Watch a retirement request through its waiting period
What It Does
The schedule protects a cancellable waiting period and rechecks authority before destructive work starts. Its notice delivery is at least once where send success precedes outcome persistence; the design does not promise exactly-once mail.
The Flow
The diagram separates the relevant success, alternative and failure paths. The numbered hop rows retain the detailed authority checks, delegated work and retry limits.
When Something Fails
A failed or unstarted watcher does not automatically acquire a replacement. Operator resume is the observed recovery path, and reliable stall detection remains an open finding.
The request identifies its authoritative schedule job; a superseded watcher settles without destructive action. Notice slots are unique by kind and due time, and recorded delivered/suppressed notices are skipped. A successful send followed by failed outcome persistence can be sent again. Hold, release and cancel refuse inapplicable repeated decisions.
Request and workspace locks serialize competing decisions and the destructive boundary. Schedule recovery refuses while the old execution is still running and repoints the request to replacement work.
Open Design Questions
The recorded findings retain any stronger planning expectation, missing writer or unproved recovery path. Observed behavior does not approve those outstanding product choices.