Gate min_timestamp semantics + add conformance test before SDK extraction (G4)

[CameronBrooks11]

Part of the Pre-Wave-5 consistency reconciliation pass (Tier-0 gate G4). Surfaced by the six-subagent pre-extraction consistency audit (2026-06-24).

Problem

min_timestamp (§7.3) freshness handling diverges across the three providers, and no conformance test covers it — so all three pass today and the divergence is invisible:

• ezo — strict: if it can't meet freshness it returns CODE_DEADLINE_EXCEEDED (src/core/handlers.cpp:471-473).
• sim / bread — lenient: return CODE_OK with QUALITY_STALE (apply_min_timestamp, byte-identical between sim handlers.cpp:119-133 and bread :68-82).

Under a shared SDK handler this must converge to one behavior. Whichever is chosen silently changes the other side's observable contract — and because the harness doesn't exercise min_timestamp (grep min_timestamp conformance/ = empty), the regression would be undetectable by the acceptance gate. This is the only silent-regression item in the whole reconciliation pass.

Decision (recommended)

Adopt the lenient behavior — return best-available data with QUALITY_STALE — matching §7.3's SHOULD wording ("return best available… indicate staleness via quality") and 2 of 3 providers. This flips ezo from an error to OK+STALE (a deliberate, documented behavior change).

Acceptance

• Decide + record the canonical min_timestamp semantics in the Wave-5 design addendum.
• Add a conformance assertion in anolis-protocol/conformance/ (e.g. test_adpp_core.py) exercising a read with min_timestamp set beyond available freshness, asserting the chosen contract (OK + QUALITY_STALE, non-empty values).
• Land the test before any provider migrates onto a shared handler, so convergence is gated, not silent.
• ezo behavior change tracked in its pre-extraction PR (DEADLINE_EXCEEDED → OK+STALE).

Blocks: the spine/handler lift in Wave-5 (#45). Evidence: audit note working/provider-sdk-wave5-prereconciliation-audit.md (G4).

[CameronBrooks11]

Gate landed — #50 merged to main. semantics.md §7.3 clarified + test_min_timestamp_hint_is_not_fatal core gate + test_selftest_freshness_hint_validator hermetic self-test + assert_freshness_hint_not_fatal helper + client.read_signals(min_timestamp=…). No wire/proto change; staged on main (no release), so inert in provider CI until pins bump.

Validated against built binaries: sim PASS, bread SKIP (mock backend → UNAVAILABLE, contract unobservable), ezo FAIL with the exact CODE_DEADLINE_EXCEEDED violation — i.e. the gate catches the divergence it was built for.

Closing: the gate exists. The remaining convergence — ezo flips DEADLINE_EXCEEDED→OK+QUALITY_STALE and bumps its harness pin — is part of ezo's Phase-C work (anolishq/anolis-provider-ezo#70, with its D1 result-type migration), which is when the gate goes green for ezo and the silent-regression risk is fully retired.