Ensure that a DELAY_UNTIL from the master only rolls the ts forwards

(if the master ever wants to revoke a delay it should use a new message
type for it)