fix(wake): #952 quarantine-audit clean sweep names BOTH unprovable residual classes

Wording-only measurement fix (#951 review finding 1, upgraded to
measurement defect): the clean-sweep OK named only "rows without
surviving dead-letter evidence", so an operator concluded NO evidence
exists when evidence can exist and be UNUSABLE — a surviving dead-letter
row whose locator extracts an empty observed_hash (live specimen: mos-dt
seq 13, bench/malformed-locator-test) can never satisfy the four-field
conviction match, because _record_last_consumed only writes rows with a
non-empty hash. The conviction predicate is UNCHANGED.

- store.sh: clean-sweep message + PROVABILITY BOUND comment name both
  classes ("no evidence" vs "evidence unusable").
- test T17: drives the REAL writer flow (12 fillers + bench key at seq
  13) and plants the VERBATIM live specimen — nested .locators.* with no
  observed_hash key, never a hand-built flat dead-letter row (the #951
  false-defect near-miss); asserts clean sweep exits 0, both classes
  named, no conviction, --repair removes nothing, ledger untouched.
- manifest: wake 0.6.15 -> 0.6.16.

Red-first: pre-fix fails exactly the two wording assertions (and the
non-conviction guards pass pre-fix — predicate correct all along); fixed
18/18. All wake suites green; detector D4 intermittent red is a
pre-existing lock-handoff timing flake in unmodified files, filed as
#966.

Written-by: pepper (sb-it-1-dt)
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/wake/store.sh

@@ -563,10 +563,17 @@ cmd_quarantine_sync() {
 # it on (kind, id, observed_seq, observed_hash) AND row.observed_seq <=
 # consumed_seq: the per-key max_by merge means the surviving row's provenance IS
 # that quarantined entry (a healed row differs in seq/hash and never matches).
-# PROVABILITY BOUND: a row whose dead-letter evidence was pruned/rotated away is
-# NOT provable and is never touched — this audit only ever removes what the
-# ledger can convict. The dead-letter ledger itself is history and is NEVER
-# modified here.
+# PROVABILITY BOUND — TWO residual classes, both unprovable (#952): (1) a row
+# whose dead-letter evidence was pruned/rotated away — no evidence to convict
+# on; (2) a row whose dead-letter evidence SURVIVES but extracts an empty
+# observed_hash (e.g. a deliberately non-conformant locator: nested
+# .locators.* with no observed_hash key) — evidence exists but can never
+# satisfy the four-field match, because _record_last_consumed only ever writes
+# rows with a NON-empty hash. Neither class is touched — this audit only ever
+# removes what the ledger can convict, and the clean-sweep message names BOTH
+# classes: "no evidence" and "evidence unusable" are different operator
+# conclusions. The dead-letter ledger itself is history and is NEVER modified
+# here.
 cmd_quarantine_audit() {
   local repair=0
   while [ $# -gt 0 ]; do
@@ -605,7 +612,7 @@ cmd_quarantine_audit() {
       )) | length) > 0)
   ' "$rec" 2>/dev/null || true)"
   if [ -z "$false_rows" ]; then
-    echo "store.sh quarantine-audit: OK — no provably-false consumed-hash rows (rows without surviving dead-letter evidence are not provable and were not judged)"
+    echo "store.sh quarantine-audit: OK — no provably-false consumed-hash rows. Two residual classes are unprovable and were NOT judged: rows whose dead-letter evidence was pruned/rotated away (no evidence to convict on), and rows whose surviving dead-letter evidence extracts an empty observed_hash (evidence exists but can never satisfy the four-field conviction match)."
     return 0
   fi
   local n row