fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier (reconciled:true, render-tier not class=digest) (#922)

Co-authored-by: jason.woltje <jason@diversecanvas.com> Co-committed-by: jason.woltje <jason@diversecanvas.com>
2026-07-26 08:45:51 +00:00
parent 712c770b7a
commit 937a276208
5 changed files with 378 additions and 82 deletions
--- a/packages/mosaic/framework/tools/wake/digest.sh
+++ b/packages/mosaic/framework/tools/wake/digest.sh
@@ -26,8 +26,23 @@
 #
 # HARD LOCATORS (§2.1): every actionable claim MUST carry a precise locator
 # (repo + issue#, a 40-char SHA, or file:anchor) so re-verification is ONE
-# targeted call. A missing locator = malformed digest = FAIL-LOUD (non-zero
+# targeted call. A missing locator = malformed ACTIONABLE entry = FAIL-LOUD.
-# exit, NOTHING emitted) — never a silent send.
+#
 # #920 (per-entry quarantine — fail-loud WITHOUT head-of-line blocking): a
 # render-refused entry (actionable-tier, no hard locator) is QUARANTINED — durably
 # DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a LOUD per-entry alarm — and
 # EXCLUDED from this drain, while the REST of the cumulative set still renders
 # (exit 0). The bad entry is accounted-for (never silently dropped); it can no
 # longer wedge the whole drain (the live pilot defect: one malformed entry
 # exit-4'd the entire cumulative-state drain, delivering NOTHING).
 #
 # #920 (amended FIX 2 — reconciler enumerations are ORIENTATION-tier): a
 # reconciler ENUMERATION carries locators.reconciled==true (set ONLY by
 # reconcile.sh). Enumerations are self-orienting STATE-POINTERS, never
 # consequential claims, so they are EXEMPT from the actionable hard-locator gate
 # and render as ORIENTATION pointers via _locator_line's digest-class vocabulary
 # (kind/id/observed_hash/path/…). Their STORE class is left UNCHANGED (non-
 # coalescing) so distinct enumerations never collapse (§2.3/T2/G3-R6 intact).
 #
 # BOUNDING / INJECTION / SECRETS (§2.1): link-not-inline (pointers + bounded
 # summary; raw diffs/logs stay at rest). Source free-text is NEVER instruction-
@@ -71,8 +86,13 @@ Options:
  --max-free-text N       cap for a quoted untrusted block (default: 200 chars).
 Exit codes:
-  0  digest rendered.
+  0  digest rendered. Any render-refused ACTIONABLE entry (no §2.1 hard locator)
-  4  FAIL-LOUD: an actionable claim carried no hard locator (malformed digest).
+     is QUARANTINED — DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a loud
     per-entry alarm — and EXCLUDED; the rest of the cumulative set still renders
     (#920: fail-loud is per-entry, never a whole-drain wedge). Reconciler
     enumerations (locators.reconciled==true) render ORIENTATION-tier, gate-exempt.
  2  usage error.
  3  jq is required but missing.
 Environment:
  WAKE_STATE_HOME  override base state dir (XDG by default).
@@ -252,6 +272,68 @@ _free_text() {
  ' <<<"$1"
 }
 # _actionable_tier LINE — echo "1" iff the entry is ACTIONABLE-tier (subject to
 # the §2.1 hard-locator gate and rendered as a CLAIM@seq), else "0". Shared by
 # the quarantine pass AND the actionable render loop so both classify identically
 # (no entry can render as a CLAIM@seq without having passed the gate).
 #
 # Actionable-tier = class "actionable" OR any entry whose locators carry a
 # `claim` OR a top-level `claim` (a consequential fact) — matching the render
 # tier's `.claim // .locators.claim` precedence.
 #
 # #920 (amended FIX 2): a reconciler ENUMERATION carries locators.reconciled==true
 # (set ONLY by reconcile.sh — the detector's locator whitelist
 # {kind,id,observed_hash}+{repo,path,anchor,remote,branches} cannot express it, so
 # a source cannot forge it). Enumerations are ORIENTATION-tier state-pointers, NOT
 # consequential claims, so they are EXEMPT from actionable classification (hence
 # from the hard-locator/quarantine gate) and render as orientation pointers via
 # _locator_line. Their STORE class is untouched (non-coalescing) so distinct
 # enumerations never collapse (§2.3/T2/G3-R6 intact — the class=digest silent-drop
 # that was REJECTED).
 _actionable_tier() {
  local line="$1" loc
  loc="$(jq -c '.locators // {}' <<<"$line")"
  # Orientation exemption FIRST: a reconciler enumeration is never actionable-tier.
  if jq -e '(.reconciled // false) == true' >/dev/null 2>&1 <<<"$loc"; then
    printf '0'
    return 0
  fi
  if [ "$(jq -r '.class // "actionable"' <<<"$line")" = "actionable" ]; then
    printf '1'
    return 0
  fi
  if jq -e 'has("claim") and ((.claim // "") != "")' >/dev/null 2>&1 <<<"$loc"; then
    printf '1'
    return 0
  fi
  if jq -e 'has("claim") and ((.claim // "") != "")' >/dev/null 2>&1 <<<"$line"; then
    printf '1'
    return 0
  fi
  printf '0'
