---
id: WF-PFM-QRY-020
title: Reconcile export coverage at each release
trigger: >-
  Platform activation commits its security catalog and then reconciles participant export
  declarations.
product_area: platform
module: queries
revision: 1
status: draft
design_intent: proposed
implementation_evidence: observed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
inference: []
implements:
  - CAP-PFM-QRY-018
moves:
  - STATE-PFM-QRY-012
crosses:
  - SVC-PFM-QRY-data-exports
idempotency: Unchanged declaration content creates no coverage write or registry-version increment.
concurrency: >-
  The computed plan is applied transactionally; activation sequencing supplies the expected
  single-release execution boundary.
hops:
  - 'n': 1
    actor_or_service: Manifest activation
    action: >-
      After catalog activation, collect local and remote participant declarations and invoke
      coverage reconciliation.
    anchor: >-
      services-platform:modules/data-exports/services/export-coverage/coverage-activation.ts:reconcileCoverageAtActivation
    seam: sync
    on_failure: Log and count failure without failing activation.
    left_inconsistent: Coverage can continue to describe an earlier release.
    observer: metric dataExports.coverage_reconcile_failed
    provenance: observed
    source: 'services-platform:modules/data-exports/services/export-coverage/coverage-activation.ts'
  - 'n': 2
    actor_or_service: Coverage planner
    action: >-
      Plan additions, schema-version changes, retirement and restoration while rejecting duplicate
      owners and conflicting recorded hashes.
    anchor: >-
      services-platform:modules/data-exports/services/export-coverage/reconcile-coverage.ts:planCoverage
    seam: sync
    on_failure: Log declaration conflicts and omit their writes.
    left_inconsistent: Conflicting datasets retain their previously accepted declaration.
    observer: metric dataExports.coverage_conflict
    provenance: observed
    source: 'services-platform:modules/data-exports/services/export-coverage/reconcile-coverage.ts'
  - 'n': 3
    actor_or_service: Coverage persistence
    action: >-
      Apply accepted declaration and version writes with the registry-version update in one
      transaction.
    anchor: 'services-platform:modules/data-exports/services/persistence/coverage-datasets.ts'
    seam: sync
    on_failure: Rollback a failed coverage write and report reconciliation failure.
    left_inconsistent: The registry retains its preceding committed contents.
    observer: HQ coverage reads
    provenance: observed
    source: 'services-platform:modules/data-exports/services/persistence/coverage-datasets.ts'
branches:
  - >-
    An absent datasets property leaves a service’s registry rows alone; an explicit empty list can
    retire them.
waits: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/data-exports/services/export-coverage/*.ts;
    services/persistence/coverage-datasets.ts; export-coverage/contract.ts;
    modules/security/authorizer/ports.postgres.ts (commitCatalog); docs/data-exports.md
controls: [TC-AVL-004, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-DAT-005, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-IAM-006, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-004, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
---

# Reconcile export coverage at each release

## What It Does

Platform activation commits its security catalog and then reconciles participant export declarations. An absent datasets property leaves a service’s registry rows alone; an explicit empty list can retire them.

## The Flow

```mermaid
sequenceDiagram
  participant C as Request or schedule
  participant H0 as Manifest activation
  participant H1 as Coverage planner
  participant H2 as Coverage persistence
  C->>H0: After catalog activation, collect local and remote participant declarations and invoke coverage reco
  H0->>H1: Plan additions, schema-version changes, retirement and restoration while rejecting duplicate owners 
  H1->>H2: Apply accepted declaration and version writes with the registry-version update in one transaction
```

After catalog activation, collect local and remote participant declarations and invoke coverage reconciliation. Plan additions, schema-version changes, retirement and restoration while rejecting duplicate owners and conflicting recorded hashes. Apply accepted declaration and version writes with the registry-version update in one transaction.

## When Something Fails

Log and count failure without failing activation. Coverage can continue to describe an earlier release. Log declaration conflicts and omit their writes. Conflicting datasets retain their previously accepted declaration. Rollback a failed coverage write and report reconciliation failure. The registry retains its preceding committed contents.

## Idempotency and Concurrency

Unchanged declaration content creates no coverage write or registry-version increment. The computed plan is applied transactionally; activation sequencing supplies the expected single-release execution boundary.