feat(perception): gate cross-host graph with acknowledged source clocks

tests/test_perception_realtime_scene.py

@@ -362,6 +362,48 @@ def test_consumer_expires_only_old_cell_and_rehashes_view_without_mutating_wire(
         pilot.assess_receipt(view, derived, bundle=bundle, now_ns=bundle["due_ns"])
 
 
+def test_cross_host_uncertainty_expires_per_cell_and_survives_publication(pilot):
+    payload, bundle, ddr = cell_input()
+    # Without uncertainty old ground would be 249 ms old; upper bound is253 ms.
+    bundle["clock_observer"] = lambda _: (NOW + 49_000_000, 4_000_000)
+    pilot.prepare_publication(payload, bundle, ddr, epoch_id="pilot", now_ns=123, mode="per-cell")
+    assert payload["cell_assessment"]["expired_ground_cells"] == 1
+    assert payload["policy_actions"] == [2, 0]
+    assert payload["freshness_at_publication"]["clock_uncertainty_ms"] == 4
+    fresh = pilot.validate_receipt(payload, bundle, epoch_id="pilot")
+    # An independently measured later receipt can have a slightly smaller
+    # midpoint while still overlapping the published interval.
+    local_bundle = {k: v for k, v in bundle.items() if k != "clock_observer"}
+    view, checked = pilot.assess_receipt(
+        payload, fresh, bundle=local_bundle, now_ns=bundle["due_ns"] + 48_000_000
+    )
+    assert checked.clock_uncertainty_ms == 0 and view["policy_actions"] == [2, 0]
+    with pytest.raises(ValueError, match="backwards"):
+        pilot.assess_receipt(
+            payload, fresh, bundle=local_bundle, now_ns=bundle["due_ns"] + 44_000_000
+        )
+
+
+def test_one_clock_snapshot_per_publication_and_receipt_boundary(pilot):
+    payload, bundle, ddr = cell_input()
+    calls = []
+
+    def observe(now):
+        assert now not in calls  # A later refresh may no longer describe this instant.
+        calls.append(now)
+        return NOW + now, 4_000_000
+
+    bundle["clock_observer"] = observe
+    pilot.prepare_publication(
+        payload, bundle, ddr, epoch_id="pilot", now_ns=260_000_000, mode="per-cell"
+    )
+    assert payload["policy_actions"] == [2, 2]  # Exercises suppression/reassessment too.
+    fresh = pilot.validate_receipt(payload, bundle, epoch_id="pilot")
+    view, checked = pilot.assess_receipt(payload, fresh, bundle=bundle, now_ns=270_000_000)
+    assert calls == [260_000_000, 270_000_000]
+    assert not checked.fresh_complete and view["policy_actions"] == [2, 2]
+
+
 @pytest.mark.parametrize("missing,held_ms", [(True, 0), (False, 220)])
 def test_cell_freshness_cannot_override_missing_lidar_or_stale_segmentation(
     pilot, missing, held_ms