@synapsor/runner 1.6.0 → 1.6.1

package/dist/runner.mjs

@@ -25064,6 +25064,8 @@ var protocolVersions = {
   runnerProposal: "synapsor.runner-proposal.v1",
   runnerActivity: "synapsor.runner-activity.v1",
   principalScope: "synapsor.principal-scope.v1",
+  freshnessAuthority: "synapsor.freshness-authority.v1",
+  freshnessProof: "synapsor.freshness-proof.v1",
   legacyWritebackJob: "1.0",
   normalizedWritebackJobV2: "2.0",
   normalizedWritebackJobV3: "3.0",
@@ -25111,6 +25113,101 @@ var principalScopeGuardSchema = z.object({
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope fingerprint does not match its trusted value", path: ["value_fingerprint"] });
   }
 });
+var freshnessDependencyUnsignedSchema = z.object({
+  id: safeIdentifier,
+  capability: z.string().regex(/^[A-Za-z_][A-Za-z0-9_.-]*\.[A-Za-z_][A-Za-z0-9_.-]*$/, "expected reviewed capability name"),
+  source_id: z.string().min(1).max(160),
+  engine: writebackEngineSchema,
+  target: z.object({
+    schema: safeIdentifier,
+    table: safeIdentifier,
+    primary_key: columnValueSchema,
+    tenant_column: safeIdentifier,
+    principal_column: safeIdentifier.optional()
+  }),
+  expected_version: columnValueSchema,
+  evidence: z.object({
+    bundle_id: z.string().min(1).max(200),
+    query_fingerprint: sha256
+  })
+});
+var freshnessDependencyV1Schema = freshnessDependencyUnsignedSchema.extend({
+  descriptor_digest: sha256
+}).superRefine((dependency, ctx) => {
+  const { descriptor_digest: _digest, ...unsigned } = dependency;
+  if (canonicalJsonDigest(unsigned) !== dependency.descriptor_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency digest mismatch", path: ["descriptor_digest"] });
+  }
+});
+var freshnessAuthorityUnsignedSchema = z.object({
+  schema_version: z.literal(protocolVersions.freshnessAuthority),
+  required: z.literal(true),
+  target: z.object({
+    mode: z.enum(["exact_guard", "frozen_set", "not_applicable"]),
+    member_count: z.number().int().min(0).max(100)
+  }),
+  dependencies: z.array(freshnessDependencyV1Schema).max(16)
+});
+var freshnessAuthorityV1Schema = freshnessAuthorityUnsignedSchema.extend({
+  dependency_set_digest: sha256
+}).superRefine((authority, ctx) => {
+  const identities = authority.dependencies.map((dependency) => dependency.id);
+  if (new Set(identities).size !== identities.length) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency ids must be unique", path: ["dependencies"] });
+  }
+  const sorted = [...authority.dependencies].sort((left, right) => left.source_id.localeCompare(right.source_id) || left.target.schema.localeCompare(right.target.schema) || left.target.table.localeCompare(right.target.table) || JSON.stringify(left.target.primary_key.value).localeCompare(JSON.stringify(right.target.primary_key.value)) || left.id.localeCompare(right.id));
+  if (JSON.stringify(sorted) !== JSON.stringify(authority.dependencies)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependencies must use deterministic lock order", path: ["dependencies"] });
+  }
+  const { dependency_set_digest: _digest, ...unsigned } = authority;
+  if (canonicalJsonDigest(unsigned) !== authority.dependency_set_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency-set digest mismatch", path: ["dependency_set_digest"] });
+  }
+});
+var freshnessCheckStatusSchema = z.enum(["fresh", "stale", "unavailable", "invalid", "unsupported"]);
+var freshnessItemResultSchema = z.object({
+  id: z.string().min(1).max(160),
+  kind: z.enum(["target", "supporting"]),
+  status: z.enum(["fresh", "stale", "not_applicable", "unavailable", "invalid", "unsupported"]),
+  safe_code: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
+  expected_version_digest: sha256.optional(),
+  observed_version_digest: sha256.optional()
+});
+var freshnessProofUnsignedSchema = z.object({
+  schema_version: z.literal(protocolVersions.freshnessProof),
+  proposal_id: z.string().min(1),
+  proposal_hash: sha256,
+  proposal_version: z.number().int().positive(),
+  dependency_set_digest: sha256,
+  checked_at: z.string().datetime(),
+  valid_until: z.string().datetime(),
+  source_adapters: z.array(z.object({
+    source_id: z.string().min(1).max(160),
+    engine: writebackEngineSchema
+  })).min(1).max(8),
+  result: freshnessCheckStatusSchema,
+  safe_code: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
+  target_count: z.number().int().min(0).max(100),
+  supporting_count: z.number().int().min(0).max(16),
+  checks: z.array(freshnessItemResultSchema).max(116)
+});
+var freshnessProofV1Schema = freshnessProofUnsignedSchema.extend({
+  proof_digest: sha256
+}).superRefine((proof, ctx) => {
+  if (Date.parse(proof.valid_until) < Date.parse(proof.checked_at)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness proof validity ends before it was checked", path: ["valid_until"] });
+  }
+  if (proof.checks.filter((check) => check.kind === "target").length !== proof.target_count) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness target count mismatch", path: ["target_count"] });
+  }
+  if (proof.checks.filter((check) => check.kind === "supporting").length !== proof.supporting_count) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness supporting count mismatch", path: ["supporting_count"] });
+  }
+  const { proof_digest: _digest, ...unsigned } = proof;
+  if (canonicalJsonDigest(unsigned) !== proof.proof_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness proof digest mismatch", path: ["proof_digest"] });
+  }
+});
 var resolvedDeduplicationComponentSchema = z.object({
   column: safeIdentifier,
   value: scalar,
@@ -25240,6 +25337,7 @@ var changeSetV1Schema = z.object({
     allowed_columns: z.array(z.string().min(1)).min(1),
     expected_version: columnValueSchema
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   evidence: z.object({
     bundle_id: z.string().min(1),
     query_fingerprint: sha256,
@@ -25260,6 +25358,7 @@ var changeSetV1Schema = z.object({
   }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(changeSet.freshness, changeSet.source.source_id, sourceEngine(changeSet.source.kind), "exact_guard", 1, ctx);
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) {
     if (!allowed.has(column)) {
@@ -25327,6 +25426,7 @@ var changeSetV2Schema = z.object({
     version_advance: versionAdvanceSchema.optional(),
     deduplication: z.object({ components: z.array(resolvedDeduplicationComponentSchema).min(1).max(8) }).optional()
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   reversibility: reversibilityRequestSchema.optional(),
   evidence: z.object({
     bundle_id: z.string().min(1),
@@ -25346,6 +25446,14 @@ var changeSetV2Schema = z.object({
   integrity: z.object({ proposal_hash: sha256 }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(
+    changeSet.freshness,
+    changeSet.source.source_id,
+    sourceEngine(changeSet.source.kind),
+    changeSet.operation === "single_row_insert" ? "not_applicable" : "exact_guard",
+    changeSet.operation === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) {
     if (!allowed.has(column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: `patch column not allowed: ${column}`, path: ["patch", column] });
@@ -25412,6 +25520,7 @@ var changeSetV3Schema = z.object({
     expected_version: columnValueSchema.optional(),
     version_advance: versionAdvanceSchema.optional()
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   frozen_set: frozenSetSchema,
   reversibility: reversibilityRequestSchema.optional(),
   evidence: z.object({ bundle_id: z.string().min(1), query_fingerprint: sha256, items: z.array(z.unknown()).max(100) }).passthrough(),
@@ -25426,6 +25535,14 @@ var changeSetV3Schema = z.object({
   integrity: z.object({ proposal_hash: sha256 }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(
+    changeSet.freshness,
+    changeSet.source.source_id,
+    sourceEngine(changeSet.source.kind),
+    changeSet.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    changeSet.operation === "batch_insert" ? 0 : changeSet.frozen_set.row_count,
+    ctx
+  );
   if (changeSet.source.primary_key.value !== void 0 || changeSet.guards.expected_version) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set guards live on frozen members, not the top-level envelope", path: ["frozen_set"] });
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) if (!allowed.has(column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: `patch column not allowed: ${column}`, path: ["patch", column] });
@@ -25521,6 +25638,7 @@ var writebackJobV1Schema = z.object({
   allowed_columns: z.array(safeIdentifier).min(1),
   patch: scalarMap,
   conflict_guard: publicConflictGuardSchema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   lease: z.object({
     lease_id: z.string().min(1),
@@ -25528,6 +25646,7 @@ var writebackJobV1Schema = z.object({
     expires_at: z.string().min(1)
   })
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(job.freshness, job.runner_scope.source_id, job.engine, "exact_guard", 1, ctx);
   validateAllowedPatchColumns(job.allowed_columns, Object.keys(job.patch), job.target.primary_key.column, job.tenant_guard.column, ctx);
   if (job.principal_scope && job.allowed_columns.includes(job.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
 });
@@ -25549,6 +25668,7 @@ var normalizedWritebackJobV1Schema = writebackJobV1Schema.transform((job) => ({
   allowed_columns: job.allowed_columns,
   patch: job.patch,
   conflict_guard: normalizeConflictGuard(job.conflict_guard),
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   lease_expires_at: job.lease.expires_at,
   attempt_count: job.lease.attempt
@@ -25582,10 +25702,12 @@ var legacyWritebackJobSchema = z.object({
     z.object({ kind: z.literal("row_hash"), expected_hash: z.string().min(1) }),
     z.object({ kind: z.literal("none") })
   ]),
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   lease_expires_at: z.union([z.string(), z.number()]),
   attempt_count: z.number().int().nonnegative().optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(job.freshness, job.source_id, job.engine, "exact_guard", 1, ctx);
   validateAllowedPatchColumns(job.allowed_columns, Object.keys(job.patch), job.target.primary_key.column, job.target.tenant_guard.column, ctx);
   if (job.target.principal_scope && job.allowed_columns.includes(job.target.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
 });
@@ -25612,6 +25734,7 @@ var normalizedWritebackJobV2InputSchema = z.object({
     z.object({ kind: z.literal("row_hash"), expected_hash: z.string().min(1) }),
     z.object({ kind: z.literal("none") })
   ]),
+  freshness: freshnessAuthorityV1Schema.optional(),
   version_advance: versionAdvanceSchema.optional(),
   deduplication: z.object({ components: z.array(resolvedDeduplicationComponentSchema).min(1).max(8) }).optional(),
   idempotency_key: z.string().min(1),
@@ -25619,6 +25742,14 @@ var normalizedWritebackJobV2InputSchema = z.object({
   attempt_count: z.number().int().positive(),
   inverse_capture: inverseDescriptorV1Schema.optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.source_id,
+    job.engine,
+    job.operation === "single_row_insert" ? "not_applicable" : "exact_guard",
+    job.operation === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   if (job.operation !== "single_row_insert" && job.target.primary_key.value === void 0) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "UPDATE and DELETE require a primary-key value", path: ["target", "primary_key", "value"] });
   }
@@ -25684,6 +25815,7 @@ var writebackJobV2Schema = z.object({
   principal_scope: principalScopeGuardSchema.optional(),
   allowed_columns: z.array(safeIdentifier),
   mutation: writebackMutationV2Schema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   inverse_capture: inverseDescriptorV1Schema.optional(),
   lease: z.object({
@@ -25692,6 +25824,14 @@ var writebackJobV2Schema = z.object({
     expires_at: z.string().min(1)
   })
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.runner_scope.source_id,
+    job.engine,
+    job.mutation.kind === "single_row_insert" ? "not_applicable" : "exact_guard",
+    job.mutation.kind === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   const mutation = job.mutation;
   if (mutation.kind !== "single_row_insert" && job.target.primary_key.value === void 0) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "UPDATE and DELETE require a primary-key value", path: ["target", "primary_key", "value"] });
@@ -25730,6 +25870,7 @@ var writebackJobV2Schema = z.object({
   conflict_guard: job.mutation.kind === "single_row_insert" ? { kind: "none" } : normalizeConflictGuard(job.mutation.conflict_guard),
   ...job.mutation.kind === "single_row_update" && job.mutation.version_advance ? { version_advance: job.mutation.version_advance } : {},
   ...job.mutation.kind === "single_row_insert" ? { deduplication: job.mutation.deduplication } : {},
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   ...job.inverse_capture ? { inverse_capture: job.inverse_capture } : {},
   lease_expires_at: job.lease.expires_at,
@@ -25748,6 +25889,7 @@ var normalizedWritebackJobV3InputSchema = z.object({
   allowed_columns: z.array(safeIdentifier).max(256),
   patch: boundedScalarRecord,
   conflict_guard: z.object({ kind: z.literal("none") }).default({ kind: "none" }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   version_advance: versionAdvanceSchema.optional(),
   frozen_set: frozenSetSchema,
   idempotency_key: z.string().min(1),
@@ -25755,6 +25897,14 @@ var normalizedWritebackJobV3InputSchema = z.object({
   attempt_count: z.number().int().positive(),
   inverse_capture: inverseDescriptorV1Schema.optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.source_id,
+    job.engine,
+    job.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    job.operation === "batch_insert" ? 0 : job.frozen_set.row_count,
+    ctx
+  );
   if (job.target.principal_scope && job.allowed_columns.includes(job.target.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
   if (job.operation === "set_delete" && (job.allowed_columns.length || Object.keys(job.patch).length || job.version_advance)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set DELETE cannot carry patch authority", path: ["patch"] });
   if (job.operation === "set_update" && (!Object.keys(job.patch).length || !job.version_advance)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set UPDATE requires patch and version advance", path: ["patch"] });
@@ -25776,9 +25926,19 @@ var writebackJobV3Schema = z.object({
   patch: boundedScalarRecord,
   version_advance: versionAdvanceSchema.optional(),
   frozen_set: frozenSetSchema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   inverse_capture: inverseDescriptorV1Schema.optional(),
   lease: z.object({ lease_id: z.string().min(1), attempt: z.number().int().positive(), expires_at: z.string().min(1) })
+}).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.runner_scope.source_id,
+    job.engine,
+    job.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    job.operation === "batch_insert" ? 0 : job.frozen_set.row_count,
+    ctx
+  );
 }).transform((job) => ({
   protocol_version: protocolVersions.normalizedWritebackJobV3,
   job_id: job.writeback_job_id,
@@ -25793,6 +25953,7 @@ var writebackJobV3Schema = z.object({
   conflict_guard: { kind: "none" },
   ...job.version_advance ? { version_advance: job.version_advance } : {},
   frozen_set: job.frozen_set,
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   ...job.inverse_capture ? { inverse_capture: job.inverse_capture } : {},
   lease_expires_at: job.lease.expires_at,
@@ -26146,6 +26307,38 @@ var runnerActivityV1Schema = z.object({
   detail: z.record(z.unknown()).optional(),
   occurred_at: z.string().min(1).max(80).optional()
 }).strict();
+function sourceEngine(kind) {
+  if (kind === "external_postgres") return "postgres";
+  if (kind === "external_mysql") return "mysql";
+  return void 0;
+}
+function validateFreshnessBinding(freshness, sourceId, engine, expectedTargetMode, expectedMemberCount, ctx) {
+  if (!freshness) return;
+  if (!engine) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "freshness authority requires an external PostgreSQL or MySQL source",
+      path: ["freshness"]
+    });
+    return;
+  }
+  if (freshness.target.mode !== expectedTargetMode || freshness.target.member_count !== expectedMemberCount) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `freshness target authority must be ${expectedTargetMode} with ${expectedMemberCount} reviewed member(s)`,
+      path: ["freshness", "target"]
+    });
+  }
+  for (const [index, dependency] of freshness.dependencies.entries()) {
+    if (dependency.source_id !== sourceId || dependency.engine !== engine) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "freshness dependencies must use the proposal/writeback source and engine",
+        path: ["freshness", "dependencies", index, "source_id"]
+      });
+    }
+  }
+}
 function validateAllowedPatchColumns(allowedColumns, patchColumns, primaryKeyColumn, tenantGuardColumn, ctx) {
   const allow = new Set(allowedColumns);
   for (const column of patchColumns) {
@@ -26206,6 +26399,12 @@ function normalizeConflictGuard(guard) {
 function parseChangeSet(input) {
   return z.union([changeSetV1Schema, changeSetV2Schema, changeSetV3Schema, compensationChangeSetV1Schema]).parse(input);
 }
+function parseFreshnessAuthority(input) {
+  return freshnessAuthorityV1Schema.parse(input);
+}
+function parseFreshnessProof(input) {
+  return freshnessProofV1Schema.parse(input);
+}
 function parseWritebackJob(input) {
   return writebackJobSchema.parse(input);
 }
@@ -26576,10 +26775,12 @@ function sleep(ms) {
 
 // packages/config/src/index.ts
 init_dist();
-var TOP_LEVEL_KEYS2 = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "operator_identity", "session_auth", "http_security", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "generated_authority", "strict", "result_format"]);
+var TOP_LEVEL_KEYS2 = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "proposal_freshness", "operator_identity", "session_auth", "http_security", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "generated_authority", "strict", "result_format"]);
 var STORAGE_KEYS = /* @__PURE__ */ new Set(["sqlite_path", "shared_postgres"]);
 var SHARED_POSTGRES_STORAGE_KEYS = /* @__PURE__ */ new Set(["mode", "url_env", "schema", "lock_timeout_ms", "max_entries"]);
 var APPROVALS_KEYS = /* @__PURE__ */ new Set(["disable_auto_approval"]);
+var PROPOSAL_FRESHNESS_KEYS = /* @__PURE__ */ new Set(["approval", "dependencies"]);
+var FRESHNESS_DEPENDENCY_KEYS = /* @__PURE__ */ new Set(["id", "capability", "identity_from_arg", "version_column"]);
 var METRICS_KEYS = /* @__PURE__ */ new Set(["enabled", "token_env"]);
 var GRADUATED_TRUST_KEYS = /* @__PURE__ */ new Set(["enabled", "kill_switch", "workspace_id", "project_id", "criteria"]);
 var GRADUATED_TRUST_CRITERION_KEYS = /* @__PURE__ */ new Set([
@@ -26824,6 +27025,7 @@ function validateRunnerCapabilityConfig(input) {
   validateMetrics(input.metrics, strict, errors);
   validateGraduatedTrust(input.graduated_trust, strict, errors);
   validateCapabilities2(input.capabilities, input.sources, input.contexts, input.executors, input.mode, strict, errors, warnings, hasContracts);
+  validateProposalFreshness(input.proposal_freshness, input.capabilities, strict, errors);
   validateEffectiveContextCompatibility(input.trusted_context, input.contexts, input.capabilities, errors);
   validateApprovalPolicyReferences(input.capabilities, input.policies, errors);
   validateWritebackReadiness(input.sources, input.capabilities, input.mode, errors, warnings);
@@ -27911,6 +28113,125 @@ function validateCapabilities2(value, sources, contexts, executors, mode, strict
     capabilityNames.set(capability.name, index);
   });
 }
+function validateProposalFreshness(value, capabilitiesValue, strict, errors) {
+  if (value === void 0) return;
+  if (!isRecord2(value)) {
+    errors.push({
+      path: "$.proposal_freshness",
+      code: "PROPOSAL_FRESHNESS_NOT_OBJECT",
+      message: "proposal_freshness must map reviewed proposal capability names to freshness policy."
