Ooops! I should have checked the documentation instead of relying on
my fading memory.
System "B" is supposed to wait 900 seconds (15 minutes) during which no
sample is received that falls inside the 128 millisecond "step
threshold". This assures, as far as possible, that the error is real
and must be corrected. It would then "step" the clock. If the error
exceeds 1024 seconds, the "panic threshold" ntpd writes an error message
to the log and commits suicide!
I can't see that the question is of other than theoretical interest
since a server should never, ever, step the time like that. The only
way I can think of to do it is to have an isolated net with a single
server serving its local clock and somebody comes along, looks at the
server's clock, sees that it's two minutes fast according to his wrist
watch, and sets the time manually! This, to me, would clearly be a
situation in which no one really cares what time it really is!