@synapsor/runner 1.6.0 → 1.6.2

package/dist/runtime.mjs

@@ -1787,10 +1787,12 @@ function sortJson(value) {
 }
 
 // packages/config/src/index.ts
-var TOP_LEVEL_KEYS2 = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "operator_identity", "session_auth", "http_security", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "generated_authority", "strict", "result_format"]);
+var TOP_LEVEL_KEYS2 = /* @__PURE__ */ new Set(["version", "mode", "storage", "sources", "trusted_context", "contexts", "executors", "capabilities", "contracts", "policies", "approvals", "proposal_freshness", "operator_identity", "session_auth", "http_security", "rate_limits", "metrics", "graduated_trust", "cloud", "governance", "generated_authority", "strict", "result_format"]);
 var STORAGE_KEYS = /* @__PURE__ */ new Set(["sqlite_path", "shared_postgres"]);
 var SHARED_POSTGRES_STORAGE_KEYS = /* @__PURE__ */ new Set(["mode", "url_env", "schema", "lock_timeout_ms", "max_entries"]);
 var APPROVALS_KEYS = /* @__PURE__ */ new Set(["disable_auto_approval"]);
+var PROPOSAL_FRESHNESS_KEYS = /* @__PURE__ */ new Set(["approval", "dependencies"]);
+var FRESHNESS_DEPENDENCY_KEYS = /* @__PURE__ */ new Set(["id", "capability", "identity_from_arg", "version_column"]);
 var METRICS_KEYS = /* @__PURE__ */ new Set(["enabled", "token_env"]);
 var GRADUATED_TRUST_KEYS = /* @__PURE__ */ new Set(["enabled", "kill_switch", "workspace_id", "project_id", "criteria"]);
 var GRADUATED_TRUST_CRITERION_KEYS = /* @__PURE__ */ new Set([
@@ -2035,6 +2037,7 @@ function validateRunnerCapabilityConfig(input) {
   validateMetrics(input.metrics, strict, errors);
   validateGraduatedTrust(input.graduated_trust, strict, errors);
   validateCapabilities2(input.capabilities, input.sources, input.contexts, input.executors, input.mode, strict, errors, warnings, hasContracts);
+  validateProposalFreshness(input.proposal_freshness, input.capabilities, strict, errors);
   validateEffectiveContextCompatibility(input.trusted_context, input.contexts, input.capabilities, errors);
   validateApprovalPolicyReferences(input.capabilities, input.policies, errors);
   validateWritebackReadiness(input.sources, input.capabilities, input.mode, errors, warnings);
@@ -3122,6 +3125,125 @@ function validateCapabilities2(value, sources, contexts, executors, mode, strict
     capabilityNames.set(capability.name, index);
   });
 }
+function validateProposalFreshness(value, capabilitiesValue, strict, errors) {
+  if (value === void 0) return;
+  if (!isRecord2(value)) {
+    errors.push({
+      path: "$.proposal_freshness",
+      code: "PROPOSAL_FRESHNESS_NOT_OBJECT",
+      message: "proposal_freshness must map reviewed proposal capability names to freshness policy."
+    });
+    return;
+  }
+  const capabilities = Array.isArray(capabilitiesValue) ? capabilitiesValue.filter(isRecord2) : [];
+  const byName = new Map(capabilities.flatMap((capability) => isQualifiedName2(capability.name) ? [[String(capability.name), capability]] : []));
+  for (const [proposalName, rawPolicy] of Object.entries(value)) {
+    const path3 = `$.proposal_freshness.${proposalName}`;
+    if (!isQualifiedName2(proposalName)) {
+      errors.push({ path: path3, code: "INVALID_FRESHNESS_CAPABILITY_NAME", message: "Freshness policy keys must be existing qualified proposal capability names." });
+      continue;
+    }
+    if (!isRecord2(rawPolicy)) {
+      errors.push({ path: path3, code: "FRESHNESS_POLICY_NOT_OBJECT", message: "Freshness policy must be an object." });
+      continue;
+    }
+    if (strict) checkUnknownKeys2(rawPolicy, PROPOSAL_FRESHNESS_KEYS, path3, errors);
+    if (rawPolicy.approval !== "required") {
+      errors.push({ path: `${path3}.approval`, code: "FRESHNESS_APPROVAL_REQUIRED", message: "Freshness-enabled proposals must set approval to required." });
+    }
+    const proposal = byName.get(proposalName);
+    if (!proposal) {
+      errors.push({ path: path3, code: "FRESHNESS_PROPOSAL_UNKNOWN", message: `Freshness policy references unknown proposal capability ${proposalName}.` });
+      continue;
+    }
+    if (proposal.kind !== "proposal") {
+      errors.push({ path: path3, code: "FRESHNESS_PROPOSAL_REQUIRED", message: `${proposalName} must be a proposal capability.` });
+    }
+    const writeback = isRecord2(proposal.writeback) ? proposal.writeback : void 0;
+    if (writeback?.mode !== "direct_sql") {
+      errors.push({
+        path: path3,
+        code: "FRESHNESS_DIRECT_SQL_REQUIRED",
+        message: "Strict proposal freshness currently requires same-database direct_sql writeback; app-owned and cross-source handlers must enforce their own transaction preconditions."
+      });
+    }
+    const operation = isRecord2(proposal.operation) ? proposal.operation : void 0;
+    if ((operation?.kind ?? "update") !== "insert") {
+      const guard = isRecord2(proposal.conflict_guard) ? proposal.conflict_guard : void 0;
+      if (!isSafeIdentifier2(guard?.column)) {
+        errors.push({ path: path3, code: "FRESHNESS_EXACT_TARGET_GUARD_REQUIRED", message: "Freshness-required UPDATE/DELETE needs an exact conflict_guard.column; weak row hashes are not sufficient." });
+      }
+    }
+    if (rawPolicy.dependencies !== void 0 && !Array.isArray(rawPolicy.dependencies)) {
+      errors.push({ path: `${path3}.dependencies`, code: "FRESHNESS_DEPENDENCIES_NOT_ARRAY", message: "dependencies must be an array of reviewed single-row read references." });
+      continue;
+    }
+    const dependencies = Array.isArray(rawPolicy.dependencies) ? rawPolicy.dependencies : [];
+    if (dependencies.length > 16) {
+      errors.push({ path: `${path3}.dependencies`, code: "FRESHNESS_DEPENDENCY_LIMIT", message: "A proposal may declare at most 16 supporting freshness dependencies." });
+    }
+    const ids = /* @__PURE__ */ new Set();
+    for (const [index, rawDependency] of dependencies.entries()) {
+      const dependencyPath = `${path3}.dependencies[${index}]`;
+      if (!isRecord2(rawDependency)) {
+        errors.push({ path: dependencyPath, code: "FRESHNESS_DEPENDENCY_NOT_OBJECT", message: "Freshness dependency must be an object." });
+        continue;
+      }
+      if (strict) checkUnknownKeys2(rawDependency, FRESHNESS_DEPENDENCY_KEYS, dependencyPath, errors);
+      if (!isSafeIdentifier2(rawDependency.id)) {
+        errors.push({ path: `${dependencyPath}.id`, code: "INVALID_FRESHNESS_DEPENDENCY_ID", message: "Dependency id must be a fixed safe identifier." });
+      } else if (ids.has(String(rawDependency.id))) {
+        errors.push({ path: `${dependencyPath}.id`, code: "DUPLICATE_FRESHNESS_DEPENDENCY_ID", message: "Dependency ids must be unique within a proposal." });
+      } else {
+        ids.add(String(rawDependency.id));
+      }
+      if (!isQualifiedName2(rawDependency.capability)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "INVALID_FRESHNESS_DEPENDENCY_CAPABILITY", message: "Dependency capability must be a reviewed qualified capability name." });
+        continue;
+      }
+      const dependency = byName.get(String(rawDependency.capability));
+      if (!dependency) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_UNKNOWN", message: `Unknown supporting capability ${String(rawDependency.capability)}.` });
+        continue;
+      }
+      if (dependency.kind !== "read" || dependency.protected_read !== void 0 || dependency.aggregate !== void 0) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_SINGLE_ROW_READ_REQUIRED", message: "Supporting freshness dependencies must reference reviewed single-row read capabilities." });
+      }
+      if (dependency.name === proposalName) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_CYCLE", message: "A proposal cannot depend on itself." });
+      }
+      if (dependency.source !== proposal.source) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_CROSS_SOURCE_UNSUPPORTED", message: "Strict atomic freshness requires the proposal and supporting dependency to use the same source." });
+      }
+      if ((dependency.context ?? null) !== (proposal.context ?? null)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_CONTEXT_MISMATCH", message: "Supporting freshness dependencies must use the same reviewed trusted context as the proposal." });
+      }
+      const target = isRecord2(dependency.target) ? dependency.target : void 0;
+      if (!isSafeIdentifier2(target?.tenant_key) && target?.single_tenant_dev !== true) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_TENANT_SCOPE_REQUIRED", message: "Supporting dependencies require a trusted tenant key or an existing explicit single-tenant-dev boundary." });
+      }
+      const proposalTarget = isRecord2(proposal.target) ? proposal.target : void 0;
+      if (isSafeIdentifier2(target?.principal_scope_key) && !isSafeIdentifier2(proposalTarget?.principal_scope_key)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_PRINCIPAL_SCOPE_UNAVAILABLE", message: "A principal-scoped dependency cannot introduce a trusted principal value absent from the proposal authority." });
+      }
+      if (!isSafeIdentifier2(rawDependency.identity_from_arg) || !isRecord2(proposal.args) || !(String(rawDependency.identity_from_arg) in proposal.args)) {
+        errors.push({ path: `${dependencyPath}.identity_from_arg`, code: "FRESHNESS_IDENTITY_ARG_UNKNOWN", message: "identity_from_arg must name an existing scalar proposal argument." });
+      } else {
+        const proposalArg = isRecord2(proposal.args[String(rawDependency.identity_from_arg)]) ? proposal.args[String(rawDependency.identity_from_arg)] : void 0;
+        if (!proposalArg || proposalArg.type === "object_array") {
