4. Clarification on runtime clock validity:

Do not require continuous GPS visibility to keep the clock valid. Use a holdover model.

At startup:
- Require GPS/PPS/RTC discipline before entering BLE survey mode.
- Set:
    g_clockValid = true
    g_lastDisciplineEpochMs = currentEpochMs()
    g_lastDisciplineMillis = millis()

During runtime:
- clock_valid remains true while:
    millis() - g_lastDisciplineMillis <= kMaxDisciplineAgeMs
- gps_valid is evaluated separately from the latest GPS fix age:
    rx_gps_age_ms <= kMaxGpsFixAgeMs

If the unit later moves under trees or near buildings and loses satellite visibility:
- Do not immediately invalidate clock_valid.
- Let gps_valid become false when rx_gps_age_ms exceeds kMaxGpsFixAgeMs.
- Continue OLED BLE display if possible.
- Do not write normal observation rows unless both clock_valid and gps_valid are true, or else write rows with explicit validity fields so analysis can filter them.

The important point is: a temporary GPS outage should stale the coordinates, not necessarily the disciplined clock.
