@malloy-publisher/server 0.0.223 → 0.0.224

package/src/service/environment.ts

@@ -28,7 +28,7 @@ import {
    assertSafeRelativeModelPath,
    safeJoinUnderRoot,
 } from "../path_safety";
-import { BuildManifest } from "../storage/DatabaseInterface";
+import { FreshnessManifest } from "../storage/DatabaseInterface";
 import { URL_READER } from "../utils";
 import {
    buildEnvironmentMalloyConfig,
@@ -1119,7 +1119,7 @@ export class Environment {
     */
    public async reloadAllModelsForPackage(
       packageName: string,
-      manifest: BuildManifest["entries"],
+      manifest: FreshnessManifest,
    ): Promise<void> {
       assertSafePackageName(packageName);
       return this.withPackageLock(packageName, async () => {
@@ -1193,7 +1193,7 @@ export class Environment {
     */
    private async fetchManifestEntriesWithTimeout(
       manifestLocation: string,
-   ): Promise<BuildManifest["entries"]> {
+   ): Promise<FreshnessManifest> {
       let timer: ReturnType<typeof setTimeout> | undefined;
       const timeout = new Promise<never>((_, reject) => {
          timer = setTimeout(

package/src/service/freshness.spec.ts

@@ -0,0 +1,183 @@
+import { describe, expect, it } from "bun:test";
+
+import type {
+   FreshnessAwareManifestEntry,
+   FreshnessManifest,
+} from "../storage/DatabaseInterface";
+import { evaluateManifestFreshness, filterFreshManifest } from "./freshness";
+
+// A fixed "now" so age math is deterministic.
+const NOW = new Date("2026-07-07T12:00:00.000Z");
+const NOW_MS = NOW.getTime();
+
+/** dataAsOf `ageSeconds` before NOW. */
+function asOf(ageSeconds: number): string {
+   return new Date(NOW_MS - ageSeconds * 1000).toISOString();
+}
+
+describe("evaluateManifestFreshness", () => {
+   it("serves the table when un-gated (no window)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(1_000_000),
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_table");
+   });
+
+   it("serves the table when a window is declared but no dataAsOf anchor", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "live",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_table");
+   });
+
+   it("serves the table when fresh (age within window)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(1800),
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "live",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_table");
+   });
+
+   it("serves the table at the exact window boundary (age == window)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(3600),
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "live",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_table");
+   });
+
+   it("drops a stale entry with fallback live (=> serve live)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(7200),
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "live",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_live");
+   });
+
+   it("keeps a stale entry with fallback stale_ok (=> serve the stale table)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(7200),
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "stale_ok",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_table");
+   });
+
+   it("drops a stale entry with fallback fail (interim: serve live in v1)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(7200),
+         freshnessWindowSeconds: 3600,
+         freshnessFallback: "fail",
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_live");