 }
 # _quarantine_entry LINE SEQ — QUARANTINE a render-refused entry (#920): append it
 # verbatim to the durable dead-letter ledger ($STATE_DIR/dead-letter.jsonl, atomic
 # write) and raise a LOUD per-entry fail-loud alarm on stderr. The entry is thereby
 # accounted-for (never silently dropped) without wedging the rest of the
 # cumulative-state drain. The append is idempotent (a still-pending malformed entry
 # is re-drained every timer tick) so the ledger stays bounded. A dead-letter write
 # failure is itself alarmed but never aborts the drain — the good entries MUST
 # still deliver (availability is the whole point of #920).
 _quarantine_entry() {
  local line="$1" seq="$2" dlq="$STATE_DIR/dead-letter.jsonl"
  if [ ! -f "$dlq" ] || ! grep -qxF "$line" "$dlq" 2>/dev/null; then
    local existing
    existing="$(cat "$dlq" 2>/dev/null || true)"
    if ! printf '%s\n%s\n' "$existing" "$line" | grep -v '^[[:space:]]*$' | _atomic_write "$dlq"; then
      echo "digest.sh: FAIL-LOUD QUARANTINE (#920) — malformed ACTIONABLE entry at observed_seq=$seq has no §2.1 hard locator AND the durable dead-letter write to $dlq FAILED. The entry is EXCLUDED from this digest and loudly surfaced here; investigate immediately." >&2
      return 0
    fi
  fi
  echo "digest.sh: FAIL-LOUD QUARANTINE (#920) — malformed ACTIONABLE entry at observed_seq=$seq has no §2.1 hard locator (repo+issue#/40-char SHA/file:anchor). DEAD-LETTERED to $dlq and EXCLUDED from this digest; the rest of the cumulative set still renders (no head-of-line block). Re-feed the source with a valid hard locator." >&2
 }
 cmd_render() {
  _need_jq
  local src='store' from_file='' lane="${WAKE_LANE:-}" board_head='' \
@@ -284,35 +366,35 @@ cmd_render() {
  local observed consumed depth
  observed="$(_wake_read_int "$STATE_DIR/observed_seq" 0)"
  consumed="$(_wake_read_int "$STATE_DIR/consumed_seq" 0)"
  depth="$(printf '%s\n' "$pending" | grep -c . || true)"
-  # --- FAIL-LOUD PASS FIRST (§2.1): validate every actionable claim carries a
+  # --- QUARANTINE PASS FIRST (§2.1 fail-loud, PER-ENTRY — #920) --------------
-  # hard locator BEFORE emitting a single byte. A malformed digest must never be
+  # Partition the cumulative set into the DELIVERABLE set (pending_ok) and the
-  # partially sent. Actionable-tier = class "actionable" OR any entry whose
+  # render-refused entries. An ACTIONABLE-tier entry (per _actionable_tier) that
-  # locators carry a `claim` OR a top-level `claim` (a consequential fact) —
+  # carries NO §2.1 hard locator is QUARANTINED — durably DEAD-LETTERED + a loud
-  # matching the render tier's `.claim // .locators.claim` precedence, so no
+  # per-entry alarm — and EXCLUDED, while every OTHER entry still renders (exit 0).
-  # entry can render as a CLAIM@seq without passing this gate. -------------
+  # This preserves fail-loud (the bad entry is accounted-for, never silently
-  local line class loc is_actionable
+  # dropped) WITHOUT letting one malformed entry wedge the whole drain (the live
  # #920 head-of-line-blocking defect that exit-4'd the entire cumulative-state
  # drain). Reconciler enumerations (locators.reconciled==true) are ORIENTATION-
  # tier and gate-exempt, so they pass straight through to the deliverable set.
  local line loc seq pending_ok='' quarantined=0
  while IFS= read -r line; do
    [ -n "$line" ] || continue
    printf '%s' "$line" | jq -e . >/dev/null 2>&1 || continue
-    class="$(jq -r '.class // "actionable"' <<<"$line")"
+    if [ "$(_actionable_tier "$line")" = "1" ]; then
      loc="$(jq -c '.locators // {}' <<<"$line")"
-    is_actionable=0
+      if ! _has_hard_locator "$loc"; then
    [ "$class" = "actionable" ] && is_actionable=1
    if jq -e 'has("claim") and ((.claim // "") != "")' >/dev/null 2>&1 <<<"$loc"; then
      is_actionable=1
    fi
    if jq -e 'has("claim") and ((.claim // "") != "")' >/dev/null 2>&1 <<<"$line"; then
      is_actionable=1
    fi
    if [ "$is_actionable" = "1" ] && ! _has_hard_locator "$loc"; then
      local seq
        seq="$(jq -r '.observed_seq // "?"' <<<"$line")"
-      echo "digest.sh: FAIL-LOUD — malformed digest: actionable claim at observed_seq=$seq has no hard locator (repo+issue#/40-char SHA/file:anchor). Refusing to render (§2.1)." >&2
+        _quarantine_entry "$line" "$seq"
-      exit 4
+        quarantined=$((quarantined + 1))
        continue
      fi
    fi
    pending_ok="$pending_ok$line"$'\n'
  done <<<"$pending"
  # The deliverable cumulative set is the input MINUS the quarantined entries.
  pending="$(printf '%s' "$pending_ok" | grep -v '^[[:space:]]*$' || true)"
  depth="$(printf '%s\n' "$pending" | grep -c . || true)"
  # --- render (all validated) ----------------------------------------------
  local n_actionable=0
@@ -348,14 +430,13 @@ cmd_render() {
      while IFS= read -r line; do
        [ -n "$line" ] || continue
        printf '%s' "$line" | jq -e . >/dev/null 2>&1 || continue
-        local aclass aloc a_is claim seq ft
+        local aloc claim seq ft
-        aclass="$(jq -r '.class // "actionable"' <<<"$line")"
+        # #920: _actionable_tier EXEMPTS reconciler enumerations (reconciled==true)
