@@ -13,6 +13,21 @@ All notable changes to **Heliograph** are recorded here. The format follows
   once a newer revision was published (`libcrypto3`/`libssl3` 3.5.9-r0, `curl` 8.22.0-r0), the pinned ones
   disappeared and every fresh build failed in the `apk` step. Those pins are now `>=` minimum
   versions: the CVE fixes still can't regress, and newer revisions install without breaking the build.
+- **A delayed NTP round no longer brings back an obsolete clock offset after it was cleared.** When a
+  remote vantage reports an unsynchronized round, the hub clears that vantage's clock stat for the
+  target, but the clear also dropped the stat's freshness timestamp. A store-and-forward replay of an
+  *older* synchronized round could then re-set the offset, so `/api/targets?vantage=…` and the
+  dashboard showed an out-of-date offset next to the newer round. The clear now keeps its timestamp,
+  so only a round newer than it can set the stat again.
+- **A config reload no longer pre-fills a redefined target's alert window with its old measurement.**
+  On a reload (SIGHUP or a config apply), alert windows are warm-started from stored history, which
+  was matched only by host, probe, metric and step. Changing what a target measures without changing
+  those, such as a `TCPConnect` port from `443` to `22`, re-imported the old port's rounds, so a
+  `CheckLoss(x=3)` alert fired on the *first* failure of the new port. A target whose measurement
+  identity changed in a reload is no longer warm-started: its alerts wait for `x` rounds of the new
+  measurement. A target that only gains an alert on reload is still warm-started. On a cold start,
+  smoked has no record of a target's previous definition, so a target redefined while smoked was
+  stopped can still be warm-started from its recent old rounds.
 
 ### Security
 - **Revoking and re-adding a vantage now retires its earlier certificates.** Agent authorization
@@ -35,6 +50,11 @@ All notable changes to **Heliograph** are recorded here. The format follows
   SCRAM password handling. That path runs the operator-supplied database password through a
   different precis profile from the one the advisory names, so no remote trigger is known; the bump
   clears the scan. Caddy's `--with golang.org/x/text` floor is raised to match.
+- **`smoked vantage add -out` writes the onboarding bundle owner-only.** The `.tar.gz` embeds the
+  vantage's client private key in `agent.yaml`, but was created with the default `0666`-minus-umask
+  mode, which is world-readable (`0644`) under the usual `022` umask. It is now created `0600`
+  regardless of umask, and an existing file that `-out` overwrites is tightened to `0600` before any
+  key material is written to it.
 
 ## [2.2.0] - 2026-09-05
 
 
@@ -310,11 +310,13 @@ func main() {
 	// evalMu (inside swapRuntime) only guards the swap; applyMu is strictly outside it.
 	var applyMu sync.Mutex
 	// seedFn seeds a freshly built engine's alert windows from durable history on a reload,
-	// so a target that is newly alerted or redefined isn't left dark until X fresh samples
-	// arrive (CODE_REVIEW #4). Assigned once the store exists (below); the SIGHUP goroutine and
-	// the API apply both pass it into swapRuntime. It reads the store, so swapRuntime runs it
-	// before taking evalMu. nil until assigned — an early reload simply skips seeding.
-	var seedFn func(*runtime)
+	// so a target with no live window to inherit (e.g. one that just gained an alert) isn't
+	// left dark until X fresh samples arrive (CODE_REVIEW #4). swapRuntime picks which targets
+	// it may seed (reloadSeedTargets). Assigned once the store exists (below); the SIGHUP
+	// goroutine and the API apply both pass it into swapRuntime. It reads the store, so
+	// swapRuntime runs it before taking evalMu. nil until assigned — an early reload simply
+	// skips seeding.
+	var seedFn func(*runtime, []model.Monitor)
 	if *configPath != "" {
 		fmt.Printf("config: %d targets from %s\n", len(rt.jobs), *configPath)
 	}
@@ -347,11 +349,11 @@ func main() {
 	}
 
