Files
Paul Lorenz dc777e0131 Report clock skew between gossip peers
A tombstone now carries the deadline it will be reaped on, so expiry depends on
wall clocks one node writes and another reads. Skew is bounded either way and
cannot lose or corrupt state, but it does shift when tombstones are collected,
and nothing made that visible.

- stamps the sender's clock on the anti-entropy digest and on the canary. Those
  are the two axes a deadline crosses, since routers create tombstones as well as
  controllers, and both messages already run on a schedule
- warns when the difference reaches a tenth of a tombstone lifetime, with a floor
  so a short lifetime does not make ordinary transit a warning. Expressed against
  the lifetime because that is what makes skew matter, so retuning one retunes
  the other
- reports at most once per peer per ten minutes. Skew persists, so an unbounded
  report is a line per exchange for as long as the clocks disagree
- names the direction, since a peer ahead of us stamps deadlines we collect late
  and a peer behind us stamps ones we collect early or that arrive already past

It reports and corrects nothing. A one-way delta is skew plus transit and
queueing, so it bounds skew rather than measuring it: enough to see the seconds
to minutes that shift collection, and unfit to act on. Acting on it would trade a
visible bounded problem for an invisible one.
2026-09-03 14:56:09 -04:00
..