+   });
+
+   it("drops a stale entry with no declared fallback (=> serve live)", () => {
+      const entry: FreshnessAwareManifestEntry = {
+         tableName: "t",
+         dataAsOf: asOf(7200),
+         freshnessWindowSeconds: 3600,
+      };
+      expect(evaluateManifestFreshness(entry, NOW)).toBe("serve_live");
+   });
+});
+
+describe("filterFreshManifest", () => {
+   it("includes fresh/un-gated/stale_ok and drops stale live/fail", () => {
+      const entries: FreshnessManifest = {
+         fresh: {
+            tableName: "fresh_t",
+            dataAsOf: asOf(1800),
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "live",
+         },
+         ungated: { tableName: "ungated_t", dataAsOf: asOf(999999) },
+         staleLive: {
+            tableName: "stale_live_t",
+            dataAsOf: asOf(7200),
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "live",
+         },
+         staleOk: {
+            tableName: "stale_ok_t",
+            dataAsOf: asOf(7200),
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "stale_ok",
+         },
+         staleFail: {
+            tableName: "stale_fail_t",
+            dataAsOf: asOf(7200),
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "fail",
+         },
+      };
+
+      const { manifest } = filterFreshManifest(entries, NOW);
+      expect(Object.keys(manifest).sort()).toEqual([
+         "fresh",
+         "staleOk",
+         "ungated",
+      ]);
+      expect(manifest.fresh).toEqual({ tableName: "fresh_t" });
+      expect(manifest.staleOk).toEqual({ tableName: "stale_ok_t" });
+      expect(manifest.ungated).toEqual({ tableName: "ungated_t" });
+   });
+
+   it("reports the earliest future window-crossing as nextStaleSince", () => {
+      const entries: FreshnessManifest = {
+         a: {
+            tableName: "a_t",
+            dataAsOf: asOf(1800), // window 3600 => flips at NOW + 1800s
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "live",
+         },
+         b: {
+            tableName: "b_t",
+            dataAsOf: asOf(1000), // window 3600 => flips at NOW + 2600s (later)
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "live",
+         },
+      };
+
+      const { nextStaleSince } = filterFreshManifest(entries, NOW);
+      // Earliest flip is entry a: dataAsOf(a) + window.
+      expect(nextStaleSince).toBe(NOW_MS - 1800 * 1000 + 3600 * 1000);
+   });
+
+   it("kept stale_ok entries do not set a future nextStaleSince", () => {
+      const entries: FreshnessManifest = {
+         staleOk: {
+            tableName: "stale_ok_t",
+            dataAsOf: asOf(7200),
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "stale_ok",
+         },
+      };
+      const { manifest, nextStaleSince } = filterFreshManifest(entries, NOW);
+      expect(Object.keys(manifest)).toEqual(["staleOk"]);
+      // Its window crossing is already in the past, so nothing schedules a
+      // future recompute.
+      expect(nextStaleSince).toBeNull();
+   });
+
+   it("returns null nextStaleSince when nothing is gated", () => {
+      const entries: FreshnessManifest = {
+         a: { tableName: "a_t" },
+         b: { tableName: "b_t", dataAsOf: asOf(10) },
+      };
+      const { manifest, nextStaleSince } = filterFreshManifest(entries, NOW);
+      expect(Object.keys(manifest).sort()).toEqual(["a", "b"]);
+      expect(nextStaleSince).toBeNull();
+   });
+});

