next
The clock after current, enforcing the invariant base rests on: the per-boot counter must never carry into the epoch bits.
A carry would silently borrow the next boot's epoch, so the next restart would no longer strictly out-clock this incarnation and would quietly fall back to TTL-bounded recovery. Reaching it takes 2^COUNTER_BITS publishes within a single boot — so this fails loudly rather than degrading in silence.
Throws
if the per-boot counter is exhausted.