@@ -53,21 +53,27 @@ story — keep it intact.
 Default to 24-hour time. The code is split so the logic is testable off-Pi and the only
 hardware-touching part is isolated:
 
-- [piclock/clock.py](piclock/clock.py) — **pure** time → `DisplayState` (4-char text + colon). No
-  I/O. Shows `----` when the clock isn't synced. The colon is **steady by default** (this is
+- [piclock/clock.py](piclock/clock.py) — **pure** time → `DisplayState` (4-char text + colon +
+  sync dot). No I/O. Shows `----` until the clock's **first-ever** sync; after that, losing NTP
+  keeps the (free-running, still approximately right) time on the display and only the sync
+  dot goes dark — the dashes never come back mid-run. The colon is **steady by default** (this is
   a bedside clock — no movement at night); an optional 1 Hz blink is config-gated and derived
   from the wall clock, not a tick counter, so it can't drift.
 - [piclock/display.py](piclock/display.py) — the HT16K33 `smbus2` driver, plus a pure
-  `build_buffer()` (font/colon → 16-byte RAM) and a `NullDisplay` for off-Pi runs. The
+  `build_buffer()` (font/colon/sync-dot → 16-byte RAM; the NTP sync indicator is the
+  backpack's lower-left dot, sharing the colon's RAM byte) and a `NullDisplay` for off-Pi
+  runs. The
   driver skips redundant I2C writes when nothing changed. The hardware is wrapped in
   `ResilientDisplay`: if the display is absent or a connector is bumped, `show()` never
   raises — it logs once and retries the connection every ~10 s, so the service keeps running
   (no crash-loop) and the correct time appears the instant the display reconnects.
 - [piclock/timesync.py](piclock/timesync.py) — `is_ntp_synced()` via `timedatectl show -p
-  NTPSynchronized`. Any error → treated as not-synced (so we show dashes, never a bad time).
+  NTPSynchronized`. Any error → treated as not-synced (pre-first-sync that means dashes —
+  never a bad time; post-sync it just darkens the sync dot). The loop polls it every 5 s
+  until the first sync, then every 60 s to track sync loss.
 - [piclock/config.py](piclock/config.py) — `Config` dataclass with `PICLOCK_*` env overrides
-  (brightness, schedule on/off + times + wake/night brightness, 24h, blink, I2C bus/address,
-  tick, and `PICLOCK_DISPLAY=null` for dev). Validates its inputs at construction, including
+  (brightness, schedule on/off + times + wake/night brightness, 24h, blink, sync dot, I2C
+  bus/address, tick, and `PICLOCK_DISPLAY=null` for dev). Validates its inputs at construction, including
   that the schedule edges are in daily order.
 - [piclock/schedule.py](piclock/schedule.py) — **pure** day/night schedule logic: wall-clock time →
   phase (`off` / `wake` / `night`). No I/O, unit-tested like `clock.py`.
@@ -109,7 +115,9 @@ hardware-touching part is isolated:
 
 Guarantees worth preserving: the display layer must **fail soft** on I2C errors (a missing or
 flaky display logs + reconnects, never crashes the service); the clock must keep showing
-`----` until `is_ntp_synced()` is true; and **HomeKit and control-socket startup are
+`----` until `is_ntp_synced()` is first true — but once it has synced, a later sync loss
+must **not** bring the dashes back (show the free-running time, sync dot dark); and
+**HomeKit and control-socket startup are
 non-fatal** — if either can't start (missing deps, unwritable state dir, missing socket
 dir, …) the app logs and runs the clock without it, since the 7-seg's job must never depend
 on an optional feature. `Config` validates its inputs
 
@@ -24,7 +24,10 @@ The Pi has no battery-backed clock, so correctness comes from two things:
   Python's `zoneinfo` applies DST rules automatically. No offset math, ever.
 
 Before the clock has synced after a cold boot, the display shows `----` rather than a
-confidently wrong time.
+confidently wrong time. Once it has synced, the backpack's lower-left indicator dot stays
+lit as a sync indicator; if NTP is later lost the time keeps showing (the system clock
+free-runs and stays approximately right) and only the dot goes dark. (Sync-indicator idea
+borrowed from [tenox7/rpiclock](https://github.com/tenox7/rpiclock).)
 