 	// Now that the store exists, wire the reload seed: on a config reload, swapRuntime seeds
-	// the new engine from durable history for targets it can't inherit (redefined or newly
-	// alerted), then InheritStateFrom overwrites the seed for same-identity targets (#4).
-	seedFn = func(nrt *runtime) {
-		warmStartAlerts(ctx, nrt.engine, nrt.monitors, nrt.metricByName, st, time.Now())
-	}
+	// the new engine from durable history for every target whose measurement identity is
+	// unchanged, then InheritStateFrom overwrites the seed with the live window where one
+	// exists, so the seed only fills windows the running engine doesn't have, e.g. a newly
+	// alerted target's (#4).
+	seedFn = historySeed(ctx, st)
 
 	// SIGHUP reloads the config; on error the running config is kept (a bad edit can't take the
 	// collector down). Alert firing state and sample windows carry over from the running engine
@@ -385,7 +387,10 @@ func main() {
 	// that is already breaching at startup fires on its first new round instead of
 	// waiting X fresh samples (the durable-store replacement for SmokePing's S sentinel).
 	// Boot uses this directly; a SIGHUP/API reload runs the same seed via seedFn inside
-	// swapRuntime and then carries unchanged windows/state via InheritStateFrom.
+	// swapRuntime and then carries unchanged windows/state via InheritStateFrom. Unlike a
+	// reload, boot has no previous fingerprint to compare (the store keeps none), so a target
+	// redefined while smoked was down can still be seeded from its old measurement's rounds
+	// if they are recent enough to pass recentContiguous.
 	if rt := current.Load(); rt.engine != nil {
 		warmStartAlerts(ctx, rt.engine, rt.monitors, rt.metricByName, st, time.Now())
 	}
@@ -822,6 +827,27 @@ func main() {
 	}
 }
 
+// createOwnerOnly opens path for writing (created or truncated) readable by its owner only, for a
+// file that will hold a secret. A new file is created 0600 whatever the umask; an existing regular
+// file with any group/other permission bits is tightened to 0600 before the caller writes to it, so
+// overwriting a world-readable file can't leave the secret world-readable. A non-regular path (a
+// FIFO, /dev/stdout) is left alone: its mode isn't this file's to change.
+func createOwnerOnly(path string) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	fi, err := f.Stat()
+	if err == nil && fi.Mode().IsRegular() && fi.Mode().Perm()&0o077 != 0 {
+		err = f.Chmod(0o600)
+	}
+	if err != nil {
+		f.Close()
+		return nil, err
+	}
+	return f, nil
+}
+
 // vantageCmd implements `smoked vantage <add NAME|ls|revoke NAME> [-dsn DSN]` — provisioning
 // against the same TimescaleDB the daemon uses. The subcommand and the vantage NAME are
 // positional (git-style), so flags may follow them: `vantage add nyc -dsn X`. -dsn defaults
@@ -886,7 +912,8 @@ func vantageCmd(args []string) int {
 
 		switch {
 		case *out != "":
-			f, err := os.Create(*out)
+			// The bundle embeds the client private key: owner-only, never os.Create's 0666-umask.
+			f, err := createOwnerOnly(*out)
 			if err != nil {
 				fmt.Fprintf(os.Stderr, "vantage add: %v\n", err)
 				return 1
@@ -1257,16 +1284,17 @@ func (rt *runtime) commitRemote(ctx context.Context, ing store.ResultIngester, o
 // state + sample windows over from the running engine (so a reload/apply doesn't
 // re-fire alerts already firing or drop hysteresis history). Serialized against a
 // round's alert eval via evalMu. Shared by the SIGHUP reload and the config-apply API.
-func swapRuntime(current *atomic.Pointer[runtime], evalMu *sync.Mutex, nrt *runtime, seed func(*runtime)) {
+func swapRuntime(current *atomic.Pointer[runtime], evalMu *sync.Mutex, nrt *runtime, seed func(nrt *runtime, monitors []model.Monitor)) {
 	// Seed the new engine's windows from durable history BEFORE the swap and OUTSIDE evalMu.
-	// A target whose measurement identity changed, or one that just gained its first alert,
-	// won't inherit a window below — without seeding it would start dark and fire late
-	// (CODE_REVIEW #4). recentContiguous filters the seed to the current host/probe, so a
-	// redefined target pulls nothing stale. nrt.engine isn't live yet, so this needs no lock,
-	// keeping the store read off the evalMu critical path. Inherit then overwrites the seed for
-	// same-identity targets with their live window.
+	// A target that just gained its first alert has no window to inherit below — without
+	// seeding it would start dark and fire late (CODE_REVIEW #4). A target whose measurement
+	// identity changed is not seeded at all (reloadSeedTargets): its stored rounds measured the
+	// old definition. nrt.engine isn't live yet, so this needs no lock, keeping the store read
+	// off the evalMu critical path. Inherit then overwrites the seed for same-identity targets
+	// with their live window. Reading current here, outside evalMu, is safe because every caller
+	// holds applyMu, so no other swap can land before the locked Load below.
 	if seed != nil && nrt.engine != nil {
-		seed(nrt)
+		seed(nrt, reloadSeedTargets(current.Load(), nrt))
 	}
 	evalMu.Lock()
 	old := current.Load()
@@ -1277,6 +1305,26 @@ func swapRuntime(current *atomic.Pointer[runtime], evalMu *sync.Mutex, nrt *runt
 	evalMu.Unlock()
 }
 
