Module time/instant

The two clocks: Instant (monotonic, for measuring elapsed time) and SystemTime (wall clock, for timestamps that outlive the process).

They are deliberately DIFFERENT TYPES and not interconvertible. A monotonic reading has no meaning outside this process — it cannot be persisted, compared across machines, or turned into a date — while a wall-clock reading can jump backwards when the system clock is adjusted and so must never be used to measure a duration. Rust draws the same line, and mixing them is the bug the split prevents.

Example

{ Instant, SystemTime, UNIX_EPOCH } :: import "std/time/instant";

start := Instant.now();
// ... do work ...
println(start.elapsed().as_millis());       // elapsed: monotonic

t := SystemTime.now();
match(t.duration_since(UNIX_EPOCH),         // timestamp: wall clock
  .Ok(d) => println(d.as_secs()),
  .Err(e) => println(e)
);

Stability

unstable — SystemTime arrived in v0.2.28 (#522) and has had one release, and two shapes here still differ from Rust in ways that a caller can only discover by reading the body. Instant.duration_since and Instant.sub CLAMP at zero, where Rust's Instant::duration_since panics on a later argument and splits the non-panicking cases into checked_duration_since and saturating_duration_since; the clamp is defensible for a monotonic clock but it silently turns a reversed-argument bug into a zero. Neither type has the checked_add/checked_sub Rust offers, Instant has no Hash or Default while Duration has both, and SystemTime has no ToString/Debug — a timestamp that cannot be printed. Instant.add/ sub also multiply out to a nanosecond count, which is exactly what the SystemTime helpers below were written to avoid; it is harmless only because a monotonic reading is uptime rather than a date.

Freezing needs the clamp-vs-checked_* split decided and those trait gaps filled. The two-clock division itself is settled and will not move.