 ## Hardware
 
@@ -120,6 +123,7 @@ Set via environment variables (typically in the systemd unit):
 | `PICLOCK_WAKE_BRIGHTNESS` | `15` | Level the schedule's evening wake applies, `0`–`15` |
 | `PICLOCK_NIGHT_BRIGHTNESS` | `0` | Level the schedule's night dim applies, `0`–`15` (`0` is still lit) |
 | `PICLOCK_BLINK` | `0` | Blink the colon at 1 Hz (default: steady, no movement at night) |
+| `PICLOCK_SYNC_DOT` | `1` | Lower-left dot lit while NTP-synced, dark when free-running; `0` disables the dot |
 | `PICLOCK_I2C_BUS` | `1` | I2C bus number |
 | `PICLOCK_I2C_ADDRESS` | `0x70` | HT16K33 address |
 | `PICLOCK_TICK` | `0.2` | Loop period, seconds |
 
@@ -19,10 +19,13 @@
 
 log = logging.getLogger("piclock")
 
-# How often to poll for NTP sync while still unsynced. Decoupled from the (much
-# faster) display tick so a no-network boot doesn't spawn `timedatectl` 5x/sec
-# forever; the display shows `----` meanwhile, so a few seconds' lag is invisible.
+# How often to poll for NTP sync. Decoupled from the (much faster) display tick
+# so a no-network boot doesn't spawn `timedatectl` 5x/sec forever; the display
+# shows `----` meanwhile, so a few seconds' lag is invisible. Once synced we
+# keep polling (the sync dot tracks losing sync too) but relax the interval —
+# sync loss is rare and a minute's lag on the indicator is invisible.
 _SYNC_POLL_SECONDS = 5.0
+_SYNCED_POLL_SECONDS = 60.0
 
 # Shown when the display is switched off (by the day/night schedule or HomeKit):
 # all segments dark, so no LEDs are lit — this is the point, sparing the 7-seg's
@@ -49,6 +52,11 @@ def _handle_signal(signum, _frame):
     log.info("starting %s", config)
     display = make_display(config)
     synced = False
+    # Latches True at the first sync and stays True: `----` is only for the
+    # boot window where the clock has never been right. After that, losing NTP
+    # keeps the (free-running, still approximately right) time on the display
+    # and only the sync dot goes dark.
+    ever_synced = False
 
     # Display on/off + brightness state, shared by everything that controls the
     # display. The optional day/night schedule (evaluated below, in-process)
@@ -94,11 +102,17 @@ def _handle_signal(signum, _frame):
 
     try:
         while not stop.is_set():
-            if not synced and time.monotonic() >= next_sync_check:
+            if time.monotonic() >= next_sync_check:
+                was_synced = synced
                 synced = timesync.is_ntp_synced()
-                next_sync_check = time.monotonic() + _SYNC_POLL_SECONDS
-                if synced:
+                next_sync_check = time.monotonic() + (
+                    _SYNCED_POLL_SECONDS if synced else _SYNC_POLL_SECONDS
+                )
+                if synced and not was_synced:
+                    ever_synced = True
                     log.info("system clock synchronized")
+                elif was_synced and not synced:
+                    log.warning("NTP sync lost; free-running until it returns")
 
             now = datetime.now()
 
@@ -152,18 +166,20 @@ def _handle_signal(signum, _frame):
                 state = clock.render(
                     now,
                     synced,
+                    ever_synced=ever_synced,
                     hour24=config.hour24,
                     blink=config.blink_colon,
                 )
                 text, colon = state.text, state.colon
+                sync_dot = state.sync_dot and config.sync_dot
             else:
-                text, colon = _BLANK_TEXT, False  # display switched off
+                text, colon, sync_dot = _BLANK_TEXT, False, False  # display off
 
             # The display backend is fault-tolerant (see make_display): show()
             # never raises on I/O errors, it logs and reconnects on its own. So a
             # missing or bumped display can't crash the loop.
             display.set_brightness(control.brightness)  # deduped; cheap per-tick
-            display.show(text, colon)
+            display.show(text, colon, sync_dot)
 
             stop.wait(config.tick_seconds)
     finally:
 
@@ -16,27 +16,32 @@
 
 @dataclass(frozen=True)
 class DisplayState:
-    """Desired display contents: four characters plus colon on/off."""
+    """Desired display contents: four characters, colon, and sync-indicator dot."""
 
     text: str  # exactly 4 chars; space means a blank digit
     colon: bool
+    sync_dot: bool = False
 
 
 def render(
     now: datetime,
     synced: bool,
     *,
+    ever_synced: bool = False,
     hour24: bool = True,
     blink: bool = False,
 ) -> DisplayState:
     """Render the current local time into a DisplayState.
 
