updates should be deferred till last

[inverted-capital]

Many updates to the root appear to be bogging down the system, when there is further child activity due to complete. Updating root asap may be too expensive to maintain as a strategy.

[inverted-capital]

This should be superseded by signing the approot only.

The approot would be signed when enough execution time had passed, and would still leave some activities unprocessed. We might opt to allow some actions to always run to completion so the approot is always predictable rather than timing based.

The cutoff should be defined as joules, so the cutoff result is always predictable.