Function check 

pub fn check(
    contract: &FreshnessContract,
    input: &FreshnessCheckInput,
) -> FreshnessDecision

Evaluate contract against input, returning a deterministic FreshnessDecision.

Precedence:

1. Domain mismatch is checked first (cheap, structural).
2. Signature missing-when-required is checked next.
3. Signature mismatch is checked before TTL so a rotated signature never silently slips through on an unexpired contract.
4. TTL (elapsed > max-age) is the last gate.

The decision is fully determined by (contract, input) — no I/O, no clock reads.