One trace, three clocks

The trace said a tool finished before it started.

One worker recorded the request at 14:03:11. A provider callback reached another host and was stamped 14:03:09. The duration metric still reported 2.4 seconds, while the replay claimed the approval had already expired.

None of those observations was necessarily corrupt. N17Q had asked one field called time to represent clock synchronization, local duration, and scenario semantics.

An agent trace needed at least three clocks, each answering a different question.

Wall time located an event in shared history

Wall time answered when an observer believed an event occurred on a calendar. It supported operator correlation, retention, legal records, external receipts, and comparisons with provider logs.

N17Q stored UTC instants with source, precision, and observed clock uncertainty where available. The interface rendered local zones only as presentation. It never persisted a bare local time whose daylight-saving interpretation could change.

Wall time was valuable and not a total ordering. Hosts drifted, synchronization stepped clocks, providers rounded values, queues delayed delivery, and remote systems reported their own observation time.

The trace used wall time to situate evidence, not to prove causality.

Monotonic time measured local duration

A worker needed to know how long parsing, model inference, tool execution, and policy evaluation took. Subtracting wall timestamps failed when the system clock adjusted during an operation.

N17Q captured monotonic start and end readings inside one runtime. These values had no calendar meaning and could not be compared across hosts or restarts. They produced trustworthy local elapsed time.

Each span named the monotonic clock domain that generated it. A parent could aggregate child durations only when the relationship was valid. Cross-worker latency remained a composition of observed intervals and queue evidence, not fake nanosecond precision.

Performance accounting became accurate within its declared boundary.

Logical time governed product semantics

Replay, approval expiry, retry windows, scheduled waits, and simulated provider delays needed a controllable notion of now.

N17Q introduced a logical clock per world. In ordinary execution it advanced with wall time under a recorded mapping. In fixture runs the harness advanced it explicitly. Product policy read logical time rather than calling the host clock.

This allowed a six-hour hold to be tested instantly and an old scenario to begin at its historical date. Pausing a fixture froze semantic time even though the test process kept running.

Logical time was not an attempt to replace reality. It was the time coordinate used by the workflow's rules.

The clocks were related, not collapsed

At run creation, N17Q recorded wall instant, monotonic origin for the local process, logical instant, and mapping revision. Events carried whichever coordinates they could support.

A local span usually had all three. An imported provider webhook had remote wall time, local receive wall time, and current logical observation time but no shared monotonic reading. A historical fixture event could have logical time and source wall evidence while being executed now.

The schema made absence normal. It did not fill missing coordinates by copying another field.

This prevented a display convenience from becoming a false claim about ordering.

Causality came from edges

The tool candidate caused policy evaluation. Approval preceded activation. An attempt emitted a request before a matching response could be observed. These facts came from identities and event relationships.

N17Q stored parent, predecessor, intent, attempt, and message links. The trace graph used those links as its causal skeleton. Time helped explain gaps and detect anomalies but did not override a known edge because one timestamp appeared earlier.

Concurrent events could remain partially ordered. The system did not invent a sequence when two safe reads ran independently.

A graph with imperfect clocks told a truer story than a perfectly sorted table.

Ingestion time was not occurrence time

Remote events often arrived later. A callback might be retried after several minutes, or an offline worker might upload its trace after reconnecting.

Each imported event kept source occurrence time if supplied, local received time, and durable ingested time. The source's trust class and precision accompanied its timestamp. N17Q never rewrote ingestion order to make a late event appear physically inserted into the past.

Views could sort by causal sequence, source time, or ingestion time and labeled the choice. Incident review often needed all three.

Late evidence enriched the account without falsifying when the system learned it.

A provider date rounded to seconds could not reliably order two callbacks 200 milliseconds apart. A filesystem timestamp might have platform-dependent resolution. A copied email header could omit a zone.

N17Q represented precision and uncertainty rather than padding every value to microseconds. Comparisons that fell within an uncertainty interval returned indeterminate. Rules requiring strict order used causal evidence or product-managed sequence numbers.

The UI showed coarse values without theatrical decimals. Exports preserved the original representation alongside normalized interpretation.

Precision stopped being a formatting choice and became part of what the observation could prove.

Sequence numbers stayed scoped

A central database could assign an increasing event ID at ingestion. It was useful for pagination and append order, but it did not prove occurrence order across disconnected producers.

Workers also emitted local sequence counters within a trace segment. Tool adapters could maintain attempt-local phases. The simulated world used its own mutation revision.

N17Q named each sequence domain. It never compared two counters merely because both were integers.