+    });
+    return;
+  }
+  const capabilities = Array.isArray(capabilitiesValue) ? capabilitiesValue.filter(isRecord2) : [];
+  const byName = new Map(capabilities.flatMap((capability) => isQualifiedName2(capability.name) ? [[String(capability.name), capability]] : []));
+  for (const [proposalName, rawPolicy] of Object.entries(value)) {
+    const path26 = `$.proposal_freshness.${proposalName}`;
+    if (!isQualifiedName2(proposalName)) {
+      errors.push({ path: path26, code: "INVALID_FRESHNESS_CAPABILITY_NAME", message: "Freshness policy keys must be existing qualified proposal capability names." });
+      continue;
+    }
+    if (!isRecord2(rawPolicy)) {
+      errors.push({ path: path26, code: "FRESHNESS_POLICY_NOT_OBJECT", message: "Freshness policy must be an object." });
+      continue;
+    }
+    if (strict) checkUnknownKeys2(rawPolicy, PROPOSAL_FRESHNESS_KEYS, path26, errors);
+    if (rawPolicy.approval !== "required") {
+      errors.push({ path: `${path26}.approval`, code: "FRESHNESS_APPROVAL_REQUIRED", message: "Freshness-enabled proposals must set approval to required." });
+    }
+    const proposal = byName.get(proposalName);
+    if (!proposal) {
+      errors.push({ path: path26, code: "FRESHNESS_PROPOSAL_UNKNOWN", message: `Freshness policy references unknown proposal capability ${proposalName}.` });
+      continue;
+    }
+    if (proposal.kind !== "proposal") {
+      errors.push({ path: path26, code: "FRESHNESS_PROPOSAL_REQUIRED", message: `${proposalName} must be a proposal capability.` });
+    }
+    const writeback2 = isRecord2(proposal.writeback) ? proposal.writeback : void 0;
+    if (writeback2?.mode !== "direct_sql") {
+      errors.push({
+        path: path26,
+        code: "FRESHNESS_DIRECT_SQL_REQUIRED",
+        message: "Strict proposal freshness currently requires same-database direct_sql writeback; app-owned and cross-source handlers must enforce their own transaction preconditions."
+      });
+    }
+    const operation = isRecord2(proposal.operation) ? proposal.operation : void 0;
+    if ((operation?.kind ?? "update") !== "insert") {
+      const guard = isRecord2(proposal.conflict_guard) ? proposal.conflict_guard : void 0;
+      if (!isSafeIdentifier2(guard?.column)) {
+        errors.push({ path: path26, code: "FRESHNESS_EXACT_TARGET_GUARD_REQUIRED", message: "Freshness-required UPDATE/DELETE needs an exact conflict_guard.column; weak row hashes are not sufficient." });
+      }
+    }
+    if (rawPolicy.dependencies !== void 0 && !Array.isArray(rawPolicy.dependencies)) {
+      errors.push({ path: `${path26}.dependencies`, code: "FRESHNESS_DEPENDENCIES_NOT_ARRAY", message: "dependencies must be an array of reviewed single-row read references." });
+      continue;
+    }
+    const dependencies = Array.isArray(rawPolicy.dependencies) ? rawPolicy.dependencies : [];
+    if (dependencies.length > 16) {
+      errors.push({ path: `${path26}.dependencies`, code: "FRESHNESS_DEPENDENCY_LIMIT", message: "A proposal may declare at most 16 supporting freshness dependencies." });
+    }
+    const ids = /* @__PURE__ */ new Set();
+    for (const [index, rawDependency] of dependencies.entries()) {
+      const dependencyPath = `${path26}.dependencies[${index}]`;
+      if (!isRecord2(rawDependency)) {
+        errors.push({ path: dependencyPath, code: "FRESHNESS_DEPENDENCY_NOT_OBJECT", message: "Freshness dependency must be an object." });
+        continue;
+      }
+      if (strict) checkUnknownKeys2(rawDependency, FRESHNESS_DEPENDENCY_KEYS, dependencyPath, errors);
+      if (!isSafeIdentifier2(rawDependency.id)) {
+        errors.push({ path: `${dependencyPath}.id`, code: "INVALID_FRESHNESS_DEPENDENCY_ID", message: "Dependency id must be a fixed safe identifier." });
+      } else if (ids.has(String(rawDependency.id))) {
+        errors.push({ path: `${dependencyPath}.id`, code: "DUPLICATE_FRESHNESS_DEPENDENCY_ID", message: "Dependency ids must be unique within a proposal." });
+      } else {
+        ids.add(String(rawDependency.id));
+      }
+      if (!isQualifiedName2(rawDependency.capability)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "INVALID_FRESHNESS_DEPENDENCY_CAPABILITY", message: "Dependency capability must be a reviewed qualified capability name." });
+        continue;
+      }
+      const dependency = byName.get(String(rawDependency.capability));
+      if (!dependency) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_UNKNOWN", message: `Unknown supporting capability ${String(rawDependency.capability)}.` });
+        continue;
+      }
+      if (dependency.kind !== "read" || dependency.protected_read !== void 0 || dependency.aggregate !== void 0) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_SINGLE_ROW_READ_REQUIRED", message: "Supporting freshness dependencies must reference reviewed single-row read capabilities." });
+      }
+      if (dependency.name === proposalName) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_CYCLE", message: "A proposal cannot depend on itself." });
+      }
+      if (dependency.source !== proposal.source) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_CROSS_SOURCE_UNSUPPORTED", message: "Strict atomic freshness requires the proposal and supporting dependency to use the same source." });
+      }
+      if ((dependency.context ?? null) !== (proposal.context ?? null)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_CONTEXT_MISMATCH", message: "Supporting freshness dependencies must use the same reviewed trusted context as the proposal." });
+      }
+      const target2 = isRecord2(dependency.target) ? dependency.target : void 0;
+      if (!isSafeIdentifier2(target2?.tenant_key) && target2?.single_tenant_dev !== true) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_TENANT_SCOPE_REQUIRED", message: "Supporting dependencies require a trusted tenant key or an existing explicit single-tenant-dev boundary." });
+      }
+      const proposalTarget = isRecord2(proposal.target) ? proposal.target : void 0;
+      if (isSafeIdentifier2(target2?.principal_scope_key) && !isSafeIdentifier2(proposalTarget?.principal_scope_key)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_PRINCIPAL_SCOPE_UNAVAILABLE", message: "A principal-scoped dependency cannot introduce a trusted principal value absent from the proposal authority." });
+      }
+      if (!isSafeIdentifier2(rawDependency.identity_from_arg) || !isRecord2(proposal.args) || !(String(rawDependency.identity_from_arg) in proposal.args)) {
+        errors.push({ path: `${dependencyPath}.identity_from_arg`, code: "FRESHNESS_IDENTITY_ARG_UNKNOWN", message: "identity_from_arg must name an existing scalar proposal argument." });
+      } else {
+        const proposalArg = isRecord2(proposal.args[String(rawDependency.identity_from_arg)]) ? proposal.args[String(rawDependency.identity_from_arg)] : void 0;
+        if (!proposalArg || proposalArg.type === "object_array") {
+          errors.push({ path: `${dependencyPath}.identity_from_arg`, code: "FRESHNESS_IDENTITY_ARG_NOT_SCALAR", message: "identity_from_arg must reference one bounded scalar proposal argument." });
+        }
+      }
+      const lookup = isRecord2(dependency.lookup) ? dependency.lookup : void 0;
+      if (!isSafeIdentifier2(lookup?.id_from_arg) || !isRecord2(dependency.args) || !(String(lookup?.id_from_arg) in dependency.args)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_LOOKUP_INVALID", message: "Supporting capability must have one fixed reviewed lookup argument." });
+      }
+      if (!isSafeIdentifier2(rawDependency.version_column)) {
+        errors.push({ path: `${dependencyPath}.version_column`, code: "FRESHNESS_VERSION_COLUMN_REQUIRED", message: "version_column must be an exact fixed safe identifier." });
+      }
+    }
+  }
+}
 function validateCapability(value, index, sourceNames, contextNames, executorNames, strict, errors, warnings) {
   const path26 = `$.capabilities[${index}]`;
   if (!isRecord2(value)) {
@@ -30421,6 +30742,14 @@ async function sourceTransaction(client, job, config, fn, hooks = {}) {
         scope: config.databaseScope,
         operations: ["SELECT", rlsOperationForJob(job)]
       });
+      for (const dependency of freshnessDependencies(job)) {
+        await assertPostgresRlsTarget(client, {
+          schema: dependency.target.schema,
+          table: dependency.target.table,
+          scope: config.databaseScope,
+          operations: ["SELECT"]
+        });
+      }
       await bindPostgresRlsScope(client, config.databaseScope);
     }
     await hooks.afterBegin?.();
@@ -30540,6 +30869,15 @@ function validateOperation(job) {
 }
 async function mutatePostgres(job, client) {
   if (job.protocol_version === "4.0") return await mutatePostgresCompensation(job, client);
+  const freshnessConflict = await lockPostgresFreshnessDependencies(job, client);
+  if (freshnessConflict) {
+    return {
+      status: "conflict",
+      affectedRows: 0,
+      code: freshnessConflict,
+      targetIdentity: identityForJob(job)
+    };
+  }
   if (job.protocol_version === "3.0") return await mutatePostgresSet(job, client);
   const operation = operationOf(job);
   if (operation === "single_row_insert") return await insertPostgres(job, client);
@@ -30577,6 +30915,38 @@ async function mutatePostgres(job, client) {
   verifyVersionAdvanced(job, resultVersion);
   return { status: "applied", affectedRows: 1, targetIdentity: identityForJob(job), resultVersion, beforeDigest, afterDigest: digest({ identity: identityForJob(job), patch: job.patch, version: resultVersion }) };
 }
+function freshnessDependencies(job) {
+  if (!("freshness" in job) || !job.freshness) return [];
+  return job.freshness.dependencies;
+}
+async function lockPostgresFreshnessDependencies(job, client) {
+  for (const dependency of freshnessDependencies(job)) {
+    const values = [
+      dependency.target.primary_key.value,
+      job.target.tenant_guard.value
+    ];
+    const where = [
+      `${quotePostgresIdentifier(dependency.target.primary_key.column)} = $1`,
+      `${quotePostgresIdentifier(dependency.target.tenant_column)} = $2`
+    ];
+    if (dependency.target.principal_column) {
+      const scope = principalScope(job);
+      if (!scope) return "FRESHNESS_DEPENDENCY_SCOPE_INVALID";
+      values.push(scope.value);
+      where.push(`${quotePostgresIdentifier(dependency.target.principal_column)} = $${values.length}`);
+    }
+    const result = await client.query(
+      `SELECT ${quotePostgresIdentifier(dependency.expected_version.column)}::text AS "__synapsor_freshness_version" FROM ${quotePostgresIdentifier(dependency.target.schema)}.${quotePostgresIdentifier(dependency.target.table)} WHERE ${where.join(" AND ")} FOR UPDATE`,
+      values
+    );
+    if (result.rowCount !== 1) return "FRESHNESS_DEPENDENCY_STALE";
+    if (!versionValuesMatch(
+      result.rows[0]?.__synapsor_freshness_version,
+      dependency.expected_version.value
+    )) return "FRESHNESS_DEPENDENCY_STALE";
+  }
+  return void 0;
+}
 function compensationProjection(job) {
   const columns = /* @__PURE__ */ new Set([job.target.primary_key.column, job.target.tenant_guard.column]);
   const scope = principalScope(job);
@@ -31176,6 +31546,15 @@ var PostgresProposalRuntimeStore = class {
   async createProposal(input) {
     return await this.withWrite("createProposal", (store) => store.createProposal(input));
   }
+  async recordFreshnessProof(input) {
+    return await this.withWrite("recordFreshnessProof", (store) => store.recordFreshnessProof(input));
+  }
+  async latestFreshnessProof(proposalId) {
+    return await this.withRead((store) => store.latestFreshnessProof(proposalId));
+  }
+  async recordFreshnessApprovalBlocked(proposalId, input) {
+    await this.withWrite("recordFreshnessApprovalBlocked", (store) => store.recordFreshnessApprovalBlocked(proposalId, input));
+  }
   async approveProposalByPolicy(proposalId, options) {
     return await this.withWrite("approveProposalByPolicy", (store) => store.approveProposalByPolicy(proposalId, options));
   }
@@ -31624,6 +32003,7 @@ var ProposalStore = class {
         decision_hash TEXT,
         signature TEXT,
         integrity_hash TEXT,
+        freshness_proof_digest TEXT,
         created_at TEXT NOT NULL,
         FOREIGN KEY (proposal_id) REFERENCES proposals(proposal_id)
       );
@@ -31897,6 +32277,7 @@ var ProposalStore = class {
     this.ensureColumn("approvals", "decision_hash", "TEXT");
     this.ensureColumn("approvals", "signature", "TEXT");
     this.ensureColumn("approvals", "integrity_hash", "TEXT");
+    this.ensureColumn("approvals", "freshness_proof_digest", "TEXT");
   }
   ensureSearchIndexes() {
     this.db.exec(`
@@ -32187,6 +32568,75 @@ var ProposalStore = class {