        # so they never render as a CLAIM@seq — they are ORIENTATION-tier pointers
        # only. Same classifier as the quarantine pass (single source of truth).
        [ "$(_actionable_tier "$line")" = "1" ] || continue
        aloc="$(jq -c '.locators // {}' <<<"$line")"
        a_is=0
        [ "$aclass" = "actionable" ] && a_is=1
        claim="$(jq -r '.claim // (.locators.claim) // ""' <<<"$line")"
        [ -n "$claim" ] && a_is=1
        [ "$a_is" = "1" ] || continue
        seq="$(jq -r '.observed_seq // "?"' <<<"$line")"
        printf '  * seq %s — CLAIM@seq (point-in-time; UNTRUSTED — VERIFY LIVE, do NOT act on this line):\n' "$seq"
        if [ -n "$claim" ]; then
--- a/packages/mosaic/framework/tools/wake/manifest.txt
+++ b/packages/mosaic/framework/tools/wake/manifest.txt
@@ -57,8 +57,26 @@
 #              FAIL-LOUD, and the secret-scrub/SHA-preservation contract are all
 #              unchanged — this makes the existing scrub deterministic across
 #              runners, it does not weaken it.
 #   0.6.4  #920 digest.sh drain-quarantine + reconciler-enumeration render tier
 #              (live wake-pilot finding #6, BLOCKING). (a) PER-ENTRY
 #              QUARANTINE: a render-refused ACTIONABLE entry (no §2.1 hard
 #              locator) is now DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl +
 #              a loud per-entry alarm and EXCLUDED, while the REST of the
 #              cumulative set still renders (exit 0). Replaces the whole-digest
 #              exit-4 that let ONE malformed entry wedge the entire drain (head-
 #              of-line blocking — 4 consecutive live timer failures, nothing
 #              delivered). Fail-loud is preserved, now per-entry; the bad entry
 #              is never silently dropped. (b) Reconciler ENUMERATIONS render
 #              ORIENTATION-tier: an entry whose locators carry reconciled==true
 #              (set only by reconcile.sh) is EXEMPT from the actionable hard-
 #              locator gate and renders as an orientation pointer via
 #              _locator_line's digest-class vocabulary — a RENDER-layer change
 #              only. reconcile.sh's STORE class is UNCHANGED (non-coalescing), so
 #              distinct enumerations never collapse (§2.3/T2/G3-R6 intact); the
 #              rejected class=digest alternative would have silently coalesced
 #              them. store.sh and reconcile.sh are UNCHANGED by 0.6.4.
 component=wake
-version=0.6.3
+version=0.6.4
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -72,7 +90,11 @@ schema_max=1
 #   store.sh    A2 — three-cursor durable store + drain lib.           (W2)
 #   ack.sh      A4 — RECEIVED/CONSUMED ack-wrapper (local-write + ship). (W2)
 #   digest.sh   A3 — cumulative-state digest renderer (hard locators,
-#                    two-tier trust, injection/secret scrub).           (W3)
+#                    two-tier trust, injection/secret scrub). PER-ENTRY
 #                    quarantine: a render-refused entry is dead-lettered +
 #                    alarmed + excluded, the rest still renders (no head-of-line
 #                    block); reconciler enumerations (reconciled==true) render
 #                    ORIENTATION-tier, gate-exempt.                  (W3, #920)
 #   sign.sh     A5 — non-circular HMAC signer (independent wake_id,
 #                    load_credentials by-name; fills the hmac placeholder). (W3)
 #   detector.sh A1 — per-host single-instance delta-gated detector daemon
--- a/packages/mosaic/framework/tools/wake/test-wake-digest-hmac.sh
+++ b/packages/mosaic/framework/tools/wake/test-wake-digest-hmac.sh
@@ -7,8 +7,9 @@
 # that invariant regresses:
 #   D1 CUMULATIVE-STATE: two still-pending changes both render (not just the
 #      latest delta) — a delta would silently drop the older change.      (§2.1)
-#   D2 HARD-LOCATOR enforcement: an actionable claim with no precise locator
+#   D2 HARD-LOCATOR enforcement: an actionable claim with no precise locator is
-#      FAILS LOUD (non-zero exit, nothing emitted).                       (§2.1)
+#      QUARANTINED — dead-lettered + alarmed + excluded — never delivered as
 #      valid (fail-loud PER-ENTRY, #920; the rest of the drain still renders). (§2.1)
 #   D3 TWO-TIER trust: orientation decides the no-op case with ZERO tool calls;
 #      an actionable fact is a CLAIM-TO-VERIFY, never auto-actioned.       (§2.1)
 #   D4 SCRUB: a secret-canary + ANSI/bidi/zero-width in SOURCE free-text is
@@ -27,7 +28,8 @@
 #      digest-class entry (the shape detector.sh actually enqueues:
 #      kind/id/observed_hash/remote/path, not repo/issue/sha/file) carries a
 #      non-empty, usable locator — and the ACTIONABLE-tier hard-locator
-#      FAIL-LOUD (exit 4) is UNCHANGED for a malformed actionable claim.  (§2.1)