Scoped sequence numbers complemented clocks: exact order inside a producer, explicit edges across producers, and honest ambiguity where neither existed.

Approval expiry used logical now and receipt facts

An approval receipt had issued and expiry instants tied to the execution world. The final gate evaluated it using current logical time and recorded wall mapping.

For an ordinary run, a major wall-clock correction forced policy to refresh mapping and could pause consequential execution. The system did not let setting the host clock backward extend a receipt quietly.

For replay, the historical approval was evidence only. A simulated receipt could expire as the harness advanced logical time.

The decision trace recorded both the rule and the coordinates used. “Expired” became reproducible rather than dependent on whichever machine reran the test.

Timeouts belonged to monotonic spans

Transport timeout answered how much local waiting an attempt was allowed. It used monotonic time inside the adapter runtime.

When the deadline fired, N17Q recorded the elapsed span and the attempt's send boundary. The semantic result could be failed before send, interrupted after possible send, or still pending under an asynchronous provider contract.

A timeout did not declare that the remote world had not changed. Nor did a late callback erase the fact that the local wait exceeded its budget.

Duration policy and consequence state remained related but distinct.

Retry schedules lived in logical time

Backoff described when the workflow could attempt another safe operation. Recording only “sleep 30 seconds” lost its meaning across process restarts.

N17Q stored the next eligible logical instant, reason, attempt lineage, and remaining retry budget. A scheduler waking late could proceed if other preconditions still held. Waking early did not turn process uptime into permission.

Fixture tests advanced logical time directly to eligibility and preserved the intended delay in the trace. Randomized jitter came from a recorded seed.

The schedule survived because it belonged to durable workflow state rather than a sleeping worker.

Budgets needed both elapsed and semantic time

Compute cost and worker occupancy used monotonic durations. User-facing turnaround used wall observations. Workflow limits such as “stop after two logical hours including pauses” used the logical clock.

N17Q declared which measure each budget consumed. A fixture replay could run in milliseconds without pretending its simulated provider delay cost no workflow time. A long human approval pause could count against a business deadline while consuming no worker runtime.

Reports placed these totals side by side instead of merging them into one duration.

The system could become faster without rewriting how long the scenario was meant to take.

Context compaction retained temporal state

An early summary said “retry later” and omitted the actual eligible instant, original attempt boundary, and provider visibility window. After resume, the model chose a plausible delay from the prose.

N17Q kept deadlines, holds, expiries, and clock mappings in structured checkpoint state. A summary described them for reasoning but could not alter their value. The scheduler and policy gate read the durable fields.

Switching models or trimming conversation did not reset time. Neither did restarting the application.

Temporal commitments outlived the language that originally explained them.

Model and tool streams arrived as small deltas. Rendering each delta immediately could produce a visually smooth trace while overwhelming storage and leaking transport timing into semantics.

N17Q captured bounded transport events with monotonic receive order, then coalesced them into durable content items. The UI could animate using current display time without changing recorded occurrence evidence.

Time to first token, active stream duration, and finalization latency remained performance measures. A partially streamed tool call did not become an earlier semantic candidate simply because its name appeared quickly.

The interface could feel responsive while the trace stayed structurally honest.

Provider timestamps remained foreign claims

A receipt might include created_at, a webhook might include event_time, and a signed object might carry an expiry. N17Q preserved these as provider assertions under the connection contract.

Adapters parsed format and zone, bounded impossible values, and recorded the raw safe representation. Product logic used a provider timestamp only where the contract granted it meaning. It did not let arbitrary tool output set the workflow clock.

Comparisons showed remote and local observations with uncertainty. Large disagreement triggered investigation rather than automatic correction.

Time crossing a trust boundary needed the same provenance as any other data.

The simulated world owned its calendar

Some scenarios depended on weekdays, quiet hours, retention periods, or a daylight-saving transition. A fixed numeric clock without calendar rules was insufficient.

The fixture world declared timezone database version, locale-independent calendar rules, and logical starting instant. Business constraints used named zones rather than the operator's machine setting. Tests included ambiguous and skipped local times.

I stored user-entered local schedules as local specification plus zone and resolved occurrences, not as one permanently converted offset. The trace showed the resolution used for each event.

Calendar behavior became a testable dependency instead of environmental folklore.

If synchronization detected a wall jump beyond tolerance, N17Q emitted a clock-mapping change. Safe local work could continue. Expiring approvals, external deadlines, and scheduled effects paused for reevaluation.

The system did not attempt to prove whether the old or new wall value was metaphysically correct. It recognized that a product assumption had changed.

