pub(crate) fn check_runaway_write_ts(now: &Timestamp, timestamp: Timestamp)Expand description
Reports a write timestamp that is further ahead of now than
write_ts_upper_bound allows, the signal that the EpochMilliseconds timeline has
run away (e.g. after a wall-clock regression, or from a durably poisoned oracle).
This is a detector, not a guard: the timestamp has already been chosen, and every caller that can still refuse one checks the bound itself. It logs rather than fails, because every way left to reach it is a condition this process inherited. A durable runaway is re-applied to the oracle on every boot, and a backwards clock step is what the group committer’s throttle waits out, so failing here would turn a stalled timeline into a crash loop.