+          errors.push({ path: `${dependencyPath}.identity_from_arg`, code: "FRESHNESS_IDENTITY_ARG_NOT_SCALAR", message: "identity_from_arg must reference one bounded scalar proposal argument." });
+        }
+      }
+      const lookup = isRecord2(dependency.lookup) ? dependency.lookup : void 0;
+      if (!isSafeIdentifier2(lookup?.id_from_arg) || !isRecord2(dependency.args) || !(String(lookup?.id_from_arg) in dependency.args)) {
+        errors.push({ path: `${dependencyPath}.capability`, code: "FRESHNESS_DEPENDENCY_LOOKUP_INVALID", message: "Supporting capability must have one fixed reviewed lookup argument." });
+      }
+      if (!isSafeIdentifier2(rawDependency.version_column)) {
+        errors.push({ path: `${dependencyPath}.version_column`, code: "FRESHNESS_VERSION_COLUMN_REQUIRED", message: "version_column must be an exact fixed safe identifier." });
+      }
+    }
+  }
+}
 function validateCapability(value, index, sourceNames, contextNames, executorNames, strict, errors, warnings) {
   const path3 = `$.capabilities[${index}]`;
   if (!isRecord2(value)) {
@@ -3907,6 +4029,8 @@ var protocolVersions = {
   runnerProposal: "synapsor.runner-proposal.v1",
   runnerActivity: "synapsor.runner-activity.v1",
   principalScope: "synapsor.principal-scope.v1",
+  freshnessAuthority: "synapsor.freshness-authority.v1",
+  freshnessProof: "synapsor.freshness-proof.v1",
   legacyWritebackJob: "1.0",
   normalizedWritebackJobV2: "2.0",
   normalizedWritebackJobV3: "3.0",
@@ -3954,6 +4078,101 @@ var principalScopeGuardSchema = z.object({
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope fingerprint does not match its trusted value", path: ["value_fingerprint"] });
   }
 });
+var freshnessDependencyUnsignedSchema = z.object({
+  id: safeIdentifier,
+  capability: z.string().regex(/^[A-Za-z_][A-Za-z0-9_.-]*\.[A-Za-z_][A-Za-z0-9_.-]*$/, "expected reviewed capability name"),
+  source_id: z.string().min(1).max(160),
+  engine: writebackEngineSchema,
+  target: z.object({
+    schema: safeIdentifier,
+    table: safeIdentifier,
+    primary_key: columnValueSchema,
+    tenant_column: safeIdentifier,
+    principal_column: safeIdentifier.optional()
+  }),
+  expected_version: columnValueSchema,
+  evidence: z.object({
+    bundle_id: z.string().min(1).max(200),
+    query_fingerprint: sha256
+  })
+});
+var freshnessDependencyV1Schema = freshnessDependencyUnsignedSchema.extend({
+  descriptor_digest: sha256
+}).superRefine((dependency, ctx) => {
+  const { descriptor_digest: _digest, ...unsigned } = dependency;
+  if (canonicalJsonDigest(unsigned) !== dependency.descriptor_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency digest mismatch", path: ["descriptor_digest"] });
+  }
+});
+var freshnessAuthorityUnsignedSchema = z.object({
+  schema_version: z.literal(protocolVersions.freshnessAuthority),
+  required: z.literal(true),
+  target: z.object({
+    mode: z.enum(["exact_guard", "frozen_set", "not_applicable"]),
+    member_count: z.number().int().min(0).max(100)
+  }),
+  dependencies: z.array(freshnessDependencyV1Schema).max(16)
+});
+var freshnessAuthorityV1Schema = freshnessAuthorityUnsignedSchema.extend({
+  dependency_set_digest: sha256
+}).superRefine((authority, ctx) => {
+  const identities = authority.dependencies.map((dependency) => dependency.id);
+  if (new Set(identities).size !== identities.length) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency ids must be unique", path: ["dependencies"] });
+  }
+  const sorted = [...authority.dependencies].sort((left, right) => left.source_id.localeCompare(right.source_id) || left.target.schema.localeCompare(right.target.schema) || left.target.table.localeCompare(right.target.table) || JSON.stringify(left.target.primary_key.value).localeCompare(JSON.stringify(right.target.primary_key.value)) || left.id.localeCompare(right.id));
+  if (JSON.stringify(sorted) !== JSON.stringify(authority.dependencies)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependencies must use deterministic lock order", path: ["dependencies"] });
+  }
+  const { dependency_set_digest: _digest, ...unsigned } = authority;
+  if (canonicalJsonDigest(unsigned) !== authority.dependency_set_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness dependency-set digest mismatch", path: ["dependency_set_digest"] });
+  }
+});
+var freshnessCheckStatusSchema = z.enum(["fresh", "stale", "unavailable", "invalid", "unsupported"]);
+var freshnessItemResultSchema = z.object({
+  id: z.string().min(1).max(160),
+  kind: z.enum(["target", "supporting"]),
+  status: z.enum(["fresh", "stale", "not_applicable", "unavailable", "invalid", "unsupported"]),
+  safe_code: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
+  expected_version_digest: sha256.optional(),
+  observed_version_digest: sha256.optional()
+});
+var freshnessProofUnsignedSchema = z.object({
+  schema_version: z.literal(protocolVersions.freshnessProof),
+  proposal_id: z.string().min(1),
+  proposal_hash: sha256,
+  proposal_version: z.number().int().positive(),
+  dependency_set_digest: sha256,
+  checked_at: z.string().datetime(),
+  valid_until: z.string().datetime(),
+  source_adapters: z.array(z.object({
+    source_id: z.string().min(1).max(160),
+    engine: writebackEngineSchema
+  })).min(1).max(8),
+  result: freshnessCheckStatusSchema,
+  safe_code: z.string().regex(/^[A-Z][A-Z0-9_]*$/),
+  target_count: z.number().int().min(0).max(100),
+  supporting_count: z.number().int().min(0).max(16),
+  checks: z.array(freshnessItemResultSchema).max(116)
+});
+var freshnessProofV1Schema = freshnessProofUnsignedSchema.extend({
+  proof_digest: sha256
+}).superRefine((proof, ctx) => {
+  if (Date.parse(proof.valid_until) < Date.parse(proof.checked_at)) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness proof validity ends before it was checked", path: ["valid_until"] });
+  }
+  if (proof.checks.filter((check) => check.kind === "target").length !== proof.target_count) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness target count mismatch", path: ["target_count"] });
+  }
+  if (proof.checks.filter((check) => check.kind === "supporting").length !== proof.supporting_count) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness supporting count mismatch", path: ["supporting_count"] });
+  }
+  const { proof_digest: _digest, ...unsigned } = proof;
+  if (canonicalJsonDigest(unsigned) !== proof.proof_digest) {
+    ctx.addIssue({ code: z.ZodIssueCode.custom, message: "freshness proof digest mismatch", path: ["proof_digest"] });
+  }
+});
 var resolvedDeduplicationComponentSchema = z.object({
   column: safeIdentifier,
   value: scalar,
@@ -4083,6 +4302,7 @@ var changeSetV1Schema = z.object({
     allowed_columns: z.array(z.string().min(1)).min(1),
     expected_version: columnValueSchema
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   evidence: z.object({
     bundle_id: z.string().min(1),
     query_fingerprint: sha256,
@@ -4103,6 +4323,7 @@ var changeSetV1Schema = z.object({
   }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(changeSet.freshness, changeSet.source.source_id, sourceEngine(changeSet.source.kind), "exact_guard", 1, ctx);
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) {
     if (!allowed.has(column)) {
@@ -4170,6 +4391,7 @@ var changeSetV2Schema = z.object({
     version_advance: versionAdvanceSchema.optional(),
     deduplication: z.object({ components: z.array(resolvedDeduplicationComponentSchema).min(1).max(8) }).optional()
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   reversibility: reversibilityRequestSchema.optional(),
   evidence: z.object({
     bundle_id: z.string().min(1),
@@ -4189,6 +4411,14 @@ var changeSetV2Schema = z.object({
   integrity: z.object({ proposal_hash: sha256 }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(
+    changeSet.freshness,
+    changeSet.source.source_id,
+    sourceEngine(changeSet.source.kind),
+    changeSet.operation === "single_row_insert" ? "not_applicable" : "exact_guard",
+    changeSet.operation === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) {
     if (!allowed.has(column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: `patch column not allowed: ${column}`, path: ["patch", column] });
@@ -4255,6 +4485,7 @@ var changeSetV3Schema = z.object({
     expected_version: columnValueSchema.optional(),
     version_advance: versionAdvanceSchema.optional()
   }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   frozen_set: frozenSetSchema,
   reversibility: reversibilityRequestSchema.optional(),
   evidence: z.object({ bundle_id: z.string().min(1), query_fingerprint: sha256, items: z.array(z.unknown()).max(100) }).passthrough(),
@@ -4269,6 +4500,14 @@ var changeSetV3Schema = z.object({
   integrity: z.object({ proposal_hash: sha256 }),
   created_at: z.string().min(1)
 }).superRefine((changeSet, ctx) => {
+  validateFreshnessBinding(
+    changeSet.freshness,
+    changeSet.source.source_id,
+    sourceEngine(changeSet.source.kind),
+    changeSet.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    changeSet.operation === "batch_insert" ? 0 : changeSet.frozen_set.row_count,
+    ctx
+  );
   if (changeSet.source.primary_key.value !== void 0 || changeSet.guards.expected_version) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set guards live on frozen members, not the top-level envelope", path: ["frozen_set"] });
   const allowed = new Set(changeSet.guards.allowed_columns);
   for (const column of Object.keys(changeSet.patch)) if (!allowed.has(column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: `patch column not allowed: ${column}`, path: ["patch", column] });
@@ -4364,6 +4603,7 @@ var writebackJobV1Schema = z.object({
   allowed_columns: z.array(safeIdentifier).min(1),
   patch: scalarMap,
