Module clock 

Time, as a thing that is supplied rather than a thing that is ambient.

docs/14-review-findings.md F11 records that deterministic simulation cannot be retrofitted and names the constraint: virtualize clock, network and disk from the first line of runtime code. docs/13-testing.md §13.4 restates it in bold. The runtime then called SystemTime::now() directly for three phases anyway (docs/42 §42.4), which is what a constraint with no position in an order gets you.

This module is the cheap half of the fix, and deliberately only the cheap half. It is a seam, not a simulator: there is no scheduler here, no virtual time, no ordering of events against each other. There is a trait with one implementation that reads the host and one that a caller sets, so that the retrofit F11 forbids never has to happen. docs/42 §42.4’s verdict is exactly that: “adopt the injected clock now; watch DST proper”.

What is on the seam and what is not

The wall clock is: an envelope’s at, the now() primitive, the milliseconds in a time-ordered id, a telemetry timestamp. Those are the readings that enter data — an envelope is logged and replayed, so where its at came from is a determinism question.

Elapsed time is not, yet: Instant::now() survives in the places that measure how long something took (beck bench, the append and render histograms). A duration measured for a metric does not enter the log, does not reach a fold, and cannot change what a replay produces. It will have to move here when DST proper arrives, and saying so is cheaper than pretending this module already covers it.

Structs

ManualClock

A clock whose reading is whatever the caller last set.

SystemClock

The host’s clock — the only place in this workspace that reads it.

Traits

Clock

A source of wall-clock time.

Functions

process_clock

The clock for readings that have no owner to take one from.

set_process_clock

Install the process clock. Returns false if one has already been read or installed.