feat(wake): #940 snapshot-datable digests — adapter fd-3 snapshot-metadata channel

A digest locator carried observed_hash + emit_ts but nothing DATING the
snapshot, so a consumer could not tell a fresh snapshot from one already
superseded at delivery without a tool call (wake-pilot finding
fw-wake-digest-snapshot-lag: seq 56 rendered "(none)" from a board revision
superseded ~5s before delivery by one adding a FLEET STOP block).

Additive + backward-compatible:
- detector.sh: invoke the W4 source adapter with fd 3 -> temp file; the
  adapter MAY write {"snapshot_sha": "<git commit sha>", "snapshot_ts":
  <epoch>}. Out-of-band is load-bearing: stdout is hashed by the delta
  gate, so an in-band tip-commit sha would advance observed_hash on every
  unrelated push. Metadata is ADVISORY and validated (sha ^[0-9a-f]{7,64}$,
  ts number); malformed metadata drops LOUDLY but never fails the poll or
  suppresses the wake. Valid fields join the enqueue locators. An adapter
  that never writes fd 3 is byte-identical legacy behavior.
- digest.sh: _locator_line renders snapshot_sha=/snapshot_ts= (scrubbed)
  beside observed_hash=; snapshot_sha+path upgrades the actionable-tier
  re-verify hint to one-call `git show <snapshot_sha>:<path>`. With
  emit_ts already in the header, snapshot age is local arithmetic.
- tests: detector D10 (fields land in locators; metadata-only change is
  NOT a delta) + D11 (malformed metadata: loud drop, wake still fires, no
  fields); digest Q10 (orientation dating render, no-vestige sibling,
  actionable re-verify upgrade). manifest 0.6.12; watch-list schema
  untouched ([1,1]); store/reconcile/beacon unchanged.

Closes #940

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/wake/test-wake-digest-quarantine.sh

@@ -301,6 +301,42 @@ echo "== Q9 (d): WAKE_ALARM_SINK_CMD unconfigured OR unreachable -> FAIL LOUD (n
   true
 ) && ok
 
+echo "== Q10: snapshot metadata (#940) — snapshot_sha/snapshot_ts render on the locator line and feed the re-verify hint =="
+(
+  home="$(fresh_home q10)"
+  export WAKE_STATE_HOME="$home"
+  unset WAKE_AGENT
+  f="$TMP_ROOT/q10.jsonl"
+  {
+    # (a) a digest-class ORIENTATION pointer WITH adapter-attested snapshot
+    #     metadata — the fields must render on the pointer line (the tier where
+    #     the snapshot-lag class actually bit; re-verify hints are actionable-
+    #     tier-only by design and are asserted via (c) below).
+    printf '%s\n' '{"observed_seq":21,"class":"digest","locators":{"kind":"board_file","id":"SNAP-A","path":"BOARD.md","observed_hash":"aaaa1111","snapshot_sha":"0123abc4567890def0123abc4567890def012345","snapshot_ts":1753850000},"emit_ts":2}'
+    # (b) a sibling WITHOUT the fields — must render no snapshot vestige.
+    printf '%s\n' '{"observed_seq":22,"class":"digest","locators":{"kind":"board_file","id":"SNAP-B","path":"OTHER.md","observed_hash":"bbbb2222"},"emit_ts":2}'
+    # (c) an ACTIONABLE entry (hard locator: repo+issue) carrying path +
+    #     snapshot_sha — its re-verify hint must upgrade to the one-call
+    #     `git show <snapshot_sha>:<path>` (most-specific-first).
+    printf '%s\n' '{"observed_seq":23,"class":"actionable","locators":{"repo":"example/repo","issue":7,"path":"BOARD.md","observed_hash":"cccc3333","snapshot_sha":"0123abc4567890def0123abc4567890def012345","snapshot_ts":1753850000},"emit_ts":2}'
+  } >"$f"
+  out="$("$DIGEST" render --from-file "$f" --agent default 2>/dev/null)"
+  rc=$?
+  [ "$rc" -eq 0 ] || fail_msg "Q10: render must succeed (rc=$rc)"
+  snapa_line="$(printf '%s\n' "$out" | grep 'id=SNAP-A' || true)"
+  printf '%s' "$snapa_line" | grep -q 'snapshot_sha=0123abc4567890def0123abc4567890def012345' \
+    || fail_msg "Q10: snapshot_sha must render on the ORIENTATION pointer line [$snapa_line]"
+  printf '%s' "$snapa_line" | grep -q 'snapshot_ts=1753850000' \
+    || fail_msg "Q10: snapshot_ts must render on the ORIENTATION pointer line (age = emit_ts - snapshot_ts, local arithmetic) [$snapa_line]"
+  printf '%s' "$out" | grep -q 'git show 0123abc4567890def0123abc4567890def012345:BOARD.md' \
+    || fail_msg "Q10: snapshot_sha+path must upgrade the actionable re-verify hint to a one-call git show"
+  # The sibling without metadata must not grow empty snapshot_ fields.
+  snapb_line="$(printf '%s\n' "$out" | grep 'id=SNAP-B' || true)"
+  printf '%s' "$snapb_line" | grep -q 'snapshot_' \
+    && fail_msg "Q10: an entry without metadata must render NO snapshot_ fields [$snapb_line]"
+  true
+) && ok
+
 echo
 if [ -s "$FAILFILE" ]; then
   echo "wake digest-quarantine harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2