When renewal and deployment run together

Renewal and deployment run together in the cases below, and when this cycle renews as the backstop. That renewal deploys in the same cycle. There is no extra exception for a short-lived certificate.

1. The certificate held on a target expires before the next cycle. TLSPilot looks at the certificate recorded on the target, not at the certificate in the inventory. It renews and deploys immediately. If a newer certificate already exists, it only deploys it. When the renewal attempts are exhausted, exactly one immediate attempt is made. If it fails, the next attempt is in the next cycle, also after a restart of the service.
2. ARI emergency with the switch on. The CA has pulled the window forward and Renew immediately on CA emergency is ON (the global switch, or On for this certificate). TLSPilot renews and deploys immediately (event 1221).
3. Force renew. You confirm, TLSPilot renews at the issuer and deploys to the targets. See chapter Renew a certificate early.
4. Renew without Force, when the certificate is due, from the API, the CLI, or Invoke-TLSPilotCertificateRenew. If it is not due, the command redeploys under the normal health rules and does not issue.
5. First issuance and revoke-and-replace. The new certificate is deployed as part of that operation.

The column shows Renew & Deploy: and the time, on an orange background, while case 1 or case 2 is already due.