Coordinating signals across devices

Two machines, one animal

The object of study walks from a bowl to a windowsill while a battery-powered radio on her neck and a mains-powered hub on a shelf each record part of what happened. Nothing about that arrangement guarantees a shared timeline. The two devices boot at different moments, sleep on different schedules, and communicate over a link that can drop mid-transfer.

When they disagree, the error does not present as a timing bug. It presents as a household report in which two afternoons have been glued into one, or in which a meal appears twice, and the person reading it has no way to tell that the underlying problem was arithmetic about clocks.

A wearable without a wall clock

Keeping accurate calendar time on a small battery device is expensive, and a device that has been asleep cannot be assumed to know how long it was away. Our collar therefore does not pretend to know the hour. It reports how long it has been running and a marker identifying the current run, which together let the hub distinguish “later in the same session” from “after a restart.”

The hub converts that into recognisable time by maintaining anchors between the wearable’s own elapsed time and world time, established when its own clock is in a known-good state. Transport delay only ever inflates the apparent age of a message, so anchoring uses the least-delayed observation available and corrects only toward earlier estimates when later evidence proves an earlier anchor contained queueing delay. Samples implying that the wall clock ran backwards are not allowed to participate.

Anchors are scoped to a session. A restart, a step correction to the hub’s clock, or a failure of the time service opens a new segment, and fitting across a segment boundary is prohibited. Before the first trustworthy time reading after startup, the path stays closed rather than optimistic.

Four labels instead of one number

Rather than attach a single timestamp of unknown quality to every recording, each one carries an explicit statement of how well its time is known. A recording is trusted when the current session has a usable anchor; extrapolated when it relies on an anchor from the same session and is kept but marked weaker; unsynchronised when the evidence is insufficient, in which case the wearable’s own elapsed time is preserved and no world time is invented; and flagged as belonging to an unrecognised session when the reported run does not match any anchor the hub holds.

These labels are load-bearing downstream. A later summary is entitled to refuse a row on the basis of its time quality, which is why the enumeration is stable and surfaced rather than being smoothed into a single confidence figure. In the memory work on this device, the fact that every accepted observation was unsynchronised was precisely what prevented a plausible-looking weekly account from being published.

Repair later rather than guess now

Time quality is allowed to improve, under conditions. A recording can be re-timed once the hub holds enough evidence from the same device and the same session—at least two anchors at different elapsed times—and the observed transport delay has been stable since startup. Recordings also retain a durable upper bound on when they can have been written, so that later rewriting cannot weaken an earlier invariant.

Rescanning is deliberately bounded: a full pass happens once per device session, and ordinary operation only revisits the small set of recordings still waiting for a later anchor. A correctness mechanism that re-examines every recording on every heartbeat becomes a background load, and background load on a shared device eventually becomes someone’s dropped frame.

One crossing with one owner

Coordination is also a question of who is allowed to write. Traffic from the wearable crosses into the hub through a single path, and exactly one service owns that path; commands and firmware updates travel the same way. A second writer is not a convenience but a mechanism for a recording transfer and an update to corrupt one another.

Framing is treated with the same conservatism. When a message is truncated or fails its integrity check, the partial candidate is discarded and the receiver resynchronises on the next clean frame instead of interpolating a plausible middle. Losing a message is recoverable; storing a chimera is not, because nothing downstream can later tell that it was assembled from two different moments.

The tests that matter to a household

The acceptance questions are ordinary ones. After an update, does this collar still record. Does a second collar in the same home remain untouched. When camera video and collar audio are combined, does the sound belong to the picture on screen. Do two recordings from the same afternoon still land in the right order.

None of that is visible as a feature. It is the reason a day in a house can be described once, rather than as two devices arguing about the same animal.