Unique ID generator - 64 bits, and two facts nobody can check

Ask these before drawing anything

• Must the id be sortable by creation time? This is the question that decides everything. If not, UUIDv4 is a better answer than anything on this board and the interview is over in one minute - which is a good answer, not a failure.
• Is the id ever shown to a user or put in a URL? Sortable ids are enumerable and they leak volume: two ids an hour apart tell anybody how many rows were created in between. If it is public, it needs a separate opaque external id.
• How many bits are available? 64 fits in a bigint and in a JavaScript BigInt but NOT in a JavaScript Number, which silently loses precision above 2^53 and is the most common production bug in this design.
• How many generating processes will there ever be? The worker id space is a hard ceiling. 1,024 sounds infinite until a fleet autoscales.
• Is the clock trustworthy, and who owns NTP? If nobody can answer this, the design has an unowned dependency at its centre.
• What should happen when an id cannot safely be generated - fail the write, or block? There is no third option, and the answer is an availability number.

Functional

• Generate a 64-bit id that is unique across the entire fleet, forever.
• Ids increase monotonically with time, so that ordering by id orders by creation.
• Generation is in process: no network call, no service to be unavailable.
• A worker acquires its worker id automatically on start and releases it on stop.
• An id can be decoded back into its timestamp, datacenter and worker, for debugging.

Non-functional

• p99 under 1 microsecond per id. This is arithmetic and a lock, not a request.
• Zero duplicates. Not "rare" duplicates - a duplicate here is a primary key collision discovered weeks later in a table nobody was watching.
• Survive the id registry being unavailable for the length of a lease without producing a duplicate. Note what this does NOT say: it does not say keep generating.
• Ids remain unique across a datacenter failover, a process restart within the same millisecond, and a clock correction.
• The scheme must last 69 years from its epoch, and the expiry date must be written down somewhere a human will find it.

Out of scope

• Global ordering. Two ids generated in the same millisecond on two workers have no meaningful order between them, and any code that assumes one is wrong.
• Cryptographic unpredictability. These ids are guessable by construction. Anything needing unguessability needs a random token instead, alongside.
• Ids for entities that already have a natural key. The best id generator is the one you did not need.