-exports/00000000-0000-4000-8000-000000000001/record.json',
+    );
+  });
+
+  it('denies an export approval issued under a stale policy version', () => {
+    const recordId = '00000000-0000-4000-8000-000000000001';
+    const command = { recordId };
+    const pending = createApprovalRequest({
+      action: '${name}:record-export',
+      author: directOwner,
+      command,
+      expiresAt: '2026-08-01T13:00:00.000Z',
+      now: '2026-08-01T12:00:00.000Z',
+      policyVersion: '1.0.0',
+      resource: { id: recordId, type: 'record' },
+      slice: '${name}',
+    });
+    expect(
+      decideApprovalRequest(pending, {
+        approver: directAdmin,
+        expectedRequestDigest: pending.requestDigest,
+        now: '2026-08-01T12:05:00.000Z',
+        outcome: 'approved',
+        reasonReference: 'privacy-review-stale',
+        requiredPolicyVersion: '2.0.0',
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: pending,
+    });
+    const approved = decideApprovalRequest(pending, {
+      approver: directAdmin,
+      expectedRequestDigest: pending.requestDigest,
+      now: '2026-08-01T12:05:00.000Z',
+      outcome: 'approved',
+      reasonReference: 'privacy-review-1',
+      requiredPolicyVersion: '1.0.0',
+    }).request;
+
+    expect(
+      beginApprovalExecution(approved, {
+        action: '${name}:record-export',
+        command,
+        executionId: 'export:' + pending.id,
+        now: '2026-08-01T12:06:00.000Z',
+        requiredPolicyVersion: '2.0.0',
+        resource: { id: recordId, type: 'record' },
+      }),
+    ).toMatchObject({
+      decision: {
+        category: 'policy-stale',
+        decision: 'deny',
+        policyVersion: '2.0.0',
+      },
+      request: { status: 'approved' },
+    });
+  });
+
+  it('builds a correction ledger and minimized cross-Slice event together', () => {
+    process.env.EVENT_BUS_NAME = 'fixture-events';
+    process.env.EBK_STAGE = 'development';
+    const artifacts = createRecordCorrectionArtifacts({
+      correlationId: 'correction-1',
+      name: 'Synthetic correction',
+      now: '2026-08-01T12:00:00.000Z',
+      principal: directAdmin,
+      recordId: '00000000-0000-4000-8000-000000000001',
+      runScope: 'unit3-fixture',
+    });
+    expect(artifacts.ledger.action).toBe('correction');
+    expect(artifacts.ledger.pseudonymousKey).toMatch(/^opaque:/);
+    const event = JSON.parse(artifacts.event.Detail ?? '{}');
+    const lifecycle = parseDataLifecycleChangeEvent(event.data);
+    expect(lifecycle).toMatchObject({
+      action: 'correction',
+      policyVersion: DATA_RIGHTS_POLICY_VERSION,
+      sourceSlice: '${name}',
+    });
+    expect(JSON.stringify(lifecycle)).not.toContain(
+      '00000000-0000-4000-8000-000000000001',
+    );
+  });
+
+  it('uses the runtime pseudonymous-reference implementation for subjects', () => {
+    expect(dataRightsSubjectReference('subject-1')).toMatch(/^opaque:/);
+    expect(dataRightsSubjectReference('subject-1')).toBe(
+      dataRightsSubjectReference('subject-1'),
+    );
+  });
+
+  it('records cleanup deadline reports at exact production decision points', async () => {
+    const schedule = {
+      cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+      expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+      uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+    };
+    const completed = new FakeCleanupDatabase([]);
+    await recordPreparedExportCleanupDeadlineReport(completed as never, {
+      approvalRequestId: 'completed-export',
+      ...schedule,
+      lifecycleStatus: 'completed',
+      now: '2026-08-03T12:00:00.000Z',
+    });
+    expect(completed.pendingReports.size).toBe(0);
+
+    const beforeDeadline = new FakeCleanupDatabase([]);
+    await recordPreparedExportCleanupDeadlineReport(
