The author is not an engineer, and that single fact drives Section 9 of the requirement: a failure they cannot read is an unfinished feature.
The provider API is listed as an actor with a goal because it is the only party that can throttle us, and designing as if it were passive is how platforms get their application credentials suspended.
The connector developer is an actor because the catalogue is the growth ceiling, and their incentive is to ship rather than to classify replay safety honestly.
Assumptions
2.5 M active workspaces, 12 M enabled automations — so the median author owns a handful, and the distribution has a long dormant tail.
The workspace admin and the author are usually different people, and the admin finds out about a connection after it exists.
Risks
The operator cannot distinguish our backlog from a provider's slowness without the per-provider health signal in view 17.
Nobody in this cast is accountable for a dormant automation that will fire wrongly in six months.