The Cuckoo Escapement: field report, kernel patch, dashboard

What the Raspberry Pi time-server guides get wrong on a Pi 4, with the
measurements. The headline artifact is a four-line pps-gpio patch: PREEMPT_RT
force-threads IRQ handlers, and pps-gpio takes its timestamp inside its handler,
so the realtime kernel puts a scheduler between the electrical edge and the
clock. IRQF_NO_THREAD takes RMS offset from 2468 ns to 199 ns.

- kernel/     the patch
- dashboard/  live status page (position hidden by default)
- docs-site/  the write-up (Astro/Starlight, brass, no tutorial section)

dashboard/deploy/deploy.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Idempotent install/update of the gps-ntp dashboard. Run on the Pi as root
+# from the synced source tree (APPDIR). Safe to re-run.
+set -euo pipefail
+
+APPDIR="${APPDIR:-/opt/gpsntp-dashboard}"
+SVC=gpsntp-dashboard
+
+echo "==> dedicated system user"
+id -u gpsntp &>/dev/null || useradd --system --no-create-home --shell /usr/sbin/nologin gpsntp
+
+echo "==> python venv + editable install"
+if [ ! -x "$APPDIR/.venv/bin/python" ]; then
+  if ! python3 -m venv "$APPDIR/.venv" 2>/dev/null; then
+    apt-get update -qq && apt-get install -y python3-venv python3-pip
+    python3 -m venv "$APPDIR/.venv"
+  fi
+fi
+"$APPDIR/.venv/bin/pip" install --quiet --upgrade pip
+"$APPDIR/.venv/bin/pip" install --quiet -e "$APPDIR"
+
+echo "==> narrow sudoers rule (clients command only)"
+install -m 0440 "$APPDIR/deploy/gpsntp-dashboard.sudoers" /etc/sudoers.d/gpsntp-dashboard
+visudo -cf /etc/sudoers.d/gpsntp-dashboard
+
+echo "==> systemd unit"
+install -m 0644 "$APPDIR/deploy/gpsntp-dashboard.service" "/etc/systemd/system/${SVC}.service"
+
+echo "==> ownership"
+chown -R gpsntp:gpsntp "$APPDIR"
+
+echo "==> enable + (re)start"
+systemctl daemon-reload
+systemctl enable "${SVC}.service" >/dev/null 2>&1 || true
+systemctl restart "${SVC}.service"
+sleep 2
+systemctl is-active "${SVC}.service" && echo "==> dashboard active on :8080"