fix(wake): #946 digest ack watermark clamped at quarantined seqs — disclose AND clamp (#951)

Closes #946.

The digest omitted a quarantined entry's claim from disclosure while still advancing the ack watermark it instructed the consumer to run — converting a fail-safe HOLD into a silent DISCARD, through the documented normal path. Measured: the burial instruction was re-issued FIVE times, four fresh digests plus one system-initiated redelivery fired purely because the entry had gone unconsumed for 1826s. That redelivery is the proof of the 'indefinitely' half: the mechanism re-asserted itself with no new information.

SCOPE — this was NOT a missing check in the consume path. Measured before the fix: dead-letter occurrences were digest.sh 27, store.sh 0, ack.sh 0, detector.sh 0, reconcile.sh 0. Quarantine was owned ENTIRELY by the renderer; the store that advances the watermark had zero knowledge the ledger existed, so an entry could be quarantined by one subsystem and consumed by another with no possible interaction. The fix is therefore a deliberate cross-module decision — option (b), quarantine recorded into a store-owned file, preserving the existing direction of dependency — pre-registered by the consumer before any diff existed.

VERIFICATION
- Pipeline 2107 terminal SUCCESS at e11bc6622, read clone-inclusive from the provider API rather than through `pipeline-status.sh` (which filters `.type != "clone"` per workflow and would hide a clone failure behind an all-green table): 9/9 children success, exit 0 each, no non-success member. Its `test` step runs all nine wake harnesses via turbo -> packages/mosaic `test` -> `test:framework-shell`.
- Independent review by the consumer on the affected lane: eleven pre-registered acceptance checks, authored and delivered BEFORE the diff was read — the file list deliberately unlooked-at, because a filename alone would have disclosed which option was chosen. All eleven resolved, no blocker.
- The check that decides it: a RAW `ack.sh consumed --upto N` with no digest involved must refuse to advance past a quarantined seq — the case an agent hits when a digest is MISSED, and the one that would have sunk a disclosure-only fix. Covered at the head as a named assertion (T13 ordinary-path bypass), written independently of the reviewer's list.
- Mutation: one asserted site disabled -> TWELVE assertions die, every one BEHAVIOURAL, ZERO count assertions, including one killing across the module boundary the fix spans.
- RED control at base a6b5f6a: 34 and 10 assertions fail, matching the body exactly.
- Coordinator re-verify by a different instrument than the reviewer used: static reference counts across the base/head boundary — store.sh 0 -> 49, ack.sh 0 -> 6, `--agent` unchanged at 4 (so #949 correctly stayed out). A fix present-but-inert passes the count and fails the mutation; a fix behaviourally correct but smuggling #949 passes the mutation and fails the count. Neither result is reachable by repeating the other.

KNOWN RESIDUALS
- The `consumed-hashes` repair criterion is met only for keys that RE-EMIT. A corrupted row whose key never recurs stays false indefinitely; the sweep covers those, and the known-false row named in the acceptance criteria had already self-healed by re-emission rather than by design — safe by population, not by design.
- The audit's clean-sweep message names one unprovable class; a second exists (a surviving dead-letter row with an empty `observed_hash` cannot be convicted either). Wording, not logic. Filed separately.
- The audit's provability bound makes dead-letter RETENTION load-bearing for auditability. Nothing prunes it today, so this is latent — but any future rotation or size cap silently converts provable rows into unprovable ones with no signal at either end. This is not a defect; it is a property that BECAME load-bearing and is recorded nowhere. Filed separately.
- `test-wake-detector.sh` D4 fails at this head AND identically at base, with an empty diff over detector files — pre-existing, tracked, not introduced here.

Authored by pepper (sb-it-1-dt); reviewed independently by mos-dt (sb-it-1-dt). The mos-dt-0 commit and fork identity does not identify the author — attribution collapse tracked separately.

Co-authored-by: mos-dt-0 <[email protected]>

packages/mosaic/framework/tools/wake/ack.sh

@@ -54,6 +54,16 @@ Commands:
                                          Local-write only; a background sync
                                          ships it (never blocks on network).
                                          --no-sync suppresses the background ship.
+                                         --force-past-quarantine passes the #946
+                                         force flag through to store.sh consume:
+                                         the ONLY way to advance past a
+                                         QUARANTINED (dead-lettered, never
+                                         delivered) seq. The store's per-seq
+                                         step-over diagnostics are re-emitted on
+                                         stderr; no consumed-hash witness is
+                                         recorded for the quarantined entry.
+                                         Without the flag, a consume that would
+                                         cross a quarantined seq is REFUSED.
   embed --upto N [--wake-id ID] [--agent A]
                                          Print the copy-run ack line to EMBED in
                                          a digest (does not perform the ack).
@@ -169,7 +179,7 @@ cmd_received() {
 
 cmd_consumed() {
   _need_jq
-  local upto='' wake_id='' do_sync="1"
+  local upto='' wake_id='' do_sync="1" force="0"
   while [ $# -gt 0 ]; do
     case "$1" in
     --upto)
@@ -184,6 +194,10 @@ cmd_consumed() {
       do_sync="0"
       shift
       ;;
+    --force-past-quarantine)
+      force="1"
+      shift
+      ;;
     *)
       echo "ack.sh consumed: unknown option '$1'" >&2
       exit 2
@@ -200,11 +214,25 @@ cmd_consumed() {
   # Advance consumed_seq via the store. The store enforces the CONTIGUOUS
   # gapless-prefix rule and rejects a gap (cannot ack N while N-1 unconsumed).
   # This is a LOCAL-WRITE cursor advance — no network.
-  local new_cursor
-  if ! new_cursor="$("$STORE_SH" consume --upto "$upto" 2>&1)"; then
+  local new_cursor store_args
+  store_args=(consume --upto "$upto")
+  if [ "$force" = "1" ]; then
+    store_args+=(--force-past-quarantine)
+  fi
+  if ! new_cursor="$("$STORE_SH" "${store_args[@]}" 2>&1)"; then
     echo "ack.sh consumed: refused — $new_cursor" >&2
     exit 1
   fi
+  if [ "$force" = "1" ]; then
+    # #946: on the forced path the store's LOUD per-seq step-over diagnostics
+    # were captured together with the cursor line (2>&1 above). Re-emit them on
+    # OUR stderr — the loudness must survive the wrapper — and keep only the
+    # final line (the cursor) for the CONSUMED report below.
+    local cursor_line
+    cursor_line="$(printf '%s\n' "$new_cursor" | tail -n1)"
+    printf '%s\n' "$new_cursor" | sed '$d' | grep -v '^[[:space:]]*$' >&2 || true
+    new_cursor="$cursor_line"
+  fi
 
   # Record the CONSUMED ack in the local ledger (still no network).
   local record