     const row = this.db.prepare("SELECT proposal_id FROM query_audit WHERE evidence_bundle_id = ? AND proposal_id IS NOT NULL ORDER BY created_at DESC LIMIT 1").get(evidenceBundleId);
     return isRecord4(row) && row.proposal_id != null ? String(row.proposal_id) : void 0;
   }
+  recordFreshnessProof(input) {
+    const proof = parseFreshnessProof(input);
+    const proposal = this.requireProposal(proof.proposal_id);
+    assertProposalIdentity(proposal, proof.proposal_hash, proof.proposal_version);
+    const authority = proposalFreshnessAuthority(proposal);
+    if (!authority) {
+      throw new ProposalStoreError(
+        "FRESHNESS_NOT_REQUIRED",
+        `proposal ${proof.proposal_id} has no reviewed freshness authority`
+      );
+    }
+    if (proof.dependency_set_digest !== authority.dependency_set_digest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_AUTHORITY_MISMATCH",
+        `freshness proof does not match proposal ${proof.proposal_id}`
+      );
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.transaction(() => {
+      this.appendEvent(proof.proposal_id, "proposal_freshness_checked", "runner", { proof });
+      if (proof.result === "stale") {
+        const current = this.requireProposal(proof.proposal_id);
+        if (current.state === "pending_review" || current.state === "approved" || current.state === "pending_worker") {
+          this.db.prepare("UPDATE proposals SET state = ?, updated_at = ? WHERE proposal_id = ?").run("conflict", now, proof.proposal_id);
+          this.appendEvent(proof.proposal_id, "proposal_conflict", "runner", {
+            reason: "freshness_stale",
+            safe_code: proof.safe_code,
+            proof_digest: proof.proof_digest
+          });
+        }
+      }
+    });
+    return proof;
+  }
+  latestFreshnessProof(proposalId) {
+    this.requireProposal(proposalId);
+    const row = this.db.prepare(`
+      SELECT payload_json
+      FROM proposal_events
+      WHERE proposal_id = ? AND kind = 'proposal_freshness_checked'
+      ORDER BY event_id DESC
+      LIMIT 1
+    `).get(proposalId);
+    if (!isRecord4(row)) return void 0;
+    try {
+      const payload = JSON.parse(String(row.payload_json));
+      return parseFreshnessProof(payload.proof);
+    } catch {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_TAMPERED",
+        `stored freshness proof for proposal ${proposalId} failed integrity validation`
+      );
+    }
+  }
+  recordFreshnessApprovalBlocked(proposalId, input) {
+    this.requireProposal(proposalId);
+    const proof = this.latestFreshnessProof(proposalId);
+    if (!proof || proof.proof_digest !== input.proof_digest || proof.result === "fresh") {
+      throw new ProposalStoreError(
+        "FRESHNESS_BLOCK_RECORD_INVALID",
+        `freshness block for proposal ${proposalId} does not match its latest non-fresh proof`
+      );
+    }
+    this.appendEvent(proposalId, "proposal_approval_blocked_freshness", input.actor, {
+      proof_digest: proof.proof_digest,
+      safe_code: input.safe_code,
+      result: proof.result
+    });
+  }
   approveProposal(proposalId, options) {
     const proposal = this.requireProposal(proposalId);
     assertWritebackAllowed(proposal, "approved");
@@ -32207,11 +32657,12 @@ var ProposalStore = class {
       if (isRecord4(existing)) {
         throw new ProposalStoreError("APPROVER_ALREADY_COUNTED", `operator ${options.approver} already recorded a decision for proposal ${proposalId}`);
       }
+      this.assertApprovalFreshness(current, options.freshness_proof_digest, now);
       this.db.prepare(`
         INSERT INTO approvals (
           proposal_id, proposal_version, proposal_hash, approver, status, reason,
-          identity_json, decision_hash, signature, integrity_hash, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          identity_json, decision_hash, signature, integrity_hash, freshness_proof_digest, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `).run(
         proposalId,
         options.proposal_version,
@@ -32223,6 +32674,7 @@ var ProposalStore = class {
         options.identity?.decision_hash ?? null,
         options.identity?.signature ?? null,
         options.identity?.integrity_hash ?? null,
+        options.freshness_proof_digest ?? null,
         now
       );
       const progress = this.approvalProgress(proposalId);
@@ -32235,6 +32687,7 @@ var ProposalStore = class {
         proposal_version: options.proposal_version,
         reason: options.reason ?? null,
         identity: publicIdentitySummary(options.identity),
+        freshness_proof_digest: options.freshness_proof_digest ?? null,
         approvals: progress.approved,
         required_approvals: progress.required,
         remaining_approvals: progress.remaining
@@ -32343,17 +32796,31 @@ var ProposalStore = class {
         });
         return;
       }
+      this.assertApprovalFreshness(proposal, options.freshness_proof_digest, now);
       this.db.prepare("UPDATE proposals SET state = ?, updated_at = ? WHERE proposal_id = ?").run("approved", now, proposalId);
       this.db.prepare(`
-        INSERT INTO approvals (proposal_id, proposal_version, proposal_hash, approver, status, reason, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?)
-      `).run(proposalId, options.proposal_version, options.proposal_hash, actor, "approved", options.reason, now);
+        INSERT INTO approvals (
+          proposal_id, proposal_version, proposal_hash, approver, status, reason,
+          freshness_proof_digest, created_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        proposalId,
+        options.proposal_version,
+        options.proposal_hash,
+        actor,
+        "approved",
+        options.reason,
+        options.freshness_proof_digest ?? null,
+        now
+      );
       this.appendEvent(proposalId, "proposal_approved", actor, {
         proposal_hash: options.proposal_hash,
         proposal_version: options.proposal_version,
         reason: options.reason,
         policy: options.policy,
-        aggregate_limits: options.limits ?? []
+        aggregate_limits: options.limits ?? [],
+        freshness_proof_digest: options.freshness_proof_digest ?? null
       });
     });
     return {
@@ -32701,7 +33168,8 @@ var ProposalStore = class {
       writeback_job_id: receipt.writeback_job_id,
       rows_affected: receipt.rows_affected,
       source_database_mutated: receipt.source_database_mutated,
-      receipt_hash: receipt.receipt_hash
+      receipt_hash: receipt.receipt_hash,
+      safe_error_code: "safe_error_code" in receipt ? receipt.safe_error_code ?? null : null
     });
   }
   recordHandlerWritebackJob(input) {
@@ -32785,6 +33253,7 @@ var ProposalStore = class {
       tenant_guard: changeSet.guards.tenant,
       ...changeSet.guards.principal_scope ? { principal_scope: changeSet.guards.principal_scope } : {},
       allowed_columns: changeSet.guards.allowed_columns,
+      ..."freshness" in changeSet && changeSet.freshness ? { freshness: parseFreshnessAuthority(changeSet.freshness) } : {},
       idempotency_key: `${proposal.proposal_id}:${proposal.object_id}`,
       lease
     };
@@ -33238,7 +33707,21 @@ var ProposalStore = class {
       const key = `${tenantId}\0${capability}`;
       let row = rows.get(key);
       if (!row) {
-        row = { tenant_id: tenantId, capability, worker_retries: 0, dead_letters: 0, auto_approval_limit_trips: 0 };
+        row = {
+          tenant_id: tenantId,
+          capability,
+          worker_retries: 0,
+          dead_letters: 0,
+          auto_approval_limit_trips: 0,
+          freshness_checks: 0,
+          freshness_fresh: 0,
+          freshness_stale_target: 0,
+          freshness_stale_supporting: 0,
+          freshness_unavailable: 0,
+          freshness_unsupported: 0,
+          freshness_approval_blocked: 0,
+          freshness_apply_blocked: 0
+        };
         rows.set(key, row);
       }
       return row;
@@ -33246,7 +33729,14 @@ var ProposalStore = class {
     const events2 = this.db.prepare(`
       SELECT p.tenant_id, p.action, e.kind, e.payload_json
       FROM proposal_events e JOIN proposals p ON p.proposal_id = e.proposal_id
-      WHERE e.kind IN ('writeback_retry_scheduled', 'writeback_dead_lettered', 'policy_auto_approval_deferred')
+      WHERE e.kind IN (
+        'writeback_retry_scheduled',
+        'writeback_dead_lettered',
+        'policy_auto_approval_deferred',
+        'proposal_freshness_checked',
+        'proposal_approval_blocked_freshness',
+        'writeback_conflict'
+      )
         AND (? IS NULL OR p.tenant_id = ?)
         AND (? IS NULL OR p.action = ?)
     `).all(filters.tenant ?? null, filters.tenant ?? null, filters.capability ?? null, filters.capability ?? null);
@@ -33255,13 +33745,29 @@ var ProposalStore = class {
       const row = ensure(String(raw.tenant_id), String(raw.action));
       if (raw.kind === "writeback_retry_scheduled") row.worker_retries += 1;
       if (raw.kind === "writeback_dead_lettered") row.dead_letters += 1;
-      if (raw.kind === "policy_auto_approval_deferred") {
-        try {
-          const payload = JSON.parse(String(raw.payload_json));
-          if (Array.isArray(payload.tripped_limits) && payload.tripped_limits.length > 0) row.auto_approval_limit_trips += 1;
-        } catch {
+      let payload = {};
+      try {
+        const parsed = JSON.parse(String(raw.payload_json));
+        if (isRecord4(parsed)) payload = parsed;
+      } catch {
+      }
+      if (raw.kind === "proposal_freshness_checked") {
+        row.freshness_checks += 1;
+        const proof = isRecord4(payload.proof) ? payload.proof : {};
+        if (proof.result === "fresh") row.freshness_fresh += 1;
+        if (proof.result === "unavailable") row.freshness_unavailable += 1;
+        if (proof.result === "unsupported") row.freshness_unsupported += 1;
+        if (proof.result === "stale") {
+          const checks = Array.isArray(proof.checks) ? proof.checks.filter(isRecord4) : [];
+          if (checks.some((check) => check.kind === "target" && check.status === "stale")) row.freshness_stale_target += 1;
+          if (checks.some((check) => check.kind === "supporting" && check.status === "stale")) row.freshness_stale_supporting += 1;
         }
       }
+      if (raw.kind === "proposal_approval_blocked_freshness") row.freshness_approval_blocked += 1;
+      if (raw.kind === "writeback_conflict" && /^FRESHNESS_/.test(String(payload.safe_error_code ?? ""))) row.freshness_apply_blocked += 1;
+      if (raw.kind === "policy_auto_approval_deferred") {
+        if (Array.isArray(payload.tripped_limits) && payload.tripped_limits.length > 0) row.auto_approval_limit_trips += 1;
+      }
     }
     return [...rows.values()].sort((left, right) => left.tenant_id.localeCompare(right.tenant_id) || left.capability.localeCompare(right.capability));
   }
@@ -34109,6 +34615,61 @@ var ProposalStore = class {
     }
     return proposal;
   }
+  assertApprovalFreshness(proposal, proofDigest, now) {
+    const authority = proposalFreshnessAuthority(proposal);
+    if (!authority) {
+      if (proofDigest !== void 0) {
+        throw new ProposalStoreError(
+          "FRESHNESS_PROOF_UNEXPECTED",
+          `proposal ${proposal.proposal_id} does not require a freshness proof`
+        );
+      }
+      return;
+    }
+    if (!proofDigest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_REQUIRED",
+        `proposal ${proposal.proposal_id} requires a fresh live proof before approval`
+      );
+    }
+    const proof = this.latestFreshnessProof(proposal.proposal_id);
+    if (!proof || proof.proof_digest !== proofDigest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_MISSING",
+        `the latest freshness proof for proposal ${proposal.proposal_id} was not supplied`
+      );
+    }
+    if (proof.proposal_hash !== proposal.proposal_hash || proof.proposal_version !== proposal.proposal_version || proof.dependency_set_digest !== authority.dependency_set_digest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_AUTHORITY_MISMATCH",
+        `freshness proof does not match proposal ${proposal.proposal_id}`
+      );
+    }
+    if (proof.result !== "fresh") {
+      throw new ProposalStoreError(
+        proof.result === "stale" ? "FRESHNESS_STALE" : "FRESHNESS_NOT_VERIFIED",
+        `proposal ${proposal.proposal_id} freshness result is ${proof.result}`
+      );
+    }
+    if (Date.parse(proof.valid_until) < Date.parse(now)) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_EXPIRED",
+        `freshness proof for proposal ${proposal.proposal_id} has expired`
+      );
+    }
+    const used = this.db.prepare(`
+      SELECT approval_id
+      FROM approvals
+      WHERE proposal_id = ? AND freshness_proof_digest = ?
