Constant MAX_LAMPORT_LEAD 

pub const MAX_LAMPORT_LEAD: u64 = _; // 4_294_967_296u64

How far ahead of this runtime’s Lamport clock a received event’s stamp may be: 2^32.

A Lamport stamp is what its writer says about itself, and every receiver raises its own clock to the highest stamp it stores. Unbounded, one event from a trusted key stamped near u64::MAX would drag every clock in the mesh to the end of its range in a single round, after which every event written anywhere carries the same saturated stamp and the fold no longer orders them causally. A legitimate stamp is never further ahead than the number of events written in the repository’s whole history — each event rises one above what its writer had seen — so the bound is far above anything a real mesh reaches, a fresh runtime joining at clock zero included. What it changes is the cost of the attack: the clock rises at most this much per event stored, so exhausting it takes 2^32 signed, stored events rather than one. An event past the bound is refused Rejection::ClockAhead, on arrival and from a reloaded file alike.

use std::sync::Arc;
use majordomus_cli::mesh::identity::NodeIdentity;
use majordomus_cli::mesh::journal::{EventBody, Journal, Rejection, MAX_LAMPORT_LEAD};

let writer = Arc::new(NodeIdentity::ephemeral().unwrap());
let a = Journal::open(Arc::clone(&writer), "0000000000000001", "repo".into(), None).unwrap();
let b = Journal::open(Arc::new(NodeIdentity::ephemeral().unwrap()), "0000000000000002",
    "repo".into(), None).unwrap();
let mut event = a.append_own(EventBody::SessionClosed { session: "s1".into() }).unwrap();

// signed by a key B trusts, and stamped further ahead of B's clock than the bound allows
event.lamport = MAX_LAMPORT_LEAD + 1;
event.sig = writer.sign(&event.signing_bytes());
let report = b.ingest(&[event.clone()], &|_| Ok(()));
assert_eq!(report.rejected[&Rejection::ClockAhead], 1);
assert_eq!(b.tallies().lamport, 0, "and B's clock did not move");

// exactly at the bound it is an ordinary event
event.lamport = MAX_LAMPORT_LEAD;
event.sig = writer.sign(&event.signing_bytes());
assert_eq!(b.ingest(&[event], &|_| Ok(())).accepted, 1);