   conflict_guard: publicConflictGuardSchema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   lease: z.object({
     lease_id: z.string().min(1),
@@ -4371,6 +4611,7 @@ var writebackJobV1Schema = z.object({
     expires_at: z.string().min(1)
   })
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(job.freshness, job.runner_scope.source_id, job.engine, "exact_guard", 1, ctx);
   validateAllowedPatchColumns(job.allowed_columns, Object.keys(job.patch), job.target.primary_key.column, job.tenant_guard.column, ctx);
   if (job.principal_scope && job.allowed_columns.includes(job.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
 });
@@ -4392,6 +4633,7 @@ var normalizedWritebackJobV1Schema = writebackJobV1Schema.transform((job) => ({
   allowed_columns: job.allowed_columns,
   patch: job.patch,
   conflict_guard: normalizeConflictGuard(job.conflict_guard),
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   lease_expires_at: job.lease.expires_at,
   attempt_count: job.lease.attempt
@@ -4425,10 +4667,12 @@ var legacyWritebackJobSchema = z.object({
     z.object({ kind: z.literal("row_hash"), expected_hash: z.string().min(1) }),
     z.object({ kind: z.literal("none") })
   ]),
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   lease_expires_at: z.union([z.string(), z.number()]),
   attempt_count: z.number().int().nonnegative().optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(job.freshness, job.source_id, job.engine, "exact_guard", 1, ctx);
   validateAllowedPatchColumns(job.allowed_columns, Object.keys(job.patch), job.target.primary_key.column, job.target.tenant_guard.column, ctx);
   if (job.target.principal_scope && job.allowed_columns.includes(job.target.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
 });
@@ -4455,6 +4699,7 @@ var normalizedWritebackJobV2InputSchema = z.object({
     z.object({ kind: z.literal("row_hash"), expected_hash: z.string().min(1) }),
     z.object({ kind: z.literal("none") })
   ]),
+  freshness: freshnessAuthorityV1Schema.optional(),
   version_advance: versionAdvanceSchema.optional(),
   deduplication: z.object({ components: z.array(resolvedDeduplicationComponentSchema).min(1).max(8) }).optional(),
   idempotency_key: z.string().min(1),
@@ -4462,6 +4707,14 @@ var normalizedWritebackJobV2InputSchema = z.object({
   attempt_count: z.number().int().positive(),
   inverse_capture: inverseDescriptorV1Schema.optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.source_id,
+    job.engine,
+    job.operation === "single_row_insert" ? "not_applicable" : "exact_guard",
+    job.operation === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   if (job.operation !== "single_row_insert" && job.target.primary_key.value === void 0) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "UPDATE and DELETE require a primary-key value", path: ["target", "primary_key", "value"] });
   }
@@ -4527,6 +4780,7 @@ var writebackJobV2Schema = z.object({
   principal_scope: principalScopeGuardSchema.optional(),
   allowed_columns: z.array(safeIdentifier),
   mutation: writebackMutationV2Schema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   inverse_capture: inverseDescriptorV1Schema.optional(),
   lease: z.object({
@@ -4535,6 +4789,14 @@ var writebackJobV2Schema = z.object({
     expires_at: z.string().min(1)
   })
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.runner_scope.source_id,
+    job.engine,
+    job.mutation.kind === "single_row_insert" ? "not_applicable" : "exact_guard",
+    job.mutation.kind === "single_row_insert" ? 0 : 1,
+    ctx
+  );
   const mutation = job.mutation;
   if (mutation.kind !== "single_row_insert" && job.target.primary_key.value === void 0) {
     ctx.addIssue({ code: z.ZodIssueCode.custom, message: "UPDATE and DELETE require a primary-key value", path: ["target", "primary_key", "value"] });
@@ -4573,6 +4835,7 @@ var writebackJobV2Schema = z.object({
   conflict_guard: job.mutation.kind === "single_row_insert" ? { kind: "none" } : normalizeConflictGuard(job.mutation.conflict_guard),
   ...job.mutation.kind === "single_row_update" && job.mutation.version_advance ? { version_advance: job.mutation.version_advance } : {},
   ...job.mutation.kind === "single_row_insert" ? { deduplication: job.mutation.deduplication } : {},
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   ...job.inverse_capture ? { inverse_capture: job.inverse_capture } : {},
   lease_expires_at: job.lease.expires_at,
@@ -4591,6 +4854,7 @@ var normalizedWritebackJobV3InputSchema = z.object({
   allowed_columns: z.array(safeIdentifier).max(256),
   patch: boundedScalarRecord,
   conflict_guard: z.object({ kind: z.literal("none") }).default({ kind: "none" }),
+  freshness: freshnessAuthorityV1Schema.optional(),
   version_advance: versionAdvanceSchema.optional(),
   frozen_set: frozenSetSchema,
   idempotency_key: z.string().min(1),
@@ -4598,6 +4862,14 @@ var normalizedWritebackJobV3InputSchema = z.object({
   attempt_count: z.number().int().positive(),
   inverse_capture: inverseDescriptorV1Schema.optional()
 }).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.source_id,
+    job.engine,
+    job.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    job.operation === "batch_insert" ? 0 : job.frozen_set.row_count,
+    ctx
+  );
   if (job.target.principal_scope && job.allowed_columns.includes(job.target.principal_scope.column)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "principal scope column must not be patch-allowlisted", path: ["allowed_columns"] });
   if (job.operation === "set_delete" && (job.allowed_columns.length || Object.keys(job.patch).length || job.version_advance)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set DELETE cannot carry patch authority", path: ["patch"] });
   if (job.operation === "set_update" && (!Object.keys(job.patch).length || !job.version_advance)) ctx.addIssue({ code: z.ZodIssueCode.custom, message: "set UPDATE requires patch and version advance", path: ["patch"] });
@@ -4619,9 +4891,19 @@ var writebackJobV3Schema = z.object({
   patch: boundedScalarRecord,
   version_advance: versionAdvanceSchema.optional(),
   frozen_set: frozenSetSchema,
+  freshness: freshnessAuthorityV1Schema.optional(),
   idempotency_key: z.string().min(1),
   inverse_capture: inverseDescriptorV1Schema.optional(),
   lease: z.object({ lease_id: z.string().min(1), attempt: z.number().int().positive(), expires_at: z.string().min(1) })
+}).superRefine((job, ctx) => {
+  validateFreshnessBinding(
+    job.freshness,
+    job.runner_scope.source_id,
+    job.engine,
+    job.operation === "batch_insert" ? "not_applicable" : "frozen_set",
+    job.operation === "batch_insert" ? 0 : job.frozen_set.row_count,
+    ctx
+  );
 }).transform((job) => ({
   protocol_version: protocolVersions.normalizedWritebackJobV3,
   job_id: job.writeback_job_id,
@@ -4636,6 +4918,7 @@ var writebackJobV3Schema = z.object({
   conflict_guard: { kind: "none" },
   ...job.version_advance ? { version_advance: job.version_advance } : {},
   frozen_set: job.frozen_set,
+  ...job.freshness ? { freshness: job.freshness } : {},
   idempotency_key: job.idempotency_key,
   ...job.inverse_capture ? { inverse_capture: job.inverse_capture } : {},
   lease_expires_at: job.lease.expires_at,
@@ -4989,6 +5272,38 @@ var runnerActivityV1Schema = z.object({
   detail: z.record(z.unknown()).optional(),
   occurred_at: z.string().min(1).max(80).optional()
 }).strict();
+function sourceEngine(kind) {
+  if (kind === "external_postgres") return "postgres";
+  if (kind === "external_mysql") return "mysql";
+  return void 0;
+}
+function validateFreshnessBinding(freshness, sourceId, engine, expectedTargetMode, expectedMemberCount, ctx) {
+  if (!freshness) return;
+  if (!engine) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "freshness authority requires an external PostgreSQL or MySQL source",
+      path: ["freshness"]
+    });
+    return;
+  }
+  if (freshness.target.mode !== expectedTargetMode || freshness.target.member_count !== expectedMemberCount) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `freshness target authority must be ${expectedTargetMode} with ${expectedMemberCount} reviewed member(s)`,
+      path: ["freshness", "target"]
+    });
+  }
+  for (const [index, dependency] of freshness.dependencies.entries()) {
+    if (dependency.source_id !== sourceId || dependency.engine !== engine) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "freshness dependencies must use the proposal/writeback source and engine",
+        path: ["freshness", "dependencies", index, "source_id"]
+      });
+    }
+  }
+}
 function validateAllowedPatchColumns(allowedColumns, patchColumns, primaryKeyColumn, tenantGuardColumn, ctx) {
   const allow = new Set(allowedColumns);
   for (const column of patchColumns) {
@@ -5049,6 +5364,12 @@ function normalizeConflictGuard(guard) {
 function parseChangeSet(input) {
   return z.union([changeSetV1Schema, changeSetV2Schema, changeSetV3Schema, compensationChangeSetV1Schema]).parse(input);
 }
+function parseFreshnessAuthority(input) {
+  return freshnessAuthorityV1Schema.parse(input);
+}
+function parseFreshnessProof(input) {
+  return freshnessProofV1Schema.parse(input);
+}
 function parseWritebackJob(input) {
   return writebackJobSchema.parse(input);
 }
@@ -5583,6 +5904,15 @@ var PostgresProposalRuntimeStore = class {
   async createProposal(input) {
     return await this.withWrite("createProposal", (store) => store.createProposal(input));
   }
+  async recordFreshnessProof(input) {
+    return await this.withWrite("recordFreshnessProof", (store) => store.recordFreshnessProof(input));
+  }
+  async latestFreshnessProof(proposalId) {
+    return await this.withRead((store) => store.latestFreshnessProof(proposalId));
