Bound the marker's range, not just its syntax — and let a check do the sweep

[fdaviddpt]

Closes #326
Closes #332

#326 — a digits-only marker ahead of now stuck the throttle on, permanently and mutely

case "$LAST_MOD" in ''|*[!0-9]*) LAST_MOD=0 ;; esac rejects the syntax error and does not bound the value. A marker holding a future epoch — clock stepped back by NTP, a VM snapshot restore, a container clock jump, or an overflowing integer — makes ELAPSED negative, so [ "$ELAPSED" -lt "$SAVE_COOLDOWN" ] is true and exit 0 fires. That exit 0 sits above the line that rewrites the marker, so the self-heal the whole design rests on is unreachable on exactly the path that needs it.

Every subsequent run skips. Nothing on stderr, nothing in hook-errors.log. The user discovers it by noticing that nothing has been saved for a week.

Four sites, each now rejecting a negative ELAPSED, resetting the marker at the point of rejection rather than below the exit, and saying so:

Site	What had stopped
save-session.sh:174	no session saved again
save-session.sh:627	NDC compression never runs; now.md grows unbounded — and here the existing rewrite is inside if RUN_NDC, i.e. inside the branch the bug skips, so the immediate reset is load-bearing rather than belt-and-braces
50-git-backup.sh:180	git backup stopped — #258's original outage, reached through a value the guard accepts
post-tool-hook.sh:355	never forks a save again, compounding the first row

The misleading comment at save-session.sh:155-157 — which asserted the marker self-heals and one corruption costs one skipped cooldown — is corrected. It was still there after v0.17.0 corrected only the CHANGELOG.

Proceed rather than abort. Epoch seconds do not move for DST or a timezone change, so the "laptop suspended over a boundary" case does not arise; only a real clock step produces this. Proceeding costs one extra save, refusing costs the preservation.

The diagnostic goes to hook-errors.log, because /remember:doctor reports "Recent errors" from that file and it is what maintainers ask reporters to paste. Not emitted from post-tool-hook.sh: one line per tool call for as long as the clock is behind is noise, and save-session.sh emits exactly one when it heals. That site takes a pure range test — no rewrite, no diagnostic, zero added spawns or reads.

#332 — the hand-fixing was the defect, so a check does the sweep

The issue says seven sites remain. There are twelve, and the five it does not name were found by the check rather than by reading — which is the argument for having one:

scripts/doctor.sh:346            $_mf_bytes
scripts/lib-lock.sh:412          $_s
scripts/lib-lock.sh:421          $1
scripts/lib-lock.sh:430          $1
scripts/run-consolidation.sh:218 $staging_consumed

tests/test_arith_base_lint_332.py fails on any value guarded by a digits-only case that reaches $(( )) without 10#. All twelve sites fixed — radix after the case, never instead of it.

No shared helper, and the issue is right about why. Not for the sourcing-cost reason: all four #326 sites already source log.sh, so report_error adds a function definition and nothing else — no spawn, no read, invisible to test_post_tool_hook_spawns.py and test_case_divergence_298.py, both green. The real reason is that a helper cannot stop an author who has never heard of it. The check can.

The suite was using #326 as an off switch

tests/test_ndc_day_boundary.py suppressed NDC at three sites by writing 2**40 into tmp/last-ndc.ts — a marker ~34,000 years ahead — relying on the negative ELAPSED to engage the cooldown. It went red the moment the guard landed. Switched to _suppress_ndc(), the brake #159 established as supported.

A targeted-only run would have shipped that red. It is the reason the full suite ran.

Tests

TDD, red first: 10 targeted failures before implementation, plus the lint red listing all twelve sites. The 6 initially-passing tests are deliberate controls — a fresh marker still throttles at each gate, and the overflow parameters really do go negative against unfixed code.

Green: 16 + 6 targeted. Full suite: 1545 passed, 43 skipped in 892.37s. Windows unverified; the only new test that runs there is the pure-Python lint.

Out of scope

• Fifteen sites read a case-guarded value into $(( )) and four issues have each fixed a subset by hand — the hand-fixing is the defect #332 should be re-scoped to twelve sites before it is closed, or the next inventory inherits the staleness it complains about.
• 50-git-backup.sh:167 still says "Falling back to 0 self-heals" without the range caveat the two save-session.sh comments now carry.
• The per-tool-call hot path lost its byte-identity pin and the replacement can be walked around #330's hot-path pin is three substring checks; post-tool-hook.sh gained 18 comment lines and a variable here without any of them noticing — exactly the gap that issue describes.