Four entry points, one execution path. Every mode produces the same execution document and the same outbox row, so nothing downstream of admission needs to know how a workflow was started.
Operator replay is modelled as a first-class trigger rather than a back door. It creates a new execution linked to its parent, which keeps the audit trail intact and keeps replay from mutating history.
Scheduling is a control-plane concern with an explicit misfire policy. A scheduler that was down for an hour must be told whether to skip, run once, or catch up — leaving it undefined is how duplicate month-end runs happen.
Semantics per mode
Immediate: idempotent on the client's Idempotency-Key, answered 202, p95 under 300 ms.
Scheduled: cron with IANA timezone and DST awareness, evaluated on a 60-second tick by the leader only (view 30), each fire claimed with a fencing token so a leader change cannot double-fire.
Event-driven: CloudEvents through Event Grid, filtered on eventType and tenantId, deduplicated on event id within a 24-hour window because Event Grid itself is at-least-once.
Risks
Catch-up misfire policy can produce a burst of executions after an outage. It is per-schedule configuration with a documented default of skip, and the burst is bounded by the tenant's concurrency lease.
The 24-hour dedupe window is a storage-versus-safety trade. A publisher that redelivers after 24 hours will cause a duplicate execution, which is why publishers are asked to include a stable event id.
Timezone-aware cron near DST boundaries is the classic source of missed or doubled runs. It is a named test case rather than an assumption.
