What the active-user constraint actually means
Simple triggers (onOpen, onEdit, onSelectionChange, onInstall, doGet, doPost) execute immediately in response to a user action, under that user's identity, with zero OAuth prompts. That sounds convenient until you try to call GmailApp, send an email, or hit an external API — those services require authorization, and simple triggers cannot request it. The script silently fails or throws a vague 'authorization required' error that shows up nowhere obvious.
The 30-second execution limit is a second wall. A simple onEdit that writes back one cell is fine. One that iterates 500 rows, calls an external API, or triggers a chain of SpreadsheetApp reads will hit the wall. The function terminates mid-run with no retry and no log entry in the execution transcript unless you have Stackdriver logging wired up.
The first time I hit this, I wasted an afternoon thinking the logic was wrong. The logic was fine; the trigger type was wrong.