fix(wake): #942 follow-up — whole-string knob validation; grep line anchors admit multi-line values

mos-dt's post-verdict residual (non-blocking, comments 19484/19487): grep is
LINE-oriented, so ^[0-9]{1,9}$ binds per line and a knob with an embedded
newline ($'300\n8', $'300\nabc') passes the regex whole yet is FATAL inside
$((...)) under set -u — the same poll-killing class #942 fixed, reachable only
via the env-config operand (snap_ts is immune: jq's number type-check cannot
emit an embedded newline).

Fix (mos-dt-verified pattern): replace grep with a whole-string case pattern —
'' and *[!0-9]* reject, length <= 9 — identical accept/reject to the regex on
every single-line value, rejects both multi-line cases. 10# radix force
unchanged. Two new D13 sub-cases (SHA-CC2/SHA-CC3) cover exactly the repros;
det_seq assertion 6 -> 8. Manifest states the string-extent rule: the validator
and the consumer must agree on STRING EXTENT, not just shape and radix.

Suite: 13 groups, D13 green 4/4 local runs; sole intermittent failure is the
known pre-existing D4 fd-9 flake (carried separately by mos-dt).

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/wake/test-wake-detector.sh

@@ -644,6 +644,26 @@ EOF
   entry="$("$STORE" drain | tail -1)"
   echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \
     || fail_msg "D13: negative slack must NOT invert the guard into deny-all [$entry]"
+  # (c2) MULTI-LINE knobs — grep's ^...$ anchors bind PER LINE, so a value with
+  # an embedded newline ($'300\n8') passed the old regex whole yet is FATAL in
+  # \$((...)) ('error token is "8"'; $'300\nabc' dies as unbound variable). The
+  # case pattern matches the WHOLE string: both must fall back loudly, keep the ts.
+  printf '{"snapshot_sha":"%s","snapshot_ts":%s}\n' "$goodsha" "$(date +%s)" >"$stub/repo_r1.meta"
+  printf 'SHA-CC2\n' >"$stub/repo_r1"
+  err="$(WAKE_SNAPSHOT_TS_FUTURE_SLACK=$'300\n8' "$DET" poll-once 2>&1 >/dev/null)"; rc=$?
+  [ "$rc" -eq 0 ] || fail_msg "D13: multi-line SLACK (300\\n8) must NEVER fail the poll (rc=$rc) [$err]"
+  echo "$err" | grep -qi 'falling back to 300' || fail_msg "D13: multi-line slack must be LOUD on stderr [$err]"
+  entry="$("$STORE" drain | tail -1)"
+  echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \
+    || fail_msg "D13: valid metadata must SURVIVE a multi-line knob [$entry]"
+  printf '{"snapshot_sha":"%s","snapshot_ts":%s}\n' "$goodsha" "$(date +%s)" >"$stub/repo_r1.meta"
+  printf 'SHA-CC3\n' >"$stub/repo_r1"
+  err="$(WAKE_SNAPSHOT_TS_FUTURE_SLACK=$'300\nabc' "$DET" poll-once 2>&1 >/dev/null)"; rc=$?
+  [ "$rc" -eq 0 ] || fail_msg "D13: multi-line SLACK (300\\nabc) must NEVER fail the poll (rc=$rc) [$err]"
+  echo "$err" | grep -qi 'falling back to 300' || fail_msg "D13: multi-line non-numeric slack must be LOUD on stderr [$err]"
+  entry="$("$STORE" drain | tail -1)"
+  echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts")' >/dev/null 2>&1 \
+    || fail_msg "D13: valid metadata must SURVIVE a multi-line non-numeric knob [$entry]"
   # (d2-pre) ZERO-PADDED knobs — shape-valid, radix-hostile. '08' passes the
   # regex but is fatal octal in \$((...)) without the 10# normalization; '0300'
   # silently means 192 (octal), so a ts +250s ahead would be WRONGLY dropped.
@@ -671,7 +691,7 @@ EOF
   entry="$("$STORE" drain | tail -1)"
   echo "$entry" | jq -e --arg s "$goodsha" 'select(.locators.snapshot_sha==$s) | .locators | has("snapshot_ts") | not' >/dev/null 2>&1 \
     || fail_msg "D13: valid SLACK=0 must drop the future ts but keep the sha [$entry]"
-  [ "$(det_seq)" = "6" ] || fail_msg "D13: all six real deltas must still have enqueued, got seq $(det_seq)"
+  [ "$(det_seq)" = "8" ] || fail_msg "D13: all eight real deltas must still have enqueued, got seq $(det_seq)"
 ) && ok
 
 echo