+// reloadSeedTargets returns the monitors a reload may warm-start from durable history: all of
+// nrt's except a target whose measurement identity (targetFP) changed since old. The store keeps
+// no fingerprint and warmStartAlerts matches history only on host/probe/metric/cadence, so the
+// recent rounds it would find for a redefined target were measured under the old definition:
+// moving a TCPConnect target from port 443 to 22 would count port-443 failures toward the port-22
+// consecutive-loss matcher and fire it early. A redefined target starts with an empty window and
+// waits for X rounds of its new measurement. A same-identity target stays seedable (it inherits
+// its live window over the seed, or needs the seed if it just gained an alert), and so does a
+// target absent from old, which has no previous identity to compare (as at boot).
+func reloadSeedTargets(old, nrt *runtime) []model.Monitor {
+	out := make([]model.Monitor, 0, len(nrt.monitors))
+	for _, m := range nrt.monitors {
+		if was, ok := old.targetFP[m.ID]; ok && was != nrt.targetFP[m.ID] {
+			continue
+		}
+		out = append(out, m)
+	}
+	return out
+}
+
 // reloadIdentity builds the per-target/per-alert identity InheritStateFrom uses to decide what
 // survives a reload: which targets exist (ValidTarget) with an unchanged measurement identity
 // (SameTarget), which alerts are attached to each target now (Attached), and whether each
@@ -1325,8 +1373,9 @@ func sameStringSet(x, y []string) bool {
 // the old and new runtime, using the same federation.Fingerprint (probe/host/params/pings/
 // probe-config) the ingest and in-flight-drop paths key on — so the reload inherit-gate can't
 // disagree with them. A target that is new, removed, or redefined in ANY of those fields is
-// absent (false), so InheritStateFrom carries neither its window nor its firing/visible state;
-// it is seeded fresh from durable history instead (CODE_REVIEW #4).
+// absent (false), so InheritStateFrom carries neither its window nor its firing/visible state
+// (CODE_REVIEW #4). A new target is seeded from durable history; a redefined one is not
+// (reloadSeedTargets), since that history measured its old definition.
 func sameTargetIdentity(old, nrt *runtime) map[string]bool {
 	same := make(map[string]bool, len(nrt.targetFP))
 	for name, fp := range nrt.targetFP {
@@ -1342,7 +1391,7 @@ func sameTargetIdentity(old, nrt *runtime) map[string]bool {
 // runtime in. Validate → persist → swap: an invalid doc never persists, a stale
 // version never swaps. Returns api.ErrConfigInvalid / api.ErrConfigConflict.
 func applyConfig(cfgStore *configstore.Store, current *atomic.Pointer[runtime], evalMu *sync.Mutex,
-	build func(dbFragment func() ([]byte, error)) (*runtime, error), doc json.RawMessage, expectedVersion int, seed func(*runtime)) error {
+	build func(dbFragment func() ([]byte, error)) (*runtime, error), doc json.RawMessage, expectedVersion int, seed func(*runtime, []model.Monitor)) error {
 	nrt, berr := build(func() ([]byte, error) { return doc, nil })
 	if berr != nil {
 		return fmt.Errorf("%w: %v", api.ErrConfigInvalid, berr)
@@ -1378,6 +1427,14 @@ func alertRTT(o scheduler.Outcome) float64 {
 	return o.Computed.Median
 }
 
