A restarted clock must not rewrite production history

A syntactically valid timestamp string proves only that a serialiser formatted a register according to a text grammar; it does not prove that the clock agreed with Coordinated Universal Time (UTC) when the physical event occurred.[S10][S32] RFC 3339 specifies an Internet profile of ISO 8601 in which every timestamp expresses a four-digit year, month, day, hour, minute, second, optional fractional second and an explicit offset or Z indicator relative to UTC, eliminating local time-zone ambiguity and permitting lexicographical sorting when timestamps share a common UTC offset and precision.[S32] Yet an edge controller whose uncompensated real-time clock wakes from a power cut at 1970-01-01T00:00:04.120Z or 2024-01-31T00:00:00.000Z emits valid RFC 3339 strings that place a current sewing completion years in the past, corrupting shift attribution, lot genealogy and dwell-time calculations once delayed events reach an upstream database.[S13][S30][S32]

To preserve what the capture device knew at the moment of work, GFT specifies a three-timestamp envelope for every event: source_event_time (when the sensor trigger, scan or operator confirmation was accepted locally), site_ingest_time (when the site broker or SQLite store committed the event on the Local Area Network, LAN) and central_ingest_time (when the upstream service committed the replayed record after backhaul recovery).[S03][S12][S13][S20][S32] None of these fields may overwrite another during replay; instead, each carries a clock_quality attribute recording the synchronisation state of the clock that struck it.[S10][S11][S32]

In the Network Time Protocol version 4 (NTPv4) specification, RFC 5905 defines roles and metrics that clarify what a clock knows.[S10] A primary server at stratum 1 synchronises directly to a reference clock traceable to UTC, such as a Global Navigation Satellite System (GNSS) receiver, secondary servers at strata 2 to 15 distribute time down a subnet, and stratum 16 designates an unsynchronised clock.[S10] At every update, an NTPv4 association tracks offset (theta), round-trip delay (delta), dispersion (epsilon, growing at the worst-case frequency tolerance PHI of 15 parts per million in RFC 5905) and jitter (psi), combining them into root delay (DELTA), root dispersion (EPSILON) and synchronisation distance (LAMBDA = EPSILON + DELTA / 2), while the Leap Indicator (LI) signals value 3 when unsynchronised and a zero timestamp marks unknown time.[S10]

When an edge station records a bundle transfer on a weak grid, its event schema should capture enough timing metadata to reconstruct both the nominal instant and its uncertainty band.[S10][S32] GFT's proposed event envelope attaches four timing fields to the source observation:

Retaining source_event_time_utc, site_ingest_time_utc and central_ingest_time_utc side by side separates process duration between stations, LAN queueing delay and WAN backlog duration during backhaul recovery.[S08][S13][S32] If a station's real-time clock battery failed over a weekend and recorded 40 illustrative scans at an epoch date before the site NTP server booted, site_ingest_time_utc brackets the capture window while UNSYNCHRONISED_EPOCH prevents scripts from computing a multi-year negative lead time.[S10][S30][S32]

When external connectivity fails or a switch loses power between bays, capture stations cannot request sequential keys from a central coordinator.[S03][S31] Relying on an online auto-increment sequence or ticket server forces the line either to stop recording work during a partition or to assign temporary numbers that collide upon reconnection.[S13][S31] RFC 9562 defines 128-bit Universally Unique Identifiers (UUIDs) so distributed nodes can mint persistent identifiers autonomously, while noting that uniqueness and sortability depend on the UUID version, entropy quality and clock-rollback handling.[S31]

Comparing the UUID versions in RFC 9562 shows why a factory on an intermittent grid cannot treat a time-ordered UUID as a standalone substitute for sequence and identity fields.[S31] UUID version 4 (UUIDv4) populates 122 bits (outside the 4-bit version 0b0100 and 2-bit variant 0b10) from a Cryptographically Secure Pseudorandom Number Generator (CSPRNG), avoiding wall-clock dependency at the cost of poor B-tree index locality.[S31] Conversely, UUID version 7 (UUIDv7) places a 48-bit big-endian Unix Epoch millisecond timestamp (unix_ts_ms) in bits 0 through 47, followed by the 4-bit version (0b0111), 12 bits in rand_a, the 2-bit variant (0b10) and 62 bits in rand_b, sorting monotonically and clustering cleanly in SQLite indexes under synchronised operation.[S13][S31]

On an unreliable grid, embedding a wall-clock timestamp inside UUIDv7 exposes two hazards.[S31] First, if an edge node reboots without a valid real-time clock or experiences a backward clock step when NTP disciplines a fast oscillator, the 48-bit unix_ts_ms prefix moves backward.[S10][S31] RFC 9562 Sections 6.1 and 6.2 warn that when the clock moves backward, time-based generators break monotonicity or risk collisions unless the implementation maintains generator state (such as the last timestamp and a monotonic counter in rand_a or rand_b) and applies monotonic error checking.[S31] Second, RFC 9562 Sections 6.9 and 8 warn that uniqueness depends on a seeded CSPRNG; if an embedded node boots rapidly after power loss before gathering sufficient entropy, or if a virtualised image is cloned across stations without reseeding state, random bits can repeat.[S31]

GFT therefore separates uniqueness from causal ordering by requiring a composite identity alongside event_id.[S13][S31] Even when event_id is minted as a 128-bit UUIDv4 or UUIDv7, every locally committed record must carry (source_id, boot_id, source_seq):[S31]

Combining source_id, boot_id and source_seq prevents post-crash counter collisions.[S13][S31] If a station with an unrecovered journal resets its counter to 1 after an abrupt power cut while its clock resets to a default date, omitting boot_id causes new events (STN-01, seq=1..50) to collide with pre-outage events (STN-01, seq=1..50), leading an idempotent consumer to drop new work or overwrite prior records.[S12][S15][S16][S19] Including boot_id marks the restart boundary, accepts the new sequence without collision and flags any unclosed transaction from the prior boot for supervisor review.[S13][S31]