Expiry looks like housekeeping. A timestamp passes, a background worker finds the stale row, and the system moves it to a terminal state.
That model is safe only when your database is authoritative for the outcome. The moment another system can complete the work, a timeout becomes much weaker evidence. It tells you that your local clock ran out. It does not prove that nothing happened elsewhere.
A recent committed C# change made this distinction concrete. The implementation and names are private, but the lesson is broadly useful: before an expiry worker made an irreversible local transition, it first reconciled with the external authority.
The Failure Hidden Inside a Timer
Consider a generalized hosted operation:
