Transitions are validated, not merely applied. An ETag-guarded write with a legality check means an out-of-order message is rejected rather than silently overwriting a later state — the difference between eventual consistency and eventual corruption.
COMPLETED, CANCELLED and DEAD_LETTERED are the only terminal states. TIMED_OUT and FAILED route into retry triage, because a timeout is usually a transient condition wearing a different name.
WAITING_SLOT is a real state rather than queue delay. Making backpressure visible in the state machine is what allows an operator to distinguish 'the platform is saturated' from 'the platform is broken'.
Guards
Lease lost returns a task to SCHEDULED, not to FAILED. The worker died; the task did not fail, and the attempt count is not burned.
A permanent error class skips the retry budget entirely and dead-letters on the first attempt. Retrying a 400 five times is five ways to be wrong slower.
Cancellation is checked at dispatch and again at receipt, so a cancelled execution's in-flight tasks are dropped rather than run to completion (view 18).
Assumptions
Every transition emits an event, so this diagram and the event log in view 12 are the same machine viewed twice.
Task-level and workflow-level deadlines are both configurable; the workflow deadline wins and cancels its outstanding tasks.
Compensation on failure is a workflow-authoring pattern, not a platform state. There is no automatic rollback, and that is a deliberate V1 boundary.
