feat(wake): #940 snapshot-datable digests — fd-3 snapshot-metadata channel (#941)

Adapter emits snapshot sha/ts out-of-band on fd 3 so a changing value never enters the delta-gate hash. Detector validates advisorily (sha regex, epoch sanity before arithmetic, future-skew slack); malformed metadata is dropped loudly and never gates the wake. Digest renders snapshot_sha/snapshot_ts plus a git-show re-verify hint. Adapters that never write fd 3 are byte-identical.

Reviewed-by: Mos (design, independent)
Reviewed-by: mos-dt (artifact, hardening §2)
Co-authored-by: mos-dt-0 <[email protected]>

packages/mosaic/framework/tools/wake/manifest.txt

@@ -240,8 +240,50 @@
 #              guard/witness-marker are REMOVED — T9/T11 now RUN and ASSERT their failure
 #              paths in every environment including non-priv CI. Changed: _wake-common.sh
 #              (seam), test-wake-store-ack.sh (T9/T11 conversion).
+#   0.6.12 #940 snapshot-datable digests — the adapter-contract fd-3 snapshot-
+#              metadata channel (wake-pilot finding fw-wake-digest-snapshot-lag:
+#              a digest's locator carried observed_hash + emit_ts but nothing
+#              DATING the snapshot, so a consumer could not tell a fresh
+#              snapshot from one already superseded at delivery without a tool
+#              call). ADDITIVE + backward-compatible: (a) detector.sh invokes
+#              the W4 source adapter with fd 3 redirected to a temp file; the
+#              adapter MAY write one JSON object {"snapshot_sha": "<git commit
+#              sha>", "snapshot_ts": <epoch>} there. OUT-OF-BAND is load-
+#              bearing: everything on stdout is hashed by the delta gate, so an
+#              in-band tip-commit sha would advance observed_hash on every
+#              unrelated push (spurious delta wake per watched file). Metadata
+#              is ADVISORY and validated (sha ^[0-9a-f]{7,64}$, ts number):
+#              malformed metadata is dropped with a LOUD stderr diagnostic but
+#              NEVER fails the poll or suppresses the wake — the obligation
+#              never depends on optional dating. Valid fields join the enqueue
+#              locators; an adapter that never writes fd 3 is byte-identical
+#              legacy behavior. (b) digest.sh _locator_line renders
+#              snapshot_sha=/snapshot_ts= (scrubbed) beside observed_hash=, and
+#              snapshot_sha+path upgrades the one-call re-verify hint to
+#              `git show <snapshot_sha>:<path>` (snapshot_sha IS a commit sha,
+#              unlike observed_hash, so it may feed the git hint). With emit_ts
+#              already in the header, snapshot age becomes local arithmetic for
+#              the consumer — zero round trips. Watch-list schema UNTOUCHED
+#              ([1,1] unchanged — adapter contract + locator vocabulary, not
+#              watch-list config). store.sh/reconcile.sh/beacon.sh UNCHANGED.
+#              Review hardening (#941 §2): snapshot_ts additionally requires a
+#              VALID snapshot_sha (a bare number with no revision to re-verify
+#              against is the weakest attestation — dropped loudly), must be a
+#              sane positive epoch (^[0-9]{1,12}$ — validated BEFORE the shell
+#              integer comparison so an absurd value cannot error past it), and
+#              must not sit beyond a future-skew allowance
+#              (WAKE_SNAPSHOT_TS_FUTURE_SLACK, default 300 s): a future ts
+#              yields a NEGATIVE age — stale-reads-fresher-than-fresh, the
+#              exact failure class #940 fixes. NOTE for consumers: these fields
+#              are ADVISORY and their ABSENCE IS DELIBERATELY NOT DIAGNOSTIC —
+#              a pre-#940 adapter and a dropped-as-malformed attestation render
+#              identically (no snapshot_* fields); the drop is loud only in the
+#              detector's own stderr. Do not build load-bearing logic on the
+#              absence of these fields.
+#              Changed: detector.sh, digest.sh (+ test-wake-detector.sh
+#              D10/D11/D12, test-wake-digest-quarantine.sh Q10).
 component=wake
-version=0.6.11
+version=0.6.12
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version