-    Before the clock is synced, returns dashes with the colon off. Once synced,
-    formats HH:MM; in 12-hour mode the leading zero of the hour is blanked. The
-    colon is steady by default; when ``blink`` is set it is lit only for the
-    first half of each second.
+    Until the clock has synced for the first time, returns dashes with the
+    colon off — never a confidently-wrong time. Once synced, formats HH:MM
+    with the sync dot lit; in 12-hour mode the leading zero of the hour is
+    blanked. If sync is later lost (``synced`` False, ``ever_synced`` True)
+    the time stays up — the system clock free-runs and remains approximately
+    right — and only the sync dot goes dark. The colon is steady by default;
+    when ``blink`` is set it is lit only for the first half of each second.
     """
-    if not synced:
+    if not synced and not ever_synced:
         return DisplayState(UNSYNCED_TEXT, colon=False)
 
     if hour24:
@@ -46,4 +51,4 @@ def render(
         text = f"{hour12:2d}{now.minute:02d}"  # space-pads a single-digit hour
 
     colon = (now.microsecond < 500_000) if blink else True
-    return DisplayState(text, colon)
+    return DisplayState(text, colon, sync_dot=synced)
@@ -79,6 +79,10 @@ class Config:
     dim_at: time = time(20, 0)  # drop to night_brightness (night)
     hour24: bool = True
     blink_colon: bool = False  # steady colon by default — no movement for a dark bedroom
+    # The backpack's lower-left indicator dot shows NTP sync status: lit while
+    # the system clock is synced, dark while it free-runs. It dims with the
+    # rest of the display; switch it off if even that is too much at night.
+    sync_dot: bool = True
     tick_seconds: float = 0.2  # loop granularity; colon blink derives from wall clock
     backend: str = "ht16k33"  # "ht16k33" for hardware, "null" for off-Pi dev/testing
 
@@ -137,6 +141,7 @@ def from_env(cls) -> "Config":
             dim_at=_env_time("PICLOCK_DIM_AT", cls.dim_at),
             hour24=_env_bool("PICLOCK_24H", cls.hour24),
             blink_colon=_env_bool("PICLOCK_BLINK", cls.blink_colon),
+            sync_dot=_env_bool("PICLOCK_SYNC_DOT", cls.sync_dot),
             tick_seconds=_env_float("PICLOCK_TICK", cls.tick_seconds),
             backend=os.environ.get("PICLOCK_DISPLAY", cls.backend).strip().lower(),
             ctl_socket=os.environ.get("PICLOCK_CTL_SOCKET", cls.ctl_socket),
 
@@ -9,9 +9,13 @@
 
     0x00  digit 0 (leftmost)
     0x02  digit 1
-    0x04  colon   (bit 1 = centre colon)
+    0x04  colon + indicator dots (bit 1 = centre colon, bit 2 = upper-left
+          dot, bit 3 = lower-left dot, bit 4 = upper-right dot)
     0x06  digit 2
     0x08  digit 3 (rightmost)
+
+The lower-left indicator dot doubles as the NTP-sync indicator: lit while the
+system clock is synced, dark while it free-runs.
 """
 
 from __future__ import annotations
@@ -41,15 +45,16 @@
 _DIGIT_ADDR = (0, 2, 6, 8)  # RAM offset of each of the four digit positions
 _COLON_ADDR = 4
 _COLON_BIT = 0x02
+_SYNC_DOT_BIT = 0x08  # lower-left indicator dot, shares the colon's RAM byte
 
 # HT16K33 command bytes.
 _CMD_OSCILLATOR_ON = 0x21  # system setup: oscillator on
 _CMD_DISPLAY_ON = 0x81  # display setup: on, no blink
 _CMD_DIMMING = 0xE0  # | level (0-15)
 
 
-def build_buffer(text: str, colon: bool) -> list[int]:
-    """Encode four characters + colon into the 16-byte HT16K33 RAM buffer.
+def build_buffer(text: str, colon: bool, sync_dot: bool = False) -> list[int]:
+    """Encode four characters + colon + sync dot into the 16-byte HT16K33 RAM buffer.
 