+  }
+  async recordFreshnessApprovalBlocked(proposalId, input) {
+    await this.withWrite("recordFreshnessApprovalBlocked", (store) => store.recordFreshnessApprovalBlocked(proposalId, input));
+  }
   async approveProposalByPolicy(proposalId, options) {
     return await this.withWrite("approveProposalByPolicy", (store) => store.approveProposalByPolicy(proposalId, options));
   }
@@ -6031,6 +6361,7 @@ var ProposalStore = class {
         decision_hash TEXT,
         signature TEXT,
         integrity_hash TEXT,
+        freshness_proof_digest TEXT,
         created_at TEXT NOT NULL,
         FOREIGN KEY (proposal_id) REFERENCES proposals(proposal_id)
       );
@@ -6304,6 +6635,7 @@ var ProposalStore = class {
     this.ensureColumn("approvals", "decision_hash", "TEXT");
     this.ensureColumn("approvals", "signature", "TEXT");
     this.ensureColumn("approvals", "integrity_hash", "TEXT");
+    this.ensureColumn("approvals", "freshness_proof_digest", "TEXT");
   }
   ensureSearchIndexes() {
     this.db.exec(`
@@ -6594,6 +6926,75 @@ var ProposalStore = class {
     const row = this.db.prepare("SELECT proposal_id FROM query_audit WHERE evidence_bundle_id = ? AND proposal_id IS NOT NULL ORDER BY created_at DESC LIMIT 1").get(evidenceBundleId);
     return isRecord3(row) && row.proposal_id != null ? String(row.proposal_id) : void 0;
   }
+  recordFreshnessProof(input) {
+    const proof = parseFreshnessProof(input);
+    const proposal = this.requireProposal(proof.proposal_id);
+    assertProposalIdentity(proposal, proof.proposal_hash, proof.proposal_version);
+    const authority = proposalFreshnessAuthority(proposal);
+    if (!authority) {
+      throw new ProposalStoreError(
+        "FRESHNESS_NOT_REQUIRED",
+        `proposal ${proof.proposal_id} has no reviewed freshness authority`
+      );
+    }
+    if (proof.dependency_set_digest !== authority.dependency_set_digest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_AUTHORITY_MISMATCH",
+        `freshness proof does not match proposal ${proof.proposal_id}`
+      );
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.transaction(() => {
+      this.appendEvent(proof.proposal_id, "proposal_freshness_checked", "runner", { proof });
+      if (proof.result === "stale") {
+        const current = this.requireProposal(proof.proposal_id);
+        if (current.state === "pending_review" || current.state === "approved" || current.state === "pending_worker") {
+          this.db.prepare("UPDATE proposals SET state = ?, updated_at = ? WHERE proposal_id = ?").run("conflict", now, proof.proposal_id);
+          this.appendEvent(proof.proposal_id, "proposal_conflict", "runner", {
+            reason: "freshness_stale",
+            safe_code: proof.safe_code,
+            proof_digest: proof.proof_digest
+          });
+        }
+      }
+    });
+    return proof;
+  }
+  latestFreshnessProof(proposalId) {
+    this.requireProposal(proposalId);
+    const row = this.db.prepare(`
+      SELECT payload_json
+      FROM proposal_events
+      WHERE proposal_id = ? AND kind = 'proposal_freshness_checked'
+      ORDER BY event_id DESC
+      LIMIT 1
+    `).get(proposalId);
+    if (!isRecord3(row)) return void 0;
+    try {
+      const payload = JSON.parse(String(row.payload_json));
+      return parseFreshnessProof(payload.proof);
+    } catch {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_TAMPERED",
+        `stored freshness proof for proposal ${proposalId} failed integrity validation`
+      );
+    }
+  }
+  recordFreshnessApprovalBlocked(proposalId, input) {
+    this.requireProposal(proposalId);
+    const proof = this.latestFreshnessProof(proposalId);
+    if (!proof || proof.proof_digest !== input.proof_digest || proof.result === "fresh") {
+      throw new ProposalStoreError(
+        "FRESHNESS_BLOCK_RECORD_INVALID",
+        `freshness block for proposal ${proposalId} does not match its latest non-fresh proof`
+      );
+    }
+    this.appendEvent(proposalId, "proposal_approval_blocked_freshness", input.actor, {
+      proof_digest: proof.proof_digest,
+      safe_code: input.safe_code,
+      result: proof.result
+    });
+  }
   approveProposal(proposalId, options) {
     const proposal = this.requireProposal(proposalId);
     assertWritebackAllowed(proposal, "approved");
@@ -6614,11 +7015,12 @@ var ProposalStore = class {
       if (isRecord3(existing)) {
         throw new ProposalStoreError("APPROVER_ALREADY_COUNTED", `operator ${options.approver} already recorded a decision for proposal ${proposalId}`);
       }
+      this.assertApprovalFreshness(current, options.freshness_proof_digest, now);
       this.db.prepare(`
         INSERT INTO approvals (
           proposal_id, proposal_version, proposal_hash, approver, status, reason,
-          identity_json, decision_hash, signature, integrity_hash, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+          identity_json, decision_hash, signature, integrity_hash, freshness_proof_digest, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       `).run(
         proposalId,
         options.proposal_version,
@@ -6630,6 +7032,7 @@ var ProposalStore = class {
         options.identity?.decision_hash ?? null,
         options.identity?.signature ?? null,
         options.identity?.integrity_hash ?? null,
+        options.freshness_proof_digest ?? null,
         now
       );
       const progress = this.approvalProgress(proposalId);
@@ -6642,6 +7045,7 @@ var ProposalStore = class {
         proposal_version: options.proposal_version,
         reason: options.reason ?? null,
         identity: publicIdentitySummary(options.identity),
+        freshness_proof_digest: options.freshness_proof_digest ?? null,
         approvals: progress.approved,
         required_approvals: progress.required,
         remaining_approvals: progress.remaining
@@ -6750,17 +7154,31 @@ var ProposalStore = class {
         });
         return;
       }
+      this.assertApprovalFreshness(proposal, options.freshness_proof_digest, now);
       this.db.prepare("UPDATE proposals SET state = ?, updated_at = ? WHERE proposal_id = ?").run("approved", now, proposalId);
       this.db.prepare(`
-        INSERT INTO approvals (proposal_id, proposal_version, proposal_hash, approver, status, reason, created_at)
-        VALUES (?, ?, ?, ?, ?, ?, ?)
-      `).run(proposalId, options.proposal_version, options.proposal_hash, actor, "approved", options.reason, now);
+        INSERT INTO approvals (
+          proposal_id, proposal_version, proposal_hash, approver, status, reason,
+          freshness_proof_digest, created_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      `).run(
+        proposalId,
+        options.proposal_version,
+        options.proposal_hash,
+        actor,
+        "approved",
+        options.reason,
+        options.freshness_proof_digest ?? null,
+        now
+      );
       this.appendEvent(proposalId, "proposal_approved", actor, {
         proposal_hash: options.proposal_hash,
         proposal_version: options.proposal_version,
         reason: options.reason,
         policy: options.policy,
-        aggregate_limits: options.limits ?? []
+        aggregate_limits: options.limits ?? [],
+        freshness_proof_digest: options.freshness_proof_digest ?? null
       });
     });
     return {
@@ -7108,7 +7526,8 @@ var ProposalStore = class {
       writeback_job_id: receipt.writeback_job_id,
       rows_affected: receipt.rows_affected,
       source_database_mutated: receipt.source_database_mutated,
-      receipt_hash: receipt.receipt_hash
+      receipt_hash: receipt.receipt_hash,
+      safe_error_code: "safe_error_code" in receipt ? receipt.safe_error_code ?? null : null
     });
   }
   recordHandlerWritebackJob(input) {
@@ -7192,6 +7611,7 @@ var ProposalStore = class {
       tenant_guard: changeSet.guards.tenant,
       ...changeSet.guards.principal_scope ? { principal_scope: changeSet.guards.principal_scope } : {},
       allowed_columns: changeSet.guards.allowed_columns,
+      ..."freshness" in changeSet && changeSet.freshness ? { freshness: parseFreshnessAuthority(changeSet.freshness) } : {},
       idempotency_key: `${proposal.proposal_id}:${proposal.object_id}`,
       lease
     };
@@ -7645,7 +8065,21 @@ var ProposalStore = class {
       const key = `${tenantId}\0${capability}`;
       let row = rows.get(key);
       if (!row) {
-        row = { tenant_id: tenantId, capability, worker_retries: 0, dead_letters: 0, auto_approval_limit_trips: 0 };
+        row = {
+          tenant_id: tenantId,
+          capability,
+          worker_retries: 0,
+          dead_letters: 0,
+          auto_approval_limit_trips: 0,
+          freshness_checks: 0,
+          freshness_fresh: 0,
+          freshness_stale_target: 0,
+          freshness_stale_supporting: 0,
+          freshness_unavailable: 0,
+          freshness_unsupported: 0,
+          freshness_approval_blocked: 0,
+          freshness_apply_blocked: 0
+        };
         rows.set(key, row);
       }
       return row;
@@ -7653,7 +8087,14 @@ var ProposalStore = class {
     const events = this.db.prepare(`
       SELECT p.tenant_id, p.action, e.kind, e.payload_json
       FROM proposal_events e JOIN proposals p ON p.proposal_id = e.proposal_id
-      WHERE e.kind IN ('writeback_retry_scheduled', 'writeback_dead_lettered', 'policy_auto_approval_deferred')
+      WHERE e.kind IN (
+        'writeback_retry_scheduled',
+        'writeback_dead_lettered',
+        'policy_auto_approval_deferred',
+        'proposal_freshness_checked',
+        'proposal_approval_blocked_freshness',
+        'writeback_conflict'
+      )
         AND (? IS NULL OR p.tenant_id = ?)