+      LIMIT 1
+    `).get(proposal.proposal_id, proofDigest);
+    if (isRecord4(used)) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_ALREADY_USED",
+        `freshness proof for proposal ${proposal.proposal_id} already authorized a reviewer decision`
+      );
+    }
+  }
   setState(proposalId, state, actor, payload) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.transaction(() => {
@@ -34269,6 +34830,17 @@ function stateFromChangeSet(changeSet) {
   if (changeSet.approval.status === "canceled") return "canceled";
   return "pending_review";
 }
+function proposalFreshnessAuthority(proposal) {
+  if (!("freshness" in proposal.change_set) || proposal.change_set.freshness === void 0) return void 0;
+  try {
+    return parseFreshnessAuthority(proposal.change_set.freshness);
+  } catch {
+    throw new ProposalStoreError(
+      "FRESHNESS_AUTHORITY_TAMPERED",
+      `stored freshness authority for proposal ${proposal.proposal_id} failed integrity validation`
+    );
+  }
+}
 function requiredApprovalCount(proposal) {
   const configured = proposal.change_set.approval.required_approvals;
   return typeof configured === "number" && Number.isSafeInteger(configured) && configured >= 1 ? configured : 1;
@@ -34795,6 +35367,7 @@ function rowToApproval(row) {
     decision_hash: row.decision_hash == null ? void 0 : String(row.decision_hash),
     signature: row.signature == null ? void 0 : String(row.signature),
     integrity_hash: row.integrity_hash == null ? void 0 : String(row.integrity_hash),
+    freshness_proof_digest: row.freshness_proof_digest == null ? void 0 : String(row.freshness_proof_digest),
     created_at: String(row.created_at)
   };
 }
@@ -35218,7 +35791,7 @@ var sharedLedgerRestoreSpecs = {
     "updated_at"
   ], ["proposal_id", "proposal_version", "proposal_hash", "action", "state", "tenant_id", "business_object", "object_id", "source_kind", "source_id", "source_schema", "source_table", "source_database_mutated", "change_set_json", "created_at", "updated_at"]),
   proposal_events: restoreSpec("event_id", ["event_id", "proposal_id", "kind", "actor", "payload_json", "created_at"], ["event_id", "proposal_id", "kind", "actor", "payload_json", "created_at"]),
-  approvals: restoreSpec("approval_id", ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "reason", "identity_json", "decision_hash", "signature", "integrity_hash", "created_at"], ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "created_at"]),
+  approvals: restoreSpec("approval_id", ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "reason", "identity_json", "decision_hash", "signature", "integrity_hash", "freshness_proof_digest", "created_at"], ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "created_at"]),
   writeback_jobs: restoreSpec("writeback_job_id", ["writeback_job_id", "proposal_id", "proposal_hash", "status", "job_json", "created_at", "updated_at"], ["writeback_job_id", "proposal_id", "proposal_hash", "status", "job_json", "created_at", "updated_at"]),
   writeback_intents: restoreSpec("intent_id", ["intent_id", "idempotency_key", "writeback_job_id", "proposal_id", "proposal_hash", "runner_id", "operation", "status", "intent_json", "result_json", "reconciliation_reason", "created_at", "updated_at"], ["intent_id", "idempotency_key", "writeback_job_id", "proposal_id", "proposal_hash", "runner_id", "operation", "status", "intent_json", "created_at", "updated_at"]),
   idempotency_receipts: restoreSpec("idempotency_key", ["idempotency_key", "writeback_job_id", "proposal_id", "receipt_status", "receipt_json", "created_at"], ["idempotency_key", "writeback_job_id", "proposal_id", "receipt_status", "receipt_json", "created_at"]),
@@ -41327,6 +41900,18 @@ async function callConfiguredTool(input) {
     at: createdAt
   });
   const queryFingerprint = queryFingerprintFor(capability, context);
+  const freshnessCapture = capability.kind === "proposal" ? await captureProposalFreshnessAuthority({
+    config: input.config,
+    capability,
+    args: input.args,
+    context,
+    source,
+    readRow: input.readRow,
+    env: input.env,
+    proposalId,
+    createdAt,
+    targetMemberCount: operation === "insert" ? 0 : setOperation ? currentRows.length : 1
+  }) : void 0;
   const changeSet = capability.kind === "proposal" ? buildChangeSet({
     config: input.config,
     capability,
@@ -41344,7 +41929,8 @@ async function callConfiguredTool(input) {
     resolvedDeduplication,
     evidenceBundleId,
     queryFingerprint,
-    objectId
+    objectId,
+    freshness: freshnessCapture?.authority
   }) : void 0;
   await input.store.recordEvidenceBundle({
     evidence_bundle_id: evidenceBundleId,
@@ -41389,6 +41975,48 @@ async function callConfiguredTool(input) {
       }
     });
   }
+  for (const supporting of freshnessCapture?.evidence ?? []) {
+    await input.store.recordEvidenceBundle({
+      evidence_bundle_id: supporting.bundle_id,
+      tenant_id: context.tenant_id,
+      capability: supporting.capability.name,
+      source_id: supporting.capability.source,
+      source_table: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+      business_object: supporting.capability.target.table,
+      object_id: String(supporting.primary_key.value),
+      query_fingerprint: supporting.query_fingerprint,
+      payload: {
+        kind: "freshness_dependency",
+        dependency_id: supporting.dependency_id,
+        capability: supporting.capability.name,
+        source_id: supporting.capability.source,
+        target: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+        parameters_redacted: true,
+        source_database_changed: false
+      },
+      items: []
+    });
+    await input.store.recordQueryAudit({
+      evidence_bundle_id: supporting.bundle_id,
+      capability: supporting.capability.name,
+      source_id: supporting.capability.source,
+      query_fingerprint: supporting.query_fingerprint,
+      table_name: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+      business_object: supporting.capability.target.table,
+      object_id: String(supporting.primary_key.value),
+      primary_key_value: String(supporting.primary_key.value),
+      row_count: 1,
+      payload: {
+        kind: "freshness_dependency",
+        dependency_id: supporting.dependency_id,
+        capability: supporting.capability.name,
+        columns: [supporting.version_column],
+        parameters_redacted: true,
+        tenant_bound: Boolean(supporting.capability.target.tenant_key),
+        principal_bound: Boolean(supporting.capability.target.principal_scope_key)
+      }
+    });
+  }
   if (capability.kind === "read") {
     return {
       status: "ok",
@@ -41438,7 +42066,9 @@ async function callConfiguredTool(input) {
     capability,
     store: input.store,
     proposal,
-    patch: changeSet.patch
+    patch: changeSet.patch,
+    env: input.env,
+    readRow: input.readRow
   });
   await input.store.recordEvidenceBundle({
     evidence_bundle_id: evidenceBundleId,
@@ -41486,7 +42116,7 @@ async function callConfiguredTool(input) {
     env: input.env
   });
   return {
-    status: input.config.governance?.mode === "cloud_linked" ? "pending_cloud_sync" : input.config.mode === "shadow" ? "shadow_proposal_created" : approvalResult.proposal.state === "approved" ? "approved" : "review_required",
+    status: input.config.governance?.mode === "cloud_linked" ? "pending_cloud_sync" : input.config.mode === "shadow" ? "shadow_proposal_created" : approvalResult.freshness?.status === "stale" ? "freshness_conflict" : approvalResult.proposal.state === "approved" ? "approved" : "review_required",
     action: capability.name,
     proposal_id: approvalResult.proposal.proposal_id,
     proposal_version: approvalResult.proposal.proposal_version,
@@ -41511,6 +42141,7 @@ async function callConfiguredTool(input) {
       } : {}
     },
     approval_required: approvalResult.proposal.state === "pending_review",
+    ...approvalResult.freshness ? { freshness: approvalResult.freshness } : {},
     governance: input.config.governance?.mode === "cloud_linked" ? { authority: "synapsor_cloud", state: "pending_cloud_sync", evidence_residency: "metadata_only" } : { authority: "local" },
     writeback: changeSet.writeback,
     source_database_changed: false,
@@ -41993,18 +42624,52 @@ async function maybeAutoApproveProposal(input) {
   if (!policy) throw new McpRuntimeError("APPROVAL_POLICY_UNRESOLVED", `capability ${input.capability.name} references missing approval policy ${policyName}.`);
   const evaluation = evaluateApprovalPolicy(input.capability, policy, input.patch);
   if (!evaluation.qualifies) return { proposal: input.proposal, approved: false, policy: policyName };
+  let freshnessProofDigest;
+  const freshness = await evaluateProposalFreshness({
+    config: input.config,
+    proposal: input.proposal,
+    env: input.env,
+    readRow: input.readRow
+  });
+  if (freshness.required) {
+    await input.store.recordFreshnessProof(freshness.proof);
+    if (freshness.status !== "fresh") {
+      await input.store.recordFreshnessApprovalBlocked(input.proposal.proposal_id, {
+        proof_digest: freshness.proof.proof_digest,
+        safe_code: freshness.safe_code,
+        actor: `policy:${policyName}`
+      });
+      return {
+        proposal: await input.store.getProposal(input.proposal.proposal_id) ?? input.proposal,
+        approved: false,
+        policy: policyName,
+        freshness: {
+          status: freshness.status,
+          safe_code: freshness.safe_code
+        }
+      };
+    }
+    freshnessProofDigest = freshness.proof.proof_digest;
+  }
   const decision = await input.store.approveProposalByPolicy(input.proposal.proposal_id, {
     policy: policyName,
     proposal_hash: input.proposal.proposal_hash,
     proposal_version: input.proposal.proposal_version,
     reason: `auto-approved by policy ${policyName}: ${evaluation.reason}`,
-    limits: policy.limits
+    limits: policy.limits,
+    freshness_proof_digest: freshnessProofDigest
   });
   return {
     proposal: decision.proposal,
     approved: decision.approved,
     policy: policyName,
-    tripped_limits: decision.tripped_limits
+    tripped_limits: decision.tripped_limits,
+    ...freshness.required ? {
+      freshness: {
+        status: freshness.status,
+        safe_code: freshness.safe_code
+      }
+    } : {}
   };
 }
 function approvalPolicyByName(config, policyName) {
@@ -42272,6 +42937,372 @@ function errorMessage(error) {
   if (isRecord6(error) && typeof error.message === "string") return error.message;
   return typeof error === "string" ? error : "";
 }
+async function captureProposalFreshnessAuthority(input) {
+  const policy = input.config.proposal_freshness?.[input.capability.name];
+  if (!policy) return void 0;
+  const operation = input.capability.operation?.kind ?? "update";
+  const targetMode = operation === "insert" ? "not_applicable" : isSetCapability(input.capability) ? "frozen_set" : "exact_guard";
+  const captured = [];
+  for (const configured of policy.dependencies ?? []) {
+    const capability = (input.config.capabilities ?? []).find((item) => item.name === configured.capability);
+    if (!capability || capability.kind !== "read") {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_INVALID", `Reviewed freshness dependency ${configured.id} is unavailable.`);
+    }
+    const identity = scalar3(input.args[configured.identity_from_arg]);
+    if (identity === null) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_IDENTITY_MISSING", `Freshness dependency ${configured.id} requires its reviewed scalar identity.`);
+    }
+    const readCapability = {
+      ...capability,
+      conflict_guard: { column: configured.version_column }
+    };
+    const current = await input.readRow({
+      sourceName: capability.source,
+      source: input.source,
+      capability: readCapability,
+      args: { [capability.lookup.id_from_arg]: identity },
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    if (current.rowCount !== 1) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_UNRESOLVED", `Freshness dependency ${configured.id} did not resolve to one authorized row.`);
+    }
+    const primaryValue = scalar3(current.row[capability.target.primary_key]);
+    const versionValue = scalar3(current.row[configured.version_column]);
+    if (primaryValue === null || versionValue === null) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_VERSION_MISSING", `Freshness dependency ${configured.id} lacks an exact primary-key or version value.`);
+    }
+    const bundleId = stableId("evf", {
+      proposal_id: input.proposalId,
+      dependency_id: configured.id,
+      primary_key: primaryValue,
+      created_at: input.createdAt
+    });
+    const queryFingerprint = queryFingerprintFor(readCapability, input.context);
+    const unsigned2 = {
+      id: configured.id,
+      capability: configured.capability,
+      source_id: capability.source,
+      engine: input.source.engine,
+      target: {
+        schema: capability.target.schema,
+        table: capability.target.table,
+        primary_key: { column: capability.target.primary_key, value: primaryValue },
+        tenant_column: capability.target.tenant_key ?? "__single_tenant_dev",
+        ...capability.target.principal_scope_key ? { principal_column: capability.target.principal_scope_key } : {}
+      },
+      expected_version: { column: configured.version_column, value: conflictGuardScalar(versionValue) },
+      evidence: {
+        bundle_id: bundleId,
+        query_fingerprint: queryFingerprint
+      }
+    };
+    const descriptor = {
+      ...unsigned2,
+      descriptor_digest: canonicalJsonDigest(unsigned2)
+    };
+    captured.push({
+      descriptor,
+      evidence: {
+        dependency_id: configured.id,
+        bundle_id: bundleId,
+        query_fingerprint: queryFingerprint,
+        capability,
+        primary_key: descriptor.target.primary_key,
+        version_column: configured.version_column
+      }
+    });
+  }
+  captured.sort((left, right) => left.descriptor.source_id.localeCompare(right.descriptor.source_id) || left.descriptor.target.schema.localeCompare(right.descriptor.target.schema) || left.descriptor.target.table.localeCompare(right.descriptor.target.table) || JSON.stringify(left.descriptor.target.primary_key.value).localeCompare(JSON.stringify(right.descriptor.target.primary_key.value)) || left.descriptor.id.localeCompare(right.descriptor.id));
+  const unsigned = {
+    schema_version: protocolVersions.freshnessAuthority,
+    required: true,
+    target: { mode: targetMode, member_count: input.targetMemberCount },
+    dependencies: captured.map((item) => item.descriptor)
+  };
+  const authority = parseFreshnessAuthority({
+    ...unsigned,
+    dependency_set_digest: canonicalJsonDigest(unsigned)
+  });
+  return {
+    authority,
+    evidence: captured.map((item) => item.evidence)
+  };
+}
+async function evaluateProposalFreshness(input) {
+  const config = resolveRuntimeConfig(input.config);
+  assertValidRunnerCapabilityConfig(config);
+  const authority = freshnessAuthorityFromChangeSet(input.proposal.change_set);
+  if (!authority) {
+    return {
+      required: false,
+      status: "not_required",
+      safe_code: "FRESHNESS_NOT_REQUIRED",
+      target_count: 0,
+      supporting_count: 0
+    };
+  }
+  const env = input.env ?? process.env;
+  const resources = createMcpRuntimeSharedResources(config, env, input.readRow, input.clock, input.credentialResolver);
+  const checkedAtMs = (input.clock ?? Date.now)();
+  const checks = [];
+  let forcedResult;
+  let forcedCode;
+  try {
+    const capability = (config.capabilities ?? []).find((item) => item.name === input.proposal.action);
