Enhancement: Add timestamp safety boundary to prevent unreasonable max_ts updates #17916
Description
Subtask of
Enhancement
Currently, max_ts can be updated to any larger value (exceeding current PD TSO). This poses a potential risk where bugs or unsafe usage could set max_ts to an unreasonably large value, causing critical bugs and data corruption.
Proposed Solution:
Add a configurable safety boundary (max_ts_limit) that:
- Enforces a maximum allowed deviation of
max_tsfrom PD timestamp - Regularly syncs with PD to maintain a reasonable limit
- Prevents updates to unreasonable future timestamps
- Timestamps that are known to be from PD TSO can bypass the limit.