Constant MAX_FUTURE_SKEW_MS 

pub const MAX_FUTURE_SKEW_MS: u64 = _; // 2_592_000_000u64

How far ahead of the receiver’s wall clock an incoming _updated_at’s physical (millis) component may sit and still be treated as honest. A device can legitimately be offline for a long stretch and cross-device wall clocks drift, so the window is generous — 30 days. A stamp beyond receiver wall + this has no honest explanation (a broken clock or buggy client), so the receiver refuses to let it win last-writer-wins or ratchet the local clock. The bound is one-sided: only grossly-future stamps are rejected; a stamp in the past is always honest (an offline device’s older edits) and is never bounded.