+      beforeDeadline as never,
+      {
+        approvalRequestId: 'before-deadline-export',
+        ...schedule,
+        lifecycleStatus: 'artifact-deletion-in-progress',
+        now: '2026-08-02T11:59:59.999Z',
+      },
+    );
+    expect(beforeDeadline.pendingReports.size).toBe(0);
+
+    const atDeadline = new FakeCleanupDatabase([]);
+    await recordPreparedExportCleanupDeadlineReport(atDeadline as never, {
+      approvalRequestId: 'at-deadline-export',
+      ...schedule,
+      lifecycleStatus: 'artifact-deletion-in-progress',
+      now: '2026-08-02T12:00:00.000Z',
+    });
+    expect(atDeadline.pendingReports).toEqual(
+      new Set(['at-deadline-export']),
+    );
+
+    const crossingDeadline = new FakeCleanupDatabase([]);
+    crossingDeadline.clockTimestamp =
+      new Date('2026-08-02T12:00:00.000Z');
+    await recordFinalizedExportCleanupDeadlineReport(
+      crossingDeadline as never,
+      {
+        approvalRequestId: 'crossing-deadline-export',
+        ...schedule,
+        now: '2026-08-02T11:59:59.999Z',
+      },
+    );
+    expect(crossingDeadline.pendingReports).toEqual(
+      new Set(['crossing-deadline-export']),
+    );
+
+    const conflict = new FakeCleanupDatabase([]);
+    conflict.pendingReports.add('conflicting-export');
+    conflict.reportDeadlines.set(
+      'conflicting-export',
+      new Date('2026-08-03T12:00:00.000Z'),
+    );
+    await expect(
+      recordPreparedExportCleanupDeadlineReport(conflict as never, {
+        approvalRequestId: 'conflicting-export',
+        ...schedule,
+        lifecycleStatus: 'artifact-deletion-in-progress',
+        now: '2026-08-02T12:00:00.000Z',
+      }),
+    ).rejects.toThrow(/deadline report is inconsistent/i);
+  });
+
+  it('keeps retained deletion authority independent of report inventory saturation', async () => {
+    const schedule = {
+      cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+      expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+      uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+    };
+    const saturated = new FakeCleanupDatabase([]);
+    for (let index = 0; index < ${PENDING_EXPORT_CLEANUP_REPORT_BOUND}; index += 1) {
+      const resourceRef = 'saturating-export-' + String(index);
+      saturated.pendingReports.add(resourceRef);
+      saturated.reportDeadlines.set(resourceRef, schedule.cleanupDeadlineAt);
+    }
+
+    await expect(
+      recordPreparedExportCleanupDeadlineReport(saturated as never, {
+        approvalRequestId: 'overflow-export',
+        ...schedule,
+        lifecycleStatus: 'artifact-deletion-in-progress',
+        now: '2026-08-02T12:00:00.000Z',
+      }),
+    ).resolves.toBeUndefined();
+    expect(saturated.pendingReports.size).toBe(
+      ${PENDING_EXPORT_CLEANUP_REPORT_BOUND},
+    );
+    expect(saturated.pendingReports.has('overflow-export')).toBe(false);
+
+    const invalidCapacity = new FakeCleanupDatabase([]);
+    invalidCapacity.maximumPendingReports =
+      ${PENDING_EXPORT_CLEANUP_REPORT_BOUND} - 1;
+    await expect(
+      recordPreparedExportCleanupDeadlineReport(invalidCapacity as never, {
+        approvalRequestId: 'invalid-capacity-export',
+        ...schedule,
+        lifecycleStatus: 'artifact-deletion-in-progress',
+        now: '2026-08-02T12:00:00.000Z',
+      }),
+    ).rejects.toThrow(/report capacity is invalid/i);
+  });
+
+  it('treats a concurrently acknowledged report as observed, not corrupt', async () => {
+    const schedule = {
+      cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+      expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+      uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+    };
+    const acknowledged = new FakeCleanupDatabase([]);
