#35557 kernel, validation: Add btck_chainstate_manager_set_clock_time

Introduces `ChainstateManager::Now()` and a C/C++ API `btck_chainstate_manager_set_clock_time` / `SetClockTime` to allow kernel consumers and tests to set and query clock time on a per-chainstate-manager instance. Time-sensitive validation operations—including header future-time validation, IBD status evaluation (`IsTipRecent`), header pre-sync logging, and verification progress—are updated to read time through `ChainstateManager`. The PR also standardizes mempool time on `NodeClock::time_point` (`MempoolTime`) and segregates `NodeClock::now()` into a separate translation unit omitted from `libbitcoinkernel` to catch accidental nondeterministic clock usage at link time.

Problem: Validation logic in `libbitcoinkernel` directly queried system time via process-global clock functions, preventing kernel library callers and tests from driving validation deterministically across multiple instances. Furthermore, uncoordinated queries to `NodeClock::now()` caused race conditions across second boundaries in tests like `chainstatemanager_ibd_exit_after_loading_blocks`.

Evidence of importance:

• Commit 79c304eacd explains an intermittent test failure: "The test set up the tip time using Now<NodeSeconds>() and then called UpdateIBDStatus(), which calls IsTipRecent(), which also calls Now<NodeSeconds>(). If a second boundary was crossed between the two calls, the tip_recent=true case would fail spuriously."
• The PR description notes this provides an instance-scoped alternative to #35496 (which added global `btck_set_mock_time`), eliminating global state sharing between concurrent kernel instances.

Scope: The diff includes refactoring mempool time types from integers to `NodeClock::time_point` and adjusting link targets to disallow `NodeClock::now()` in `libbitcoinkernel`, which spans beyond `ChainstateManager` itself.

Risk of a mistake: medium (validation, consensus). A flaw in clock routing or time casting could alter block header future-time consensus checks or disrupt IBD latch transitions, potentially causing valid blocks to be rejected or nodes to stay in IBD indefinitely.

Changed since the previous assessment: Adapted the `utxo_total_supply` fuzz harness and `chainstatemanager_ibd_exit_after_loading_blocks` unit test to directly exercise the per-chainman clock instead of relying on global mock clocks.

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

• author: clarify relevance and approach following merge of #35496 and feedback from maflcko and sedited 2026-08-17

Mild

objection that needs an answer has none yet (maflcko)

Thread notes: Statement r:4588310492 was edited with additional rebase announcements up to pr/kclock.11, but does not answer the open questions on relevance or approach from maflcko and sedited.

Objections, suggestions, and questions:

Support:

• sedited (member) (2026-06-21) [read]: prefers setting clock time on chainman over setting it in options because it can be updated repeatedly and matches current global mocktime mechanics

Participants:

• maflcko (member, objection, 5 statements 2026-06-18 to 2026-08-17): objected to GetMockTime in fuzz tests, questioned PR relevance after #35496 merged, and cited conflict with #35906
• sedited (member, support, 2 statements 2026-06-21 to 2026-10-26): supported setter approach over options approach, but later questioned whether the PR is worth the squeeze
• stickies-v (member, objection, 1 statements 2026-06-23 to 2026-06-23): raised ergonomics concerns with per-object clock setting and suggested a callback clock abstraction
• seduless (contributor, neutral, 1 statements 2026-06-25 to 2026-06-25): suggested using FakeNodeClock RAII helper in chainstatemanager tests

126 lines under test/bench/ci.

• src/validation.cpp +29/-29
• src/test/kernel/test_kernel.cpp +35/-0
• src/test/rbf_tests.cpp +17/-17
• src/kernel/bitcoinkernel.h +28/-0
• src/txmempool.h +19/-5
• src/validation.h +21/-1
• src/txmempool.cpp +8/-8
• src/util/time.h +13/-3
• src/util/time_nondet.cpp +14/-0
• src/node/mempool_persist.cpp +9/-2
• src/test/fuzz/tx_pool.cpp +5/-5
• src/test/validation_chainstatemanager_tests.cpp +9/-1
• src/kernel/bitcoinkernel.cpp +9/-0
• src/test/fuzz/utxo_total_supply.cpp +6/-3
• src/kernel/mempool_entry.h +5/-3
• src/kernel/bitcoinkernel_wrapper.h +7/-0
• src/chain.h +4/-2
• src/test/fuzz/package_eval.cpp +3/-3
• src/test/util/txmempool.cpp +3/-3
• src/util/time.cpp +2/-4
• src/bench/blockencodings.cpp +1/-1
• src/bench/mempool_ephemeral_spends.cpp +1/-1
• src/bench/mempool_eviction.cpp +1/-1
• src/bench/mempool_stress.cpp +1/-1
• src/bench/rpc_mempool.cpp +1/-1
• src/node/chainstate.cpp +1/-1
• src/rpc/mempool.cpp +1/-1
• src/test/fuzz/rbf.cpp +1/-1
• src/test/fuzz/util/mempool.cpp +1/-1
• src/test/util/setup_common.cpp +1/-1
• src/util/CMakeLists.txt +1/-0

The short text the ranking pass compares across PRs.

This pull request adds an instance-scoped clock override API (`btck_chainstate_manager_set_clock_time`) and routes validation time checks through `ChainstateManager::Now()`. This eliminates the kernel's reliance on host system clocks and process-global mock time, enabling independent, deterministic multi-instance validation while fixing an intermittent unit test race across second boundaries. It also converts mempool time representations to type-safe time points and enforces clock determinism by preventing `libbitcoinkernel` from linking against `NodeClock::now()`. No dependencies are required.

P2 · new feature

Adds per-instance clock time querying and injection to the C/C++ kernel API, replacing global mocktime to support deterministic concurrent kernel instances. This advances the kernel boundary by removing direct node clock dependencies and catching nondeterministic clock usage at link time.

Membership: Has the Kernel label and adds `btck_chainstate_manager_set_clock_time` and `SetClockTime` to `src/kernel/bitcoinkernel.h` and `bitcoinkernel.cpp`.

Factors: security/stability 0, bug 1, performance 0, user value 0, leverage 1

P3 · cleanup

Routes header future-time validation, IBD evaluation, and progress calculation through `ChainstateManager::Now()`, eliminating global system time queries. This makes validation logic safer to test in isolation and resolves a spurious second-boundary race condition in `chainstatemanager_ibd_exit_after_loading_blocks`.

Membership: Has the Validation label and updates validation time checks across `src/validation.cpp` and `src/validation.h` to query clock time via `ChainstateManager`.

Factors: security/stability 0, bug 1, performance 0, user value 0, leverage 1