Separate clock offset, drift, and synchronization evidence

Write a clock reading as C(t), where t is ideal elapsed physical time for this model. Offset is C(t) minus t after choosing a common epoch; frequency error describes how quickly that difference changes. A clock can have excellent short-term stability but a large initial offset. Another can currently match the reference while drifting rapidly afterward. Resolution only describes distinguishable readings. None of these properties alone establishes an upper bound on error, and a small average error does not prove that every reading satisfies a safety-critical bound used by a protocol.

If the clock's rate remains between one minus rho and one plus rho, its error can grow by at most rho times elapsed physical time after the last trusted bound. This argument assumes uninterrupted rate control and an identified reference; a clock step, suspend behavior, virtual-machine pause, or faulty source can violate the model. Record how a deployed time service detects lost synchronization and how applications react when uncertainty expands. An implementation that silently keeps its former confidence interval after losing its reference has changed a correctness assumption without telling its callers.

In a four-timestamp exchange, the client records send time t1 and receive time t4; the server records receive time t2 and send time t3. Subtract the server's processing interval from the client's round trip to estimate network delay. The familiar offset estimator splits that delay symmetrically between directions. If the server clock is ahead, the estimate is positive under this convention. Keep units and signs visible: confusing a client-minus-server offset with a server-minus-client correction can move an otherwise reasonable clock farther from its reference.

Symmetric one-way delay is an assumption, not something that four timestamps independently prove. Different outbound and return paths can bias the offset estimate even when measurements are repeatable. Selecting low-delay observations can reduce queueing noise without removing a persistent asymmetry. NTP also includes filtering, source selection, dispersion, and clock discipline beyond this one exchange. A production synchronization claim needs those mechanisms and their fault model, not just a short formula. In particular, a statistical statement that most measurements are close is weaker than a guarantee that real time lies inside every advertised interval.

A wall clock is useful for human dates and correlations, but corrections can make it unsuitable for subtracting arbitrary readings to measure a local duration. A monotonic clock avoids discontinuous wall-time adjustments under its documented semantics. It is still local: its epoch is not generally meaningful on another host. Suspension and frequency discipline also matter; Linux exposes different clock choices with different behavior. Name the clock domain in measurements and persisted deadlines. After a reboot, a former monotonic reading is not automatically comparable with the new process's readings merely because both values are expressed in nanoseconds.

Repeated measurements can reduce random uncertainty without fixing a systematic path bias. The sampling lab makes that limited distinction concrete through an unrelated binary late-observation indicator. For each comparison, Reset, re-set both p and n, predict the sample-mean variance, then inspect or Step. Compare p=0.2 with n=20 and n=100 as separate configurations. The variance falls fivefold under the independent Bernoulli model, but this instrument does not estimate clock offset or calibrate a time source. Use that contrast to explain why more observations cannot, by themselves, establish a missing asymmetry bound.