The runtime does everything except decide what a failure means. It reports an outcome and settles the message; retry policy and state transition are control-plane decisions read from the workflow definition, which is what keeps retry behaviour a property of the workflow rather than of the worker image.
Cancellation is checked at receipt, before the idempotency claim. A cancelled execution's in-flight messages are dropped and settled rather than executed, so cancellation is fast without needing to reach into the queue.
Credentials are acquired per execution from the pod's workload identity, never read from environment or config. A handler receives a token with the scope it needs and nothing broader (view 28).
Timing and limits
Lock auto-renewal runs on a background timer and extends to a 2-hour ceiling for the long-running class. Renewal failure is treated as lease loss, and the handler is cancelled rather than allowed to continue against an expired lock.
The timeout watchdog enforces the per-task deadline independently of the lock, because a handler that hangs on a socket will not notice either one on its own.
Local semaphores bound in-process concurrency per type and per tenant, which is the last of the four backpressure points in view 21 and the only one that protects the pod itself.
Settlement rules
Abandon is used only for transient errors where an immediate redelivery is wanted. Everything else is completed with an emitted failure result, so the control plane owns the retry decision.
Native dead-lettering by the worker is reserved for unparseable envelopes. A business failure never dead-letters at the message layer, because the error context would be lost.
On SIGTERM the worker stops receiving, finishes or abandons its in-flight lease, then exits. terminationGracePeriodSeconds is set above the longest lock renewal window, which is what makes view 23's zero-downtime claim true.