package/src/service/freshness.ts

@@ -0,0 +1,112 @@
+/**
+ * Per-query freshness gate for persisted sources (persistence.md §9.3, §14
+ * Phase B). A query on a `#@ persist` source may use its materialized table
+ * only while that table is within its declared freshness window; otherwise the
+ * query does what the source's `fallback` says.
+ *
+ * Two settled design principles anchor this (do not re-derive them the easy
+ * way):
+ *
+ *  1. Enforce per query, not at bind. Filtering stale entries once when the
+ *     manifest is bound would let a table that crosses its window while the
+ *     package stays loaded keep serving stale. The serve path re-evaluates
+ *     freshness on every query.
+ *  2. Clock on `dataAsOf`, not build completion. The window is a deadline on
+ *     *data* age; the anchor is the artifact's data-as-of instant (snapshot
+ *     start) supplied by the control plane. `age = now - dataAsOf`.
+ *
+ * Scope: `live`/`stale_ok` are fully publisher-side. `fail` degrades to
+ * serve-live in this first cut (the entry is dropped like `live`); the airtight
+ * `fail` path — which must *error* a query that joins a stale persist source —
+ * is a gated forked-malloy follow-up and is not built here.
+ */
+
+import {
+   BuildManifest,
+   FreshnessAwareManifestEntry,
+   FreshnessManifest,
+} from "../storage/DatabaseInterface";
+
+/**
+ * What to do with a single manifest entry at query time.
+ *  - `serve_table`: substitute the materialized table (include `{ tableName }`).
+ *  - `serve_live`:  drop the entry so `strict:false` falls through to live SQL.
+ *
+ * `fail` collapses to `serve_live` in v1 (see module note).
+ */
+export type FreshnessDecision = "serve_table" | "serve_live";
+
+/**
+ * Evaluate one entry against `now`. An entry with no `freshnessWindowSeconds`
+ * is un-gated (always serve the table). A fresh entry (age within window) is
+ * served. A stale entry serves its table only under `stale_ok`; `live` and
+ * `fail` both drop to live in this first cut.
+ */
+export function evaluateManifestFreshness(
+   entry: FreshnessAwareManifestEntry,
+   now: Date,
+): FreshnessDecision {
+   // Un-gated: no declared window ⇒ never stale. Also the rollout-safe default
+   // before the control plane starts stamping the freshness fields.
+   if (entry.freshnessWindowSeconds == null) return "serve_table";
+   // A window without an anchor can't be evaluated; treat as un-gated rather
+   // than tripping every query (matches "absent ⇒ never stale").
+   if (entry.dataAsOf == null) return "serve_table";
+   const dataAsOfMs = Date.parse(entry.dataAsOf);
+   if (Number.isNaN(dataAsOfMs)) return "serve_table";
+   const ageSeconds = (now.getTime() - dataAsOfMs) / 1000;
+   const stale = ageSeconds > entry.freshnessWindowSeconds;
+   if (!stale) return "serve_table";
+   return entry.freshnessFallback === "stale_ok" ? "serve_table" : "serve_live";
+}
+
+/**
+ * The instant a currently-fresh, gated entry will cross its window
+ * (`dataAsOf + window`), or `null` when the entry has no evaluable window
+ * (un-gated). Used to compute the next memo-invalidation instant.
+ */
+function staleSinceMs(entry: FreshnessAwareManifestEntry): number | null {
+   if (entry.freshnessWindowSeconds == null || entry.dataAsOf == null) {
+      return null;
+   }
+   const dataAsOfMs = Date.parse(entry.dataAsOf);
+   if (Number.isNaN(dataAsOfMs)) return null;
+   return dataAsOfMs + entry.freshnessWindowSeconds * 1000;
+}
+
+/**
+ * Compute the freshness-filtered Malloy build manifest for `now` from the full
+ * retained wire entries.
+ *
+ * Returns the `sourceEntityId -> { tableName }` map of entries that should
+ * substitute their materialized table (fresh, un-gated, or stale-`stale_ok`),
+ * plus `nextStaleSince`: the earliest future instant a currently-included,
+ * gated entry will cross its window. Because age only ever grows, the
+ * fresh→stale transition is one-way, so a single `nextStaleSince` instant is a
+ * sufficient memo-invalidation deadline — no per-entry heap is needed. `null`
+ * means no included entry has an evaluable window, so the result never changes
+ * until the entries are replaced (rebind).
+ */
+export function filterFreshManifest(
+   entries: FreshnessManifest,
+   now: Date,
+): { manifest: BuildManifest["entries"]; nextStaleSince: number | null } {
+   const manifest: BuildManifest["entries"] = {};
+   let nextStaleSince: number | null = null;
+   const nowMs = now.getTime();
+
+   for (const [sourceEntityId, entry] of Object.entries(entries)) {
+      if (evaluateManifestFreshness(entry, now) === "serve_live") continue;
+      manifest[sourceEntityId] = { tableName: entry.tableName };
+
+      // Only currently-fresh gated entries can flip later; a kept stale
+      // `stale_ok` entry (staleSince already in the past) never changes again.
+      const flipAt = staleSinceMs(entry);
+      if (flipAt != null && flipAt > nowMs) {
+         nextStaleSince =
+            nextStaleSince == null ? flipAt : Math.min(nextStaleSince, flipAt);
+      }
+   }
+
+   return { manifest, nextStaleSince };
+}

package/src/service/manifest_loader.spec.ts

@@ -46,6 +46,39 @@ describe("fetchManifestEntries", () => {
       });
    });
 
