Summary

Surge shows inconsistent status indicators for technically identical and successful NTP operations. The same successful time synchronization is marked as "success" for short-lived processes but "error" for daemon processes.

Problem Description

Two processes performing identical NTP operations to time.apple.com:123 receive different status markings:

sntp (command-line tool): ✅ Success - "Process terminated"
timed (system daemon): ❌ Error - "ERR_IDLE_CLOSE"

Both operations successfully complete NTP time synchronization with identical network behavior.

Evidence

sntp Process (Marked as Success ✅)

Rule Evaluating - 0.5 ms
Active - 726.6 ms
Events
08:14:41.523456 [Rule] Rule evaluating requires DNS lookup for rule: GEOIP CN
08:14:41.523602 [DNS] Use cached DNS result for time.apple.com. A record count: 3, AAAA record count: 0
08:14:41.523692 [Rule] DNS completed, IPv4 address for matching: 17.253.84.251, IPv6 address for matching: N/A
08:14:41.523785 [Rule] Rule matched: FINAL
08:14:42.250987 [UDP] Process terminated

timed Process (Marked as Error ❌)

Rule Evaluating - 2.0 ms
Active - 1089.9 s
Events
06:21:49.211916 [Rule] Rule evaluating requires DNS lookup for rule: GEOIP CN
06:21:49.212078 [DNS] Use cached DNS result for time.apple.com. A record count: 3, AAAA record count: 0
06:21:49.212141 [Rule] DNS completed, IPv4 address for matching: 17.253.84.251, IPv6 address for matching: N/A
06:21:49.212225 [Rule] Rule matched: FINAL
06:39:59.078793 [UDP] Closed with error: ERR_IDLE_CLOSE (SGNGTCP2ErrorDomain:-238)

Verification

Both operations successfully completed time synchronization (verified in macOS system logs):

log show --predicate 'process == "timed"' --last 10m | grep "Received time"
# Shows: "Received time Tue Sep 9 08:14:24 2025±0.23 from NTP"

Impact

User Confusion: Users believe system daemons are failing when they're actually succeeding
False Diagnostics: Users waste time investigating normal system behavior
Inconsistent UX: Identical successful operations display different status indicators

Expected Behavior

Both successful NTP operations should be marked consistently. The ERR_IDLE_CLOSE after successful data transfer appears to be normal resource cleanup, not an actual error.

Environment

Surge Version: 5.10.5 (3350)
macOS Version: macOS Sequoia15.6.1
Scenario: System automatic time sync vs manual sntp command

Reproduction

Monitor Surge dashboard during automatic system time sync (timed)
Run manual sntp time.apple.com command
Compare status indicators for identical NTP operations
Notice successful operations marked differently based on process type