Module windows 

Pure cadence-window arithmetic (R4.3/R13.3).

One clock per loop (R2.2): windows sit on a fixed grid anchored at registration, so a late sweep never drifts the cadence — it fires the elapsed window once and re-arms on the original grid past now (lateness-not-death: a missed window is COUNTED by the dead-man switch, never silently replayed as a burst of catch-up fires).

Functions

advance_window

The next window boundary on the loop’s own grid strictly after now, starting from the boundary that just fired.

initial_window

The first cadence window after registration: registered_at + period.

next_check_at

When the sweeper must next look at this loop: the earliest of the next cadence window and every invariant’s duration-form deadline (skipping invariants whose alarm is already latched — a latched alarm re-arms only through a confirmation, so there is nothing to poll for).