+   it("carries the control-plane freshness fields verbatim", async () => {
+      const dataAsOf = "2026-07-07T00:00:00.000Z";
+      const file = await writeManifest({
+         entries: {
+            gated: {
+               sourceEntityId: "gated",
+               physicalTableName: "schema.gated_mz",
+               dataAsOf,
+               freshnessWindowSeconds: 3600,
+               freshnessFallback: "stale_ok",
+            },
+            ungated: {
+               sourceEntityId: "ungated",
+               physicalTableName: "schema.ungated_mz",
+            },
+         },
+      });
+
+      const entries = await fetchManifestEntries(file);
+
+      // Filter-free: freshness fields are retained for the serve-path gate; a
+      // window-less entry is left un-gated.
+      expect(entries).toEqual({
+         gated: {
+            tableName: "schema.gated_mz",
+            dataAsOf,
+            freshnessWindowSeconds: 3600,
+            freshnessFallback: "stale_ok",
+         },
+         ungated: { tableName: "schema.ungated_mz" },
+      });
+   });
+
    it("reads via a file:// URI", async () => {
       const file = await writeManifest({
          entries: { b1: { sourceEntityId: "b1", physicalTableName: "t1" } },

package/src/service/manifest_loader.ts

@@ -4,7 +4,7 @@ import * as fs from "fs/promises";
 import { fileURLToPath } from "url";
 import { components } from "../api";
 import { logger } from "../logger";
-import { BuildManifest } from "../storage/DatabaseInterface";
+import { FreshnessManifest } from "../storage/DatabaseInterface";
 
 type WireBuildManifest = components["schemas"]["BuildManifest"];
 
@@ -58,14 +58,18 @@ async function readManifestBytes(uri: string): Promise<string> {
 
 /**
  * Fetch and parse the control-plane-computed build manifest at `uri`, returning
- * the Malloy-runtime binding map (`sourceEntityId -> { tableName }`). The wire manifest
- * keys physical tables under `physicalTableName`; the Malloy runtime consumes
- * `tableName`, so we translate here. Entries missing a physical table are
- * skipped. Throws if the URI can't be read or parsed.
+ * the full wire binding map (`sourceEntityId -> { tableName, dataAsOf,
+ * freshnessWindowSeconds, freshnessFallback }`). The wire manifest keys physical
+ * tables under `physicalTableName`; the Malloy runtime consumes `tableName`, so
+ * we translate that field here but otherwise carry the control-plane freshness
+ * fields verbatim so the serve path can gate `age vs window` per query. Entries
+ * missing a physical table are skipped. This is a pure fetch + parse: it does
+ * **not** filter on freshness (that happens per query on the serve path). Throws
+ * if the URI can't be read or parsed.
  */
 export async function fetchManifestEntries(
    uri: string,
-): Promise<BuildManifest["entries"]> {
+): Promise<FreshnessManifest> {
    const raw = await readManifestBytes(uri);
 
    let parsed: WireBuildManifest;
@@ -79,7 +83,7 @@ export async function fetchManifestEntries(
       );
    }
 
-   const entries: BuildManifest["entries"] = {};
+   const entries: FreshnessManifest = {};
    for (const [sourceEntityId, entry] of Object.entries(parsed.entries ?? {})) {
       const physicalTableName = entry?.physicalTableName;
       if (!physicalTableName) {
@@ -89,7 +93,12 @@ export async function fetchManifestEntries(
          });
          continue;
       }
-      entries[sourceEntityId] = { tableName: physicalTableName };
+      entries[sourceEntityId] = {
+         tableName: physicalTableName,
+         dataAsOf: entry.dataAsOf,
+         freshnessWindowSeconds: entry.freshnessWindowSeconds,
+         freshnessFallback: entry.freshnessFallback,
+      };
    }
    return entries;
 }

package/src/service/materialization_cron_gate.spec.ts

@@ -7,14 +7,17 @@ import { Environment } from "./environment";
 import type { Package } from "./package";
 
