prisma-risk / tsoracle / 26490101271

95%

push

github

refactor(core): PhysicalMs newtype hoists 46-bit bound to type system (#562)

Four public-API parameters across the Allocator — fence_floor,
committed_ceiling, now_ms, persisted_high_water — were all "physical-ms
values that must be <= PHYSICAL_MS_MAX". Three different methods each
re-implemented the same `if value > PHYSICAL_MS_MAX { return Err(...) }`
check.

Introduce `PhysicalMs(u64)` (allocator.rs, WindowGrant-style: in-module
with `try_new -> CoreError`, `MAX`/`ZERO` consts, `TryFrom<u64>`,
`Display`, derives `Copy/Clone/Debug/Default/PartialEq/Eq/PartialOrd/Ord/Hash`).
The bound check now lives once, at construction; signatures take
`PhysicalMs` so the invariant is compile-time proof and an accidental
swap of `now_ms` and `committed_ceiling` no longer type-checks against
bare `u64` clocks, durations, or counters.

Mirrors the PR #560 PeerEndpoint precedent of hoisting a string-shape
contract to the type system, applied to the numeric-bound contract.

Scope:

* `try_on_leadership_gained`, `try_prepare_window_extension`, and
  `try_commit_window_extension` take `PhysicalMs`; prepare also returns
  `PhysicalMs` so prepare -> commit chains without re-validation.
* The derived-value check inside `try_prepare_window_extension` (on
  `max(floor, now_ms) + ahead_ms`) is now expressed as
  `PhysicalMs::try_new(requested)` — same error variant
  `PhysicalMsOutOfRange(requested)`, single source of truth.
* `ServingCore::seed_on_leadership_gained` / `commit_extension` /
  `ExtensionSlot::prepare_extension` wrap at the boundary; their
  public signatures keep `u64` (`Allocator` boundary only — pushing
  the newtype further outward is a clean follow-up).
* The saturated-clock scenario (`SystemClock::now_ms` saturating to
  `u64::MAX`) is now caught one layer out at the boundary wrap — a
  tighter and more informative failure than the old "derived sum
  overflows u64" path. The `prepare_window_extension_overflow_*` test
  is rewritten to overflow via `ahead_m... (continued)

150 of 150 new or added lines in 2 files covered. (100.0%)

13760 of 14492 relevant lines covered (94.95%)

388656.02 hits per line