fix(wake): #952 quarantine-audit clean sweep names BOTH unprovable residual classes (#967)

Closes #952.

GATE RECORD: review CLEAR at this exact head (author != reviewer, pre-registered diff-blind checks) + terminal-green CI at this exact head + queue guard clear.
CI CAVEAT (#973): green on the wake suites is currently WEAKER THAN IT LOOKS, IN BOTH DIRECTIONS. grep error/spawn exit codes are read as absence across 257 assertion sites in six idiom forms; 36 inverted (&&-fail) sites — including 19 credential-security canaries — fail toward GREEN under load. These greens were obtained on solo reruns after load-correlated FALSE reds (2115/2116/2118; main itself was red). This merge's safety therefore rests on the CONTENT review, not on the green. Remediation charter fa551c2d0 is authored and in flight.

Co-authored-by: mos-dt-0 <[email protected]>

packages/mosaic/framework/tools/wake/test-wake-store-ack.sh

@@ -28,6 +28,15 @@
 #   T16 #946 quarantine-audit: consumed-hashes rows provably false against the
 #      dead-letter ledger are reported (exit 1) and removed only under --repair;
 #      healed rows and the ledger itself are untouched
+#   T17 #952 quarantine-audit clean sweep names BOTH unprovable residual
+#      classes: evidence pruned (no evidence) AND evidence surviving with an
+#      empty observed_hash (evidence unusable). Fixture is the VERBATIM live
+#      specimen (mos-dt lane dead-letter seq 13, bench/malformed-locator-test)
+#      — a nested .locators.* row with NO observed_hash key. Do NOT hand-build
+#      a FLAT dead-letter fixture here: consumed-hashes rows are genuinely
+#      flat, dead-letter rows are genuinely nested, and a flat fixture makes
+#      the audit's CORRECT non-conviction look exactly like the defect under
+#      hunt (this false-defect near-miss actually happened in the #951 review)
 #
 # Isolated: every test runs against a fresh WAKE_STATE_HOME temp dir.
 set -uo pipefail
@@ -680,6 +689,50 @@ echo "== T16: #946 — quarantine-audit: a consumed-hash row matching a dead-let
   grep -qi 'OK' "$TMP_ROOT/t16.ok" || fail_msg "T16: a clean audit must say OK [$(cat "$TMP_ROOT/t16.ok")]"
 ) && ok
 
+echo "== T17: #952 — the clean-sweep message names BOTH unprovable residual classes; a surviving-but-empty-hash dead-letter row is correctly NOT convicted =="
+(
+  WAKE_STATE_HOME="$(fresh_state t17)"
+  export WAKE_STATE_HOME
+  unset WAKE_AGENT
+  STATE_DIR="$WAKE_STATE_HOME/default"
+  rec="$STATE_DIR/consumed-hashes.jsonl"
+  dl="$STATE_DIR/dead-letter.jsonl"
+  # Drive the REAL flow so the consumed-hashes row is produced by the actual
+  # writer (_record_last_consumed), not hand-built: 12 fillers, then the bench
+  # key lands at observed_seq 13 — the same seq as the live specimen below.
+  i=1
+  while [ "$i" -le 12 ]; do
+    "$STORE" enqueue --class actionable --locators "{\"kind\":\"filler\",\"id\":\"f$i\",\"observed_hash\":\"HF$i\"}" >/dev/null || fail_msg "T17: filler enqueue $i failed"
+    i=$((i + 1))
+  done
+  "$STORE" enqueue --class actionable --locators '{"kind":"bench","id":"malformed-locator-test","observed_hash":"H-REAL-CONSUMED"}' >/dev/null
+  "$STORE" consume --upto 13 >/dev/null 2>&1 || fail_msg "T17: baseline consume failed"
+  jq_any "$rec" '.kind=="bench" and .id=="malformed-locator-test" and .observed_seq==13 and .observed_hash=="H-REAL-CONSUMED"' ||
+    fail_msg "T17: fixture broken — the real writer did not record the bench@13 row"
+  # VERBATIM live specimen: mos-dt lane dead-letter.jsonl line 1 (2026-07-26).
+  # Copied byte-for-byte per the #952 fixture constraint — nested .locators.*
+  # with NO observed_hash key, so the audit's extraction yields "".
+  printf '%s\n' '{"observed_seq":13,"locators":{"kind":"bench","id":"malformed-locator-test","note":"deliberately non-conformant"},"class":"actionable","emit_ts":1785055610,"hmac":""}' >"$dl"
+  # Guard the near-miss trap: the specimen must be genuinely NESTED (no
+  # top-level kind) and must extract an EMPTY hash via the audit's own paths.
+  jq -e '(has("kind") | not) and .locators.kind=="bench" and ((.locators.observed_hash // "") == "")' "$dl" >/dev/null ||
+    fail_msg "T17: specimen fixture is not the genuine nested shape — rebuild it from the live lane, not the schema"
+  # Evidence SURVIVES (kind/id/seq all match the row) but extracts hash "";
+  # _record_last_consumed never writes an empty-hash row, so the four-field
+  # match can never fire: this is unprovable class 2, NOT a false witness.
+  rep="$TMP_ROOT/t17.rep"
+  "$STORE" quarantine-audit >"$rep" 2>&1 || fail_msg "T17: the audit must exit 0 — nothing here is provable [$(cat "$rep")]"
+  grep -q 'FALSE WITNESS' "$rep" && fail_msg "T17: the empty-hash evidence must NOT convict (the predicate is correct and must not change) [$(cat "$rep")]"
+  # The wording under test (#952): BOTH residual classes, named.
+  grep -qi 'pruned' "$rep" || fail_msg "T17: clean sweep must name residual class 1 — evidence pruned away [$(cat "$rep")]"
+  grep -qi 'empty observed_hash' "$rep" || fail_msg "T17: clean sweep must name residual class 2 — surviving evidence with an empty observed_hash [$(cat "$rep")]"
+  # --repair on a clean sweep removes nothing: the unprovable row survives.
+  "$STORE" quarantine-audit --repair >"$TMP_ROOT/t17.fix" 2>&1 || fail_msg "T17: --repair on a clean sweep must exit 0 [$(cat "$TMP_ROOT/t17.fix")]"
+  jq_any "$rec" '.kind=="bench" and .observed_seq==13 and .observed_hash=="H-REAL-CONSUMED"' ||
+    fail_msg "T17: --repair must NOT remove the unprovable bench@13 row — the audit only removes what the ledger can convict"
+  [ "$(grep -c . "$dl")" = "1" ] || fail_msg "T17: the dead-letter LEDGER must be untouched"
+) && ok
+
 echo
 if [ -s "$FAILFILE" ]; then
   echo "wake store/ack harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2