Operators saw affected intents and could inspect authoritative external time where necessary. The new mapping applied prospectively; old events kept the coordinates observed at capture.

Treating clock correction as state prevented silent reinterpretation of the trace.

Trace export preserved coordinate meaning

CSV was convenient and dangerous because three time columns without metadata invited casual subtraction.

N17Q exported structured clock domains, units, precision, sources, uncertainty, and mapping events alongside event data. Human-oriented reports rendered a primary timeline and linked alternative views. Machine consumers received schema versions and validation fixtures.

Derived duration fields named their calculation basis. Negative wall differences could appear as observations without becoming negative execution spans.

Portable evidence required portable semantics, not merely ISO strings.

A task entered a durable queue on one host and began on another. Calling the difference queue latency assumed both wall clocks agreed closely enough. Sometimes they did not.

N17Q recorded enqueue and claim events with causal identity, each host's wall evidence, and the queue service's ordered receipt where available. The report could present a bounded latency interval or an authoritative service duration instead of subtracting unrelated local timestamps.

Within one scheduler process, monotonic spans remained exact. Across the boundary, uncertainty was visible. Service-level objectives used the strongest shared clock the infrastructure actually supported.

This prevented clock skew from manufacturing both impossible negative waits and flattering performance numbers.

Rate limits mixed external and local time

Providers returned reset timestamps, retry durations, and sometimes only opaque throttling messages. These values crossed a contract boundary before influencing scheduling.

Adapters normalized documented headers into provider-clock observations and conservative local eligibility windows. A duration received at a known monotonic instant was usually safer than a remote calendar timestamp. When the provider supplied both and they disagreed, the stricter supported bound won and the conflict entered the trace.

The workflow stored the resulting logical hold with its provenance. Replay fixtures reproduced the same throttle without contacting the provider.

A rate-limit response constrained the next action; it did not get to redefine the system's clock.

Retention used ingestion and event semantics separately

Deleting trace evidence thirty days after occurrence sounded simple until a late callback arrived for an older run. If retention used source occurrence time, the new evidence could expire immediately. If it used ingestion only, old sensitive content might persist indefinitely through repeated imports.

N17Q assigned retention from both evidence class and durable ingestion, while preserving occurrence time for the historical account. Late events could be summarized or linked to an already compacted record without reopening all expired artifacts.

Legal and product requirements remained explicit policy inputs. Clock fields did not smuggle a retention decision into generic storage code.

Time governed preservation only after the system named which time and why.

Humans saw ranges before false certainty

Most people reading the trace did not want a lecture on distributed clocks. They wanted to know why a task paused or whether two actions overlapped.

The default view used phrases such as “received about three seconds later,” “order established by request lineage,” and “remote time differs by roughly four seconds.” Exact coordinates remained available in evidence details. Ambiguous overlap appeared as a range, not an arbitrarily sorted animation.

This presentation reduced precision without reducing honesty. It also made genuine anomalies easier to notice because the interface stopped decorating every event with equally authoritative-looking timestamps.

The trace became calmer when it admitted what the clocks could not prove.

That restraint paid off during ordinary debugging. Operators could separate a genuinely slow adapter from a delayed callback, a scheduler pause from worker execution, and an expired product deadline from a shifted host clock. Alerts used the appropriate coordinate and linked directly to its clock domain. The same vocabulary appeared in traces, budgets, fixtures, and reports, so a timing explanation no longer changed meaning as it moved between teams or tools.

Time stopped being decorative metadata and became typed evidence.

The impossible order became explainable

In the original trace, the provider callback's remote wall clock was about four seconds behind the worker. It arrived locally 2.4 monotonic seconds after send. The logical world advanced by the same duration during the live run. During replay, the harness had incorrectly restored the historical expiry but initialized logical now from the current date.

After separating clocks, the view showed the remote timestamp with uncertainty, the exact local attempt duration, and a causal edge from request to callback. Replay seeded the correct logical instant, so approval state reproduced faithfully.

The tool had never finished before it started. One sorting rule had compared foreign clocks, and one replay path had confused calendar time with scenario time.

The repaired trace did not force every event onto one immaculate line. It showed where the evidence was exact, where order came from causality, and where two observations could only be placed within a range.

Wall time answered when the event sat in shared history. Monotonic time answered how long local work took. Logical time answered what the workflow's rules believed now meant.

One trace needed all three because an agent system lives simultaneously in operations, computation, and an evolving product world.

Giving each clock one honest job made the whole chronology easier to trust, test, replay, and explain under pressure.

Consistently.