fix(wake): #941 review §2 — snapshot_ts hardening: sha precondition, epoch sanity, future-skew rejection

A ts without a valid sha is unverifiable dating — dropped loudly. A future
ts yields a negative age (stale reads fresher-than-fresh, the failure class
this PR exists to fix) — rejected beyond WAKE_SNAPSHOT_TS_FUTURE_SLACK
(default 300s). Epoch sanity (^[0-9]{1,12}$) is validated BEFORE the shell
integer comparison so an absurd value cannot error past the guard. All three
paths covered by new D12. Manifest now records that snapshot_* absence is
deliberately not diagnostic (reviewer observation, PR #941 comment 19475).

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/wake/detector.sh

@@ -272,6 +272,32 @@ _poll_source() {
         snap_sha=""
         snap_ts=""
       fi
+      # A ts must be a sane positive epoch BEFORE any arithmetic touches it: a
+      # negative or absurdly large value would make the shell integer comparison
+      # below error out and silently KEEP the bad ts — validate first, compare after.
+      if [ -n "$snap_ts" ] && ! printf '%s' "$snap_ts" | grep -Eq '^[0-9]{1,12}$'; then
+        echo "detector.sh: source '$kind/$id' snapshot_ts rejected (not a sane positive epoch) — snapshot_ts DROPPED, poll continues (#940)." >&2
+        snap_ts=""
+      fi
+      # ts is only meaningful anchored to a revision the consumer can re-verify —
+      # a bare number with no sha behind it is the weakest possible attestation,
+      # so ts requires a valid sha (#940 review §2).
+      if [ -n "$snap_ts" ] && [ -z "$snap_sha" ]; then
+        echo "detector.sh: source '$kind/$id' snapshot_ts without a valid snapshot_sha — snapshot_ts DROPPED (unverifiable dating), poll continues (#940)." >&2
+        snap_ts=""
+      fi
+      # A FUTURE ts renders a stale snapshot fresher-than-fresh (negative age) —
+      # wrong in the reassuring direction, the exact failure class #940 fixes.
+      # Cross-host NTP skew of a few seconds is the NORMAL case, so allow a small
+      # slack; beyond it, drop the ts (the sha stays: independently verifiable).
+      if [ -n "$snap_ts" ]; then
+        local now_s
+        now_s="$(date +%s)"
+        if [ "$snap_ts" -gt $((now_s + ${WAKE_SNAPSHOT_TS_FUTURE_SLACK:-300})) ]; then
+          echo "detector.sh: source '$kind/$id' snapshot_ts is beyond the ${WAKE_SNAPSHOT_TS_FUTURE_SLACK:-300}s future-skew allowance (ts=$snap_ts now=$now_s) — snapshot_ts DROPPED, poll continues (#940)." >&2
+          snap_ts=""
+        fi
+      fi
     else
       echo "detector.sh: source '$kind/$id' wrote UNPARSEABLE snapshot metadata on fd 3 — DROPPED, poll continues (#940)." >&2
     fi