+#      FAIL-LOUD is PRESERVED (now per-entry quarantine, #920) for a malformed
 #      actionable claim.                                                  (§2.1)
 #
 # Isolated: every test runs against a fresh temp state / credential file.
 set -uo pipefail
@@ -109,60 +111,71 @@ echo "== D1: CUMULATIVE-STATE — two pending changes BOTH render (not just late
  echo "$out" | grep -q 'pending=2' || fail_msg "D1: cumulative pending count wrong (expected 2)"
 ) && ok
-echo "== D2: HARD-LOCATOR enforcement — actionable claim with no locator FAILS LOUD =="
+echo "== D2: HARD-LOCATOR enforcement — a malformed actionable claim is QUARANTINED (fail-loud PER-ENTRY, #920); never delivered as valid =="
 (
-  WAKE_STATE_HOME="$(fresh_state d2)"
+  h="$(fresh_state d2)"
  WAKE_STATE_HOME="$h"
  export WAKE_STATE_HOME
  unset WAKE_AGENT WAKE_LANE
  # An actionable claim carrying NO hard locator (no repo+issue / sha / file).
  "$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"mergeable=true"}' >/dev/null
-  if out="$("$DIGEST" render 2>/dev/null)"; then
+  err="$TMP_ROOT/d2.err"
    fail_msg "D2: malformed digest (actionable, no locator) must FAIL, but render succeeded"
  fi
  rc=0
-  "$DIGEST" render >/dev/null 2>&1 || rc=$?
+  out="$("$DIGEST" render 2>"$err")" || rc=$?
-  [ "$rc" -eq 4 ] || fail_msg "D2: expected fail-loud exit 4, got $rc"
+  # #920: NO longer a whole-digest exit-4 — the malformed entry is QUARANTINED
-  # Nothing emitted on stdout when malformed (no silent partial send).
+  # (dead-lettered + alarmed + excluded) and the digest STILL renders (exit 0),
-  [ -z "${out:-}" ] || fail_msg "D2: a malformed digest emitted body instead of failing loud [$out]"
+  # but the unlocated claim is NEVER delivered as a valid CLAIM (fail-loud is
-  # A present-but-imprecise sha (not 40 hex) does NOT satisfy the hard locator.
+  # preserved, now per-entry). The old exit-4 wedged the entire drain (#920).
-  WAKE_STATE_HOME="$(fresh_state d2b)"
+  [ "$rc" -eq 0 ] || fail_msg "D2: a malformed actionable must be quarantined (render exit 0, #920), got $rc"
  printf '%s' "$out" | grep -q 'mergeable=true' && fail_msg "D2: an unlocated actionable claim must NOT be delivered as a valid CLAIM"
  grep -q 'mergeable=true' "$h/default/dead-letter.jsonl" 2>/dev/null || fail_msg "D2: the malformed claim must be DEAD-LETTERED (fail-loud preserved, per-entry)"
  grep -qi 'QUARANTINE' "$err" || fail_msg "D2: a LOUD per-entry alarm must fire for the malformed claim"
  # A present-but-imprecise sha (not 40 hex) does NOT satisfy the hard locator ->
  # quarantined, not delivered.
  h="$(fresh_state d2b)"
  WAKE_STATE_HOME="$h"
  export WAKE_STATE_HOME
  "$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"ci=green","sha":"abc123"}' >/dev/null
  rc=0
-  "$DIGEST" render >/dev/null 2>&1 || rc=$?
+  out="$("$DIGEST" render 2>/dev/null)" || rc=$?
-  [ "$rc" -eq 4 ] || fail_msg "D2: imprecise sha (not 40-hex) must not satisfy the hard-locator gate (got exit $rc)"
+  [ "$rc" -eq 0 ] || fail_msg "D2: imprecise-sha entry must be quarantined (render exit 0), got $rc"
-  # The SAME claim WITH a precise 40-hex sha renders fine.
+  printf '%s' "$out" | grep -q 'ci=green' && fail_msg "D2: imprecise sha (not 40-hex) must not satisfy the hard-locator gate (claim must not deliver)"
-  WAKE_STATE_HOME="$(fresh_state d2c)"
+  grep -q 'ci=green' "$h/default/dead-letter.jsonl" 2>/dev/null || fail_msg "D2: imprecise-sha claim must be dead-lettered"
