fix(core): foreign-session digest render throws RangeError on finite out-of-range timestamps

[0xMudit]

What happened

Rendering a foreign-session digest can crash the resume/send flow with RangeError: Invalid time value.

packages/core/src/foreign-session.ts:635 guards the toISOString() call with Number.isFinite(digest.updatedAtMs), with a comment claiming this prevents exactly that RangeError. It does not:

`updated_at=${Number.isFinite(digest.updatedAtMs) ? new Date(digest.updatedAtMs).toISOString() : 'unknown'}`,

Date clamps at ±8.64e15 ms (TimeClip); any finite value beyond that makes new Date(ts) an Invalid Date, and .toISOString() throws. Verified on Node 24:

$ node -e "console.log(new Date(1e16).toISOString())"
RangeError: Invalid time value

The untrusted value flows straight through: normalizeEpochMs (packages/core/src/foreign-session.ts:404-413) accepts any finite number ≥ 1,577,836,800,000 as-is, so a corrupt or future-schema Codex SQLite row (e.g. a nanosecond epoch ≈ 1.7e18) passes validation, survives the 30-day window filter in codexRowsToSummaries, and reaches the digest render via buildForeignSessionHandoffMessage.

How to reproduce

1. Point Maka at a Codex store whose threads.updated_at_ms contains e.g. 10000000000000000 (1e16)
2. Resume / send in that session — the digest render throws RangeError: Invalid time value

Suggested fix

Validate epoch range, not just finiteness — accept only Math.abs(t) <= 8_640_000_000_000 inside normalizeEpochMs (rejecting or clamping out-of-range rows), or apply the same range check at line 635.

[hydraxman]

I can take this.

Dev design: define the ECMAScript TimeClip bound once, reject normalized store timestamps outside that range, and keep the prompt-render boundary fail-closed by emitting updated_at=unknown for any invalid digest timestamp.

Scope / non-goals: no schema migration, no clamping, and no change to valid seconds-to-milliseconds normalization.

Test plan / acceptance: add a RED regression for a Codex row with updated_at_ms = 1e16 plus direct digest rendering at that boundary; after the fix, the row must not carry the invalid timestamp, rendering must not throw, valid timestamps must remain ISO-formatted, and the full @maka/core suite must pass.

[hydraxman]

Implemented in #3835 at a68af7b193cfa9333cc56f7ec818868e88da0faf.

RED / GREEN evidence:

• RED on current main: npm --workspace @maka/core test reported 656 passed / 2 failed; the invalid timestamp was retained and direct digest rendering threw RangeError.
• GREEN: the same core suite passes 658/658.
• Full workspace typecheck, production build, Biome lint/format, desktop/UI Knip, and git diff --check pass.

Acceptance:

• out-of-range normalized timestamps are rejected
• direct invalid digest timestamps render as updated_at=unknown without throwing
• valid timestamp behavior and existing seconds normalization remain covered
• no schema, dependency, or public API change