+// historySeed returns the reload seed swapRuntime runs: it warm-starts the given monitors' alert
+// windows in nrt's not-yet-live engine from st's durable history, as of when it runs.
+func historySeed(ctx context.Context, st store.Store) func(nrt *runtime, monitors []model.Monitor) {
+	return func(nrt *runtime, monitors []model.Monitor) {
+		warmStartAlerts(ctx, nrt.engine, monitors, nrt.metricByName, st, time.Now())
+	}
+}
+
 // warmStartLookback bounds how far back a remote vantage's warm-start history read goes.
 // SeedWindow trims to the deepest matcher window anyway; this just caps the query.
 const warmStartLookback = 24 * time.Hour
 
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+	"syscall"
 	"testing"
 	"time"
 
@@ -566,8 +567,7 @@ func TestSwapRuntimeSeedsNewlyAlertedTarget(t *testing.T) {
 		engine:   alert.NewEngine(alertDef, map[string]alert.Notifier{"cap": cap}),
 		monitors: []model.Monitor{monAlerted}, alertsByTarget: map[string][]string{"t": {"loss"}}, targetFP: map[string]string{"t": "fp"},
 	}
-	seed := func(r *runtime) { warmStartAlerts(context.Background(), r.engine, r.monitors, r.metricByName, st, now) }
-	swapRuntime(&current, &mu, nrt, seed)
+	swapRuntime(&current, &mu, nrt, historySeed(context.Background(), st))
 
 	// Window seeded with the 1 prior breaching round; one more now meets X=2 → fires immediately.
 	current.Load().eval([]scheduler.Outcome{{
@@ -579,6 +579,56 @@ func TestSwapRuntimeSeedsNewlyAlertedTarget(t *testing.T) {
 	}
 }
 
