[beinan]

Recovery of an interrupted native publisher can create its first durable failure record after the supervisor has checked admission. The fresh two-second cooldown previously made run_as reject the same pass immediately, which the supervisor counted as another failed execution and extended into a four-minute delay.

Wait for up to two seconds of durable cooldown before reserving a new maintenance execution, then reread the failure record before starting payload work. Longer delays still return the existing retry error. The change does not clear failure budgets, bypass storage fencing, or start an additional execution attempt.

Validation: real-etcd regressions cover recovery materializing a new catch-up deadline, continuation only after that deadline, rejection of an extended deadline, and preservation of long failure budgets. All 142 master tests passed against real etcd; master Clippy (--all-targets -- -D warnings), formatting, and git diff --check passed. Longer newly materialized deadlines still use the existing deferred error; this narrow fix addresses the observed two-second recovery cooldown.