 /**
- * The publish gate for the package-level materialization cron (§9.4
- * artifact-anchored scheduling): a declared `materialization.schedule` is the
- * power tier and is valid only when every persist source in the compiled
- * build plan resolves to an explicit `sharing=private`. These tests run a real
- * `Environment` + `Package.create` over temp dirs, so they also prove
- * end-to-end that the pinned compiler ACCEPTS `sharing=` / `refresh=` keys in
- * the `#@ persist` annotation and that the values survive to the wire build
- * plan verbatim (unset stays null — never defaulted to "shared").
+ * The publish gate for the package-level materialization cron. At Phase B the
+ * package-level cron (`materialization.schedule`) is replaced outright by
+ * `materialization.freshness.window` (persistence.md §9.4), so ANY declared cron
+ * is rejected regardless of the sources' sharing. The `sharing=private`
+ * carve-out arrives whole with Phase A (persistence-phase-b-design.md §3.4);
+ * until then there is no private artifact for a cron to own, so the B→A rule is
+ * reject-all. These tests run a real `Environment` + `Package.create` over temp
+ * dirs, so they also prove end-to-end that the pinned compiler ACCEPTS
+ * `sharing=` / `refresh=` keys in the `#@ persist` annotation and that the
+ * values survive to the wire build plan verbatim (unset stays null — never
+ * defaulted to "shared").
  */
 describe("materialization cron gate", () => {
    let rootDir: string;
@@ -99,29 +102,31 @@ source: b is duckdb.sql("SELECT 2 as x")
    );
 
    it(
-      "rejects a cron over shared/unset persist sources, pointing at freshness.window",
+      "rejects any declared cron, pointing at freshness.window",
       async () => {
          const pkg = await loadPackage(MIXED_MODEL, "0 6 * * *");
 
+         // One actionable message for the whole package — the B→A rule is
+         // reject-all, not per-source.
          const warnings = pkg.scheduleWarnings();
-         // One actionable message per offending source; the compliant private
-         // source is not flagged.
-         expect(warnings).toHaveLength(2);
+         expect(warnings).toHaveLength(1);
          const joined = pkg.formatInvalidSchedule();
-         expect(joined).toContain("'open' resolves to 'shared'");
-         expect(joined).toContain("'unspecified' resolves to unset");
-         expect(joined).not.toContain("'priv'");
+         expect(joined).toContain("materialization.schedule");
          expect(joined).toContain("materialization.freshness.window");
       },
       { timeout: 30000 },
    );
 
    it(
-      "allows a cron when every persist source is explicitly private",
+      "rejects a declared cron even when every persist source is private",
       async () => {
+         // The sharing=private carve-out arrives with Phase A; during B→A even
+         // an all-private package's cron is rejected outright.
          const pkg = await loadPackage(ALL_PRIVATE_MODEL, "0 6 * * *");
-         expect(pkg.scheduleWarnings()).toEqual([]);
-         expect(pkg.formatInvalidSchedule()).toBe("");
+         expect(pkg.scheduleWarnings()).toHaveLength(1);
+         expect(pkg.formatInvalidSchedule()).toContain(
+            "materialization.freshness.window",
+         );
       },
       { timeout: 30000 },
    );

package/src/service/materialization_service.ts

@@ -23,6 +23,7 @@ import {
    BuildManifest,
    BuildManifestResult,
    BuildPlan,
+   FreshnessManifest,
    Materialization,
    MaterializationStatus,
    MaterializationUpdate,
@@ -480,12 +481,16 @@ export class MaterializationService {
       environment: {
          reloadAllModelsForPackage(
             packageName: string,
-            manifest: BuildManifest["entries"],
+            manifest: FreshnessManifest,
          ): Promise<void>;
       },
       packageName: string,
       entries: Record<string, ManifestEntry>,
    ): Promise<void> {
+      // The post-build auto-load binds tableName-only entries: the control plane
+      // stamps freshness (dataAsOf/window/fallback) on the wire manifest it
+      // distributes, not on this in-memory post-build load, so these sources are
+      // bound un-gated (always serve the freshly-built table).
       const manifestEntries: BuildManifest["entries"] = {};
       for (const [sourceEntityId, entry] of Object.entries(entries)) {
          if (entry.physicalTableName) {

