fix(wake): #917 gate the final observed_seq cursor write + observed.set/cursor consistency (defense-in-depth) (#933)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/manifest.txt

@@ -174,8 +174,29 @@
 #              WAKE_VERIFY_USE_SYSTEMCTL pattern) — F7 is encoded in the installer,
 #              not operator memory. framework-manifest.txt, the install-ordering-
 #              guard, and the manifest parity contract are all UNCHANGED.
+#   0.6.9  #917 store.sh cmd_enqueue — HARDEN the final observed_seq cursor write
+#              (defense-in-depth, surfaced by the #915 review obs#2; non-blocking).
+#              The final cursor _atomic_write was the ONE durable write not wrapped
+#              in a failure check and was cross-file non-atomic with the observed.set
+#              write just before it. Now (a) the cursor write is GATED like the
+#              pending/observed.set writes (#908) — a cursor-write failure is
+#              FAIL-LOUD (non-zero + diagnostic), never silently swallowed into a
+#              spurious success while the allocation stayed uncommitted; and (b) on
+#              cursor-write failure observed.set is ROLLED BACK to its pre-write
+#              snapshot, so observed.set and the cursor can never be left cross-file
+#              inconsistent (observed.set ahead of a cursor that never committed) —
+#              they BOTH advance or NEITHER does. #908 is UNCHANGED: single store-side
+#              allocator, atomic allocate+enqueue under flock, arrow-1 no-burn
+#              (pending write still FIRST and its failure still aborts before any
+#              cursor advance), anti-swallow ≤consumed fail-loud, and the W2
+#              contiguous-prefix CONSUMED contract all intact. The cursor remains the
+#              sole COMMIT point (an uncommitted pending entry is re-derived/reconciled,
+#              never consumed), so a pending-ahead state is exactly the one #908 already
+#              tolerates on its observed.set-failure path. ON-DISK FORMAT UNCHANGED
+#              (read-compatible; a store written by older code reads identically). Only
+#              store.sh (+ test-wake-store-ack.sh T11) changed.
 component=wake
-version=0.6.8
+version=0.6.9
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -192,7 +213,9 @@ schema_max=1
 # Pieces shipped by this component version (informational):
 #   store.sh    A2 — three-cursor durable store + drain lib. Stale-tmp reaping is
 #                    OFF the hot enqueue path; `init` performs the age-scoped
-#                    maintenance reap (#927).                          (W2, #927)
+#                    maintenance reap (#927). enqueue's final observed_seq cursor
+#                    write is GATED fail-loud + rolls observed.set back on failure so
+#                    the two never diverge (#917).                (W2, #927, #917)
 #   ack.sh      A4 — RECEIVED/CONSUMED ack-wrapper (local-write + ship). (W2)
 #   digest.sh   A3 — cumulative-state digest renderer (hard locators,
 #                    two-tier trust, injection/secret scrub). PER-ENTRY