     Pure and hardware-free so it can be unit-tested. Raises ValueError on a
     wrong-length string or an unsupported character.
@@ -62,14 +67,14 @@ def build_buffer(text: str, colon: bool) -> list[int]:
             buf[_DIGIT_ADDR[i]] = _FONT[char]
         except KeyError:
             raise ValueError(f"unsupported character {char!r} in {text!r}") from None
-    buf[_COLON_ADDR] = _COLON_BIT if colon else 0
+    buf[_COLON_ADDR] = (_COLON_BIT if colon else 0) | (_SYNC_DOT_BIT if sync_dot else 0)
     return buf
 
 
 class Display(Protocol):
     """Minimal display interface the app loop depends on."""
 
-    def show(self, text: str, colon: bool) -> None: ...
+    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None: ...
     def set_brightness(self, level: int) -> None: ...
     def clear(self) -> None: ...
     def close(self) -> None: ...
@@ -78,7 +83,7 @@ def close(self) -> None: ...
 class NullDisplay:
     """No-op display for development and tests off the Pi."""
 
-    def show(self, text: str, colon: bool) -> None:
+    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
         pass
 
     def set_brightness(self, level: int) -> None:
@@ -99,7 +104,7 @@ def __init__(self, bus_num: int = 1, address: int = 0x70, brightness: int = 3) -
 
         self._address = address
         self._bus = SMBus(bus_num)
-        self._last: tuple[str, bool] | None = None
+        self._last: tuple[str, bool, bool] | None = None
         self._last_brightness: int | None = None
 
         try:
@@ -117,11 +122,13 @@ def set_brightness(self, level: int) -> None:
         self._bus.write_byte(self._address, _CMD_DIMMING | level)
         self._last_brightness = level
 
-    def show(self, text: str, colon: bool) -> None:
-        key = (text, colon)
+    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
+        key = (text, colon, sync_dot)
         if key == self._last:
             return  # avoid redundant I2C traffic (e.g. unchanged minute)
-        self._bus.write_i2c_block_data(self._address, 0x00, build_buffer(text, colon))
+        self._bus.write_i2c_block_data(
+            self._address, 0x00, build_buffer(text, colon, sync_dot)
+        )
         self._last = key
 
     def clear(self) -> None:
@@ -194,12 +201,12 @@ def _drop(self, exc: OSError) -> None:
             except Exception:  # best effort after an I/O failure
                 pass
 
-    def show(self, text: str, colon: bool) -> None:
+    def show(self, text: str, colon: bool, sync_dot: bool = False) -> None:
         dev = self._connect()
         if dev is None:
             return
         try:
-            dev.show(text, colon)
+            dev.show(text, colon, sync_dot)
         except OSError as exc:
             self._drop(exc)
 
 
@@ -11,6 +11,26 @@ def test_unsynced_shows_dashes_and_no_colon():
     state = clock.render(_dt(20, 30), synced=False)
     assert state.text == clock.UNSYNCED_TEXT
     assert state.colon is False
+    assert state.sync_dot is False
+
+
+def test_sync_dot_lit_while_synced():
+    assert clock.render(_dt(20, 30), synced=True).sync_dot is True
+
+
+def test_sync_loss_keeps_time_with_dot_dark():
+    # Once the clock has been right at least once, losing NTP must not bring
+    # the dashes back — the free-running system clock is still approximately
+    # right. Only the sync dot goes dark.
+    state = clock.render(_dt(20, 30), synced=False, ever_synced=True)
+    assert state.text == "2030"
+    assert state.colon is True
+    assert state.sync_dot is False
+
+
+def test_never_synced_shows_dashes_even_with_ever_synced_false():
+    state = clock.render(_dt(20, 30), synced=False, ever_synced=False)
+    assert state.text == clock.UNSYNCED_TEXT
 
 
 def test_24h_formats_with_leading_zero():