         AND (? IS NULL OR p.action = ?)
     `).all(filters.tenant ?? null, filters.tenant ?? null, filters.capability ?? null, filters.capability ?? null);
@@ -7662,13 +8103,29 @@ var ProposalStore = class {
       const row = ensure(String(raw.tenant_id), String(raw.action));
       if (raw.kind === "writeback_retry_scheduled") row.worker_retries += 1;
       if (raw.kind === "writeback_dead_lettered") row.dead_letters += 1;
-      if (raw.kind === "policy_auto_approval_deferred") {
-        try {
-          const payload = JSON.parse(String(raw.payload_json));
-          if (Array.isArray(payload.tripped_limits) && payload.tripped_limits.length > 0) row.auto_approval_limit_trips += 1;
-        } catch {
+      let payload = {};
+      try {
+        const parsed = JSON.parse(String(raw.payload_json));
+        if (isRecord3(parsed)) payload = parsed;
+      } catch {
+      }
+      if (raw.kind === "proposal_freshness_checked") {
+        row.freshness_checks += 1;
+        const proof = isRecord3(payload.proof) ? payload.proof : {};
+        if (proof.result === "fresh") row.freshness_fresh += 1;
+        if (proof.result === "unavailable") row.freshness_unavailable += 1;
+        if (proof.result === "unsupported") row.freshness_unsupported += 1;
+        if (proof.result === "stale") {
+          const checks = Array.isArray(proof.checks) ? proof.checks.filter(isRecord3) : [];
+          if (checks.some((check) => check.kind === "target" && check.status === "stale")) row.freshness_stale_target += 1;
+          if (checks.some((check) => check.kind === "supporting" && check.status === "stale")) row.freshness_stale_supporting += 1;
         }
       }
+      if (raw.kind === "proposal_approval_blocked_freshness") row.freshness_approval_blocked += 1;
+      if (raw.kind === "writeback_conflict" && /^FRESHNESS_/.test(String(payload.safe_error_code ?? ""))) row.freshness_apply_blocked += 1;
+      if (raw.kind === "policy_auto_approval_deferred") {
+        if (Array.isArray(payload.tripped_limits) && payload.tripped_limits.length > 0) row.auto_approval_limit_trips += 1;
+      }
     }
     return [...rows.values()].sort((left, right) => left.tenant_id.localeCompare(right.tenant_id) || left.capability.localeCompare(right.capability));
   }
@@ -8516,6 +8973,61 @@ var ProposalStore = class {
     }
     return proposal;
   }
+  assertApprovalFreshness(proposal, proofDigest, now) {
+    const authority = proposalFreshnessAuthority(proposal);
+    if (!authority) {
+      if (proofDigest !== void 0) {
+        throw new ProposalStoreError(
+          "FRESHNESS_PROOF_UNEXPECTED",
+          `proposal ${proposal.proposal_id} does not require a freshness proof`
+        );
+      }
+      return;
+    }
+    if (!proofDigest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_REQUIRED",
+        `proposal ${proposal.proposal_id} requires a fresh live proof before approval`
+      );
+    }
+    const proof = this.latestFreshnessProof(proposal.proposal_id);
+    if (!proof || proof.proof_digest !== proofDigest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_MISSING",
+        `the latest freshness proof for proposal ${proposal.proposal_id} was not supplied`
+      );
+    }
+    if (proof.proposal_hash !== proposal.proposal_hash || proof.proposal_version !== proposal.proposal_version || proof.dependency_set_digest !== authority.dependency_set_digest) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_AUTHORITY_MISMATCH",
+        `freshness proof does not match proposal ${proposal.proposal_id}`
+      );
+    }
+    if (proof.result !== "fresh") {
+      throw new ProposalStoreError(
+        proof.result === "stale" ? "FRESHNESS_STALE" : "FRESHNESS_NOT_VERIFIED",
+        `proposal ${proposal.proposal_id} freshness result is ${proof.result}`
+      );
+    }
+    if (Date.parse(proof.valid_until) < Date.parse(now)) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_EXPIRED",
+        `freshness proof for proposal ${proposal.proposal_id} has expired`
+      );
+    }
+    const used = this.db.prepare(`
+      SELECT approval_id
+      FROM approvals
+      WHERE proposal_id = ? AND freshness_proof_digest = ?
+      LIMIT 1
+    `).get(proposal.proposal_id, proofDigest);
+    if (isRecord3(used)) {
+      throw new ProposalStoreError(
+        "FRESHNESS_PROOF_ALREADY_USED",
+        `freshness proof for proposal ${proposal.proposal_id} already authorized a reviewer decision`
+      );
+    }
+  }
   setState(proposalId, state, actor, payload) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.transaction(() => {
@@ -8676,6 +9188,17 @@ function stateFromChangeSet(changeSet) {
   if (changeSet.approval.status === "canceled") return "canceled";
   return "pending_review";
 }
+function proposalFreshnessAuthority(proposal) {
+  if (!("freshness" in proposal.change_set) || proposal.change_set.freshness === void 0) return void 0;
+  try {
+    return parseFreshnessAuthority(proposal.change_set.freshness);
+  } catch {
+    throw new ProposalStoreError(
+      "FRESHNESS_AUTHORITY_TAMPERED",
+      `stored freshness authority for proposal ${proposal.proposal_id} failed integrity validation`
+    );
+  }
+}
 function requiredApprovalCount(proposal) {
   const configured = proposal.change_set.approval.required_approvals;
   return typeof configured === "number" && Number.isSafeInteger(configured) && configured >= 1 ? configured : 1;
@@ -9202,6 +9725,7 @@ function rowToApproval(row) {
     decision_hash: row.decision_hash == null ? void 0 : String(row.decision_hash),
     signature: row.signature == null ? void 0 : String(row.signature),
     integrity_hash: row.integrity_hash == null ? void 0 : String(row.integrity_hash),
+    freshness_proof_digest: row.freshness_proof_digest == null ? void 0 : String(row.freshness_proof_digest),
     created_at: String(row.created_at)
   };
 }
@@ -9578,7 +10102,7 @@ var sharedLedgerRestoreSpecs = {
     "updated_at"
   ], ["proposal_id", "proposal_version", "proposal_hash", "action", "state", "tenant_id", "business_object", "object_id", "source_kind", "source_id", "source_schema", "source_table", "source_database_mutated", "change_set_json", "created_at", "updated_at"]),
   proposal_events: restoreSpec("event_id", ["event_id", "proposal_id", "kind", "actor", "payload_json", "created_at"], ["event_id", "proposal_id", "kind", "actor", "payload_json", "created_at"]),
-  approvals: restoreSpec("approval_id", ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "reason", "identity_json", "decision_hash", "signature", "integrity_hash", "created_at"], ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "created_at"]),
+  approvals: restoreSpec("approval_id", ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "reason", "identity_json", "decision_hash", "signature", "integrity_hash", "freshness_proof_digest", "created_at"], ["approval_id", "proposal_id", "proposal_version", "proposal_hash", "approver", "status", "created_at"]),
   writeback_jobs: restoreSpec("writeback_job_id", ["writeback_job_id", "proposal_id", "proposal_hash", "status", "job_json", "created_at", "updated_at"], ["writeback_job_id", "proposal_id", "proposal_hash", "status", "job_json", "created_at", "updated_at"]),
   writeback_intents: restoreSpec("intent_id", ["intent_id", "idempotency_key", "writeback_job_id", "proposal_id", "proposal_hash", "runner_id", "operation", "status", "intent_json", "result_json", "reconciliation_reason", "created_at", "updated_at"], ["intent_id", "idempotency_key", "writeback_job_id", "proposal_id", "proposal_hash", "runner_id", "operation", "status", "intent_json", "created_at", "updated_at"]),
   idempotency_receipts: restoreSpec("idempotency_key", ["idempotency_key", "writeback_job_id", "proposal_id", "receipt_status", "receipt_json", "created_at"], ["idempotency_key", "writeback_job_id", "proposal_id", "receipt_status", "receipt_json", "created_at"]),
@@ -15224,6 +15748,18 @@ async function callConfiguredTool(input) {
     at: createdAt
   });
   const queryFingerprint = queryFingerprintFor(capability, context);
+  const freshnessCapture = capability.kind === "proposal" ? await captureProposalFreshnessAuthority({
+    config: input.config,
+    capability,
+    args: input.args,
+    context,
+    source,
+    readRow: input.readRow,
+    env: input.env,
+    proposalId,
+    createdAt,
+    targetMemberCount: operation === "insert" ? 0 : setOperation ? currentRows.length : 1
+  }) : void 0;
   const changeSet = capability.kind === "proposal" ? buildChangeSet({
     config: input.config,
     capability,
@@ -15241,7 +15777,8 @@ async function callConfiguredTool(input) {
     resolvedDeduplication,
     evidenceBundleId,
     queryFingerprint,
-    objectId
+    objectId,
+    freshness: freshnessCapture?.authority
   }) : void 0;
   await input.store.recordEvidenceBundle({
     evidence_bundle_id: evidenceBundleId,
@@ -15286,6 +15823,48 @@ async function callConfiguredTool(input) {
       }
     });
   }
+  for (const supporting of freshnessCapture?.evidence ?? []) {
+    await input.store.recordEvidenceBundle({
+      evidence_bundle_id: supporting.bundle_id,