  # The SAME claim WITH a precise 40-hex sha renders fine (delivered, not quarantined).
  h="$(fresh_state d2c)"
  WAKE_STATE_HOME="$h"
  export WAKE_STATE_HOME
  "$STORE" enqueue --seq 1 --class actionable --locators "$(jq -cn --arg s "$SHA40" '{claim:"ci=green",sha:$s}')" >/dev/null
-  "$DIGEST" render >/dev/null 2>&1 || fail_msg "D2: a well-located actionable claim must render"
+  out="$("$DIGEST" render 2>/dev/null)" || fail_msg "D2: a well-located actionable claim must render"
-  # --- #905: a NON-CANONICAL entry with a TOP-LEVEL `.claim` (store.sh never
+  printf '%s' "$out" | grep -q "$SHA40" || fail_msg "D2: a well-located actionable claim must be DELIVERED"
-  # emits this shape; only .locators.claim is canonical) and EMPTY .locators,
+  [ -s "$h/default/dead-letter.jsonl" ] && fail_msg "D2: a well-located claim must NOT be quarantined"
-  # fed via --stdin / --from-file, must ALSO fail loud. The render tier honors
+  # --- #905 bypass-prevention (STILL enforced, now via quarantine): a NON-
-  # `.claim // .locators.claim` (renders CLAIM@seq either way), so the
+  # CANONICAL entry with a TOP-LEVEL `.claim` (store.sh never emits this shape;
-  # fail-loud gate must cover top-level .claim too, else a hand-crafted /
+  # only .locators.claim is canonical) and EMPTY .locators, fed via --stdin /
-  # non-canonical caller could bypass the hard-locator gate entirely.
+  # --from-file, must ALSO be gated. The classifier honors `.claim //
-  WAKE_STATE_HOME="$(fresh_state d2d)"
+  # .locators.claim`, so a hand-crafted caller cannot bypass the hard-locator gate
  # — the entry is QUARANTINED (not delivered), not silently rendered.
  h="$(fresh_state d2d)"
  WAKE_STATE_HOME="$h"
  export WAKE_STATE_HOME
-  toplevel_claim_entry='{"class":"reaction","claim":"mergeable=true","locators":{}}'
+  toplevel_claim_entry='{"observed_seq":1,"class":"reaction","claim":"mergeable=true","locators":{}}'
  out=""
  if out="$(printf '%s\n' "$toplevel_claim_entry" | "$DIGEST" render --stdin 2>/dev/null)"; then
    fail_msg "D2(#905): top-level .claim + empty locators must FAIL via --stdin, but render succeeded"
  fi
  [ -z "${out:-}" ] || fail_msg "D2(#905): --stdin top-level-.claim bypass emitted body instead of failing loud [$out]"
  rc=0
-  printf '%s\n' "$toplevel_claim_entry" | "$DIGEST" render --stdin >/dev/null 2>&1 || rc=$?
+  out="$(printf '%s\n' "$toplevel_claim_entry" | "$DIGEST" render --stdin 2>/dev/null)" || rc=$?
-  [ "$rc" -eq 4 ] || fail_msg "D2(#905): expected fail-loud exit 4 for top-level .claim via --stdin, got $rc"
+  [ "$rc" -eq 0 ] || fail_msg "D2(#905): top-level .claim must be quarantined via --stdin (exit 0), got $rc"
  printf '%s' "$out" | grep -q 'mergeable=true' && fail_msg "D2(#905): --stdin top-level-.claim must NOT be delivered (gate not bypassed)"
  grep -q 'mergeable=true' "$h/default/dead-letter.jsonl" 2>/dev/null || fail_msg "D2(#905): --stdin top-level .claim must be dead-lettered (gate enforced)"
  ff="$TMP_ROOT/d2d-entry.jsonl"
  printf '%s\n' "$toplevel_claim_entry" >"$ff"
-  out2=""
+  h="$(fresh_state d2e)"
-  if out2="$("$DIGEST" render --from-file "$ff" 2>/dev/null)"; then
+  WAKE_STATE_HOME="$h"
-    fail_msg "D2(#905): top-level .claim + empty locators must FAIL via --from-file, but render succeeded"
+  export WAKE_STATE_HOME
  fi
  [ -z "${out2:-}" ] || fail_msg "D2(#905): --from-file top-level-.claim bypass emitted body instead of failing loud [$out2]"
  rc=0
-  "$DIGEST" render --from-file "$ff" >/dev/null 2>&1 || rc=$?
+  out2="$("$DIGEST" render --from-file "$ff" 2>/dev/null)" || rc=$?
-  [ "$rc" -eq 4 ] || fail_msg "D2(#905): expected fail-loud exit 4 for top-level .claim via --from-file, got $rc"
+  [ "$rc" -eq 0 ] || fail_msg "D2(#905): top-level .claim must be quarantined via --from-file (exit 0), got $rc"
  printf '%s' "$out2" | grep -q 'mergeable=true' && fail_msg "D2(#905): --from-file top-level-.claim must NOT be delivered (gate not bypassed)"
  grep -q 'mergeable=true' "$h/default/dead-letter.jsonl" 2>/dev/null || fail_msg "D2(#905): --from-file top-level .claim must be dead-lettered (gate enforced)"
 ) && ok
 echo "== D3: TWO-TIER — orientation no-op with ZERO tool calls; actionable = claim-to-verify =="
@@ -396,14 +409,21 @@ echo "== D6 (#914b): DIGEST-CLASS LOCATOR THREADING — ORIENTATION pointer carr
  printf '%s' "$orientline" | grep -qE 'remote=example/repo|id=r1|kind=repo' ||
    fail_msg "D6: digest-class ORIENTATION pointer does not carry a usable locator [$orientline]"
-  # --- ACTIONABLE-tier hard-locator FAIL-LOUD (exit 4) must be UNCHANGED ------
+  # --- ACTIONABLE-tier hard-locator FAIL-LOUD must be PRESERVED (now PER-ENTRY
-  WAKE_STATE_HOME="$(fresh_state d6b)"
+  # quarantine, #920): a digest-class ORIENTATION pointer (above) renders soft,
  # but a genuine ACTIONABLE claim with no hard locator is still fail-loud — it is
  # QUARANTINED (dead-lettered + alarmed + excluded), never delivered as valid.
  h="$(fresh_state d6b)"
  WAKE_STATE_HOME="$h"
  export WAKE_STATE_HOME
  "$STORE" enqueue --seq 1 --class actionable --locators '{"claim":"mergeable=true"}' >/dev/null
  err="$TMP_ROOT/d6b.err"
  rc=0
-  "$DIGEST" render >/dev/null 2>&1 || rc=$?