+    acknowledged.pendingReports.add('acknowledged-export');
+    acknowledged.reportDeadlines.set(
+      'acknowledged-export',
+      schedule.cleanupDeadlineAt,
+    );
+    const query = acknowledged.query.bind(acknowledged);
+    acknowledged.query = (async (text: string, values?: unknown[]) => {
+      if (text.includes('INSERT INTO cleanup_deadline_reports')) {
+        const result = await query(text, values);
+        acknowledged.pendingReports.delete('acknowledged-export');
+        acknowledged.reportDeadlines.delete('acknowledged-export');
+        return result;
+      }
+      return query(text, values);
+    }) as typeof acknowledged.query;
+
+    await expect(
+      recordPreparedExportCleanupDeadlineReport(acknowledged as never, {
+        approvalRequestId: 'acknowledged-export',
+        ...schedule,
+        lifecycleStatus: 'artifact-deletion-in-progress',
+        now: '2026-08-02T12:00:00.000Z',
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it('reports cleanup deadline state before and after exact expiry', async () => {
+    const approvalRequestId =
+      '00000000-0000-4000-8000-000000000021';
+    const candidate = (): CleanupCandidate => ({
+      approvalRequestId,
+      cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+      expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+      recordReference: 'opaque:record-21',
+      uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+    });
+
+    const beforeDeadline = new FakeCleanupDatabase([candidate()]);
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-before-deadline',
+          maximumBatches: 1,
+          now: '2026-08-02T11:59:59.999Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(beforeDeadline, async () => 'completed'),
+      ),
+    ).resolves.toMatchObject({
+      completed: 1,
+      continuationRequired: false,
+      deadlineBreached: false,
+      remainingDeadlineBreaches: 0,
+      remainingDue: 0,
+    });
+
+    const atDeadline = new FakeCleanupDatabase([candidate()]);
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-at-deadline',
+          maximumBatches: 1,
+          now: '2026-08-02T12:00:00.000Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(atDeadline, async () => 'completed'),
+      ),
+    ).resolves.toMatchObject({
+      completed: 1,
+      continuationRequired: false,
+      deadlineBreached: true,
+      remainingDeadlineBreaches: 0,
+      remainingDue: 0,
+    });
+
+    const failedCleanup = new FakeCleanupDatabase([candidate()]);
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-failed-at-deadline',
+          maximumBatches: 1,
+          now: '2026-08-02T12:00:00.000Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(failedCleanup, async () => {
+          throw new Error('simulated version cleanup failure');
+        }),
+      ),
+    ).resolves.toMatchObject({
+      completed: 0,
+      continuationRequired: true,
+      deadlineBreached: true,
+      remainingDeadlineBreaches: 1,
+      remainingDue: 1,
+      retryRequired: 1,
+    });
+    expect(failedCleanup.queries).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(
+          'cleanup_deadline_at AS "cleanupDeadlineAt"',
+        ),
+        expect.stringContaining('AS "remainingDeadlineBreaches"'),
+      ]),
+    );
+
+    const driftedSchedule = new FakeCleanupDatabase([
+      {
+        ...candidate(),
+        cleanupDeadlineAt: new Date('2026-08-03T12:00:00.000Z'),
+        expiresAt: new Date('2026-08-03T09:00:00.000Z'),
+      },
+    ]);
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-drifted-schedule',
+          maximumBatches: 1,
+          now: '2026-08-02T11:59:59.999Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(driftedSchedule, async () => 'completed'),
+      ),
+    ).rejects.toThrow(/schedule is inconsistent/i);