+    const source = capability ? config.sources?.[capability.source] : void 0;
+    if (!capability || capability.kind !== "proposal" || !source) {
+      forcedResult = "invalid";
+      forcedCode = "FRESHNESS_PROPOSAL_AUTHORITY_INVALID";
+    } else if (!proposalAuthorityMatchesCapability(input.proposal, capability)) {
+      forcedResult = "invalid";
+      forcedCode = "FRESHNESS_PROPOSAL_AUTHORITY_MISMATCH";
+    } else {
+      const context = proposalTrustedContext(config, capability, input.proposal);
+      const targetChecks = await evaluateTargetFreshness({
+        proposal: input.proposal,
+        authority,
+        capability,
+        source,
+        context,
+        env,
+        readRow: resources.readRow
+      });
+      checks.push(...targetChecks);
+      for (const dependency of authority.dependencies) {
+        const validationCode = validateResolvedFreshnessDependency(config, capability, dependency);
+        if (validationCode) {
+          checks.push({
+            id: dependency.id,
+            kind: "supporting",
+            status: "invalid",
+            safe_code: validationCode
+          });
+          continue;
+        }
+        const supporting = (config.capabilities ?? []).find((item) => item.name === dependency.capability);
+        checks.push(await evaluateSupportingFreshness({
+          dependency,
+          capability: supporting,
+          source,
+          context,
+          env,
+          readRow: resources.readRow
+        }));
+      }
+    }
+  } catch (error) {
+    const classified = classifyFreshnessReadError(error);
+    forcedResult = classified.result;
+    forcedCode = classified.safe_code;
+  } finally {
+    await resources.close();
+  }
+  const status = forcedResult ?? freshnessResultForChecks(checks);
+  const safeCode2 = forcedCode ?? freshnessSafeCode(status, checks);
+  const targetCount = checks.filter((check) => check.kind === "target").length;
+  const supportingCount = checks.filter((check) => check.kind === "supporting").length;
+  const adapters2 = freshnessSourceAdapters(input.proposal, authority);
+  const unsigned = {
+    schema_version: protocolVersions.freshnessProof,
+    proposal_id: input.proposal.proposal_id,
+    proposal_hash: input.proposal.proposal_hash,
+    proposal_version: input.proposal.proposal_version,
+    dependency_set_digest: authority.dependency_set_digest,
+    checked_at: new Date(checkedAtMs).toISOString(),
+    valid_until: new Date(checkedAtMs + Math.max(1e3, Math.min(input.proofValidityMs ?? 3e4, 3e5))).toISOString(),
+    source_adapters: adapters2,
+    result: status,
+    safe_code: safeCode2,
+    target_count: targetCount,
+    supporting_count: supportingCount,
+    checks
+  };
+  const proof = parseFreshnessProof({
+    ...unsigned,
+    proof_digest: canonicalJsonDigest(unsigned)
+  });
+  return {
+    required: true,
+    status,
+    safe_code: safeCode2,
+    target_count: targetCount,
+    supporting_count: supportingCount,
+    proof
+  };
+}
+function freshnessAuthorityFromChangeSet(changeSet) {
+  if (!("freshness" in changeSet) || changeSet.freshness === void 0) return void 0;
+  return parseFreshnessAuthority(changeSet.freshness);
+}
+function proposalAuthorityMatchesCapability(proposal, capability) {
+  const changeSet = proposal.change_set;
+  if (proposal.proposal_hash !== changeSet.integrity.proposal_hash || proposal.proposal_version !== changeSet.proposal_version) return false;
+  if (changeSet.source.source_id !== capability.source || changeSet.source.schema !== capability.target.schema || changeSet.source.table !== capability.target.table || changeSet.source.primary_key.column !== capability.target.primary_key) return false;
+  if (changeSet.contract && (!capability.contract_provenance || changeSet.contract.digest !== capability.contract_provenance.digest || changeSet.contract.version !== capability.contract_provenance.version)) return false;
+  return true;
+}
+function proposalTrustedContext(config, capability, proposal) {
+  const contextConfig = (capability.context ? config.contexts?.[capability.context] : void 0) ?? config.trusted_context;
+  const provider = contextConfig?.provider ?? (proposal.change_set.principal.source === "cloud_session" ? "cloud_session" : "environment");
+  return {
+    tenant_id: proposal.tenant_id,
+    principal: proposal.principal ?? proposal.change_set.principal.id,
+    provenance: provider
+  };
+}
+async function evaluateTargetFreshness(input) {
+  if (input.authority.target.mode === "not_applicable") return [];
+  if (input.authority.target.mode === "frozen_set") {
+    const changeSet2 = input.proposal.change_set;
+    if (changeSet2.schema_version !== protocolVersions.changeSetV3) {
+      return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_TARGET_SET_INVALID" }];
+    }
+    const current2 = await input.readRow({
+      sourceName: input.capability.source,
+      source: input.source,
+      capability: input.capability,
+      args: {},
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    const rows = current2.rows ?? (current2.rowCount === 1 ? [current2.row] : []);
+    const byIdentity = new Map(rows.map((row) => [JSON.stringify(scalar3(row[input.capability.target.primary_key])), row]));
+    return changeSet2.frozen_set.members.map((member) => {
+      const expected2 = member.expected_version;
+      const row = byIdentity.get(JSON.stringify(member.primary_key.value));
+      const observed2 = expected2 && row ? conflictGuardScalar(scalar3(row[expected2.column])) : void 0;
+      const fresh2 = Boolean(expected2 && row && versionsEqual(observed2, expected2.value));
+      return {
+        id: `target:${canonicalJsonDigest(member.primary_key).slice(7, 23)}`,
+        kind: "target",
+        status: fresh2 ? "fresh" : "stale",
+        safe_code: fresh2 ? "FRESHNESS_TARGET_FRESH" : "FRESHNESS_TARGET_STALE",
+        ...expected2 ? { expected_version_digest: versionMetadataDigest(expected2.column, expected2.value) } : {},
+        ...expected2 && observed2 !== void 0 ? { observed_version_digest: versionMetadataDigest(expected2.column, observed2) } : {}
+      };
+    });
+  }
+  const changeSet = input.proposal.change_set;
+  if (changeSet.schema_version === protocolVersions.changeSetV3 || changeSet.schema_version === protocolVersions.compensationChangeSet) {
+    return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_TARGET_AUTHORITY_INVALID" }];
+  }
+  const expected = changeSet.guards.expected_version;
+  if (!expected || expected.column === "__row_hash" || changeSet.source.primary_key.value === void 0) {
+    return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_EXACT_TARGET_GUARD_REQUIRED" }];
+  }
+  const readCapability = {
+    ...input.capability,
+    conflict_guard: { column: expected.column }
+  };
+  const current = await input.readRow({
+    sourceName: input.capability.source,
+    source: input.source,
+    capability: readCapability,
+    args: { [input.capability.lookup.id_from_arg]: changeSet.source.primary_key.value },
+    context: input.context,
+    env: input.env,
+    transaction_mode: "read_only"
+  });
+  const observed = current.rowCount === 1 ? conflictGuardScalar(scalar3(current.row[expected.column])) : void 0;
+  const fresh = current.rowCount === 1 && observed !== void 0 && versionsEqual(observed, expected.value);
+  return [{
+    id: "target",
+    kind: "target",
+    status: fresh ? "fresh" : "stale",
+    safe_code: fresh ? "FRESHNESS_TARGET_FRESH" : "FRESHNESS_TARGET_STALE",
+    expected_version_digest: versionMetadataDigest(expected.column, expected.value),
+    ...observed !== void 0 ? { observed_version_digest: versionMetadataDigest(expected.column, observed) } : {}
+  }];
+}
+function validateResolvedFreshnessDependency(config, proposalCapability, dependency) {
+  const policy = config.proposal_freshness?.[proposalCapability.name];
+  const declared = policy?.dependencies?.find((item) => item.id === dependency.id);
+  const capability = (config.capabilities ?? []).find((item) => item.name === dependency.capability);
+  const source = config.sources?.[dependency.source_id];
+  if (!declared || declared.capability !== dependency.capability || declared.version_column !== dependency.expected_version.column) return "FRESHNESS_DEPENDENCY_AUTHORITY_MISMATCH";
+  if (!capability || capability.kind !== "read" || !source) return "FRESHNESS_DEPENDENCY_AUTHORITY_INVALID";
+  if (capability.source !== proposalCapability.source || dependency.source_id !== capability.source || dependency.engine !== source.engine) return "FRESHNESS_CROSS_SOURCE_UNSUPPORTED";
+  if (capability.target.schema !== dependency.target.schema || capability.target.table !== dependency.target.table || capability.target.primary_key !== dependency.target.primary_key.column || (capability.target.tenant_key ?? "__single_tenant_dev") !== dependency.target.tenant_column || capability.target.principal_scope_key !== dependency.target.principal_column) return "FRESHNESS_DEPENDENCY_TARGET_MISMATCH";
+  return void 0;
+}
+async function evaluateSupportingFreshness(input) {
+  const readCapability = {
+    ...input.capability,
+    conflict_guard: { column: input.dependency.expected_version.column }
+  };
+  try {
+    const current = await input.readRow({
+      sourceName: input.dependency.source_id,
+      source: input.source,
+      capability: readCapability,
+      args: { [input.capability.lookup.id_from_arg]: input.dependency.target.primary_key.value },
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    const observed = current.rowCount === 1 ? conflictGuardScalar(scalar3(current.row[input.dependency.expected_version.column])) : void 0;
+    const fresh = current.rowCount === 1 && observed !== void 0 && versionsEqual(observed, input.dependency.expected_version.value);
+    return {
+      id: input.dependency.id,
+      kind: "supporting",
+      status: fresh ? "fresh" : "stale",
+      safe_code: fresh ? "FRESHNESS_DEPENDENCY_FRESH" : "FRESHNESS_DEPENDENCY_STALE",
+      expected_version_digest: versionMetadataDigest(input.dependency.expected_version.column, input.dependency.expected_version.value),
+      ...observed !== void 0 ? { observed_version_digest: versionMetadataDigest(input.dependency.expected_version.column, observed) } : {}
+    };
+  } catch (error) {
+    const classified = classifyFreshnessReadError(error);
+    return {
+      id: input.dependency.id,
+      kind: "supporting",
+      status: classified.result,
+      safe_code: classified.safe_code
+    };
+  }
+}
+function freshnessResultForChecks(checks) {
+  if (checks.some((check) => check.status === "invalid")) return "invalid";
+  if (checks.some((check) => check.status === "unsupported")) return "unsupported";
+  if (checks.some((check) => check.status === "unavailable")) return "unavailable";
+  if (checks.some((check) => check.status === "stale")) return "stale";
+  return "fresh";
+}
+function freshnessSafeCode(status, checks) {
+  if (status === "fresh") return "FRESHNESS_FRESH";
+  if (status === "stale" && checks.some((check) => check.kind === "target" && check.status === "stale")) return "FRESHNESS_TARGET_STALE";
+  if (status === "stale") return "FRESHNESS_DEPENDENCY_STALE";
+  if (status === "unavailable") return "FRESHNESS_TEMPORARILY_UNAVAILABLE";
+  if (status === "unsupported") return "FRESHNESS_TOPOLOGY_UNSUPPORTED";
+  return "FRESHNESS_AUTHORITY_INVALID";
+}
+function classifyFreshnessReadError(error) {
+  const code = error instanceof McpRuntimeError ? error.code : errorStringProperty(error, "code") ?? "";
+  if (/(TIMEOUT|POOL|CONNECTION|ECONN|ETIMEDOUT|TOO_MANY|UNAVAILABLE|SATURAT)/i.test(`${code} ${errorMessage(error)}`)) {
+    return { result: "unavailable", safe_code: "FRESHNESS_TEMPORARILY_UNAVAILABLE" };
+  }
+  if (/(UNSUPPORTED|CROSS_SOURCE)/i.test(code)) {
+    return { result: "unsupported", safe_code: "FRESHNESS_TOPOLOGY_UNSUPPORTED" };
+  }
+  return { result: "invalid", safe_code: "FRESHNESS_CHECK_FAILED" };
+}
+function freshnessSourceAdapters(proposal, authority) {
+  const entries = /* @__PURE__ */ new Map();
+  const targetEngine = proposal.source_kind === "external_mysql" ? "mysql" : "postgres";
+  entries.set(`${proposal.source_id}:${targetEngine}`, { source_id: proposal.source_id, engine: targetEngine });
+  for (const dependency of authority.dependencies) {
+    entries.set(`${dependency.source_id}:${dependency.engine}`, { source_id: dependency.source_id, engine: dependency.engine });
+  }
+  return [...entries.values()].sort((left, right) => left.source_id.localeCompare(right.source_id) || left.engine.localeCompare(right.engine));
+}
+function versionsEqual(left, right) {
+  return canonicalJsonDigest({ value: conflictGuardScalar(scalar3(left)) }) === canonicalJsonDigest({ value: conflictGuardScalar(scalar3(right)) });
+}
+function versionMetadataDigest(column, value) {
+  return canonicalJsonDigest({ column, value: conflictGuardScalar(scalar3(value)) });
+}
 function effectivePrincipalScope(config, capability, context) {
   const column = capability.target.principal_scope_key;
   if (!column) return void 0;
@@ -42350,6 +43381,7 @@ function buildChangeSet(input) {
         ...input.capability.operation.version_advance ? { version_advance: input.capability.operation.version_advance } : {},
         ...input.resolvedDeduplication ? { deduplication: input.resolvedDeduplication } : {}
       },
+      ...input.freshness ? { freshness: input.freshness } : {},
       ...input.capability.reversibility ? {
         reversibility: {
           mode: "reviewed_inverse",
@@ -42415,6 +43447,7 @@ function buildChangeSet(input) {
       allowed_columns: input.capability.allowed_columns ?? Object.keys(patch),
       expected_version: guard
     },
+    ...input.freshness ? { freshness: input.freshness } : {},
     evidence: {
       bundle_id: input.evidenceBundleId,
       query_fingerprint: input.queryFingerprint,
@@ -42548,6 +43581,7 @@ function buildBoundedSetChangeSet(input) {
       allowed_columns: kind === "set_delete" ? [] : input.capability.allowed_columns ?? Object.keys(input.patch),
       ...kind === "set_update" && operation.version_advance ? { version_advance: operation.version_advance } : {}
     },
+    ...input.freshness ? { freshness: input.freshness } : {},
     frozen_set: frozenSet,
     ...input.capability.reversibility ? {
       reversibility: {
@@ -42747,7 +43781,7 @@ var RuntimeDatabasePools = class {
         counter.active += 1;
         try {
           const query = runtimeReadQuery(input.capability, "$", input.args, input.context);
-          await client.query(input.capability.protected_read ? "BEGIN READ ONLY" : "BEGIN");
+          await client.query(input.capability.protected_read || input.transaction_mode === "read_only" ? "BEGIN READ ONLY" : "BEGIN");
           const timeoutMs = protectedStatementTimeout(input.capability, input.source.statement_timeout_ms);
           if (timeoutMs) await client.query(`SET LOCAL statement_timeout = ${timeoutMs}`);
           if (input.source.database_scope?.mode === "postgres_rls") {
@@ -42814,14 +43848,15 @@ var RuntimeDatabasePools = class {
         const timeoutMs = protectedStatementTimeout(input.capability, input.source.statement_timeout_ms);
         if (timeoutMs) await connection.query("SET SESSION max_execution_time = ?", [timeoutMs]).catch(() => void 0);
         const query = runtimeReadQuery(input.capability, "?", input.args, input.context);
-        if (input.capability.protected_read) await connection.query("START TRANSACTION READ ONLY");
+        const readOnlyTransaction = Boolean(input.capability.protected_read || input.transaction_mode === "read_only");
