KIP-1334 — Introduce max.future.record.timestamp.difference.ms to Protect Stream-Time from Future Record Poisoning

Discussion Streams

Adds a max.future.record.timestamp.difference.ms Streams config (default -1, disabled) that intercepts records whose timestamp exceeds stream-time by more than the threshold in PartitionGroup.nextRecord(), returning them as CorruptedRecord so they are committed but neither processed nor allowed to advance stream-time. A single record with a far-future timestamp from a misconfigured clock permanently poisons the monotonic stream-time, silently dropping every later record as window-expired, triggering deletion of all existing RocksDB time segments, and making stream-time punctuators fire on every record.

Details