Interface SweepSLAOptions

Notification transport seam — fired once per escalated record, alongside (not instead of) onEscalation: onEscalation is the hosts' structured-log hook, notify is the reviewer-facing transport. Same containment as ApprovalServiceOptions.notify: failures audit as approval.notify/'error' and never abort the sweep.

Injectable clock (tests, deterministic SLA math).

Fired for each record escalated.

Live-stream fan-out seam — fired once per escalated record, alongside onEscalation and notify. Same containment as ApprovalServiceOptions.stream: a throwing or rejecting sink is audited as approval.stream/'error' and never aborts the sweep. The alarm handler has no request-scoped waitUntil, so the maintenance host collects each publish into its pendingSends and awaits it there (see host-kit's runSlaSweepMaintenance) — never fire-and-forget under a maintenance alarm.

Attribution identity for audit events (e.g. the worker's system principal). Attribution only — the sweep runs inside the trusted maintenance path, so there is no role check.

Automated kinds only, and REFUSED at runtime as well: a human here would stamp principalKind: 'human' onto maintenance escalations, which would misattribute automated work to a role-bearing human identity.