We currently do outlier detection to remove occasional bad pulses. But that is occasionally insufficient in the presence of bad hardware. You can see this when testing loss of carrier for #9.

We should have an additional layer of defense against bad pulses. If we have had some pulses wherever everything is properly in sync, and then we start getting huge offsets, we should ignore them based on the time between the good offset and the bad offset. For example, if the last good offset was hours ago, then our clock could be off by quite a lot; but if the last good offset was just a minute ago, the clock can't be off by very much. The maximum offset should be some fraction of elapsed period since the last good offset.