[SignalLayerLabs]

Problem

Private scheduler requests remained fresh while storage alarms were late. The previous three-minute unattended proof passed, but subsequent quiet windows lost durable progression. An idle object could hibernate between requests and discard its unsaved physical work. Twenty hot snapshot parts also imposed a 130-minute checkpoint cadence, longer than the existing 120-second saved-state freshness requirement.

Change

Keep one autonomous local timer pending and register each asynchronous phase with ctx.waitUntil. Alarms remain the durable restart mechanism and precommit a successor before recovery. Both drivers coalesce onto one physical/save phase; they cannot queue writers. Only private scheduled requests activate the timer. Genuine incoming requests renew the platform CPU window; stale windows pause work, and saves/cold recovery require encoding headroom. Failed null-world reloads retain fifteen-second backoff and remain wakeable.

Stage at most four 1.5 MiB hot parts per atomic transaction, charging their writes plus one shared budget update. Final partial batches flush before publication. Charges survive failed publication, failed batches roll back together, and UTC accounting remains per transaction. Cadence, reservation and reported writes use these costs; twenty hot parts now allow a 96-minute cadence with the same 40k/60k admission limits.

Authority boundary

• Canonical mutation still flows only through the Sovereign World runtime.
• Observer-only logic does not write back into world state.
• AI output remains a proposal subject to deterministic validation.
• Human-linked identity does not import Earth knowledge into Citizens.

The existing world, Citizen IDs, private history/provenance, monotonic clock guard, chronological physics, cold-decode challenge and animations are retained. Autonomous verification thresholds are unchanged.

Evidence

• Nine new regressions cover the reproduced failures and authority boundaries: no-alarm physical progression, driver coalescing, Observer nonactivation, CPU renewal gaps, failed cold reload backoff, skipped-alarm recovery, mature checkpoint freshness, exact multi-part recovery and atomic interrupted batches.
• bash CHECK.sh . --skip-browser: 464 tests, deterministic Genesis and package manifest pass.
• Wrangler production bundle dry run passes. Independent review has no Critical/Important findings.
• Final native workerd five-minute proof with all alarm callbacks suppressed: 225 saved world minutes (619→844), lag87, all108 IDs, moved11/actions108/biology108. Knowledge1,880,342→2,016,419, memories55,296 and original private source preserved. Commit gaps117.94/116.50s; cadence110, no budget deferral or memory failure. Durable compressed history61.8MB with8.18MB resident bin cache. Earlier timer proof saved289 minutes from1.08m records.

Operational impact

No new bindings, migrations or plan upgrade. A warm 128 MB object costs approximately 11,059 GB-s/day before other account usage; Cloudflare Free includes 13,000 GB-s/day. Timer callbacks do not add storage-alarm writes. Existing account request, row, CPU and storage limits still apply; unlimited availability or retention is not promised. Deploy the Worker before Pages. Packed-v2-compatible rollback remains required.

Main deployment must pass its unchanged unattended, canonical-save and Observer continuity gates, followed by a separate ten-minute quiet production proof without extra Observer requests, deployments or diagnostic tail activation.