+// A reload that redefines what a target measures must not warm-start its alert window from rounds
+// of the old measurement. Moving a TCPConnect target from port 443 to 22 on the same host, with two
+// recent failing port-443 rounds in the store, a three-round loss alert must still need three
+// failing port-22 rounds, not fire on the first.
+func TestReloadDoesNotSeedRedefinedTargetFromOldMeasurement(t *testing.T) {
+	st := store.NewMem(16)
+	cap := &capNotify{}
+	alertDef := map[string]*alert.Alert{"loss": {Name: "loss", Matcher: alert.CheckLoss{L: 50, X: 3}, To: []string{"cap"}}}
+	newRT := func(m model.Monitor) *runtime {
+		return &runtime{
+			engine:         alert.NewEngine(alertDef, map[string]alert.Notifier{"cap": cap}),
+			monitors:       []model.Monitor{m},
+			alertsByTarget: map[string][]string{"t": {"loss"}},
+			targetFP:       map[string]string{"t": federation.Fingerprint(m, nil)},
+		}
+	}
+	failedRound := func(m model.Monitor, when time.Time) scheduler.Outcome {
+		return scheduler.Outcome{
+			Target:    probe.Target{ID: m.ID, Name: m.Name, Host: m.Host, Params: m.Params},
+			ProbeName: m.ProbeKind, Fingerprint: federation.Fingerprint(m, nil),
+			Computed: sample.Compute(1, nil), When: when,
+		}
+	}
+
+	port443 := model.Monitor{ID: "t", Name: "t", Host: "h", ProbeKind: "TCPConnect", Params: map[string]string{"port": "443"},
+		Pings: 1, Step: time.Minute, Alerts: []string{"loss"}, Vantages: []string{store.DefaultVantage}}
+	port22 := port443
+	port22.Params = map[string]string{"port": "22"}
+
+	var current atomic.Pointer[runtime]
+	current.Store(newRT(port443))
+	var mu sync.Mutex
+	now := time.Now()
+	for _, ago := range []time.Duration{90 * time.Second, 30 * time.Second} {
+		current.Load().storeLocal(st, []scheduler.Outcome{failedRound(port443, now.Add(-ago))})
+	}
+	if cap.n != 0 {
+		t.Fatalf("two failures must not fire a three-round alert, got %d events", cap.n)
+	}
+
+	swapRuntime(&current, &mu, newRT(port22), historySeed(context.Background(), st))
+
+	for i := 1; i <= 3; i++ {
+		current.Load().storeLocal(st, []scheduler.Outcome{failedRound(port22, now.Add(time.Duration(i)*time.Minute))})
+		if want := map[bool]int{true: 1, false: 0}[i == 3]; cap.n != want {
+			t.Fatalf("after %d failing port-22 round(s): %d notification(s), want %d", i, cap.n, want)
+		}
+	}
+}
+
 // sameTargetIdentity underpins Bug A: only a target whose measurement fingerprint is unchanged
 // keeps its inherited window/firing state across a reload. It compares the runtimes' targetFP,
 // so any identity-changing field (host, probe, params, pings, probe-config) flips it.
@@ -1079,3 +1129,43 @@ func TestVantageAddEmitsOnboardingBundle(t *testing.T) {
 		t.Fatalf("bundle file is not gzip (first bytes %x)", data[:min(2, len(data))])
 	}
 }
+
+// The `vantage add -out` bundle embeds the agent's client private key, so it must be readable by
+// its owner only: under the common 022 umask (where a default-created file is 0644), and also when
+// -out overwrites an existing file that was created world-readable.
+func TestVantageAddBundleIsOwnerOnly(t *testing.T) {
+	dsn := os.Getenv("SMOKE_TEST_DSN")
+	if dsn == "" {
+		t.Skip("set SMOKE_TEST_DSN to run vantage add test")
+	}
+	defer syscall.Umask(syscall.Umask(0o022))
+
+	dir := t.TempDir()
+	existing := filepath.Join(dir, "existing.tar.gz")
+	if err := os.WriteFile(existing, []byte("old bundle"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range []struct{ vantage, path string }{
+		{"perm-new", filepath.Join(dir, "new.tar.gz")},
+		{"perm-existing", existing},
+	} {
+		t.Cleanup(func() { vantageCmd([]string{"revoke", c.vantage, "-dsn", dsn}) })
+		if rc := vantageCmd([]string{"add", c.vantage, "-dsn", dsn, "-hub", "https://hub.example:8443", "-out", c.path}); rc != 0 {
+			t.Fatalf("%s: vantage add -out rc=%d", c.vantage, rc)
+		}
+		fi, err := os.Stat(c.path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if perm := fi.Mode().Perm(); perm != 0o600 {
+			t.Errorf("%s: bundle holding the client private key has mode %04o, want 0600", c.vantage, perm)
+		}
+		data, err := os.ReadFile(c.path)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(data) < 2 || data[0] != 0x1f || data[1] != 0x8b {
+			t.Errorf("%s: bundle file is not gzip (first bytes %x)", c.vantage, data[:min(2, len(data))])
+		}
+	}
+}
@@ -130,7 +130,10 @@ $ smoked vantage add nyc -dsn "$SMOKED_DSN" -hub https://your-hub.example:8443 -
 wrote bundle nyc-vantage.tar.gz for vantage "nyc"
 ```
 
-That tar.gz is the same onboarding bundle the GUI downloads. Omit `-out` to
+That tar.gz is the same onboarding bundle the GUI downloads. It holds the
+vantage's private key, so `-out` writes it readable by its owner only (mode
+`0600`, whatever your umask), and tightens an existing file it overwrites to
+`0600` too. Omit `-out` to
 print the rendered `agent.yaml` to stdout instead (handy for `scp`-ing just the
 file), or pass `-json` to emit the raw PEMs as JSON. `-dsn` defaults to
 `$SMOKED_DSN`. Running `vantage add nyc` again for an **already-registered**
 
@@ -119,7 +119,7 @@ type ReloadIdentity struct {
 	// here has its window and all alert state dropped.
 	ValidTarget map[string]bool
 	// SameTarget[t]: t's measurement identity (host/probe/params/...) is unchanged. If it
-	// changed, t's window and alert state are not inherited (t is seeded from history instead).
+	// changed, t's window and alert state are not inherited.
 	SameTarget map[string]bool
 	// Attached[t][name]: alert `name` is attached to target t in the NEW config. State for an
 	// alert not currently attached to t is never inherited — so detaching an alert and later