Server-authoritative time and client timers

The selected image shows a technician comparing a small clock with a large reference clock. Moving the small clock's hands corrects its reading at that instant; its own ticks then advance the reading between comparisons. Counting how often the technician looks up would measure visits, not elapsed time. A replacement clock needs another comparison before its reading can be related to the reference.

Observed relation	Mechanism
Comparison with the reference face	Calibration against server time
Saved reading plus subsequent tick duration	Anchor plus monotonic elapsed time
Looking up after several ticks	Redrawing after a delayed callback
Replacing the small clock	Establishing a new time origin

In real terms: retain a conversion between the reference and the advancing local clock. Limits: the picture has no message transit and cannot explain path asymmetry; the equations above supply that missing mechanism. Contrasting case: a clock whose hands move only when someone looks at it counts observations. Scheduling and debounce remain in the event-loop record and debounce/throttle.

Admin deadline badge: EXH-1970 → MR !2170

The deadline is 25000. These are synthetic inputs. The model executes the RFC equations; it does not send NTP packets. Redraws occur only when the fixture supplies them. RFC 5905

E1 sample offset=290 network=60
E1 redraw states=14,11,0
E1 decrement states=14,13,12

Step	State/event	Observed model output
3	Four timestamps received	offset=290 network=60
4–5	Monotonic redraws 1400, 4400, 18400	14,11,0
6	Decrement initially rounded display once per redraw	14,13,12

The repaired badge reaches its expired state despite skipped opportunities. The defective counter remains positive because it counts callbacks. This demonstrates a permitted delayed-callback trace; it does not claim browsers deliver that particular trace. Timer documentation supplies the reason such a count is unsafe. MDN timer delays

A separate ungraded Node run of timer-observation.mjs blocks its event loop and prints callback counts. It checks that the virtual premise is possible on this runtime, not that browsers share this cadence:

elapsed whole seconds 5 · interval callbacks 2 · counter would show 8 from 10, clock-based 5

Checkout hold and asymmetric paths

A checkout hold uses deadline 100000, server anchor 85000, monotonic anchor 7000 and redraw 12000. Changing device wall time after calibration leaves the computed display unchanged. A separate path simulation holds true clock offset at 400 and changes outbound/return delays, retaining server processing as a separate interval. MDN, RFC 5905

E2 wall adjustment ignored: before=10 after=10
E3 symmetric offset=400; asymmetric estimate=430; true offset=400

The asymmetry example prevents overclaiming: an estimate can be stable and still be biased. The server must apply its own acceptance policy; this lesson invents no grace window and does not treat a displayed positive number as receipt evidence. Authentication, transport replay and late-write policy require their own contracts. The executed artifact proves the arithmetic and displayed states under stated inputs, not production deadline accuracy.