The operator's slack knob was interpolated raw into $((...)) under set -u:
'300s'/'5m' -> 'value too great', 'abc' -> 'unbound variable' — all FATAL to
the poll, falsifying the PR's own 'poll never fails' invariant, and a negative
value silently inverted the guard into deny-all. Now resolved once into a
local, validated ^[0-9]{1,9}$, loud fallback to 300 on mismatch. New D13
group: '300s'/'abc'/negative all fall back and KEEP valid metadata; a valid
tightened knob (0) still rejects a future ts. Manifest states the skew
guarantee explicitly: a surviving snapshot_ts is attested only to within SLACK
seconds of the DETECTOR's clock — bounded negative age at render is possible;
treat age<=0 as effectively-current, never proof of freshness.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
A ts without a valid sha is unverifiable dating — dropped loudly. A future
ts yields a negative age (stale reads fresher-than-fresh, the failure class
this PR exists to fix) — rejected beyond WAKE_SNAPSHOT_TS_FUTURE_SLACK
(default 300s). Epoch sanity (^[0-9]{1,12}$) is validated BEFORE the shell
integer comparison so an absurd value cannot error past the guard. All three
paths covered by new D12. Manifest now records that snapshot_* absence is
deliberately not diagnostic (reviewer observation, PR #941 comment 19475).
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
A digest locator carried observed_hash + emit_ts but nothing DATING the
snapshot, so a consumer could not tell a fresh snapshot from one already
superseded at delivery without a tool call (wake-pilot finding
fw-wake-digest-snapshot-lag: seq 56 rendered "(none)" from a board revision
superseded ~5s before delivery by one adding a FLEET STOP block).
Additive + backward-compatible:
- detector.sh: invoke the W4 source adapter with fd 3 -> temp file; the
adapter MAY write {"snapshot_sha": "<git commit sha>", "snapshot_ts":
<epoch>}. Out-of-band is load-bearing: stdout is hashed by the delta
gate, so an in-band tip-commit sha would advance observed_hash on every
unrelated push. Metadata is ADVISORY and validated (sha ^[0-9a-f]{7,64}$,
ts number); malformed metadata drops LOUDLY but never fails the poll or
suppresses the wake. Valid fields join the enqueue locators. An adapter
that never writes fd 3 is byte-identical legacy behavior.
- digest.sh: _locator_line renders snapshot_sha=/snapshot_ts= (scrubbed)
beside observed_hash=; snapshot_sha+path upgrades the actionable-tier
re-verify hint to one-call `git show <snapshot_sha>:<path>`. With
emit_ts already in the header, snapshot age is local arithmetic.
- tests: detector D10 (fields land in locators; metadata-only change is
NOT a delta) + D11 (malformed metadata: loud drop, wake still fires, no
fields); digest Q10 (orientation dating render, no-vestige sibling,
actionable re-verify upgrade). manifest 0.6.12; watch-list schema
untouched ([1,1]); store/reconcile/beacon unchanged.
Closes#940
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
jason.woltjeandMos