Struct HlcService 

pub struct HlcService<S: HlcStorage> { /* private fields */ }

Shared HLC service: one lock-protected clock plus its persistence. Serializes now()/observe() across subsystems so they share a single causal clock domain in memory and on disk.

Implementations

impl<S: HlcStorage> HlcService<S>

pub fn open(storage: S) -> Result<Self, S::Error>

Seed the in-memory clock from the persisted state (0 if none) and return the service. The persisted state is the last-observed clock position, so causal monotonicity survives crashes.

pub fn now(&self, sink: &mut S::Sink) -> Result<Timestamp, S::Error>

Generate a fresh timestamp for a local write and enqueue the new state into sink. Always advances; always writes — the state must reach the committing batch, or a crash could reissue it.

pub fn observe( &self, received: Timestamp, local_wall_ms: u64, sink: &mut S::Sink, ) -> Result<(), HlcError<S::Error>>

Absorb a remote timestamp, enforcing the skew bound (see Hlc::observe). Saves into sink only when the in-memory state actually advances — observe is a no-op for stale receipts and we don’t want to spam the register.

local_wall_ms is supplied by the caller — typically a single wall_ms reading taken once when a received batch starts replaying — rather than read here per call. This judges a whole batch against one reference instant, so entries don’t drift in and out of the skew window depending on where they fall in the loop, and it keeps the skew tests deterministic. The wall clock only moves forward across a batch, so a shared start-of-batch reading is at worst conservative (it may reject a borderline entry that a fresher reading would admit) — never unsound, since it can’t widen the window.

pub fn state(&self) -> Timestamp

Current clock state without advancing it. Cheap snapshot for callers that only need to peek (e.g. tests, diagnostics).