Scenario: the exam engine and its anti-cheat pipeline

Each bidder's closing time is written in the office's tender register, and the officer works from the register, never from a bidder's watch.

At the procurement office	In the exam engine
a closing time in the register, read from the office's own clock	the attempt's stored deadline (step 1)
a written extension, entered against one bidder's name	one candidate's extra time or pause (step 2)
at closing the officer reads the register, extensions written that morning included	the finaliser reads the row when it runs (steps 3–4)
an envelope stamped in at the front desk before closing, still in the internal post	a save received within the grace (steps 6–7)
two bids with the same typing error, filed for the tender board with the documents	a case for a proctor, with its evidence (step 12)
losing bids shredded after the challenge period; the board's minutes kept	deletion when done; decisions kept (steps 13–14)

Breaks down when: a sealed envelope never changes after it is handed in, while an answer keeps changing until the deadline. And the desk stamp is the office's own, but a candidate's app can fake an event (step 9).

Contrasting case: a signal the server sees itself, such as one attempt saving from two browsers at once. It is harder to fake, yet an honest cause, a reopened tab, produces it too, so it also goes to a person.

In real terms: the server holds every clock and every decision; the browser shows the time and reports what it saw.

4.1 ExamHall EXH-2350: extra time that lived only on screen

ECON-201's save handler refused any save after the exam's own end plus 30 s, while the candidate app drew each countdown with that candidate's extra time. Two extra-time candidates kept saving every 30 s until their screens reached zero. MR !2650 stores a deadline on each attempt and checks that instead.

4.1 ECON-201 ends at 10:30:00 for the exam · grace 30 s · two extra-time candidates save every 30 s from 10:31:00 until their own screens reach zero
4.1 before MR !2650, checked against the exam's end: Ivo (25% extra) refused 44 of 44 · Noor (50% extra) refused 89 of 89
4.1 after MR !2650, checked against each attempt's deadline: Ivo refused 0 of 44 · Noor refused 0 of 89

The screens were right and the server was wrong: the accommodation lived where it decided nothing (steps 1–2).

4.2 Media streaming: one account, two cities

A streaming service flags an account when two cities play on it in one evening. A seeded month of flags, with fixture labels for their causes, run through two policies (a model):

4.2 flags 1,000 · travelling 554 · VPN 245 · family member 108 · shared password 93 (fixture labels, seed 2350)
4.2 lock at once: accounts locked by code 1,000, honest among them 907
4.2 ask "was this you?", then a person: accounts locked by code 0 · not confirmed, so sent to a person 158, of them shared passwords 67 of 93

Most flags had an honest cause, so locking by code punished the account holders; asking first and sending the rest to a person locked nobody by code (steps 10, 12).