How does a streaming system know when a window is finished?

It does not know, and nothing it can observe would tell it. It decides: it takes the largest event time it has seen so far, subtracts an allowance you picked in advance, and treats every window ending before that result as finished.

Call the largest event time seen $m$ and the allowance $d$. The result $w = m - d$ is the watermark. A window is emitted when its end falls below $w$, so a one-minute window ending at 10:09:00 is emitted the first moment $m$ reaches 10:09:00 plus $d$.

Take $d = 120$ seconds and suppose the event times seen so far run up to 10:12:30. Then $w = 10{:}12{:}30 - 2{:}00 = 10{:}10{:}30$. The window covering 10:00:00 to 10:10:00 ends at 10:10:00, which is 30 seconds below $w$, so it closes and is reported.

Running that backwards gives the exact trigger: the window closed the instant an event with event time 10:12:00 arrived, because $10{:}12{:}00 - 2{:}00 = 10{:}10{:}00$. Any event stamped 10:09:55 that turns up after that instant is not counted. It raises no error, it is not retried, it simply falls outside a window that has already been computed. The published figure is a little low and the figure itself gives no sign of it.

Note which term is which. $m$ is data: it moves forward only when events arrive, and it stops when they stop. $d$ is a configuration value, and it is the single place where a person states how much lateness is tolerable.

The natural guess is that the system is waiting for the last relevant event, and that a well-built one would notice when it had arrived. Nothing distinguishes that moment. Silence from a source with nothing to send and silence from a source whose network is down are the same observation, which is to say none. A gap in sequence numbers proves that something is missing, not that nothing further is coming, and a phone that has been in a tunnel will sync in four minutes or four days with the first three days looking identical. Even the check that every source has reported in fails, because a device that has not connected for a week is a source you do not know exists. The only definite answer available is the negative one: a recent arrival with a 10:09 timestamp proves the 10:09 window is incomplete. Its absence proves nothing at all.

Since $d$ is a judgement, set it from measurement rather than taste. Record the gap between arrival time and event time for every event, build the distribution, pick a percentile, and write the percentile down. If the ninety-ninth percentile of measured lateness is 200 seconds, then $d = 200$ s means roughly one event in a hundred arrives too late to be counted, and the sentence "we exclude about one per cent of events, and here is what happens to them" is a defensible thing to have written.

The cost of raising $d$ is memory as well as delay. At 50 events per second, a 200 second allowance keeps about $50 \times 200 = 10{,}000$ events of open state; 400 seconds keeps 20,000 for a gain in coverage that the tail of the distribution makes very small. The cost of lowering it is invisible rather than slow, and invisible is worse: a slow pipeline is noticed, an undercounted total is not.

Completeness has to hold across every input, so the believed point is the minimum of the per-partition points. One partition that stops for forty minutes holds every window open, and one partition that is merely idle does exactly the same for a completely benign reason: no events means nothing to push its point forward. Every system therefore has an idleness setting, which excludes a partition from the minimum after a stated interval with no data. Leaving it unset is how this behaviour gets discovered at an inconvenient moment, and setting it very short declares completeness while a partition is only slow.

A second consequence surprises people: closing time depends on traffic. A busy period pushes $m$ forward quickly and the hourly window is out at 10:04; the same window on a quiet night waits for something to arrive and is out at 10:40. Neither run is faulty. Systems that need output on a silent source let $w$ also advance with wall-clock time once the source is known to be idle.

The reasoning assumes an open-ended source. If the input is a finite file with a real end-of-input marker, completeness is knowable, the marker is evidence, and the job is a batch job that may as well wait for it. The guess is forced only where arrivals have no end.

The two extremes also show what $d$ is doing. At $d = 0$ the watermark is the last event time, so any event that arrives out of order is silently dropped. At a very large $d$, or under a stalled source with no wall-clock fallback, nothing ever closes and memory grows without bound. The setting is not a safety margin bolted onto a correct mechanism; it is the mechanism.