aggregator(saas-extract): applySupabaseExport never range/type-checks the export doc — negative used/limit/billedUsd are stamped as live measured data, and an array measuredAt passes the freshness gate and corrupts the card #2508

Problem

applySupabaseExport (pm-stack/aggregator/src/saas-extract.ts:701) is the trust boundary for the supabase-export file document: live.ts reads the file with JSON.parse (src/sources/live.ts:833-835) and passes the result straight in. The overlay checks shapes only loosely — typeof === "number" && Number.isFinite for metric values and billing, and a Date.parse freshness check for measuredAt — so values the producer could never legitimately emit are accepted and stamped on the Supabase card as live, measured, sourceClass: "api" data:

1. Negative numbers pass. saas-extract.ts:721-722 accepts any finite used/limit; :741-743 accepts any finite billing.billedUsd. Verified against the real module (main 7d1b081): a fresh, status:"ok" doc with used: -3.25 for db-size yields used = -3.25, percent = -650; billedUsd: -42.5 is stored verbatim (renders as a measured $-42.50 billed line); limit: -0.5 is stored as the metric's limit.
2. measuredAt is never type-checked. saas-extract.ts:707-708 only requires truthiness and a finite Date.parse(doc.measuredAt). Date.parse coerces its argument, so a JSON array measuredAt: ["2026-10-29T11:59:00.000Z"] passes the freshness gate, and :753 doc.measuredAt.slice(0, 10) then stores the array itself as the service's measuredAt (verified: typeof becomes object). Downstream, freshness() (derive.ts:899) treats its length (1) as a date-only stamp and builds an unparseable string, and tsFor (snapshot-records.ts:37-39) interpolates the array slice into a snapshot record's ts, producing 2026-10-29T11:59:00.000ZT12:00:00Z.

The module's own contract says the opposite: "Missing, failed, unparseable or stale documents change nothing", and the billing branch's comment says a failed billing probe must never render as a measured amount. A corrupted, hand-edited, or older-producer export file currently changes the card — with negative or type-corrupted values presented as the live API read.

House precedent in the same codebase: the quota-current overlay gate rejects a document outright when typeof p.measuredAt !== "string" (src/quota-current.ts:60), and the producer's own parsers reject negative sizes/counts (supabase-export parseDbSize/parseRequestCount).

Evidence

Probe (real applySupabaseExport + extractSaasServices imported from main 7d1b081, Bun): hidden_files/probe-2026-10-29-laneB-supaoverlay/probe.ts

• Case 1 (negative used/billed): used= -3.25 percent= -650 billedUsd= -42.5 sourceClass= api
• Case 2 (negative limit): used= 1 limit= -0.5
• Case 3 (array measuredAt): typeof= object value= ["2026-10-29T11:59:00.000Z"] sourceClass= api
• Case 4 (control, well-formed fresh doc): applies cleanly, measuredAt a string
• Case 5 (control, garbage-string measuredAt): correctly rejected, services unchanged

Related but distinct: #2492 is the producer (billedFromAddons in supabase-quota-export.mjs) accepting negatives at write time. This issue is the consumer gate: even with the producer fixed, the overlay reads a file from disk and must not trust values outside the domain the card renders. #2451 (isFleetFeed saas) is the feed gate for a different input and does not cover this overlay.

Why it matters

The Supabase card is the fleet's paid-trigger surface for the muse-dev project (80%-of-Free-limit flag, billed amounts). Negative or corrupted "measured" values suppress or invert the percent math, fabricate a negative billed amount, and poison snapshot history with an unparseable ts — all under an "api / measured" provenance stamp that tells the reader the numbers are trustworthy.

Acceptance criteria

• applySupabaseExport rejects (changes nothing) or drops the offending metric when used or limit is negative; percent is never computed from a negative used/limit.
• A negative billing.billedUsd is treated as "no valid billing measurement" (the existing billedUsd = null path), never stored.
• doc.measuredAt must be a string before the freshness check (mirror quota-current.ts:60); non-string values change nothing.
• Regression tests in aggregator/test/supabase-export.test.ts for: negative used, negative limit, negative billedUsd, array measuredAt — each leaves the services unchanged (or the metric/billing unset), while the existing fresh-doc tests still pass.