+        if (readOnlyTransaction) await connection.query("START TRANSACTION READ ONLY");
         try {
           const [rows] = await connection.execute(query.sql, query.values.map(scalar3));
           const list = Array.isArray(rows) ? rows : [];
-          if (input.capability.protected_read) await connection.query("COMMIT");
+          if (readOnlyTransaction) await connection.query("COMMIT");
           return { row: list[0] ?? {}, rows: list, rowCount: list.length };
         } catch (error) {
-          if (input.capability.protected_read) await connection.query("ROLLBACK").catch(() => void 0);
+          if (readOnlyTransaction) await connection.query("ROLLBACK").catch(() => void 0);
           throw error;
         }
       } finally {
@@ -43975,6 +45010,15 @@ function validateOperation2(job) {
 }
 async function mutateMysql(job, connection) {
   if (job.protocol_version === "4.0") return await mutateMysqlCompensation(job, connection);
+  const freshnessConflict = await lockMysqlFreshnessDependencies(job, connection);
+  if (freshnessConflict) {
+    return {
+      status: "conflict",
+      affectedRows: 0,
+      code: freshnessConflict,
+      targetIdentity: identityForJob2(job)
+    };
+  }
   if (job.protocol_version === "3.0") return await mutateMysqlSet(job, connection);
   const operation = operationOf2(job);
   if (operation === "single_row_insert") return await insertMysql(job, connection);
@@ -44035,6 +45079,38 @@ EXISTS (SELECT 1 FROM information_schema.USER_PRIVILEGES WHERE REPLACE(GRANTEE,
   }
   return { status: "applied", affectedRows: 1, targetIdentity: identityForJob2(job), resultVersion, beforeDigest, afterDigest: digest2({ identity: identityForJob2(job), patch: job.patch, version: resultVersion }) };
 }
+function freshnessDependencies2(job) {
+  if (!("freshness" in job) || !job.freshness) return [];
+  return job.freshness.dependencies;
+}
+async function lockMysqlFreshnessDependencies(job, connection) {
+  for (const dependency of freshnessDependencies2(job)) {
+    const where = [
+      `${quoteMysqlIdentifier(dependency.target.primary_key.column)} = ?`,
+      `${quoteMysqlIdentifier(dependency.target.tenant_column)} = ?`
+    ];
+    const values = [
+      dependency.target.primary_key.value,
+      job.target.tenant_guard.value
+    ];
+    if (dependency.target.principal_column) {
+      const scope = principalScope2(job);
+      if (!scope) return "FRESHNESS_DEPENDENCY_SCOPE_INVALID";
+      where.push(`${quoteMysqlIdentifier(dependency.target.principal_column)} = ?`);
+      values.push(scope.value);
+    }
+    const [rows] = await connection.query(
+      `SELECT ${quoteMysqlIdentifier(dependency.expected_version.column)} AS __synapsor_freshness_version FROM ${quoteMysqlIdentifier(dependency.target.schema)}.${quoteMysqlIdentifier(dependency.target.table)} WHERE ${where.join(" AND ")} FOR UPDATE`,
+      values
+    );
+    if (rows.length !== 1) return "FRESHNESS_DEPENDENCY_STALE";
+    if (!versionValuesMatch2(
+      rows[0]?.__synapsor_freshness_version,
+      dependency.expected_version.value
+    )) return "FRESHNESS_DEPENDENCY_STALE";
+  }
+  return void 0;
+}
 function compensationProjection2(job) {
   const columns = /* @__PURE__ */ new Set([job.target.primary_key.column, job.target.tenant_guard.column]);
   const scope = principalScope2(job);
@@ -45826,7 +46902,7 @@ import path3 from "node:path";
 // apps/runner/package.json
 var package_default = {
   name: "@synapsor/runner",
-  version: "1.6.0",
+  version: "1.6.1",
   description: "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   license: "Apache-2.0",
   type: "module",
@@ -50859,10 +51935,11 @@ async function startLocalUiServer(options = {}) {
   const projectRoot = path14.resolve(options.projectRoot ?? path14.dirname(configPath));
   const boundaryRoot = options.boundaryRoot ? path14.resolve(options.boundaryRoot) : void 0;
   const safeActionPreview = options.safeActionPreview ?? executeSafeActionPreview;
+  const freshnessEvaluator = options.freshnessEvaluator ?? ((proposal) => evaluateWorkbenchFreshness(configPath, proposal));
   const bootstrapState = { consumed: false };
   const server = createServer2(async (request, response) => {
     try {
-      await handleRequest({ request, response, configPath, storePath, projectRoot, boundaryRoot, storeAccess, safeActionPreview, token, csrfToken, tour: options.tour === true, bootstrapState });
+      await handleRequest({ request, response, configPath, storePath, projectRoot, boundaryRoot, storeAccess, safeActionPreview, freshnessEvaluator, token, csrfToken, tour: options.tour === true, bootstrapState });
     } catch (error) {
       sendJson(response, 500, {
         ok: false,
@@ -50896,7 +51973,7 @@ async function startLocalUiServer(options = {}) {
   };
 }
 async function handleRequest(input) {
-  const { request, response, configPath, storePath, projectRoot, boundaryRoot, storeAccess, safeActionPreview, token, csrfToken, tour, bootstrapState } = input;
+  const { request, response, configPath, storePath, projectRoot, boundaryRoot, storeAccess, safeActionPreview, freshnessEvaluator, token, csrfToken, tour, bootstrapState } = input;
   const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
   if (request.method === "GET" && url.pathname === "/" && url.searchParams.has("token")) {
     if (url.searchParams.get("token") !== token || bootstrapState.consumed) {
@@ -51207,11 +52284,32 @@ async function handleRequest(input) {
         data_pr: buildDataPr(proposal, reviewView, receipts2.at(-1)),
         events: store.events(proposalId),
         receipts: receipts2,
-        evidence: store.getEvidenceBundle(proposal.change_set.evidence.bundle_id)
+        evidence: store.getEvidenceBundle(proposal.change_set.evidence.bundle_id),
+        freshness: storedFreshnessSummary(proposal, store.latestFreshnessProof(proposalId))
       });
     });
     return;
   }
+  const freshnessMatch = url.pathname.match(/^\/api\/proposals\/([^/]+)\/check-freshness$/);
+  if (request.method === "POST" && freshnessMatch) {
+    if (!hasValidCsrf(request, csrfToken)) {
+      sendJson(response, 403, { ok: false, error: "CSRF token required for proposal freshness checks" });
+      return;
+    }
+    const proposalId = decodeURIComponent(freshnessMatch[1] ?? "");
+    const proposal = await storeAccess("read", "proposal-freshness-read", (store) => requireProposal(store, proposalId));
+    const freshness = await freshnessEvaluator(proposal);
+    if (freshness.required) {
+      await storeAccess("write", "proposal-freshness-record", (store) => {
+        store.recordFreshnessProof(freshness.proof);
+      });
+    }
+    sendJson(response, freshnessHttpStatus(freshness), {
+      ok: freshness.status === "fresh" || freshness.status === "not_required",
+      freshness: workbenchFreshnessSummary(freshness)
+    });
+    return;
+  }
   const approveMatch = url.pathname.match(/^\/api\/proposals\/([^/]+)\/approve$/);
   if (request.method === "POST" && approveMatch) {
     if (!hasValidCsrf(request, csrfToken)) {
@@ -51229,15 +52327,45 @@ async function handleRequest(input) {
     const proposalId = decodeURIComponent(approveMatch[1] ?? "");
     const body = await readJsonBody(request);
     if (body.confirm !== "approve") throw new Error("approval requires confirm=approve");
+    const proposalForCheck = await storeAccess("read", "proposal-approve-freshness-read", (store) => requireProposal(store, proposalId));
+    const freshness = await freshnessEvaluator(proposalForCheck);
+    if (freshness.required) {
+      await storeAccess("write", "proposal-approve-freshness-record", (store) => {
+        store.recordFreshnessProof(freshness.proof);
+      });
+    }
+    if (freshness.status !== "fresh" && freshness.status !== "not_required") {
+      if (freshness.required) {
+        await storeAccess("write", "proposal-approve-freshness-blocked", (store) => {
+          store.recordFreshnessApprovalBlocked(proposalId, {
+            proof_digest: freshness.proof.proof_digest,
+            safe_code: freshness.safe_code,
+            actor: stringOrDefault(body.actor, "local_reviewer")
+          });
+        });
+      }
+      sendJson(response, freshnessHttpStatus(freshness), {
+        ok: false,
+        error: freshness.status === "stale" ? "Proposal or supporting evidence is stale. Create a new source read and proposal." : "Freshness could not be verified. No approval was recorded.",
+        freshness: workbenchFreshnessSummary(freshness)
+      });
+      return;
+    }
     await storeAccess("write", "proposal-approve", (store) => {
       const proposal = requireProposal(store, proposalId);
       const updated = store.approveProposal(proposalId, {
         approver: stringOrDefault(body.actor, "local_reviewer"),
         proposal_hash: proposal.proposal_hash,
         proposal_version: proposal.proposal_version,
-        reason: typeof body.reason === "string" && body.reason.trim() ? body.reason.trim() : void 0
+        reason: typeof body.reason === "string" && body.reason.trim() ? body.reason.trim() : void 0,
+        freshness_proof_digest: freshness.required ? freshness.proof.proof_digest : void 0
+      });
+      sendJson(response, 200, {
+        ok: true,
+        proposal: updated,
+        approval_progress: store.approvalProgress(proposalId),
+        freshness: workbenchFreshnessSummary(freshness)
       });
-      sendJson(response, 200, { ok: true, proposal: updated, approval_progress: store.approvalProgress(proposalId) });
     });
     return;
   }
@@ -51282,6 +52410,65 @@ async function handleRequest(input) {
   }
   sendJson(response, 404, { ok: false, error: "not found" });
 }
+async function evaluateWorkbenchFreshness(configPath, proposal) {
+  const required = "freshness" in proposal.change_set && proposal.change_set.freshness !== void 0;
+  if (!required) {
+    return {
+      required: false,
+      status: "not_required",
+      safe_code: "FRESHNESS_NOT_REQUIRED",
+      target_count: 0,
+      supporting_count: 0
+    };
+  }
+  const config = await loadRuntimeConfigFromFile(configPath);
+  return evaluateProposalFreshness({ config, proposal, env: process.env });
+}
+function workbenchFreshnessSummary(result) {
+  if (!result.required) {
+    return {
+      required: false,
+      status: "not_required",
+      safe_code: result.safe_code,
+      target_count: 0,
+      supporting_count: 0
+    };
+  }
+  return {
+    required: true,
+    status: result.status,
+    safe_code: result.safe_code,
+    checked_at: result.proof.checked_at,
+    valid_until: result.proof.valid_until,
+    proof_digest: result.proof.proof_digest,
+    target_count: result.target_count,
+    supporting_count: result.supporting_count,
+    checks: result.proof.checks
+  };
+}
+function storedFreshnessSummary(proposal, proof) {
+  const required = "freshness" in proposal.change_set && proposal.change_set.freshness !== void 0;
+  if (!required) return { required: false, status: "not_required", safe_code: "FRESHNESS_NOT_REQUIRED" };
+  if (!proof) return { required: true, status: "not_checked", safe_code: "FRESHNESS_PROOF_MISSING" };
+  const expired = proof.result === "fresh" && Date.parse(proof.valid_until) < Date.now();
+  return {
+    required: true,
+    status: expired ? "unavailable" : proof.result,
+    safe_code: expired ? "FRESHNESS_PROOF_EXPIRED" : proof.safe_code,
+    checked_at: proof.checked_at,
+    valid_until: proof.valid_until,
+    proof_digest: proof.proof_digest,
+    target_count: proof.target_count,
+    supporting_count: proof.supporting_count,
+    checks: proof.checks
+  };
+}
+function freshnessHttpStatus(result) {
+  if (result.status === "fresh" || result.status === "not_required") return 200;
+  if (result.status === "stale") return 409;
+  if (result.status === "unavailable") return 503;
+  return 422;
+}
 async function executeSafeActionPreview(input) {
   const prepared = await prepareSafeActionPreview({ projectRoot: input.projectRoot, configPath: input.configPath });
   const previewConfigPath = path14.resolve(input.projectRoot, prepared.config_path);
@@ -52301,6 +53488,7 @@ function buildStory(payload) {
   const principalId = (cs.principal && cs.principal.id) || "the agent";
   const requiredRole = (cs.approval && cs.approval.required_role) || "a reviewer";
   const approvalProgress = payload.approval_progress || { approved: 0, required: 1, remaining: 1, complete: false };
+  const freshness = payload.freshness || { required: false, status: "not_required" };
   const story = el("div", { class: "story" });
 
   // 1. Agent requested a change
@@ -52346,8 +53534,17 @@ function buildStory(payload) {
     el("div", { class: "kv" }, [
       el("dt", { text: "Approval progress" }), el("dd", { text: approvalProgress.approved + "/" + approvalProgress.required }),
       el("dt", { text: "Policy result" }), el("dd", { text: (rv.policy_and_risk && rv.policy_and_risk.decision) || stateVal }),
+      el("dt", { text: "Live freshness" }), el("dd", { text: String(freshness.status || "not checked").replaceAll("_", " ") }),
+      el("dt", { text: "Freshness checks" }), el("dd", { text: String(freshness.target_count || 0) + " target / " + String(freshness.supporting_count || 0) + " supporting" }),
     ]),
   ];
+  if (freshness.required) {
+    approveBody.push(el("p", { text: freshness.status === "fresh"
+      ? "The live preflight passed. Approval still does not guarantee freshness through apply; the trusted apply path checks again."
+      : freshness.status === "stale"
+        ? "The target or supporting evidence drifted. This proposal cannot be refreshed; create a new source read and proposal."
+        : "A live source preflight is required before this proposal can be approved." }));
+  }
   const approvedEv = find("proposal_approved");
   const rejectedEv = find("proposal_rejected");
   if (stateVal === "pending_review") {
@@ -52466,10 +53663,42 @@ async function loadDetail(proposalId) {
     actor.setAttribute("aria-label", "Reviewer identity");
     reason.setAttribute("aria-label", "Reason for approval or rejection");
     const actions = el("div", { class: "actions" });
+    const freshness = payload.freshness || { required: false, status: "not_required" };
+    const freshnessStatus = el("div", { class: "status-line", text: freshness.required
+      ? "Freshness: " + String(freshness.status || "not checked").replaceAll("_", " ") + "."
+      : "Freshness: not required for this legacy proposal." });
+    const check = freshness.required
+      ? el("button", { class: "secondary", text: "Check live freshness", onclick: async () => {
+        check.disabled = true;
+        try {
+          await api("/api/proposals/" + encodeURIComponent(proposalId) + "/check-freshness", {
+            method: "POST",
+            headers: { "x-synapsor-csrf": csrfToken },
+            body: JSON.stringify({}),
+          });
+        } catch (error) {
+          freshnessStatus.textContent = error.message;
+        } finally {
+          await loadProposals();
+          await loadDetail(proposalId);
+        }
+      } })
+      : null;
     const approve = el("button", { text: "Approve outside MCP", onclick: async () => { await api("/api/proposals/" + encodeURIComponent(proposalId) + "/approve", { method: "POST", headers: { "x-synapsor-csrf": csrfToken }, body: JSON.stringify({ actor: actor.value, reason: reason.value, confirm: "approve" }) }); await loadProposals(); await loadDetail(proposalId); } });
+    approve.disabled = freshness.required && freshness.status !== "fresh";
+    approve.title = freshness.required
+      ? "A fresh live check is required. Approval performs another check immediately before recording the decision."
