It looks like that draft is up now. Step one is moving off of cron. Then we can meaningfully respect Retry-After when it appears. But we'll keep an eye on ARI and design with the renewal URL concept in mind.
As probably expected, no "during secondary validation" errors occurred during the 01:00 - 02:00 UTC window today with the standard complement of cert renewals running. So I think we can stick a fork in this one. Great work, @jcjones! We really appreciate you and the whole LE team!