[TheGreatAxios]

The check that refuses an approval when a document changed while the person was deciding compared the version's write time, stamped by the hub, with the approval's creation time, stamped by the database. When the two clocks disagreed, an approval of an unchanged document could be refused, and a document revised during the approval could be accepted. The hub now reads how long ago the approval was asked on the database's clock and subtracts that from the hub's time read just before the transaction, so both sides of the comparison are on the hub's clock and any doubt errs toward refusing.

A new end-to-end test, test/e2e/approval-clock.test.ts, calls recordApproval in-process against an isolated Postgres with the hub's clock set five minutes ahead of and behind the database's. With each skew it checks that a document written before the ask is approved, that a document revised after the ask is refused with artifact_changed_during_approval, and that an approval already recorded records nothing more. The hub exports its artifact service for this test, and the e2e harness shares its database setup through createTestDatabase.

Lint, format check, typecheck, bun run test (289 pass), pins:verify, vendor:verify and the full end-to-end suite (15 pass) pass. Against the service on main, three tests failed in each of three runs: approval of an unchanged document with the hub ahead, the already-recorded case with the hub ahead, and the refusal with the hub behind. With the sign of the clock correction flipped, both refusal tests failed in each of three runs.

Closes CL-12141

[linear-code]

CL-12141

[TheGreatAxios]

Closing for now while today's merges are stabilised.