+      tenant_id: context.tenant_id,
+      capability: supporting.capability.name,
+      source_id: supporting.capability.source,
+      source_table: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+      business_object: supporting.capability.target.table,
+      object_id: String(supporting.primary_key.value),
+      query_fingerprint: supporting.query_fingerprint,
+      payload: {
+        kind: "freshness_dependency",
+        dependency_id: supporting.dependency_id,
+        capability: supporting.capability.name,
+        source_id: supporting.capability.source,
+        target: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+        parameters_redacted: true,
+        source_database_changed: false
+      },
+      items: []
+    });
+    await input.store.recordQueryAudit({
+      evidence_bundle_id: supporting.bundle_id,
+      capability: supporting.capability.name,
+      source_id: supporting.capability.source,
+      query_fingerprint: supporting.query_fingerprint,
+      table_name: `${supporting.capability.target.schema}.${supporting.capability.target.table}`,
+      business_object: supporting.capability.target.table,
+      object_id: String(supporting.primary_key.value),
+      primary_key_value: String(supporting.primary_key.value),
+      row_count: 1,
+      payload: {
+        kind: "freshness_dependency",
+        dependency_id: supporting.dependency_id,
+        capability: supporting.capability.name,
+        columns: [supporting.version_column],
+        parameters_redacted: true,
+        tenant_bound: Boolean(supporting.capability.target.tenant_key),
+        principal_bound: Boolean(supporting.capability.target.principal_scope_key)
+      }
+    });
+  }
   if (capability.kind === "read") {
     return {
       status: "ok",
@@ -15335,7 +15914,9 @@ async function callConfiguredTool(input) {
     capability,
     store: input.store,
     proposal,
-    patch: changeSet.patch
+    patch: changeSet.patch,
+    env: input.env,
+    readRow: input.readRow
   });
   await input.store.recordEvidenceBundle({
     evidence_bundle_id: evidenceBundleId,
@@ -15383,7 +15964,7 @@ async function callConfiguredTool(input) {
     env: input.env
   });
   return {
-    status: input.config.governance?.mode === "cloud_linked" ? "pending_cloud_sync" : input.config.mode === "shadow" ? "shadow_proposal_created" : approvalResult.proposal.state === "approved" ? "approved" : "review_required",
+    status: input.config.governance?.mode === "cloud_linked" ? "pending_cloud_sync" : input.config.mode === "shadow" ? "shadow_proposal_created" : approvalResult.freshness?.status === "stale" ? "freshness_conflict" : approvalResult.proposal.state === "approved" ? "approved" : "review_required",
     action: capability.name,
     proposal_id: approvalResult.proposal.proposal_id,
     proposal_version: approvalResult.proposal.proposal_version,
@@ -15408,6 +15989,7 @@ async function callConfiguredTool(input) {
       } : {}
     },
     approval_required: approvalResult.proposal.state === "pending_review",
+    ...approvalResult.freshness ? { freshness: approvalResult.freshness } : {},
     governance: input.config.governance?.mode === "cloud_linked" ? { authority: "synapsor_cloud", state: "pending_cloud_sync", evidence_residency: "metadata_only" } : { authority: "local" },
     writeback: changeSet.writeback,
     source_database_changed: false,
@@ -15890,18 +16472,52 @@ async function maybeAutoApproveProposal(input) {
   if (!policy) throw new McpRuntimeError("APPROVAL_POLICY_UNRESOLVED", `capability ${input.capability.name} references missing approval policy ${policyName}.`);
   const evaluation = evaluateApprovalPolicy(input.capability, policy, input.patch);
   if (!evaluation.qualifies) return { proposal: input.proposal, approved: false, policy: policyName };
+  let freshnessProofDigest;
+  const freshness = await evaluateProposalFreshness({
+    config: input.config,
+    proposal: input.proposal,
+    env: input.env,
+    readRow: input.readRow
+  });
+  if (freshness.required) {
+    await input.store.recordFreshnessProof(freshness.proof);
+    if (freshness.status !== "fresh") {
+      await input.store.recordFreshnessApprovalBlocked(input.proposal.proposal_id, {
+        proof_digest: freshness.proof.proof_digest,
+        safe_code: freshness.safe_code,
+        actor: `policy:${policyName}`
+      });
+      return {
+        proposal: await input.store.getProposal(input.proposal.proposal_id) ?? input.proposal,
+        approved: false,
+        policy: policyName,
+        freshness: {
+          status: freshness.status,
+          safe_code: freshness.safe_code
+        }
+      };
+    }
+    freshnessProofDigest = freshness.proof.proof_digest;
+  }
   const decision = await input.store.approveProposalByPolicy(input.proposal.proposal_id, {
     policy: policyName,
     proposal_hash: input.proposal.proposal_hash,
     proposal_version: input.proposal.proposal_version,
     reason: `auto-approved by policy ${policyName}: ${evaluation.reason}`,
-    limits: policy.limits
+    limits: policy.limits,
+    freshness_proof_digest: freshnessProofDigest
   });
   return {
     proposal: decision.proposal,
     approved: decision.approved,
     policy: policyName,
-    tripped_limits: decision.tripped_limits
+    tripped_limits: decision.tripped_limits,
+    ...freshness.required ? {
+      freshness: {
+        status: freshness.status,
+        safe_code: freshness.safe_code
+      }
+    } : {}
   };
 }
 function approvalPolicyByName(config, policyName) {
@@ -16169,6 +16785,372 @@ function errorMessage(error) {
   if (isRecord5(error) && typeof error.message === "string") return error.message;
   return typeof error === "string" ? error : "";
 }
+async function captureProposalFreshnessAuthority(input) {
+  const policy = input.config.proposal_freshness?.[input.capability.name];
+  if (!policy) return void 0;
+  const operation = input.capability.operation?.kind ?? "update";
+  const targetMode = operation === "insert" ? "not_applicable" : isSetCapability(input.capability) ? "frozen_set" : "exact_guard";
+  const captured = [];
+  for (const configured of policy.dependencies ?? []) {
+    const capability = (input.config.capabilities ?? []).find((item) => item.name === configured.capability);
+    if (!capability || capability.kind !== "read") {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_INVALID", `Reviewed freshness dependency ${configured.id} is unavailable.`);
+    }
+    const identity = scalar2(input.args[configured.identity_from_arg]);
+    if (identity === null) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_IDENTITY_MISSING", `Freshness dependency ${configured.id} requires its reviewed scalar identity.`);
+    }
+    const readCapability = {
+      ...capability,
+      conflict_guard: { column: configured.version_column }
+    };
+    const current = await input.readRow({
+      sourceName: capability.source,
+      source: input.source,
+      capability: readCapability,
+      args: { [capability.lookup.id_from_arg]: identity },
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    if (current.rowCount !== 1) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_UNRESOLVED", `Freshness dependency ${configured.id} did not resolve to one authorized row.`);
+    }
+    const primaryValue = scalar2(current.row[capability.target.primary_key]);
+    const versionValue = scalar2(current.row[configured.version_column]);
+    if (primaryValue === null || versionValue === null) {
+      throw new McpRuntimeError("FRESHNESS_DEPENDENCY_VERSION_MISSING", `Freshness dependency ${configured.id} lacks an exact primary-key or version value.`);
+    }
+    const bundleId = stableId("evf", {
+      proposal_id: input.proposalId,
+      dependency_id: configured.id,
+      primary_key: primaryValue,
+      created_at: input.createdAt
+    });
+    const queryFingerprint = queryFingerprintFor(readCapability, input.context);
+    const unsigned2 = {
+      id: configured.id,
+      capability: configured.capability,
+      source_id: capability.source,
+      engine: input.source.engine,
+      target: {
+        schema: capability.target.schema,
+        table: capability.target.table,
+        primary_key: { column: capability.target.primary_key, value: primaryValue },
+        tenant_column: capability.target.tenant_key ?? "__single_tenant_dev",
+        ...capability.target.principal_scope_key ? { principal_column: capability.target.principal_scope_key } : {}
+      },
+      expected_version: { column: configured.version_column, value: conflictGuardScalar(versionValue) },
+      evidence: {
+        bundle_id: bundleId,
+        query_fingerprint: queryFingerprint
+      }
+    };
+    const descriptor = {
+      ...unsigned2,
+      descriptor_digest: canonicalJsonDigest(unsigned2)
+    };
+    captured.push({
+      descriptor,
+      evidence: {
+        dependency_id: configured.id,
+        bundle_id: bundleId,
+        query_fingerprint: queryFingerprint,
+        capability,
+        primary_key: descriptor.target.primary_key,
+        version_column: configured.version_column
