Harden quota freshness against malformed and future timestamps

[TheKrush]

Summary

Harden quota freshness evaluation for malformed timestamps, future timestamps, and local clock rollback or skew so invalid time evidence cannot make quota data appear indefinitely fresh.

Current behavior

PromptFuel 1.0.13 correctly treats old or missing trustworthy timestamps as unhealthy and uses exact 20-minute and two-hour freshness thresholds. Broader malformed/future timestamp behavior remains under-specified, and a finite timestamp in the future may be treated as fresh.

Desired behavior

Freshness evaluation should reject or conservatively handle timestamp evidence that is malformed, non-finite, implausibly far in the future, or inconsistent with a clock rollback. The chosen policy should be explicit, deterministic, and shared across ordinary provider windows, authenticated cache restoration, and imported snapshots.

Requirements

• Define the accepted timestamp domain for quota freshness calculations.
• Treat malformed, non-finite, or unparseable timestamps as missing evidence.
• Define a small, documented tolerance for normal clock skew if one is needed.
• Treat timestamps beyond that tolerance conservatively rather than as indefinitely fresh.
• Preserve exact threshold behavior for valid timestamps:
  • exactly 20 minutes old is healthy;
  • older than 20 minutes is stale;
  • exactly two hours old for imported snapshots is healthy;
  • older than two hours is stale.
• Keep ordinary provider windows scoped to their own trustworthy timestamps.
• Keep imported snapshot freshness tied to snapshot generation time.
• Preserve independent five-hour and seven-day health.
• Avoid using provider refresh time, file access time, cache-read time, or sibling timestamps as substitutes.

Non-goals / constraints

• Do not redesign the system clock or introduce network-time dependencies.
• Do not silently clamp arbitrary timestamps without tests and documented rationale.
• Do not change the existing missing-window UI, status-bar omission, tooltip, or Quota issues presentation.
• Do not expose raw provider payloads or authentication material in diagnostics.

Acceptance criteria

• Malformed and non-finite timestamps cannot make a quota value healthy.
• Future timestamps beyond the accepted skew tolerance are handled conservatively.
• A documented small-skew policy, if used, is deterministic and covered by tests.
• Clock rollback does not create negative-age values that remain fresh indefinitely.
• Ordinary, cached authenticated, and imported snapshot paths follow the same policy.
• Existing exact 20-minute and two-hour boundaries remain unchanged for valid timestamps.
• Timestamp-less numeric values still render as stale with no fabricated age.
• The canonical validation and package/install workflow passes.

Validation

• Add fixed-clock tests for malformed, non-finite, future, small-skew, large-skew, and rollback cases.
• Cover ordinary provider windows, current and legacy authenticated caches, and imported snapshots.
• Preserve regression coverage for partial windows, sibling isolation, dashboard Quota issues, tooltip, and status-bar behavior.
• Run the repository's canonical compile, unit, smoke, manifest, encoding, package, and local-install workflow.