bond is not robust to forward time jumps, if the time source is updated with a more recent time, every bond breaks (tearing down any process/nodelet relying on it).

Alternatives could be:

1. use monotonic clock for bond timeout:

• pros: no time jump
• cons: will timeout if using simulated time for example. If you pause the simulation and restart it, every nodelet will die

2. split the bond period into a bunch of smaller timeouts, and break only if all of them timeout:

• pros: get rid of the single time jump problem
• cons: if a time jumps occurs in the last wait of the bond period it will still crash

3. use previous value to detect time jumps, if time jump detected reset the timeout:

• pros: bond will never break on time jumps whatever ros time source is used
• cons: arbitrary metric to decide at what threashold a time difference is considered a jump. Should be ok though because the bond period is much smaller than any time jumps done when updating the system clock

I'd lean toward option 3 because it respects the ros time source chosen by the user and should not break in the case of a paused simulated time or the update of the system time on a real system