+      }
+    });
+  }
+  captured.sort((left, right) => left.descriptor.source_id.localeCompare(right.descriptor.source_id) || left.descriptor.target.schema.localeCompare(right.descriptor.target.schema) || left.descriptor.target.table.localeCompare(right.descriptor.target.table) || JSON.stringify(left.descriptor.target.primary_key.value).localeCompare(JSON.stringify(right.descriptor.target.primary_key.value)) || left.descriptor.id.localeCompare(right.descriptor.id));
+  const unsigned = {
+    schema_version: protocolVersions.freshnessAuthority,
+    required: true,
+    target: { mode: targetMode, member_count: input.targetMemberCount },
+    dependencies: captured.map((item) => item.descriptor)
+  };
+  const authority = parseFreshnessAuthority({
+    ...unsigned,
+    dependency_set_digest: canonicalJsonDigest(unsigned)
+  });
+  return {
+    authority,
+    evidence: captured.map((item) => item.evidence)
+  };
+}
+async function evaluateProposalFreshness(input) {
+  const config = resolveRuntimeConfig(input.config);
+  assertValidRunnerCapabilityConfig(config);
+  const authority = freshnessAuthorityFromChangeSet(input.proposal.change_set);
+  if (!authority) {
+    return {
+      required: false,
+      status: "not_required",
+      safe_code: "FRESHNESS_NOT_REQUIRED",
+      target_count: 0,
+      supporting_count: 0
+    };
+  }
+  const env = input.env ?? process.env;
+  const resources = createMcpRuntimeSharedResources(config, env, input.readRow, input.clock, input.credentialResolver);
+  const checkedAtMs = (input.clock ?? Date.now)();
+  const checks = [];
+  let forcedResult;
+  let forcedCode;
+  try {
+    const capability = (config.capabilities ?? []).find((item) => item.name === input.proposal.action);
+    const source = capability ? config.sources?.[capability.source] : void 0;
+    if (!capability || capability.kind !== "proposal" || !source) {
+      forcedResult = "invalid";
+      forcedCode = "FRESHNESS_PROPOSAL_AUTHORITY_INVALID";
+    } else if (!proposalAuthorityMatchesCapability(input.proposal, capability)) {
+      forcedResult = "invalid";
+      forcedCode = "FRESHNESS_PROPOSAL_AUTHORITY_MISMATCH";
+    } else {
+      const context = proposalTrustedContext(config, capability, input.proposal);
+      const targetChecks = await evaluateTargetFreshness({
+        proposal: input.proposal,
+        authority,
+        capability,
+        source,
+        context,
+        env,
+        readRow: resources.readRow
+      });
+      checks.push(...targetChecks);
+      for (const dependency of authority.dependencies) {
+        const validationCode = validateResolvedFreshnessDependency(config, capability, dependency);
+        if (validationCode) {
+          checks.push({
+            id: dependency.id,
+            kind: "supporting",
+            status: "invalid",
+            safe_code: validationCode
+          });
+          continue;
+        }
+        const supporting = (config.capabilities ?? []).find((item) => item.name === dependency.capability);
+        checks.push(await evaluateSupportingFreshness({
+          dependency,
+          capability: supporting,
+          source,
+          context,
+          env,
+          readRow: resources.readRow
+        }));
+      }
+    }
+  } catch (error) {
+    const classified = classifyFreshnessReadError(error);
+    forcedResult = classified.result;
+    forcedCode = classified.safe_code;
+  } finally {
+    await resources.close();
+  }
+  const status = forcedResult ?? freshnessResultForChecks(checks);
+  const safeCode = forcedCode ?? freshnessSafeCode(status, checks);
+  const targetCount = checks.filter((check) => check.kind === "target").length;
+  const supportingCount = checks.filter((check) => check.kind === "supporting").length;
+  const adapters = freshnessSourceAdapters(input.proposal, authority);
+  const unsigned = {
+    schema_version: protocolVersions.freshnessProof,
+    proposal_id: input.proposal.proposal_id,
+    proposal_hash: input.proposal.proposal_hash,
+    proposal_version: input.proposal.proposal_version,
+    dependency_set_digest: authority.dependency_set_digest,
+    checked_at: new Date(checkedAtMs).toISOString(),
+    valid_until: new Date(checkedAtMs + Math.max(1e3, Math.min(input.proofValidityMs ?? 3e4, 3e5))).toISOString(),
+    source_adapters: adapters,
+    result: status,
+    safe_code: safeCode,
+    target_count: targetCount,
+    supporting_count: supportingCount,
+    checks
+  };
+  const proof = parseFreshnessProof({
+    ...unsigned,
+    proof_digest: canonicalJsonDigest(unsigned)
+  });
+  return {
+    required: true,
+    status,
+    safe_code: safeCode,
+    target_count: targetCount,
+    supporting_count: supportingCount,
+    proof
+  };
+}
+function freshnessAuthorityFromChangeSet(changeSet) {
+  if (!("freshness" in changeSet) || changeSet.freshness === void 0) return void 0;
+  return parseFreshnessAuthority(changeSet.freshness);
+}
+function proposalAuthorityMatchesCapability(proposal, capability) {
+  const changeSet = proposal.change_set;
+  if (proposal.proposal_hash !== changeSet.integrity.proposal_hash || proposal.proposal_version !== changeSet.proposal_version) return false;
+  if (changeSet.source.source_id !== capability.source || changeSet.source.schema !== capability.target.schema || changeSet.source.table !== capability.target.table || changeSet.source.primary_key.column !== capability.target.primary_key) return false;
+  if (changeSet.contract && (!capability.contract_provenance || changeSet.contract.digest !== capability.contract_provenance.digest || changeSet.contract.version !== capability.contract_provenance.version)) return false;
+  return true;
+}
+function proposalTrustedContext(config, capability, proposal) {
+  const contextConfig = (capability.context ? config.contexts?.[capability.context] : void 0) ?? config.trusted_context;
+  const provider = contextConfig?.provider ?? (proposal.change_set.principal.source === "cloud_session" ? "cloud_session" : "environment");
+  return {
+    tenant_id: proposal.tenant_id,
+    principal: proposal.principal ?? proposal.change_set.principal.id,
+    provenance: provider
+  };
+}
+async function evaluateTargetFreshness(input) {
+  if (input.authority.target.mode === "not_applicable") return [];
+  if (input.authority.target.mode === "frozen_set") {
+    const changeSet2 = input.proposal.change_set;
+    if (changeSet2.schema_version !== protocolVersions.changeSetV3) {
+      return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_TARGET_SET_INVALID" }];
+    }
+    const current2 = await input.readRow({
+      sourceName: input.capability.source,
+      source: input.source,
+      capability: input.capability,
+      args: {},
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    const rows = current2.rows ?? (current2.rowCount === 1 ? [current2.row] : []);
+    const byIdentity = new Map(rows.map((row) => [JSON.stringify(scalar2(row[input.capability.target.primary_key])), row]));
+    return changeSet2.frozen_set.members.map((member) => {
+      const expected2 = member.expected_version;
+      const row = byIdentity.get(JSON.stringify(member.primary_key.value));
+      const observed2 = expected2 && row ? conflictGuardScalar(scalar2(row[expected2.column])) : void 0;
+      const fresh2 = Boolean(expected2 && row && versionsEqual(observed2, expected2.value));
+      return {
+        id: `target:${canonicalJsonDigest(member.primary_key).slice(7, 23)}`,
+        kind: "target",
+        status: fresh2 ? "fresh" : "stale",
+        safe_code: fresh2 ? "FRESHNESS_TARGET_FRESH" : "FRESHNESS_TARGET_STALE",
+        ...expected2 ? { expected_version_digest: versionMetadataDigest(expected2.column, expected2.value) } : {},
+        ...expected2 && observed2 !== void 0 ? { observed_version_digest: versionMetadataDigest(expected2.column, observed2) } : {}
+      };
+    });
+  }
+  const changeSet = input.proposal.change_set;
+  if (changeSet.schema_version === protocolVersions.changeSetV3 || changeSet.schema_version === protocolVersions.compensationChangeSet) {
+    return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_TARGET_AUTHORITY_INVALID" }];
+  }
+  const expected = changeSet.guards.expected_version;
+  if (!expected || expected.column === "__row_hash" || changeSet.source.primary_key.value === void 0) {
+    return [{ id: "target", kind: "target", status: "invalid", safe_code: "FRESHNESS_EXACT_TARGET_GUARD_REQUIRED" }];
+  }
+  const readCapability = {
+    ...input.capability,
+    conflict_guard: { column: expected.column }
+  };
+  const current = await input.readRow({
+    sourceName: input.capability.source,
+    source: input.source,
+    capability: readCapability,
+    args: { [input.capability.lookup.id_from_arg]: changeSet.source.primary_key.value },
+    context: input.context,
+    env: input.env,
+    transaction_mode: "read_only"
+  });
+  const observed = current.rowCount === 1 ? conflictGuardScalar(scalar2(current.row[expected.column])) : void 0;
+  const fresh = current.rowCount === 1 && observed !== void 0 && versionsEqual(observed, expected.value);