+
+    const incompleteSchedule = new FakeCleanupDatabase([
+      { ...candidate(), cleanupDeadlineAt: null },
+    ]);
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-incomplete-schedule',
+          maximumBatches: 1,
+          now: '2026-08-02T11:59:59.999Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(incompleteSchedule, async () => 'completed'),
+      ),
+    ).rejects.toThrow(/schedule is incomplete/i);
+  });
+
+  it('durably records an overdue bounded inventory when no cleanup loop can run', async () => {
+    const approvalRequestId =
+      '00000000-0000-4000-8000-000000000022';
+    const database = new FakeCleanupDatabase([
+      {
+        approvalRequestId,
+        cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+        expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+        recordReference: 'opaque:record-22',
+        uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+      },
+    ]);
+    const cleanup = vi.fn().mockResolvedValue('completed');
+    const invocation = {
+      correlationId: 'cleanup-no-loop-deadline',
+      maximumBatches: 1,
+      now: '2026-08-02T12:00:00.000Z',
+      principal: cleanupAgent,
+      shouldContinue: () => false,
+    };
+
+    await expect(
+      cleanupDueRecordExports(
+        invocation,
+        cleanupDependencies(database, cleanup),
+      ),
+    ).resolves.toMatchObject({
+      batches: 0,
+      continuationRequired: true,
+      deadlineBreached: true,
+      processed: 0,
+      remainingDeadlineBreaches: 1,
+      remainingDue: 1,
+    });
+    await expect(
+      cleanupDueRecordExports(
+        invocation,
+        cleanupDependencies(database, cleanup),
+      ),
+    ).resolves.toMatchObject({
+      batches: 0,
+      deadlineBreached: true,
+      processed: 0,
+    });
+    expect(cleanup).not.toHaveBeenCalled();
+    expect(database.pendingReports).toEqual(
+      new Set([approvalRequestId]),
+    );
+    expect(database.queries.filter((query) => query === 'BEGIN')).toHaveLength(2);
+    expect(database.queries.filter((query) => query === 'COMMIT')).toHaveLength(2);
+  });
+
+  it('commits an overdue deadline report before cleanup can fail', async () => {
+    const approvalRequestId =
+      '00000000-0000-4000-8000-000000000023';
+    const database = new FakeCleanupDatabase([
+      {
+        approvalRequestId,
+        cleanupDeadlineAt: new Date('2026-08-02T12:00:00.000Z'),
+        expiresAt: new Date('2026-08-02T09:00:00.000Z'),
+        recordReference: 'opaque:record-23',
+        uploadStartedAt: new Date('2026-08-01T12:00:00.000Z'),
+      },
+    ]);
+    const cleanup = vi.fn().mockImplementation(async () => {
+      expect(database.pendingReports).toEqual(
+        new Set([approvalRequestId]),
+      );
+      expect(database.queries).toContain('COMMIT');
+      throw new Error('simulated failure before cleanup reporting');
+    });
+
+    await expect(
+      cleanupDueRecordExports(
+        {
+          correlationId: 'cleanup-pre-report-failure',
+          maximumBatches: 1,
+          now: '2026-08-02T12:00:00.000Z',
+          principal: cleanupAgent,
+        },
+        cleanupDependencies(database, cleanup),
+      ),
+    ).resolves.toMatchObject({
+      completed: 0,
+      continuationRequired: true,
+      deadlineBreached: true,
+      retryRequired: 1,
+    });
+    expect(cleanup).toHaveBeenCalledOnce();
+    expect(database.pendingReports).toEqual(
+      new Set([approvalRequestId]),
+    );
+  });
+
+  it('emits one deadline signal and fails after best-effort cleanup', async () => {
+    process.env.EBK_STAGE = 'test';
+    process.env.EBK_WORKLOAD_IDENTITY =
+      '${name}:data-export-cleanup';
+    const emitted: Array<{ metricName?: string; value?: number }> = [];
