This first paragraph in this section states:
"The TimeToLive element indicates the time by which a message should be
delivered to and processed by the To Party."
I don't think the above statement is correct. The message must be received
by the To Party MSH prior to its TimeToLive. Once it has been persisted by
the To Party MSH, it can be delivered to the To Party. If a crash occurs
after the message has been persisted but before it can be handed over to the
To Party, it is possible that it may be processed by the To Party (on crash
recovery) even after TimeToLive has expired.
-Arvola