+  out="$("$DIGEST" render 2>"$err")" || rc=$?
-  [ "$rc" -eq 4 ] ||
+  [ "$rc" -eq 0 ] || fail_msg "D6: a malformed actionable is now per-entry quarantined (render exit 0, #920), got $rc"
-    fail_msg "D6: actionable claim with no hard locator must still FAIL-LOUD exit 4 (got $rc) — regression in the unrelated hard-locator gate"
+  printf '%s' "$out" | grep -q 'mergeable=true' && fail_msg "D6: a malformed actionable claim must NOT be delivered as valid (fail-loud preserved)"
  grep -q 'mergeable=true' "$h/default/dead-letter.jsonl" 2>/dev/null || fail_msg "D6: a malformed actionable must be DEAD-LETTERED (fail-loud preserved, per-entry)"
  grep -qi 'QUARANTINE' "$err" || fail_msg "D6: a malformed actionable must raise a loud per-entry alarm"
 ) && ok
 echo
--- a/packages/mosaic/framework/tools/wake/test-wake-digest-quarantine.sh
+++ b/packages/mosaic/framework/tools/wake/test-wake-digest-quarantine.sh
@@ -0,0 +1,173 @@
 #!/usr/bin/env bash
 # test-wake-digest-quarantine.sh — RED-FIRST invariant harness for #920 (EPIC
 # #892): per-entry QUARANTINE of a render-refused digest entry (no head-of-line
 # blocking) + reconciler ENUMERATIONS render ORIENTATION-tier.
 #
 # Each test asserts ONE invariant and goes RED against the pre-#920 digest.sh:
 #   Q1 (a) QUARANTINE + REST-DELIVERS: a malformed `actionable` carrying the live
 #          pilot's EXACT locator shape {kind,id,path,observed_hash} (no hard
 #          locator, no reconciled marker) is DEAD-LETTERED + alarmed AND EXCLUDED,
 #          while a clean valid sibling in the SAME drain still renders (exit 0).
 #          RED baseline: the old whole-digest exit-4 delivered NOTHING (the live
 #          head-of-line-blocking wedge).                                    (#920 FIX1)
 #   Q2 (b) ENUM-AS-ORIENTATION: a reconciler enumeration (locators.reconciled==
 #          true) renders as an ORIENTATION-tier pointer and does NOT exit-4 / is
 #          NOT quarantined. RED baseline: reconciled `actionable` + soft locators
 #          {kind,id,path,observed_hash} -> exit-4.                          (#920 FIX2)
 #   Q3 (c) TWO DISTINCT ENUMERATIONS BOTH SURVIVE: two distinct enumerations both
 #          render as SEPARATE orientation pointers (neither coalesced away) — the
 #          anti-collapse proof pinning the amended ruling (the REJECTED class=digest
 #          would have collapsed them to one; store class stays non-coalescing). (#920 FIX2)
 #   Q4     PRESERVED ACTIONABLE FAIL-LOUD: a genuine malformed ACTIONABLE claim
 #          (no reconciled marker, no hard locator) is STILL loudly surfaced
 #          (dead-letter + alarm) and NEVER delivered as if valid — fail-loud is
 #          preserved, now per-entry.                                        (§2.1)
 #   Q5     CLAIM-PRECEDENCE GATED: a non-actionable-class entry that carries a
 #          `claim` (a consequential fact) with no hard locator is STILL gated
 #          (quarantined), and the reconciled exemption does not leak to it.  (§2.1)
 #
 # Hermetic: feeds controlled JSONL via `digest.sh render --from-file` — NO store,
 # NO network, NO openssl (so it runs identically under the CI openssl-mask).
 #
 # Each test runs in its own (..) subshell for env isolation; the per-subshell
 # WAKE_STATE_HOME export is intentional (mirrors test-wake-reconcile.sh).
 # shellcheck disable=SC2030,SC2031
 set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DIGEST="$SCRIPT_DIR/digest.sh"
 command -v jq >/dev/null 2>&1 || {
  echo "SKIP: jq not available" >&2
  exit 0
 }
 TMP_ROOT="$(mktemp -d)"
 trap 'rm -rf "$TMP_ROOT"' EXIT
 FAILFILE="$TMP_ROOT/failures"
 : >"$FAILFILE"
 pass=0
 fail_msg() {
  echo "  FAIL: $*" >&2
  echo "x" >>"$FAILFILE"
