fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier

Live pilot finding #6 (BLOCKING): a reconciler enumeration enqueued
class=actionable with soft locators {kind,id,path,observed_hash} failed
§2.1's ACTIONABLE hard-locator taxonomy, so digest render exit-4'd the
ENTIRE cumulative-state drain — 4 consecutive timer failures, NOTHING
delivered, including clean unrelated entries (head-of-line blocking).

FIX 1 (quarantine, don't wedge): digest.sh cmd_render's fail-loud pass is
now PER-ENTRY. A render-refused ACTIONABLE entry (no hard locator) is
DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm and
EXCLUDED, while the REST of the cumulative set still renders (exit 0). The
bad entry is accounted-for, never silently dropped; one malformed entry can
no longer wedge the whole drain.

FIX 2 (AMENDED — render-tier, NOT class=digest): reconcile.sh's store class
is UNCHANGED (non-coalescing) — the naive class=digest was rejected because
store §2.3/T2 coalescing would silently collapse distinct enumerations
(proven: reconcile R6 goes RED). Instead digest.sh's actionable-classifier
now treats locators.reconciled==true (set only by reconcile.sh; not
source-forgeable) as ORIENTATION-tier: gate-exempt, rendered as an
orientation pointer via _locator_line's digest-class vocabulary. No exit-4,
no wedge, no coalescing loss; §2.3/T2/G3-R6 intact.

RED-FIRST: new test-wake-digest-quarantine.sh (openssl-independent) proves
(a) malformed {kind,id,path,observed_hash} quarantines while a clean sibling
still delivers, (b) a reconciled enumeration renders orientation-tier (no
exit-4), (c) TWO distinct enumerations both survive as separate orientation
renders (anti-collapse — the class=digest silent-drop we rejected), and the
preserved per-entry actionable fail-loud. D2/D6 in test-wake-digest-hmac.sh
updated from whole-digest exit-4 to per-entry quarantine. Wake manifest
bumped 0.6.2 -> 0.6.3 + inventory.

Closes #920
Part of #892

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

packages/mosaic/framework/tools/wake/manifest.txt

@@ -45,8 +45,26 @@
 #              pointer carries a usable (soft) locator instead of rendering
 #              empty. Display-only: the ACTIONABLE-tier hard-locator FAIL-LOUD
 #              gate (_has_hard_locator, exit 4) is unchanged.
+#   0.6.3  #920 digest.sh drain-quarantine + reconciler-enumeration render tier
+#              (live wake-pilot finding #6, BLOCKING). (a) PER-ENTRY
+#              QUARANTINE: a render-refused ACTIONABLE entry (no §2.1 hard
+#              locator) is now DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl +
+#              a loud per-entry alarm and EXCLUDED, while the REST of the
+#              cumulative set still renders (exit 0). Replaces the whole-digest
+#              exit-4 that let ONE malformed entry wedge the entire drain (head-
+#              of-line blocking — 4 consecutive live timer failures, nothing
+#              delivered). Fail-loud is preserved, now per-entry; the bad entry
+#              is never silently dropped. (b) Reconciler ENUMERATIONS render
+#              ORIENTATION-tier: an entry whose locators carry reconciled==true
+#              (set only by reconcile.sh) is EXEMPT from the actionable hard-
+#              locator gate and renders as an orientation pointer via
+#              _locator_line's digest-class vocabulary — a RENDER-layer change
+#              only. reconcile.sh's STORE class is UNCHANGED (non-coalescing), so
+#              distinct enumerations never collapse (§2.3/T2/G3-R6 intact); the
+#              rejected class=digest alternative would have silently coalesced
+#              them. store.sh and reconcile.sh are UNCHANGED by 0.6.3.
 component=wake
-version=0.6.2
+version=0.6.3
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -60,7 +78,11 @@ schema_max=1
 #   store.sh    A2 — three-cursor durable store + drain lib.           (W2)
 #   ack.sh      A4 — RECEIVED/CONSUMED ack-wrapper (local-write + ship). (W2)
 #   digest.sh   A3 — cumulative-state digest renderer (hard locators,
-#                    two-tier trust, injection/secret scrub).           (W3)
+#                    two-tier trust, injection/secret scrub). PER-ENTRY
+#                    quarantine: a render-refused entry is dead-lettered +
+#                    alarmed + excluded, the rest still renders (no head-of-line
+#                    block); reconciler enumerations (reconciled==true) render
+#                    ORIENTATION-tier, gate-exempt.                  (W3, #920)
 #   sign.sh     A5 — non-circular HMAC signer (independent wake_id,
 #                    load_credentials by-name; fills the hmac placeholder). (W3)
 #   detector.sh A1 — per-host single-instance delta-gated detector daemon