fix(wake): #934 mount-free, privilege-invariant seq-integrity fault injection (T9/T11 run in non-priv CI) (#936)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/_wake-common.sh

@@ -55,6 +55,25 @@ _wake_tmp_prefix='.wake.tmp.'
 # the old target fully intact and a stale .wake.tmp.* that readers ignore.
 _atomic_write() {
   local target="$1" dir tmp
+  # --- TEST-ONLY FAULT SEAM (issue #934) — PROD-INERT. ------------------------
+  # Forces the ALREADY-EXISTING atomic-write failure PATH (the fail-loud +
+  # rollback handling #908/#917 built) to be taken for ONE named write target, so
+  # the seq-integrity failure assertions (T9 arrow-1 no-burn, T11 cursor-write
+  # gate) RUN UNPRIVILEGED in the real non-privileged CI runner instead of being
+  # skipped behind an unshare+bind-mount injection. It is honored ONLY when the
+  # test-only env var WAKE_TEST_FAULT is explicitly set to name a write point; it
+  # writes nothing, adds no new behavior, and changes no on-disk format. No
+  # production input (CLI args, locators JSON, on-disk state, watch-list) can set
+  # a process env var, so with WAKE_TEST_FAULT unset this is a no-op and the write
+  # proceeds exactly as before. Map: pending->pending.jsonl, cursor->observed_seq.
+  if [ -n "${WAKE_TEST_FAULT:-}" ]; then
+    case "${WAKE_TEST_FAULT}:$(basename -- "$target")" in
+    pending:pending.jsonl | cursor:observed_seq)
+      cat >/dev/null 2>&1 || true # drain the producer, then report the commit as failed
+      return 1
+      ;;
+    esac
+  fi
   dir="$(dirname "$target")"
   [ -d "$dir" ] || mkdir -p "$dir"
   tmp="$(mktemp "$dir/${_wake_tmp_prefix}XXXXXX")" || return 1