 }
 ok() { pass=$((pass + 1)); }
 # A 40-hex sha = a valid §2.1 hard locator.
 SHA40="abcdef0123456789abcdef0123456789abcdef01"
 # fresh_home NAME — a fresh WAKE_STATE_HOME dir, echoed.
 fresh_home() {
  local d="$TMP_ROOT/$1"
  rm -rf "$d"
  mkdir -p "$d"
  printf '%s' "$d"
 }
 # dlq HOME — the dead-letter path for the default agent under HOME.
 dlq() { printf '%s/default/dead-letter.jsonl' "$1"; }
 echo "== Q1 (a): malformed {kind,id,path,observed_hash} QUARANTINES; clean sibling STILL delivers =="
 (
  home="$(fresh_home q1)"
  export WAKE_STATE_HOME="$home"
  unset WAKE_AGENT
  f="$TMP_ROOT/q1.jsonl"
  # The live pilot's EXACT malformed shape (no reconciled marker) + a clean sibling.
  {
    printf '%s\n' '{"observed_seq":1,"class":"actionable","locators":{"kind":"repo","id":"MALFORMED-Q","path":"docs/x.md","observed_hash":"deadbeef"},"emit_ts":1}'
    printf '{"observed_seq":2,"class":"actionable","locators":{"sha":"%s","file":"src/a.ts"},"emit_ts":1}\n' "$SHA40"
  } >"$f"
  err="$TMP_ROOT/q1.err"
  out="$("$DIGEST" render --from-file "$f" --agent default 2>"$err")"
  rc=$?
  [ "$rc" -eq 0 ] || fail_msg "Q1: render must EXIT 0 (per-entry quarantine, not whole-digest exit-4), got rc=$rc"
  printf '%s' "$out" | grep -q "$SHA40" || fail_msg "Q1: the clean sibling (sha $SHA40) must STILL be delivered in the same drain [head-of-line block]"
  printf '%s' "$out" | grep -q 'MALFORMED-Q' && fail_msg "Q1: the quarantined entry must be EXCLUDED from the rendered digest"
  [ -f "$(dlq "$home")" ] || fail_msg "Q1: a durable dead-letter file must be written"
  grep -q 'MALFORMED-Q' "$(dlq "$home")" 2>/dev/null || fail_msg "Q1: the malformed entry must be DEAD-LETTERED (accounted-for, not silently dropped)"
  grep -qi 'QUARANTINE' "$err" || fail_msg "Q1: a LOUD per-entry alarm must fire on stderr"
  grep -q 'observed_seq=1' "$err" || fail_msg "Q1: the alarm must identify the offending entry (observed_seq=1)"
 ) && ok
 echo "== Q2 (b): reconciler enumeration (reconciled:true) renders ORIENTATION-tier, NO exit-4 =="
 (
  home="$(fresh_home q2)"
  export WAKE_STATE_HOME="$home"
  unset WAKE_AGENT
  f="$TMP_ROOT/q2.jsonl"
  # A reconciler enumeration: store class actionable (unchanged) + reconciled marker.
  printf '%s\n' '{"observed_seq":5,"class":"actionable","locators":{"kind":"repo","id":"ENUM-B","path":"BOARD.md","observed_hash":"cafe1234","reconciled":true},"emit_ts":1}' >"$f"
  err="$TMP_ROOT/q2.err"
  out="$("$DIGEST" render --from-file "$f" --agent default 2>"$err")"
  rc=$?
  [ "$rc" -eq 0 ] || fail_msg "Q2: a reconciler enumeration must NOT exit-4 (it is ORIENTATION-tier), got rc=$rc"
  printf '%s' "$out" | grep -q 'id=ENUM-B' || fail_msg "Q2: the enumeration must render as an ORIENTATION pointer (id=ENUM-B via _locator_line)"
  printf '%s' "$out" | grep -q 'CLAIM@seq' && fail_msg "Q2: an enumeration must NOT render as an ACTIONABLE CLAIM@seq"
  [ -s "$(dlq "$home")" ] && fail_msg "Q2: an ORIENTATION-tier enumeration must NOT be quarantined/dead-lettered"
  true
 ) && ok
 echo "== Q3 (c): TWO DISTINCT enumerations BOTH survive as SEPARATE orientation pointers (anti-collapse) =="
 (
  home="$(fresh_home q3)"
  export WAKE_STATE_HOME="$home"
  unset WAKE_AGENT
  f="$TMP_ROOT/q3.jsonl"
  {
    printf '%s\n' '{"observed_seq":6,"class":"actionable","locators":{"kind":"repo","id":"ENUM-C1","path":"a.md","observed_hash":"1111","reconciled":true},"emit_ts":1}'
    printf '%s\n' '{"observed_seq":7,"class":"actionable","locators":{"kind":"repo","id":"ENUM-C2","path":"b.md","observed_hash":"2222","reconciled":true},"emit_ts":1}'
  } >"$f"
  err="$TMP_ROOT/q3.err"
  out="$("$DIGEST" render --from-file "$f" --agent default 2>"$err")"
  rc=$?
