Function uptime_secs 

pub fn uptime_secs() -> u64

Seconds since mark_process_start. Falls back to initializing on first read, so a caller that never marked startup reports a truthful (if late-based) 0 rather than a wrong number or a panic. saturating_sub makes a decrease structurally impossible even if a platform counter ever misbehaved.