A user clicks Export twice because the first click shows no feedback. The API creates two jobs. A worker retries one after losing its acknowledgement, producing a third object. The UI eventually displays three links for the same request. Disabling the button reduces accidental clicks; it does not make the workflow correct. The invariant belongs across every layer: One authorized export intent maps to one durable operation and one logical artifact, despite duplicate delivery. ...