refusing to run on stale input

A live pass depends on a reference input produced outside the system, arriving on somebody else's schedule. That dependency is the classic availability-versus-legitimacy trade: when the feed is late, the system can act on what it already has, or it can refuse.

The design refuses. If the reference input is missing, or older than a declared age, the pass halts outright and the halt is recorded. There is no degraded mode in which the engine decides against an out-of-date picture, because a decision made without current input is worse than no decision at all: in the record afterwards it is indistinguishable from a correct one, and it carries the same apparent authority.

The guard was verified the unglamorous way — during deployment, with a deliberately stale input, watching it halt rather than trusting that the code path was reachable.

The cost is explicit and was accepted. The system will produce nothing on a day when the feed slips, and a person has to notice and care. The benefit is that every decision in the record can be defended as having been made with the information it claims to have been made with.

What it proves: fail-closed is a stated policy here, not an accident of coding style — written down, implemented once, and tested by trying to trip it.