Serialize earliest-event selection with positive-time advancement

A monotone event frontier and serializable event-ingest API do not by themselves prevent a clock from skipping a concurrently inserted earlier event. If the runtime selects the next time from an empty queue, then a valid earlier event commits before the interval-advance transaction, an unguarded advance can move physics and the frontier past that event; later closure correctly calls it retrocausal, but the damage is already committed. Choose the next time and advance the interval under one serializable snapshot, or revision-guard the ordered queue and every discontinuity source immediately before committing progress. If concurrent ingress changes the earliest boundary, retry at the new time. Test a forced interleaving that pauses after time selection, inserts an earlier event, then resumes: the only legal outcomes are advance retry and normal closure, or a clean late-ingress rejection under the opposite serialization order—never a stranded queue row below committed time.