The silence between clock witnesses

Keep what the photodiode first supplied

Lumen’s proposed lunar receiver turns optical arrivals into recorded samples and then adapts those samples for service. Its first-record study showed that two agreeing archives can share an earlier edit. Chen and Haddad now put the retained witness before adaptive rewriting in the logical interface. A sequence number, session identity, raw payload digest, capture-stage label and retention acknowledgment travel separately from the processed service record.

The prototype is twelve authored photodiode-sample labels, not optical measurements. The capture path forks before rewriting: one branch retains a digest under a declared separate custodian; the other branches into service processing and archives A and B. A missing acknowledgment leaves a surviving event unwitnessed. It does not manufacture a disagreement or delete the usable payload.

Agreement after the wrong fork

Rewriting sample five after first retention disputes that sample against its witness. Moving the witness after rewriting makes all twelve payloads appear recovered by digest comparison. Because the declared capture stage is wrong, acquisition permission is nevertheless withheld. A declared shared custodian is also withheld. If a shared source is concealed behind false independent labels, this interface cannot expose it.

An outage at witness five yields eleven recovered events and one unwitnessed survivor. A gap in both archives yields eleven recovered and one missing event. Two payload variants yield eleven recovered and one disputed event. These are separate service states. None, by itself, certifies the receiver clock.

A clock can leave and return

In one timing case, witnesses at 0, 500 and 1,000 milliseconds all report zero residual. A sample at 250 milliseconds has a hidden 20 millisecond excursion; a paired control has none. The reviewer receives identical anchors in both cases. It therefore marks both events unwitnessed between anchors. The injected excursion exists in simulator truth only, and is not smuggled into the decision as an extra observation.

A provisional bound becomes possible only when an additional assumption is supplied: maximum residual slew of 0.02 milliseconds per millisecond, with each anchor bounded to 1 millisecond. At the midpoint of a 100 millisecond gap, the nearest anchor gives 1 + 0.02 × 50 = 2 milliseconds. At the midpoint of a 500 millisecond gap it gives 6 milliseconds, exceeding the chosen 5 millisecond requirement. This is a bound on the declared model, not measured oscillator behavior.

Operate with an explicit missing permission

An absent interior clock witness leaves the remaining payloads available but timing uncertified. Sharing clock custody with the record controller withholds the timing permission even in the short-gap case. First-record retention and clock anchoring therefore need distinct custody assignments and availability records.

Chen accepts a service display with surviving samples and a separate timing state. Haddad requires a future clock characterization to justify any slew limit before that display can claim physical timing. No lunar receiver or optical terminal was operated. Clock bounds require a declared maximum residual slew, not established receiver performance. Supplied custody labels are assumptions. The 20 ms hidden excursion is known to the simulator only; agreeing anchors cannot discover it. Integrity recovery does not confer timing permission. No optical or lunar link tested.

Results at a glance

Related records

• Before the receiver makes its second copy