The 2199 seconds reported for D-4 subtracted a test-server timestamp
(archive/cert2.pem mtime) from a dev-machine timestamp (the serial change
observed by the poll), without noting they are different clocks.
Checked against external references: the dev machine matches Google and the
Let's Encrypt ACME endpoint to the second, while test-server is 105 seconds
fast and reports NTPSynchronized=no. Three round-trip measurements put the
offset at +106.1s every time.
Corrected:
new certificate written to disk 08:20:27 UTC (mtime 17:22:13 KST - 106s)
actually served 08:58:52 UTC (dev observation, no correction)
gap 2305s = 38m25s
The correction validates itself in D-4a, where the new certificate's SCT —
signed by CT logs on their own accurate clock at 12:27:49.054 GMT — lands
one second before the skew-corrected hook time. Without the correction the
hook would appear to have run 104 seconds before the certificate existed.
Updated across the experiment doc, the index, the follow-up doc, the verdict
evidence file and the SVG.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
