Function delivery_watermark_advance 

pub fn delivery_watermark_advance(
    log_start: i64,
    current: i64,
    candidate: i64,
    log_end: i64,
) -> i64

Bound one scheduled-delivery watermark step to the live log range.

The current watermark is first clamped into [log_start, log_end] after retention or truncation. The step then moves it to the candidate when the candidate is ahead, capped at the log end: min(max(candidate, clamped current), log_end). It never moves the clamped watermark backwards or past the log end.