+    const authorize = vi.fn().mockResolvedValue(undefined);
+    const cleanup = vi.fn().mockResolvedValue({
+      batches: 1,
+      completed: 1,
+      continuationRequired: false,
+      deadlineBreached: true,
+      processed: 1,
+      remainingDeadlineBreaches: 0,
+      remainingDue: 0,
+      retryRequired: 0,
+    });
+    const report = vi
+      .fn()
+      .mockImplementationOnce(async (input: { report(value: number): boolean }) => {
+        expect(input.report(0)).toBe(true);
+        return { continuationRequired: false, reported: 0 };
+      })
+      .mockImplementationOnce(async (input: { report(value: number): boolean }) => {
+        expect(input.report(1)).toBe(true);
+        return { continuationRequired: false, reported: 1 };
+      });
+    const handler = createDataExportCleanupHandler({
+      authorize: authorize as never,
+      cleanup: cleanup as never,
+      metrics: {
+        emit: (metric: { metricName?: string; value?: number }) => {
+          emitted.push(metric);
+          return {} as never;
+        },
+      } as never,
+      report: report as never,
+    });
+    await expect(
+      handler(
+        { id: 'cleanup-deadline-proof' },
+        { getRemainingTimeInMillis: () => 60_000 },
+      ),
+    ).rejects.toThrow('confidential-export-cleanup-deadline-breached');
+    expect(authorize).toHaveBeenCalledOnce();
+    expect(cleanup).toHaveBeenCalledOnce();
+    expect(report).toHaveBeenCalledTimes(2);
+    expect(emitted).toContainEqual(
+      expect.objectContaining({
+        metricName: 'DataExportCleanupDeadlineBreaches',
+        value: 1,
+      }),
+    );
+  });
+
+  it('retries a durable deadline report after post-emission commit failure', async () => {
+    const database = new FakeCleanupDatabase([]);
+    database.pendingReports.add(
+      '00000000-0000-4000-8000-000000000021',
+    );
+    database.failCommitOnce = true;
+    const firstEmission: number[] = [];
+    await expect(
+      reportExportCleanupDeadlineBreaches(
+        {
+          correlationId: 'cleanup-report-crash',
+          report: (value) => {
+            firstEmission.push(value);
+            return true;
+          },
+        },
+        { withDatabase: cleanupDependencies(database, async () => 'completed').withDatabase },
+      ),
+    ).rejects.toThrow('simulated post-emission commit failure');
+    expect(firstEmission).toEqual([1]);
+    expect(database.pendingReports.size).toBe(1);
+
+    const retryEmission: number[] = [];
+    await expect(
+      reportExportCleanupDeadlineBreaches(
+        {
+          correlationId: 'cleanup-report-retry',
+          report: (value) => {
+            retryEmission.push(value);
+            return true;
+          },
+        },
+        { withDatabase: cleanupDependencies(database, async () => 'completed').withDatabase },
+      ),
+    ).resolves.toEqual({ continuationRequired: false, reported: 1 });
+    expect(retryEmission).toEqual([1]);
+    expect(database.pendingReports.size).toBe(0);
+
+    const afterAcknowledgement: number[] = [];
+    await reportExportCleanupDeadlineBreaches(
+      {
+        correlationId: 'cleanup-report-after-ack',
+        report: (value) => {
+          afterAcknowledgement.push(value);
+          return true;
+        },
+      },
+      { withDatabase: cleanupDependencies(database, async () => 'completed').withDatabase },
+    );
+    expect(afterAcknowledgement).toEqual([0]);
+  });
+
+  it('recovers a post-put database rollback through durable orphan cleanup', async () => {
+    process.env.DATA_EXPORT_BUCKET_NAME = 'fixture-export-bucket';
+    process.env.DATA_EXPORT_KMS_KEY_ARN =
+      'arn:aws:kms:us-east-1:111122223333:key/fixture';
+    const objectKey = recordExportObjectKey(
+      '00000000-0000-4000-8000-000000000011',