+      : "Record this human decision outside MCP.";
     const reject = el("button", { class: "danger", text: "Reject", onclick: async () => { await api("/api/proposals/" + encodeURIComponent(proposalId) + "/reject", { method: "POST", headers: { "x-synapsor-csrf": csrfToken }, body: JSON.stringify({ actor: actor.value, reason: reason.value || "rejected from local UI", confirm: "reject" }) }); await loadProposals(); await loadDetail(proposalId); } });
+    if (check) actions.append(check);
     actions.append(approve, reject);
-    reviewPane.append(el("div", { class: "callout", text: "You are the approval authority here \u2014 the model cannot reach these controls." }), actor, reason, actions);
+    reviewPane.append(
+      el("div", { class: "callout", text: "You are the approval authority here \u2014 the model cannot reach these controls." }),
+      freshnessStatus,
+      actor,
+      reason,
+      actions,
+    );
   } else if (proposal.state === "approved" || proposal.state === "pending_worker") {
     const command = trustedApplyCommand(proposalId);
     const commandBox = el("div", { class: "mono", text: command, style: "display:block;margin-top:8px" });
@@ -52495,6 +53724,7 @@ async function loadDetail(proposalId) {
     el("h3", { text: "events", style: "margin:6px 0 2px;font-size:13px;color:var(--muted)" }), pre(payload.events),
     el("h3", { text: "receipts", style: "margin:6px 0 2px;font-size:13px;color:var(--muted)" }), pre(payload.receipts),
     el("h3", { text: "evidence", style: "margin:6px 0 2px;font-size:13px;color:var(--muted)" }), pre(payload.evidence),
+    el("h3", { text: "freshness", style: "margin:6px 0 2px;font-size:13px;color:var(--muted)" }), pre(payload.freshness),
   );
   root.append(reviewPane, jsonPane);
 }
@@ -53159,7 +54389,16 @@ async function createComplianceReport(input) {
         capability: proposal.capability ?? proposal.action,
         principal: approval.approver,
         object: `${proposal.business_object}:${proposal.object_id}`,
-        details: sanitize({ status: approval.status, reason: approval.reason, identity_provider: approval.identity?.provider, verified: approval.identity?.verified, subject: approval.identity?.subject, decision_hash: approval.decision_hash, integrity_hash: approval.integrity_hash })
+        details: sanitize({
+          status: approval.status,
+          reason: approval.reason,
+          identity_provider: approval.identity?.provider,
+          verified: approval.identity?.verified,
+          subject: approval.identity?.subject,
+          decision_hash: approval.decision_hash,
+          integrity_hash: approval.integrity_hash,
+          freshness_proof_digest: approval.freshness_proof_digest
+        })
       });
       for (const event of store.events(proposal.proposal_id)) entries.push({
         timestamp: event.created_at,
@@ -53169,7 +54408,7 @@ async function createComplianceReport(input) {
         capability: proposal.capability ?? proposal.action,
         principal: event.actor,
         object: `${proposal.business_object}:${proposal.object_id}`,
-        details: sanitize({ kind: event.kind, actor: event.actor, payload_included: false })
+        details: complianceEventDetails(event)
       });
       for (const intent of store.listWritebackIntents({ proposal_id: proposal.proposal_id, limit: 1e6 })) entries.push({
         timestamp: intent.created_at,
@@ -53346,6 +54585,7 @@ async function verifyComplianceReport(report, publicKeyPath) {
 }
 function proposalEntry(proposal) {
   const change = proposal.change_set;
+  const freshness = "freshness" in change && change.freshness ? parseFreshnessAuthority(change.freshness) : void 0;
   return {
     timestamp: proposal.created_at,
     category: "proposal",
@@ -53365,10 +54605,64 @@ function proposalEntry(proposal) {
       after: change.after,
       allowed_columns: change.guards.allowed_columns,
       source_database_mutated: proposal.source_database_mutated,
-      proposal_hash: proposal.proposal_hash
+      proposal_hash: proposal.proposal_hash,
+      freshness_required: Boolean(freshness),
+      freshness_authority: freshness ? {
+        schema_version: freshness.schema_version,
+        target_mode: freshness.target.mode,
+        target_member_count: freshness.target.member_count,
+        supporting_dependency_count: freshness.dependencies.length,
+        dependency_ids: freshness.dependencies.map((dependency) => dependency.id),
+        dependency_set_digest: freshness.dependency_set_digest
+      } : void 0
     })
   };
 }
+function complianceEventDetails(event) {
+  const base = { kind: event.kind, actor: event.actor, payload_included: false };
+  if (event.kind === "proposal_freshness_checked") {
+    try {
+      const proof = parseFreshnessProof(event.payload.proof);
+      return sanitize({
+        ...base,
+        freshness: {
+          schema_version: proof.schema_version,
+          result: proof.result,
+          safe_code: proof.safe_code,
+          checked_at: proof.checked_at,
+          valid_until: proof.valid_until,
+          proof_digest: proof.proof_digest,
+          dependency_set_digest: proof.dependency_set_digest,
+          target_count: proof.target_count,
+          supporting_count: proof.supporting_count,
+          checks: proof.checks
+        }
+      });
+    } catch {
+      return sanitize({ ...base, freshness: { status: "invalid_stored_proof" } });
+    }
+  }
+  if (event.kind === "proposal_approval_blocked_freshness") {
+    return sanitize({
+      ...base,
+      freshness: {
+        result: event.payload.result,
+        safe_code: event.payload.safe_code,
+        proof_digest: event.payload.proof_digest
+      }
+    });
+  }
+  if (event.kind === "writeback_conflict" && /^FRESHNESS_/.test(String(event.payload.safe_error_code ?? ""))) {
+    return sanitize({
+      ...base,
+      freshness: {
+        safe_code: event.payload.safe_error_code,
+        apply_revalidation_blocked: true
+      }
+    });
+  }
+  return sanitize(base);
+}
 function queryAuditEntry(audit2) {
   const proposalId = string(audit2.proposal_id);
   const objectType = string(audit2.business_object) ?? string(audit2.table_name);
@@ -56571,6 +57865,7 @@ function buildLifecycleViewUnchecked(store, proposal, selection, commandName) {
   const outbox = stableBy(store.listCloudOutbox({ proposal_id: proposalId, limit: 1e3 }), (item) => `${item.created_at}:${item.event_id}`);
   const governance = stableBy(store.listCloudGovernanceEvents(proposalId), (item) => `${item.created_at}:${item.event_id}`);
   const replay2 = store.getStoredReplayForProposal(proposalId);
+  const latestFreshness = store.latestFreshnessProof(proposalId);
   assertLifecycleLinks(proposal, evidence2, audit2, jobs, intents, receipts2, worker, governance, replay2);
   const changeSet = asRecord4(proposal.change_set);
   if (!changeSet) {
@@ -56589,6 +57884,9 @@ function buildLifecycleViewUnchecked(store, proposal, selection, commandName) {
   const latestReceipt = receipts2.at(-1);
   const lineage = compensationLineage(changeSet);
   const inverseReceipts = receipts2.map((item) => asRecord4(item.receipt)?.inverse).filter((item) => item !== void 0).map((item) => safeDomainValue(item));
+  const freshnessAuthority = asRecord4(changeSet.freshness);
+  const freshnessTarget = asRecord4(freshnessAuthority?.target);
+  const freshnessDependencies3 = Array.isArray(freshnessAuthority?.dependencies) ? freshnessAuthority.dependencies : [];
   return {
     schema_version: lifecycleViewSchemaVersion,
     selection,
@@ -56635,6 +57933,21 @@ function buildLifecycleViewUnchecked(store, proposal, selection, commandName) {
       decisions: approvals.map(publicApproval),
       tripped_policy_limits: policyLimitTrips(events2)
     },
+    freshness: {
+      required: freshnessAuthority !== void 0,
+      target_count: latestFreshness?.target_count ?? numberValue(freshnessTarget?.member_count) ?? 0,
+      supporting_count: latestFreshness?.supporting_count ?? freshnessDependencies3.length,
+      latest_status: latestFreshness?.result ?? (freshnessAuthority ? "not_checked" : "not_required"),
+      latest_checked_at: latestFreshness?.checked_at ?? null,
+      latest_proof_digest: latestFreshness?.proof_digest ?? null,
+      latest_safe_code: latestFreshness?.safe_code ?? null,
+      approval_proofs: approvals.map((item) => ({
+        approval_id: item.approval_id,
+        approver: item.approver,
+        proof_digest: item.freshness_proof_digest ?? null
+      })),
+      next_action: latestFreshness?.result === "stale" ? "Create a new source read and proposal." : latestFreshness?.result === "unavailable" ? "Retry the live freshness check when the source is available." : freshnessAuthority && !latestFreshness ? "Run proposals check-freshness before approval." : "Apply still revalidates target and supporting dependencies."
+    },
     evidence: {
       bundles: evidence2.map(publicEvidence),
       count: evidence2.length
@@ -56690,6 +58003,7 @@ function formatLifecycleFirstLook(view) {
     `Object: ${view.proposal.scope.business_object}:${view.proposal.scope.object_id}`,
     `Trusted scope: tenant=${view.proposal.scope.tenant_id} principal=${view.proposal.scope.principal}`,
     `Approval: ${view.approval.status} via ${view.approval.source} (${view.approval.progress.approved}/${view.approval.progress.required})`,
+    `Freshness: ${view.freshness.latest_status}; target=${view.freshness.target_count} supporting=${view.freshness.supporting_count}; proof=${view.freshness.latest_proof_digest ?? "none"}`,
     `Evidence: ${view.evidence.count} bundle${view.evidence.count === 1 ? "" : "s"}; query audit: ${view.query_audit.count}`,
     `Writeback: ${view.writeback.jobs.length ? `${view.writeback.jobs.length} job(s)` : "not created"}; ${view.writeback.intents.length ? `${view.writeback.intents.length} intent(s)` : "no intent"}`,
     `Latest outcome: ${latest ? `${String(latest.status)} rows=${String(latest.rows_affected)} source_changed=${String(latest.source_database_mutated)}` : "not applied"}`,
@@ -56709,6 +58023,7 @@ function formatLifecycleDetails(view) {
   const sections = [
     ["Proposal", view.proposal],
     ["Approval", view.approval],
+    ["Freshness", view.freshness],
     ["Evidence", view.evidence],
     ["Query audit", view.query_audit],
     ["Writeback", view.writeback],
@@ -56827,6 +58142,7 @@ function publicApproval(approval) {
       decision_hash: identity.decision_hash,
       integrity_hash: identity.integrity_hash
     } : null,
+    freshness_proof_digest: approval.freshness_proof_digest ?? null,
     created_at: approval.created_at
   };
 }
@@ -57208,7 +58524,7 @@ function createScopedExploreMcpServer(runtime) {
     }).strict().optional()
   }).strict();
   const server = new McpServer2(
-    { name: "synapsor-runner-authoring", version: "1.6.0" },
+    { name: "synapsor-runner-authoring", version: "1.6.1" },
     { capabilities: { tools: {} } }
   );
   server.registerTool(SCOPED_EXPLORE_DESCRIBE_TOOL, {
@@ -61926,6 +63242,29 @@ async function directSqlWritebackDoctorChecks(config, sourceName, source, writeU
         message: `Rollback-only writer probe failed for configured target ${capability.target.schema}.${capability.target.table} (${safeDatabaseProbeError(error)}). Verify writer SELECT/${capabilityOperation(capability).toUpperCase()} on the target table and configured columns.`
       });
     }
+    for (const dependency of proposalFreshnessDependencyCapabilities(config, capability)) {
+      try {
+        await rollbackOnlyFreshnessDependencyProbe(
+          source.engine,
+          writeUrl,
+          dependency.capability,
+          dependency.versionColumn
+        );
+        checks.push({
+          name: `capability:${capability.name}:freshness-dependency:${dependency.id}:lock-probe`,
+          ok: true,
+          level: "pass",
+          message: `Rollback-only writer probe verified locking-read authority for freshness dependency ${dependency.capability.target.schema}.${dependency.capability.target.table} without reading or mutating business rows.`
+        });
+      } catch (error) {
+        checks.push({
+          name: `capability:${capability.name}:freshness-dependency:${dependency.id}:lock-probe`,
+          ok: false,
+          level: "fail",
+          message: `Rollback-only locking-read probe failed for freshness dependency ${dependency.capability.target.schema}.${dependency.capability.target.table} (${safeDatabaseProbeError(error)}). Verify writer SELECT plus row-lock authority on the dependency relation; a narrow UPDATE grant on its version column is sufficient for the supported PostgreSQL/MySQL fixtures.`
+        });
+      }
+    }
   }
   return checks;
 }
@@ -61935,6 +63274,22 @@ function directSqlProposalCapabilities(config, sourceName) {
     return capabilityWritebackMode2(capability) === "direct_sql";
   });
 }
+function proposalFreshnessDependencyCapabilities(config, proposal) {
+  const policy = config.proposal_freshness?.[proposal.name];
+  if (!policy) return [];
+  const capabilities = new Map((config.capabilities ?? []).map((capability) => [capability.name, capability]));
+  return (policy.dependencies ?? []).map((dependency) => {
+    const capability = capabilities.get(dependency.capability);
+    if (!capability) {
+      throw new Error(`reviewed freshness dependency capability is missing: ${dependency.capability}`);
+    }
+    return {
+      id: dependency.id,
+      capability,
+      versionColumn: dependency.version_column
+    };
+  });
+}
 async function rollbackOnlyTargetProbe(engine, databaseUrl, capability) {
   if (engine === "postgres") {
     await rollbackOnlyPostgresTargetProbe(databaseUrl, capability);
@@ -61942,6 +63297,45 @@ async function rollbackOnlyTargetProbe(engine, databaseUrl, capability) {
   }
   await rollbackOnlyMysqlTargetProbe(databaseUrl, capability);
 }
+async function rollbackOnlyFreshnessDependencyProbe(engine, databaseUrl, capability, versionColumn) {
+  if (engine === "postgres") {
+    const pg = await dynamicImportModule("pg");
+    const pool = new pg.Pool({ connectionString: databaseUrl });
+    const client = await pool.connect();
+    try {
+      await client.query("BEGIN");
+      try {
+        const table = `${quotePostgresIdentifier3(capability.target.schema)}.${quotePostgresIdentifier3(capability.target.table)}`;
+        const columns = freshnessDependencyProbeColumns(capability, versionColumn).map(quotePostgresIdentifier3).join(", ");
+        await client.query(`SELECT ${columns} FROM ${table} WHERE false FOR UPDATE`);
+        await client.query("ROLLBACK");
+      } catch (error) {
+        await client.query("ROLLBACK").catch(() => void 0);
+        throw error;
+      }
+    } finally {
+      client.release();
+      await pool.end();
+    }
+    return;
+  }
+  const mysql5 = await dynamicImportModule("mysql2/promise");
+  const connection = await mysql5.createConnection({ uri: databaseUrl, dateStrings: true });
+  try {
+    await connection.beginTransaction();
+    try {
+      const table = `${quoteMysqlIdentifier2(capability.target.schema)}.${quoteMysqlIdentifier2(capability.target.table)}`;
+      const columns = freshnessDependencyProbeColumns(capability, versionColumn).map(quoteMysqlIdentifier2).join(", ");
+      await connection.query(`SELECT ${columns} FROM ${table} WHERE 1 = 0 FOR UPDATE`);
+      await connection.rollback();
+    } catch (error) {
+      await connection.rollback().catch(() => void 0);
+      throw error;
+    }
+  } finally {
+    await connection.end();
+  }
+}
 async function rollbackOnlyPostgresTargetProbe(databaseUrl, capability) {
   const pg = await dynamicImportModule("pg");
   const pool = new pg.Pool({ connectionString: databaseUrl });
@@ -62024,6 +63418,14 @@ function proposalReadProbeColumns(capability) {
   }
   return [...columns];
 }
+function freshnessDependencyProbeColumns(capability, versionColumn) {
+  return [...new Set([
+    capability.target.primary_key,
+    capability.target.tenant_key,
