TTP Clock Authority / Skew Rule

EXPIRY+DECISION TIME→ACTIVE / EXPIRED / TIME_UNKNOWN

Four invariants.

I31

SAME RETENTION RECORD + DIFFERENT CLOCKS CAN YIELD DIFFERENT SAFETY DECISIONSTime interpretation changes permissions without changing business state.

I32

TIME-BASED SAFETY REQUIRES A DECLARED CLOCK AUTHORITY OR SKEW BOUNDDecision time needs provenance.

I33

EXPIRY INSIDE CLOCK-UNCERTAINTY WINDOW ≠ SAFE REPLAY PERMISSIONTemporal ambiguity preserves TIME_UNKNOWN.

I34

CLOCK DISAGREEMENT IS EVIDENCE CONFLICTIt must be reconciled rather than silently collapsed.

Reference decision path.

TIME-BASED PRECONDITION→ESTABLISH CLOCK BASIS

AUTHORITY TIME→EVALUATE RETENTION ONCE

OR SKEW WINDOW→EXPIRY CROSSED?→TIME_UNKNOWN → RECONCILE

Verified #018.

A 60-second retention record was evaluated by two deterministic node clocks. Node A at T0+50 saw it ACTIVE; Node B at T0+70 saw the same record EXPIRED while the original effect remained COMMITTED / effect_count=1. Letting Node B's local time authorize same-key replay produced two effects.

A declared authority time at T0+55 kept the record active, so the real second POST was deduplicated. A ±20-second uncertainty interval crossing the expiry boundary produced TIME_UNKNOWN; reconciliation found the effect already committed and no second POST was made.

Time is evidence with authority and uncertainty — not a free scalar supplied by whichever worker happens to retry.

Evidence required.

When safety depends on time, preserve the logical effect identity, expiry timestamp, node-local times, declared clock authority when present, authority decision time, skew or uncertainty bound, computed temporal state, remote authoritative status and final effect count.

Scope.

This rule concerns decision semantics. It does not prescribe NTP, PTP, chrony, production skew limits or universal provider TTLs, and it is not a clock-synchronization or exactly-once certification.

Inspect / reproduce

Short form: CLOCK DISAGREEMENT = EVIDENCE CONFLICT.