OptionalnotifyNotification transport for SLA escalations — threaded to SweepSLAOptions.notify (the cron runner already executes under the handler's waitUntil, so transports need no extra keep-alive here).
OptionalqueueOptional audit export queue.
factory.system() — the cron-only cross-tenant view.
OptionalstreamLive-stream fan-out sink for SLA escalations — the BARE hub-publish thunk
(event) => createHubTopology(env.HUB).publish(event), NOT wrapped in a
request-scoped waitUntil. A scheduled() handler runs under its OWN
waitUntil where a nested one is unavailable, so runSlaSweepMaintenance
COLLECTS each publish promise into its pendingSends and awaits it via the
terminal Promise.all — never fire-and-forget (which would be cancelled when
ctx.waitUntil(sweep()) settles) and never a nested waitUntil (which would
throw cross-request I/O). Undefined means no live escalation fan-out.
maintenancePrincipal(systemActorId). Typed as merely automated, not
vouched: the sweep derives no authority from the principal (the
SystemApprovalStore type is its authorization), so demanding the trust
brand here would ask for a token nothing on this path reads.
The firing cron expression — log correlation only.