feat(wake): #940 snapshot-datable digests — fd-3 snapshot-metadata channel (#941)

Adapter emits snapshot sha/ts out-of-band on fd 3 so a changing value never enters the delta-gate hash. Detector validates advisorily (sha regex, epoch sanity before arithmetic, future-skew slack); malformed metadata is dropped loudly and never gates the wake. Digest renders snapshot_sha/snapshot_ts plus a git-show re-verify hint. Adapters that never write fd 3 are byte-identical.

Reviewed-by: Mos (design, independent)
Reviewed-by: mos-dt (artifact, hardening §2)
Co-authored-by: mos-dt-0 <[email protected]>

packages/mosaic/framework/tools/wake/digest.sh

@@ -235,7 +235,7 @@ _has_hard_locator() {
 #     ACTIONABLE-tier hard-locator FAIL-LOUD gate is untouched.
 _locator_line() {
   local loc="$1" repo issue sha file anchor head parts='' reverify=''
-  local remote path kind id ohash branches
+  local remote path kind id ohash branches snap_sha snap_ts
   repo="$(jq -r '.repo // ""' <<<"$loc")"
   issue="$(jq -r '(.issue // "") | tostring' <<<"$loc")"
   sha="$(jq -r '.sha // ""' <<<"$loc")"
@@ -247,6 +247,8 @@ _locator_line() {
   kind="$(jq -r '.kind // ""' <<<"$loc")"
   id="$(jq -r '(.id // "") | tostring' <<<"$loc")"
   ohash="$(jq -r '.observed_hash // ""' <<<"$loc")"
+  snap_sha="$(jq -r '.snapshot_sha // ""' <<<"$loc")"
+  snap_ts="$(jq -r '(.snapshot_ts // "") | tostring' <<<"$loc")"
   branches="$(jq -r '(.branches // []) | if length > 0 then join(",") else "" end' <<<"$loc" 2>/dev/null || true)"
   [ -n "$kind" ] && parts="$parts kind=$(_scrub_inline "$kind")"
   [ "$id" != "" ] && parts="$parts id=$(_scrub_inline "$id")"
@@ -273,9 +275,18 @@ _locator_line() {
   # git commit SHA — kept distinct from `sha` so it never impersonates one or
   # feeds the `git show <sha>` re-verify hint below.
   [ -n "$ohash" ] && parts="$parts observed_hash=$(_scrub_inline "$ohash")"
+  # snapshot_sha/snapshot_ts (#940): the SNAPSHOT'S git commit sha + commit
+  # epoch, attested by the source adapter at OBSERVE time (out-of-band fd 3,
+  # detector-validated). Unlike observed_hash this IS a commit sha, so it may
+  # feed the `git show` re-verify hint; with emit_ts already in the header,
+  # snapshot age becomes local arithmetic for the consumer.
+  [ -n "$snap_sha" ] && parts="$parts snapshot_sha=$(_scrub_inline "$snap_sha")"
+  [ "$snap_ts" != "" ] && parts="$parts snapshot_ts=$(_scrub_inline "$snap_ts")"
   # One-targeted-call re-verify hint (best available, most-specific first).
   if [ -n "$sha" ] && [ -n "$file" ]; then
     reverify="git show $(_scrub_inline "$sha"):$(_scrub_inline "$file")"
+  elif [ -n "$snap_sha" ] && [ -n "$path" ]; then
+    reverify="git show $(_scrub_inline "$snap_sha"):$(_scrub_inline "$path")"
   elif [ -n "$repo" ] && [ "$issue" != "" ]; then
     reverify="issue $(_scrub_inline "$repo")#$(_scrub_inline "$issue")"
   elif [ -n "$sha" ]; then