+    capability.target.principal_scope_key,
+    versionColumn
+  ].filter((column) => Boolean(column)))];
+}
 function proposalWriteProbeColumns(capability) {
   const columns = /* @__PURE__ */ new Set();
   for (const column of capability.allowed_columns ?? []) columns.add(column);
@@ -63226,6 +64628,11 @@ async function verifyLocalWritebackAuthority(job, configPath, storePath, options
       if (proposal.proposal_hash !== job.approval_id) {
         throw new Error("writeback approval/proposal digest does not match local proposal");
       }
+      const proposalFreshness = "freshness" in proposal.change_set && proposal.change_set.freshness ? parseFreshnessAuthority(proposal.change_set.freshness) : void 0;
+      const jobFreshness = "freshness" in job && job.freshness ? parseFreshnessAuthority(job.freshness) : void 0;
+      if (Boolean(proposalFreshness) !== Boolean(jobFreshness) || proposalFreshness && jobFreshness && proposalFreshness.dependency_set_digest !== jobFreshness.dependency_set_digest) {
+        throw new Error("writeback freshness authority does not match the immutable local proposal");
+      }
       const proposalContract = proposal.change_set.contract;
       const reviewedContract = matching.contract_provenance;
       if (reviewedContract) {
@@ -63259,12 +64666,42 @@ async function verifyLocalWritebackAuthority(job, configPath, storePath, options
       } else if (proposalPrincipalScope) {
         throw new Error("local proposal carries principal scope outside the reviewed capability");
       }
-      if (!options.cloudApproved) await verifyStoredApprovalAuthority(config, configPath, store, proposal, matching);
+      if (!options.cloudApproved) {
+        verifyStoredFreshnessApprovalAuthority(store, proposal);
+        await verifyStoredApprovalAuthority(config, configPath, store, proposal, matching);
+      }
     } finally {
       store.close();
     }
   }
 }
+function verifyStoredFreshnessApprovalAuthority(store, proposal) {
+  if (!("freshness" in proposal.change_set) || !proposal.change_set.freshness) return;
+  const authority = parseFreshnessAuthority(proposal.change_set.freshness);
+  const approvals = store.approvals(proposal.proposal_id).filter((approval) => approval.status === "approved" && approval.proposal_hash === proposal.proposal_hash && approval.proposal_version === proposal.proposal_version);
+  const required = proposal.change_set.approval.required_approvals ?? 1;
+  if (new Set(approvals.map((approval) => approval.approver)).size < required) {
+    throw new Error(`proposal ${proposal.proposal_id} does not have its required freshness-bound approvals`);
+  }
+  const proofEvents = store.events(proposal.proposal_id).filter((event) => event.kind === "proposal_freshness_checked");
+  for (const approval of approvals) {
+    if (!approval.freshness_proof_digest) {
+      throw new Error(`proposal ${proposal.proposal_id} has an approval without a freshness proof`);
+    }
+    const event = proofEvents.find((candidate) => {
+      try {
+        return parseFreshnessProof(candidate.payload.proof).proof_digest === approval.freshness_proof_digest;
+      } catch {
+        return false;
+      }
+    });
+    if (!event) throw new Error(`proposal ${proposal.proposal_id} freshness proof is missing or failed integrity validation`);
+    const proof = parseFreshnessProof(event.payload.proof);
+    if (proof.result !== "fresh" || proof.proposal_hash !== proposal.proposal_hash || proof.proposal_version !== proposal.proposal_version || proof.dependency_set_digest !== authority.dependency_set_digest) {
+      throw new Error(`proposal ${proposal.proposal_id} approval freshness proof does not match immutable authority`);
+    }
+  }
+}
 async function verifyStoredApprovalAuthority(config, configPath, store, proposal, capability) {
   if (!config.operator_identity || config.operator_identity.provider === "dev_env") return;
   const approval = [...store.approvals(proposal.proposal_id)].reverse().find((item) => item.status === "approved" && item.proposal_hash === proposal.proposal_hash && item.proposal_version === proposal.proposal_version);
@@ -67082,6 +68519,7 @@ async function proposals(args) {
   const [subcommand, ...rest] = args;
   if (subcommand === "list") return proposalsList(rest);
   if (subcommand === "show") return proposalsShow(rest);
+  if (subcommand === "check-freshness") return proposalsCheckFreshness(rest);
   if (subcommand === "approve") return proposalsApprove(rest);
   if (subcommand === "reject") return proposalsReject(rest);
   if (subcommand === "writeback-job") return proposalsWritebackJob(rest);
@@ -68043,13 +69481,21 @@ async function proposalsShow(args) {
     if (!proposal) throw new Error(`proposal not found: ${resolvedProposalId}`);
     const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
     const approvalProgress = store.approvalProgress(resolvedProposalId);
-    const payload = { proposal, approval_progress: approvalProgress, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId), evidence: evidence2 };
+    const latestFreshness = store.latestFreshnessProof(resolvedProposalId);
+    const freshness = {
+      required: "freshness" in proposal.change_set && proposal.change_set.freshness !== void 0,
+      status: latestFreshness?.result ?? ("freshness" in proposal.change_set && proposal.change_set.freshness !== void 0 ? "not_checked" : "not_required"),
+      proof: latestFreshness ?? null
+    };
+    const payload = { proposal, approval_progress: approvalProgress, freshness, events: store.events(resolvedProposalId), receipts: store.receipts(resolvedProposalId), evidence: evidence2 };
     if (args.includes("--json")) {
       process2.stdout.write(`${JSON.stringify(payload, null, 2)}
 `);
     } else if (showDetails(args)) {
       process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
       process2.stdout.write(`Approval progress: ${approvalProgress.approved}/${approvalProgress.required}${approvalProgress.rejected ? " (rejected)" : ""}
+`);
+      process2.stdout.write(`Freshness: ${freshness.status}${latestFreshness ? ` checked=${latestFreshness.checked_at} proof=${latestFreshness.proof_digest}` : ""}
 `);
       process2.stdout.write(formatProposalEventDetail(payload.events));
       if (args.includes("--debug")) process2.stdout.write(formatProposalDebug(proposal, optionalArg(args, "--store")));
@@ -68061,6 +69507,119 @@ async function proposalsShow(args) {
     store.close();
   }
 }
+var freshnessExitCodes = {
+  fresh: 0,
+  not_required: 0,
+  stale: 3,
+  unavailable: 4,
+  invalid: 5,
+  unsupported: 6
+};
+async function proposalsCheckFreshness(args) {
+  const proposalId = positional(args, 0);
+  if (!proposalId) throw new Error("proposals check-freshness requires <proposal_id|latest>");
+  const storePath = localStorePath(args);
+  const configPath = optionalArg(args, "--config") ?? "synapsor.runner.json";
+  const config = await optionalRuntimeConfig(configPath);
+  if (config && runtimeStoreBridgeRequired(args, config)) {
+    return withSharedPostgresRuntimeStoreBridge(
+      args,
+      config,
+      `proposals check-freshness ${proposalId}`,
+      (bridgeStorePath) => proposalsCheckFreshness(argsWithRuntimeStoreBridge(args, bridgeStorePath))
+    );
+  }
+  assertNoRuntimeStoreForLocalMutation(config, "proposals check-freshness", args);
+  if (sharedPostgresLedgerMirrorRequested(args, config)) {
+    return withSharedPostgresLedgerMirror(
+      args,
+      storePath,
+      `proposals check-freshness ${proposalId}`,
+      () => proposalsCheckFreshness(withoutSharedPostgresLedgerMirror(args)),
+      config
+    );
+  }
+  const store = await openLocalStore(args);
+  try {
+    const resolvedProposalId = resolveProposalIdFromStore(proposalId, store);
+    const proposal = requireLocalProposal(store, resolvedProposalId);
+    const freshness = await evaluateAndRecordProposalFreshness({ proposal, config, configPath, store });
+    operationalLog(freshness.status === "fresh" || freshness.status === "not_required" ? "info" : "warn", "proposal_freshness_check", {
+      proposal_id: proposal.proposal_id,
+      capability: proposal.action,
+      tenant: proposal.tenant_id,
+      status: freshness.status,
+      error_code: freshness.safe_code,
+      target_count: freshness.target_count,
+      supporting_count: freshness.supporting_count,
+      ...freshness.required ? { freshness_proof_digest: freshness.proof.proof_digest } : {},
+      source_database_changed: false
+    });
+    process2.stdout.write(args.includes("--json") ? `${JSON.stringify(freshnessJson(freshness), null, 2)}
+` : formatFreshnessResult(freshness, args.includes("--details")));
+    return freshnessExitCodes[freshness.status];
+  } finally {
+    store.close();
+  }
+}
+async function evaluateAndRecordProposalFreshness(input) {
+  const required = "freshness" in input.proposal.change_set && input.proposal.change_set.freshness !== void 0;
+  if (!required) {
+    return {
+      required: false,
+      status: "not_required",
+      safe_code: "FRESHNESS_NOT_REQUIRED",
+      target_count: 0,
+      supporting_count: 0
+    };
+  }
+  if (!input.config) {
+    throw new Error(`freshness-required proposal needs an existing --config file; not found: ${path25.resolve(input.configPath)}`);
+  }
+  const result = await evaluateProposalFreshness({
+    config: input.config,
+    proposal: input.proposal,
+    env: process2.env
+  });
+  if (result.required) input.store.recordFreshnessProof(result.proof);
+  return result;
+}
+function freshnessJson(result) {
+  return {
+    schema_version: "synapsor.proposal-freshness-result.v1",
+    required: result.required,
+    status: result.status,
+    safe_code: result.safe_code,
+    target_count: result.target_count,
+    supporting_count: result.supporting_count,
+    ...result.required ? { proof: result.proof } : {},
+    source_database_changed: false
+  };
+}
+function formatFreshnessResult(result, details) {
+  if (!result.required) return "Freshness: not required (legacy target guard remains enforced at apply).\n";
+  const lines = [
+    `Freshness: ${result.status}`,
+    `code: ${result.safe_code}`,
+    `target checks: ${result.target_count}`,
+    `supporting checks: ${result.supporting_count}`,
+    `checked at: ${result.proof.checked_at}`,
+    `proof: ${result.proof.proof_digest}`
+  ];
+  if (result.status === "stale") lines.push("next: create a new source read and proposal; this proposal cannot be refreshed or approved");
+  else if (result.status === "unavailable") lines.push("next: retry the live check after the source is available; no approval was recorded");
+  else if (result.status === "invalid" || result.status === "unsupported") lines.push("next: fix the reviewed freshness configuration; no approval was recorded");
+  else lines.push("note: approval-time freshness does not replace the final apply-time revalidation");
+  if (details) {
+    for (const check of result.proof.checks) {
+      lines.push(
+        `- ${check.kind}:${check.id} ${check.status} (${check.safe_code})${check.expected_version_digest ? ` expected=${check.expected_version_digest}` : ""}${check.observed_version_digest ? ` observed=${check.observed_version_digest}` : ""}`
+      );
+    }
+  }
+  return `${lines.join("\n")}
+`;
+}
 async function proposalsApprove(args) {
   const proposalId = positional(args, 0);
   if (!proposalId) throw new Error("proposals approve requires <proposal_id>");
@@ -68083,6 +69642,20 @@ async function proposalsApprove(args) {
       const evidence2 = store.getEvidenceBundle(proposal.change_set.evidence.bundle_id);
       process2.stdout.write(formatProposalDetail(proposal, evidence2?.items.length));
     }
+    const freshness = await evaluateAndRecordProposalFreshness({ proposal, config, configPath, store });
+    if (!args.includes("--json")) process2.stdout.write(formatFreshnessResult(freshness, args.includes("--details")));
+    if (freshness.status !== "fresh" && freshness.status !== "not_required") {
+      if (freshness.required) {
+        store.recordFreshnessApprovalBlocked(resolvedProposalId, {
+          proof_digest: freshness.proof.proof_digest,
+          safe_code: freshness.safe_code,
+          actor: "operator"
+        });
+      }
+      if (args.includes("--json")) process2.stdout.write(`${JSON.stringify(freshnessJson(freshness), null, 2)}
+`);
+      return freshnessExitCodes[freshness.status];
+    }
     await confirmDangerousAction(args, `Approve proposal ${resolvedProposalId} for guarded writeback?`);
     const identity = await operatorIdentityForDecision({ args, config, configPath, proposal, action: "approve", reason: optionalArg(args, "--reason") });
     const updated = store.approveProposal(resolvedProposalId, {
@@ -68091,7 +69664,8 @@ async function proposalsApprove(args) {
       proposal_version: proposal.proposal_version,
       reason: optionalArg(args, "--reason") ?? void 0,
       identity,
-      require_verified_identity: Boolean(config?.operator_identity && config.operator_identity.provider !== "dev_env")
+      require_verified_identity: Boolean(config?.operator_identity && config.operator_identity.provider !== "dev_env"),
+      freshness_proof_digest: freshness.required ? freshness.proof.proof_digest : void 0
     });
     operationalLog("info", "operator_decision", {
       action: "approve",
@@ -68102,10 +69676,16 @@ async function proposalsApprove(args) {
       identity_provider: identity.provider,
       identity_verified: identity.verified,
       required_role: proposal.change_set.approval.required_role,
-      approval_progress: `${store.approvalProgress(resolvedProposalId).approved}/${store.approvalProgress(resolvedProposalId).required}`
+      approval_progress: `${store.approvalProgress(resolvedProposalId).approved}/${store.approvalProgress(resolvedProposalId).required}`,
+      freshness_status: freshness.status,
+      ...freshness.required ? { freshness_proof_digest: freshness.proof.proof_digest } : {}
     });
     const progress = store.approvalProgress(resolvedProposalId);
-    const approvalResult = { ...updated, approval_progress: progress };
+    const approvalResult = {
+      ...updated,
+      approval_progress: progress,
+      freshness: freshnessJson(freshness)
+    };
     process2.stdout.write(args.includes("--json") ? `${JSON.stringify(approvalResult, null, 2)}
 ` : progress.complete ? `approved ${updated.proposal_id} (${progress.approved}/${progress.required})
 ` : `approval recorded for ${updated.proposal_id} (${progress.approved}/${progress.required}); awaiting ${progress.remaining} more verified reviewer${progress.remaining === 1 ? "" : "s"}
@@ -71978,11 +73558,13 @@ Without --config, doctor is the legacy Cloud worker check and requires SYNAPSOR_
 	  ${cmd} proposals list [--tenant acme] [--capability billing.propose_late_fee_waiver] [--object invoice:INV-3001] [--status applied]
 	  ${cmd} proposals show latest
 	  ${cmd} proposals show latest --details
+	  ${cmd} proposals check-freshness latest --config ./synapsor.runner.json --store ./.synapsor/local.db
+	  ${cmd} proposals check-freshness latest --details --json --config ./synapsor.runner.json --store ./.synapsor/local.db
 	  ${cmd} proposals approve latest --yes
 	  ${cmd} proposals reject latest --reason "..."
 	  ${cmd} proposals approve latest --yes --shared-ledger-mirror --shared-ledger-url-env SYNAPSOR_LEDGER_DATABASE_URL
 
-	Review decisions happen outside the model-facing MCP tool surface. Human output is concise by default; use --details for reviewer metadata or --json for complete records.
+	Review decisions happen outside the model-facing MCP tool surface. A freshness-required approval performs the same live check automatically and binds the approval to its immutable proof. Freshness at approval improves review quality; apply rechecks again before mutation. Human output is concise by default; use --details for reviewer metadata or --json for complete records.
 	`,
     lifecycle: `Usage:
   ${cmd} lifecycle [--store ./.synapsor/local.db]