---------

Co-authored-by: JSap0914 <JSap0914@users.noreply.github.com>
Co-authored-by: Robert Kieffer <robert@broofa.com>

---------

Co-authored-by: Robert Kieffer <robert@broofa.com>

The v1/v6 timestamp is `msecs * 10000 + nsecs` in 100-nanosecond intervals
since the Gregorian epoch. It needs 57+ bits, so `v1Bytes()` computes it as a
32-bit `time_low` and a 28-bit `time_mid`/`time_high` half. `nsecs` was added
to the low half only, and the low half was reduced mod 2^32, so a `nsecs` value
that pushed it past 2^32 wrapped without incrementing the high half.

The high half was also derived from `msecs` alone via a floating-point divide,
which cannot see that carry at all.

The result is a timestamp 2^32 * 100ns = 429.4967296 seconds in the past. It
happens whenever `msecs * 10000` lands within 10000 of a 2^32 boundary, i.e.
for one millisecond about every 430 seconds, and then only for the `nsecs`
values above the boundary. `v1()`'s internal state walks `nsecs` from 0 to 9999
within a millisecond, so it is reachable with no options at all: generating
enough ids inside that millisecond makes the timestamp jump backwards, breaking
the monotonicity that v1 ordering and v6 sorting depend on. Because the wrap
maps two distinct instants onto one encoded timestamp, a generator with a
stable `clockseq` and `node` can also emit the same id twice, 429.496s apart.

Compute the low half's own carry and fold it into the high half. `msecs` is
split at bit 28 rather than 32 because `0x10000000 * 10000` is exactly
`625 * 0x100000000`, so the split is exact and the high half needs no
floating-point division.

…de (#973)

updateV1State() already sets the RFC 9562 section 6.10 multicast bit
on the node it randomizes and caches, but that's only reached by
plain v1() calls with no options. Every other path -- v1(options)
whenever options omits node, and v6() unconditionally, since v6
always defers its random node to v1Bytes() rather than
updateV1State() -- computes its own fresh random node inline via
node ??= rnds.slice(10, 16) without the same bit set.

v6() is the RFC-recommended, time-ordered generator, and it fails
this MUST-level requirement on its default random node roughly half
the time, not as a rare edge case (empirically ~50% across repeated
trials before this fix, 100% after).

Co-authored-by: MoonsvnLyn <287222957+FirmaSpring@users.noreply.github.com>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>