+  return [{
+    id: "target",
+    kind: "target",
+    status: fresh ? "fresh" : "stale",
+    safe_code: fresh ? "FRESHNESS_TARGET_FRESH" : "FRESHNESS_TARGET_STALE",
+    expected_version_digest: versionMetadataDigest(expected.column, expected.value),
+    ...observed !== void 0 ? { observed_version_digest: versionMetadataDigest(expected.column, observed) } : {}
+  }];
+}
+function validateResolvedFreshnessDependency(config, proposalCapability, dependency) {
+  const policy = config.proposal_freshness?.[proposalCapability.name];
+  const declared = policy?.dependencies?.find((item) => item.id === dependency.id);
+  const capability = (config.capabilities ?? []).find((item) => item.name === dependency.capability);
+  const source = config.sources?.[dependency.source_id];
+  if (!declared || declared.capability !== dependency.capability || declared.version_column !== dependency.expected_version.column) return "FRESHNESS_DEPENDENCY_AUTHORITY_MISMATCH";
+  if (!capability || capability.kind !== "read" || !source) return "FRESHNESS_DEPENDENCY_AUTHORITY_INVALID";
+  if (capability.source !== proposalCapability.source || dependency.source_id !== capability.source || dependency.engine !== source.engine) return "FRESHNESS_CROSS_SOURCE_UNSUPPORTED";
+  if (capability.target.schema !== dependency.target.schema || capability.target.table !== dependency.target.table || capability.target.primary_key !== dependency.target.primary_key.column || (capability.target.tenant_key ?? "__single_tenant_dev") !== dependency.target.tenant_column || capability.target.principal_scope_key !== dependency.target.principal_column) return "FRESHNESS_DEPENDENCY_TARGET_MISMATCH";
+  return void 0;
+}
+async function evaluateSupportingFreshness(input) {
+  const readCapability = {
+    ...input.capability,
+    conflict_guard: { column: input.dependency.expected_version.column }
+  };
+  try {
+    const current = await input.readRow({
+      sourceName: input.dependency.source_id,
+      source: input.source,
+      capability: readCapability,
+      args: { [input.capability.lookup.id_from_arg]: input.dependency.target.primary_key.value },
+      context: input.context,
+      env: input.env,
+      transaction_mode: "read_only"
+    });
+    const observed = current.rowCount === 1 ? conflictGuardScalar(scalar2(current.row[input.dependency.expected_version.column])) : void 0;
+    const fresh = current.rowCount === 1 && observed !== void 0 && versionsEqual(observed, input.dependency.expected_version.value);
+    return {
+      id: input.dependency.id,
+      kind: "supporting",
+      status: fresh ? "fresh" : "stale",
+      safe_code: fresh ? "FRESHNESS_DEPENDENCY_FRESH" : "FRESHNESS_DEPENDENCY_STALE",
+      expected_version_digest: versionMetadataDigest(input.dependency.expected_version.column, input.dependency.expected_version.value),
+      ...observed !== void 0 ? { observed_version_digest: versionMetadataDigest(input.dependency.expected_version.column, observed) } : {}
+    };
+  } catch (error) {
+    const classified = classifyFreshnessReadError(error);
+    return {
+      id: input.dependency.id,
+      kind: "supporting",
+      status: classified.result,
+      safe_code: classified.safe_code
+    };
+  }
+}
+function freshnessResultForChecks(checks) {
+  if (checks.some((check) => check.status === "invalid")) return "invalid";
+  if (checks.some((check) => check.status === "unsupported")) return "unsupported";
+  if (checks.some((check) => check.status === "unavailable")) return "unavailable";
+  if (checks.some((check) => check.status === "stale")) return "stale";
+  return "fresh";
+}
+function freshnessSafeCode(status, checks) {
+  if (status === "fresh") return "FRESHNESS_FRESH";
+  if (status === "stale" && checks.some((check) => check.kind === "target" && check.status === "stale")) return "FRESHNESS_TARGET_STALE";
+  if (status === "stale") return "FRESHNESS_DEPENDENCY_STALE";
+  if (status === "unavailable") return "FRESHNESS_TEMPORARILY_UNAVAILABLE";
+  if (status === "unsupported") return "FRESHNESS_TOPOLOGY_UNSUPPORTED";
+  return "FRESHNESS_AUTHORITY_INVALID";
+}
+function classifyFreshnessReadError(error) {
+  const code = error instanceof McpRuntimeError ? error.code : errorStringProperty(error, "code") ?? "";
+  if (/(TIMEOUT|POOL|CONNECTION|ECONN|ETIMEDOUT|TOO_MANY|UNAVAILABLE|SATURAT)/i.test(`${code} ${errorMessage(error)}`)) {
+    return { result: "unavailable", safe_code: "FRESHNESS_TEMPORARILY_UNAVAILABLE" };
+  }
+  if (/(UNSUPPORTED|CROSS_SOURCE)/i.test(code)) {
+    return { result: "unsupported", safe_code: "FRESHNESS_TOPOLOGY_UNSUPPORTED" };
+  }
+  return { result: "invalid", safe_code: "FRESHNESS_CHECK_FAILED" };
+}
+function freshnessSourceAdapters(proposal, authority) {
+  const entries = /* @__PURE__ */ new Map();
+  const targetEngine = proposal.source_kind === "external_mysql" ? "mysql" : "postgres";
+  entries.set(`${proposal.source_id}:${targetEngine}`, { source_id: proposal.source_id, engine: targetEngine });
+  for (const dependency of authority.dependencies) {
+    entries.set(`${dependency.source_id}:${dependency.engine}`, { source_id: dependency.source_id, engine: dependency.engine });
+  }
+  return [...entries.values()].sort((left, right) => left.source_id.localeCompare(right.source_id) || left.engine.localeCompare(right.engine));
+}
+function versionsEqual(left, right) {
+  return canonicalJsonDigest({ value: conflictGuardScalar(scalar2(left)) }) === canonicalJsonDigest({ value: conflictGuardScalar(scalar2(right)) });
+}
+function versionMetadataDigest(column, value) {
+  return canonicalJsonDigest({ column, value: conflictGuardScalar(scalar2(value)) });
+}
 function effectivePrincipalScope(config, capability, context) {
   const column = capability.target.principal_scope_key;
   if (!column) return void 0;
@@ -16247,6 +17229,7 @@ function buildChangeSet(input) {
         ...input.capability.operation.version_advance ? { version_advance: input.capability.operation.version_advance } : {},
         ...input.resolvedDeduplication ? { deduplication: input.resolvedDeduplication } : {}
       },
+      ...input.freshness ? { freshness: input.freshness } : {},
       ...input.capability.reversibility ? {
         reversibility: {
           mode: "reviewed_inverse",
@@ -16312,6 +17295,7 @@ function buildChangeSet(input) {
       allowed_columns: input.capability.allowed_columns ?? Object.keys(patch),
       expected_version: guard
     },
+    ...input.freshness ? { freshness: input.freshness } : {},
     evidence: {
       bundle_id: input.evidenceBundleId,
       query_fingerprint: input.queryFingerprint,
@@ -16445,6 +17429,7 @@ function buildBoundedSetChangeSet(input) {
       allowed_columns: kind === "set_delete" ? [] : input.capability.allowed_columns ?? Object.keys(input.patch),
       ...kind === "set_update" && operation.version_advance ? { version_advance: operation.version_advance } : {}
     },
+    ...input.freshness ? { freshness: input.freshness } : {},
     frozen_set: frozenSet,
     ...input.capability.reversibility ? {
       reversibility: {
@@ -16644,7 +17629,7 @@ var RuntimeDatabasePools = class {
         counter.active += 1;
         try {
           const query = runtimeReadQuery(input.capability, "$", input.args, input.context);
-          await client.query(input.capability.protected_read ? "BEGIN READ ONLY" : "BEGIN");
+          await client.query(input.capability.protected_read || input.transaction_mode === "read_only" ? "BEGIN READ ONLY" : "BEGIN");
           const timeoutMs = protectedStatementTimeout(input.capability, input.source.statement_timeout_ms);
           if (timeoutMs) await client.query(`SET LOCAL statement_timeout = ${timeoutMs}`);
           if (input.source.database_scope?.mode === "postgres_rls") {
@@ -16711,14 +17696,15 @@ var RuntimeDatabasePools = class {
         const timeoutMs = protectedStatementTimeout(input.capability, input.source.statement_timeout_ms);
         if (timeoutMs) await connection.query("SET SESSION max_execution_time = ?", [timeoutMs]).catch(() => void 0);
         const query = runtimeReadQuery(input.capability, "?", input.args, input.context);
-        if (input.capability.protected_read) await connection.query("START TRANSACTION READ ONLY");
+        const readOnlyTransaction = Boolean(input.capability.protected_read || input.transaction_mode === "read_only");
+        if (readOnlyTransaction) await connection.query("START TRANSACTION READ ONLY");
         try {
           const [rows] = await connection.execute(query.sql, query.values.map(scalar2));
           const list = Array.isArray(rows) ? rows : [];
-          if (input.capability.protected_read) await connection.query("COMMIT");
+          if (readOnlyTransaction) await connection.query("COMMIT");
           return { row: list[0] ?? {}, rows: list, rowCount: list.length };
         } catch (error) {
-          if (input.capability.protected_read) await connection.query("ROLLBACK").catch(() => void 0);
+          if (readOnlyTransaction) await connection.query("ROLLBACK").catch(() => void 0);
           throw error;
         }
       } finally {