data-retention

Delete is a late state. A legal hold stops the machine in HELD. One Scheduler invocation on the retention date sits inside the 14 million free EventBridge Scheduler invocations a month. The first write revokes access. It does not delete objects.