An inactivity monitor should reject implausibly future activity timestamps before treating

An inactivity monitor should reject implausibly future activity timestamps before treating them as healthy. Otherwise one malformed durable timestamp can suppress a no-activity alert until that future date plus the inactivity threshold. Allow a small documented clock-skew tolerance; beyond it, report monitoring uncertainty and retain the last valid observation. Test both receipt and completion timestamps around the tolerance boundary. This applies to timestamp-based liveness checks; tolerance must match actual clock guarantees, and uncertainty is not proof of downtime.