trustedClock property
Optional stricter clock (ENH-86) — when supplied, pendingEarnings
and claim read "now" from TrustedClockService.nowMsTrusted
instead of nowMsClamped. Left null (the default), behavior is
completely unchanged from before this field existed.
Worth adding over plain nowMsClamped specifically for a payout this
large and one-shot: nowMsClamped's watermark advances to WHATEVER
wall-clock value it's handed, so winding the clock forward once,
claiming, then winding it back still pays out the (fraudulent)
elapsed time — the watermark then just stays stuck at that future
value, permanently blocking further HONEST claims until real time
catches up, which is a self-inflicted lock, not a fix. A
TrustedClockService classifies that same forward jump as
ClockJudgement.suspiciousForwardJump and refuses to advance its
baseline for it, so nowMsTrusted instead returns the last
trusted "now", _earningsAt computes zero elapsed time against it,
and — unlike nowMsClamped — an honest sample right after recovers
normally instead of staying locked. A consumer that wants to
log/alert on a rejected claim can read
TrustedClockService.lastJudgement itself right after calling
claim — this service doesn't duplicate that reporting.
Implementation
final TrustedClockService? trustedClock;