+    );
+    const objectStore = new FakeExportObjectStore();
+    await expect(
+      (async () => {
+        await putEncryptedExport(objectKey, '{"id":"fixture"}', objectStore);
+        throw new Error('simulated database rollback after PutObject');
+      })(),
+    ).rejects.toThrow(/database rollback/);
+    expect(objectStore.versions.size).toBe(1);
+    const durable = new Map<string, DurableVersion>();
+    const result = await cleanupAttempt(
+      objectKey,
+      objectStore,
+      durable,
+      async (attempt) => {
+        for (const version of attempt.attemptedVersions) {
+          durable.set(version.versionId, {
+            ...version,
+            status: attempt.failedVersionIds.includes(version.versionId)
+              ? 'failed'
+              : 'deleted',
+          });
+        }
+        return attempt;
+      },
+    );
+    expect(result.failedVersionIds).toEqual([]);
+    expect(objectStore.versions.size).toBe(0);
+    expect([...durable.values()].map(({ status }) => status)).toEqual([
+      'deleted',
+    ]);
+  });
+
+  it('retries durable inventory after delete succeeds and DB finalization rolls back', async () => {
+    process.env.DATA_EXPORT_BUCKET_NAME = 'fixture-export-bucket';
+    process.env.DATA_EXPORT_KMS_KEY_ARN =
+      'arn:aws:kms:us-east-1:111122223333:key/fixture';
+    const objectKey = recordExportObjectKey(
+      '00000000-0000-4000-8000-000000000012',
+    );
+    const objectStore = new FakeExportObjectStore();
+    await putEncryptedExport(objectKey, '{"id":"fixture"}', objectStore);
+    const durable = new Map<string, DurableVersion>();
+    await expect(
+      cleanupAttempt(objectKey, objectStore, durable, async () => {
+        throw new Error('simulated cleanup finalization rollback');
+      }),
+    ).rejects.toThrow(/finalization rollback/);
+    expect(objectStore.versions.size).toBe(0);
+    expect([...durable.values()][0]?.status).toBe('deletion-in-progress');
+    const retried = await cleanupAttempt(
+      objectKey,
+      objectStore,
+      durable,
+      async (attempt) => attempt,
+    );
+    expect(retried.attemptedVersions).toHaveLength(1);
+    expect(retried.failedVersionIds).toEqual([]);
+    expect(retried.remainingVersions).toEqual([]);
+  });
+
+  it('fails a missing-VersionId delete error closed and tolerates overlapping finalization', async () => {
+    process.env.DATA_EXPORT_BUCKET_NAME = 'fixture-export-bucket';
+    process.env.DATA_EXPORT_KMS_KEY_ARN =
+      'arn:aws:kms:us-east-1:111122223333:key/fixture';
+    const objectKey = recordExportObjectKey(
+      '00000000-0000-4000-8000-000000000013',
+    );
+    const objectStore = new FakeExportObjectStore();
+    const versionId = await putEncryptedExport(
+      objectKey,
+      '{"id":"fixture"}',
+      objectStore,
+    );
+    objectStore.ambiguousDeleteError = true;
+    const durable = new Map<string, DurableVersion>();
+    const failed = await cleanupAttempt(
+      objectKey,
+      objectStore,
+      durable,
+      async (attempt) => attempt,
+    );
+    expect(failed.failedVersionIds).toEqual([versionId]);
+
+    objectStore.ambiguousDeleteError = false;
+    let completed = false;
+    const finalize = async (attempt: ExportObjectCleanupResult) => {
+      await Promise.resolve();
+      if (!completed && attempt.failedVersionIds.length === 0) {
+        completed = true;
+      }
+      return completed ? 'completed' : 'retry-required';
+    };
+    const results = await Promise.all([
+      cleanupAttempt(objectKey, objectStore, durable, finalize),
+      cleanupAttempt(objectKey, objectStore, durable, finalize),
+    ]);
+    expect(results).toEqual(['completed', 'completed']);
+  });
+});
+`;
+}
+//# sourceMappingURL=built-in-plan-data-rights-files.js.map