Durable alarms: one-shot timers that survive restarts

One shared room, one pending alarm. ctx.setAlarm(at) arms it; onAlarm runs at the deadline with a fresh server ctx even if every tab is closed. The wow: schedule +2min, kill the worker (or redeploy) - the alarm still fires exactly once cluster-wide, and the fired record shows recovered: true when the restart ate the precise timer and the leader's recovery poll fired it instead.

Scheduling as Bouncy Narwhal

Schedule (one pending alarm per room - scheduling replaces it)

Pending alarm

No alarm pending.

Fired alarms (0, newest first)

Nothing has fired yet. Schedule one above.

Server: timers = live.stream(topic, loader, { alarm: { onAlarm }, invalidateOn }). ctx.setAlarm is bound on the stream's ctx, so the loader is the room's single alarm writer: schedule / cancel RPCs record intent in Redis and publish a nudge on a control topic; invalidateOn re-runs the loader, which syncs the framework alarm to the intent.

Cluster single-fire is an atomic store-delete claim: the owning worker's precise in-memory timer and the leader's recovery poll can never both fire the same alarm (wired app-wide via configureAlarm({ store, leader })). ctx.alarm inside onAlarm carries { at, firedAt, lateMs, recovered }. No alarm.misfireMs is set here - fire-when-late is right for reminders; an auction close would declare a threshold so stale fires are skipped instead of run. See alarms.js.