Function check_freshness 

pub async fn check_freshness(
    update: &IdentityUpdate,
    chain: &dyn ChainBlocks,
) -> Result<(), ValidationError>

Reject a new update whose ERC-6492 signature names a block after its chain’s head, or one more than MAX_BLOCK_AGE_SECS before it.

Every account id’s form, chain id and address, is checked before the first chain call, so a malformed one is rejected without chain access. Each chain’s head is then read once, so a block after it is rejected without further calls, and each distinct block’s timestamp once; reads within a round run concurrently. Chain failures stay retryable; they are never a verdict on the signature. A block stamped after its head, as reads straddling a reorg can report, is rejected rather than read as fresh. Callers run this before signature verification: a verifier asked about a block the chain has not produced fails retryably instead of rejecting.