The runtime uses explicit state, attempt ceilings, idempotency keys, lease recovery, structured failure behavior, and regression tests around replay semantics. One self-audit exposed a path where a single-attempt external job could become executable again after lease expiry; the fix now enforces the configured attempt ceiling across recovery.