Function write_ts_upper_bound 

pub(crate) fn write_ts_upper_bound(now: &Timestamp) -> Timestamp

The highest timestamp the EpochMilliseconds write timeline may be advanced to while the wall clock reads now.

A write above this is a runaway: the oracle is monotone and durable, so every later write and strict-serializable read on the timeline blocks until the wall clock catches up, across restarts. Group commit stays under it by allocating from the oracle, which clamps to the clock. A caller that chooses its own write timestamp has to be checked against it, see GroupCommitter::commit_timestamped.