package/src/service/model.ts

@@ -164,6 +164,14 @@ export class Model {
       exploresDeclared: boolean;
       isQueryEntryPoint: boolean;
    } = { mode: "all", exploresDeclared: false, isQueryEntryPoint: true };
+   /** Per-query freshness resolver, pushed down by the owning Package (see
+    *  Package.wireFreshnessResolvers). Returns the freshness-filtered build
+    *  manifest for the serve path — threaded into Malloy's per-query
+    *  `buildManifest` override so a persist source only routes to its
+    *  materialized table while within its declared freshness window. Undefined
+    *  (or returning undefined) means no override: the runtime-baked manifest
+    *  applies, which serves live when unbound. */
+   private freshnessResolver?: () => BuildManifest["entries"] | undefined;
    private meter = publisherMeter();
    private queryExecutionHistogram = this.meter.createHistogram(
       "malloy_model_query_duration",
@@ -743,6 +751,29 @@ export class Model {
       this.discoveryCurationEnabled = enabled;
    }
 
+   /**
+    * Set by the owning Package (see Package.wireFreshnessResolvers). Supplies
+    * the freshness-filtered build manifest the serve path threads into Malloy's
+    * per-query `buildManifest` override so stale persist sources fall back per
+    * their declared policy. See {@link resolveFreshBuildManifest}.
+    */
+   public setFreshnessResolver(
+      resolver: () => BuildManifest["entries"] | undefined,
+   ): void {
+      this.freshnessResolver = resolver;
+   }
+
+   /**
+    * The freshness-filtered build manifest for this query, or undefined when the
+    * package is unbound / has no resolver (⇒ no per-query override; the runtime
+    * serves live). Evaluated per call so a table that crosses its window while
+    * the package stays loaded is gated on the very next query.
+    */
+   private resolveFreshBuildManifest(): BuildManifest | undefined {
+      const entries = this.freshnessResolver?.();
+      return entries ? { entries, strict: false } : undefined;
+   }
+
    public getSources(): ApiSource[] | undefined {
       return this.curateForDiscovery(this.sources);
    }
@@ -1273,8 +1304,14 @@ export class Model {
 
       const maxRows = getMaxQueryRows();
       const maxBytes = getMaxResponseBytes();
+      // Per-query freshness gate (persistence.md §9.3): resolve the
+      // freshness-filtered manifest once and thread it into both the prepare
+      // (for the row limit) and the run so a stale persist source falls back per
+      // its declared policy — and prep/run agree on the same substitution.
+      const buildManifest = this.resolveFreshBuildManifest();
       const rowLimit = resolveModelQueryRowLimit(
-         (await runnable.getPreparedResult({ givens })).resultExplore.limit,
+         (await runnable.getPreparedResult({ givens, buildManifest }))
+            .resultExplore.limit,
          { defaultLimit: getDefaultQueryRowLimit(), maxRows },
       );
       const endTime = performance.now();
@@ -1282,7 +1319,12 @@ export class Model {
 
       let queryResults;
       try {
-         queryResults = await runnable.run({ rowLimit, givens, abortSignal });
+         queryResults = await runnable.run({
+            rowLimit,
+            givens,
+            abortSignal,
+            buildManifest,
+         });
       } catch (error) {
          // Record error metrics
          const errorEndTime = performance.now();
@@ -1521,9 +1563,16 @@ export class Model {
 
             const cellMaxRows = getMaxQueryRows();
             const cellMaxBytes = getMaxResponseBytes();
+            // Per-query freshness gate (see getQueryResults): the same
+            // freshness-filtered manifest gates notebook-cell queries.
+            const buildManifest = this.resolveFreshBuildManifest();
             const rowLimit = resolveModelQueryRowLimit(
-               (await runnableToExecute.getPreparedResult({ givens }))
-                  .resultExplore.limit,
+               (
+                  await runnableToExecute.getPreparedResult({
+                     givens,
+                     buildManifest,
+                  })
+               ).resultExplore.limit,
                {
                   defaultLimit: getDefaultQueryRowLimit(),
                   maxRows: cellMaxRows,
@@ -1533,6 +1582,7 @@ export class Model {
                rowLimit,
                givens,
                abortSignal,
+               buildManifest,
             });
             const query = (await runnableToExecute.getPreparedQuery())._query;
             queryName = (query as NamedQueryDef).as || query.name;