  [ "$rc" -eq 0 ] || fail_msg "Q3: two enumerations must render (exit 0), got rc=$rc"
  n="$(printf '%s\n' "$out" | grep -c 'id=ENUM-C[12]' || true)"
  [ "$n" = "2" ] || fail_msg "Q3: BOTH distinct enumerations must survive as SEPARATE orientation pointers (expected 2, got $n) — neither coalesced away"
  printf '%s' "$out" | grep -q 'id=ENUM-C1' || fail_msg "Q3: enumeration ENUM-C1 must be present"
  printf '%s' "$out" | grep -q 'id=ENUM-C2' || fail_msg "Q3: enumeration ENUM-C2 must be present"
  [ -s "$(dlq "$home")" ] && fail_msg "Q3: enumerations must NOT be quarantined"
  true
 ) && ok
 echo "== Q4: PRESERVED — a genuine malformed ACTIONABLE claim is STILL loud (dead-letter+alarm), never delivered as valid =="
 (
  home="$(fresh_home q4)"
  export WAKE_STATE_HOME="$home"
  unset WAKE_AGENT
  f="$TMP_ROOT/q4.jsonl"
  printf '%s\n' '{"observed_seq":9,"class":"actionable","locators":{"kind":"board_file","id":"CLAIM-KEEP","observed_hash":"beef"},"emit_ts":1}' >"$f"
  err="$TMP_ROOT/q4.err"
  out="$("$DIGEST" render --from-file "$f" --agent default 2>"$err")"
  rc=$?
  [ "$rc" -eq 0 ] || fail_msg "Q4: render must exit 0 (per-entry quarantine), got rc=$rc"
  printf '%s' "$out" | grep -q 'CLAIM-KEEP' && fail_msg "Q4: a malformed actionable must NOT be delivered as if valid"
  printf '%s' "$out" | grep -q '(none) — no consequential claims pending' || fail_msg "Q4: with the only claim quarantined, the ACTIONABLE section must show (none)"
  grep -q 'CLAIM-KEEP' "$(dlq "$home")" 2>/dev/null || fail_msg "Q4: the malformed actionable must be DEAD-LETTERED (loudly surfaced, not silent)"
  grep -qi 'QUARANTINE' "$err" || fail_msg "Q4: the malformed actionable must raise a LOUD alarm"
 ) && ok
 echo "== Q5: claim-precedence gated — a non-actionable-class entry carrying a claim (no hard locator) is STILL quarantined =="
 (
  home="$(fresh_home q5)"
  export WAKE_STATE_HOME="$home"
  unset WAKE_AGENT
  f="$TMP_ROOT/q5.jsonl"
  # class=digest but locators carry a consequential `claim` -> actionable-tier by
  # precedence; no hard locator + no reconciled marker -> must be quarantined.
  printf '%s\n' '{"observed_seq":11,"class":"digest","locators":{"claim":"CI is green","kind":"repo","id":"CLAIMY"},"emit_ts":1}' >"$f"
  err="$TMP_ROOT/q5.err"
  out="$("$DIGEST" render --from-file "$f" --agent default 2>"$err")"
  rc=$?
  [ "$rc" -eq 0 ] || fail_msg "Q5: render must exit 0, got rc=$rc"
  grep -q 'CLAIMY' "$(dlq "$home")" 2>/dev/null || fail_msg "Q5: a claim-carrying entry with no hard locator must be quarantined (claim precedence, §2.1)"
  printf '%s' "$out" | grep -q 'CI is green' && fail_msg "Q5: the un-verifiable claim must NOT be delivered"
  true
 ) && ok
 echo
 if [ -s "$FAILFILE" ]; then
  echo "wake digest-quarantine harness: FAILED ($(grep -c . "$FAILFILE") assertion(s))" >&2
  exit 1
 fi
 echo "wake digest-quarantine harness: all invariants passed ($pass groups)"
--- a/packages/mosaic/package.json
+++ b/packages/mosaic/package.json
@@ -25,7 +25,7 @@
    "lint": "eslint src",
    "typecheck": "tsc --noEmit",
    "test": "vitest run --passWithNoTests && pnpm run test:framework-shell",
-    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-install.sh"
+    "test:framework-shell": "python3 src/lease-broker/daemon_deadline_unittest.py && python3 src/lease-broker/normative_fragments_unittest.py && python3 src/lease-broker/receipt_challenge_unittest.py && python3 src/lease-broker/context_recovery_unittest.py && python3 src/lease-broker/recovery_runtime_unittest.py && python3 src/lease-broker/recovery_b1_adversarial_unittest.py && python3 src/lease-broker/framework_skill_portability_unittest.py && python3 src/mutator-gate/runtime_tools_unittest.py && python3 src/mutator-gate/runtime_launch_guard_unittest.py && python3 src/mutator-gate/version_coupling_unittest.py && python3 framework/tools/lease-broker/check-runtime-launches.py --root ../.. && bash framework/tools/codex/test-pr-diff-context.sh && bash framework/tools/qa/test-deps-preflight.sh && bash framework/tools/git/test-pr-review-gitea-comment.sh && bash framework/tools/git/test-pr-review-repo-host-override.sh && bash framework/tools/git/test-ci-queue-wait-branch-absent.sh && bash framework/tools/git/test-git-credential-mosaic.sh && bash framework/tools/git/test-gitea-token-identity.sh && bash framework/tools/_scripts/test-install-ordering-guard.sh && bash framework/tools/tmux/agent-send.test.sh && bash framework/tools/wake/test-wake-store-ack.sh && bash framework/tools/wake/test-wake-digest-hmac.sh && bash framework/tools/wake/test-wake-digest-quarantine.sh && bash framework/tools/wake/test-wake-detector.sh && bash framework/tools/wake/test-wake-fn-oracle.sh && bash framework/tools/wake/test-wake-reconcile.sh && bash framework/tools/wake/test-wake-beacon.sh && bash framework/tools/wake/test-wake-install.sh"
  },
  "dependencies": {
    "@mosaicstack/brain": "workspace:*",