briefs: heartbeat-canon PACKAGING PLAN Rev 2 — address W-jarvis review (manifest/version, schema ordering, blank-reset target, fw/op boundaries)

briefs/PACKAGING-PLAN-HEARTBEAT-CANON-MS-LEAD.md

@@ -6,6 +6,9 @@ RATIFIED) + `ENHANCE-CADENCE-WRITER-FIX.md` + `ENHANCE-BASELINE.md`.
 **Scope:** §6 category-A framework-component items (A1–A11) + WAKE-DOCTRINE guide. NOT pilot (B*, mos-dt-0)
 or operator-config values (C*). Proposal only — **no framework PR cut until Mos acks this plan** (per Mos).
 **Repo facts verified** against `mosaicstack/stack` origin/main (read-only ls-tree) — not assumed.
+**Rev 2 (2026-07-25):** addresses W-jarvis independent review at `cd11bbb` — 4 gaps resolved
+(1 component manifest/version, 2 schema ordering ≤ W4, 3 blank-reset target/lifecycle, 4 framework/operator
+boundaries + fail-closed) + the #889 minor. Still PROPOSED / PENDING-AUTHORITY.
 
 ---
 
@@ -42,14 +45,14 @@ beacon (A8), A9, A11 are near-independent; installer (A10) lands last (needs all
 
 | PR | Contents | Notes |
 |---|---|---|
-| **W0** | A11 WAKE-DOCTRINE.md | docs-only, independent; lands first as normative reference. Resolves #889 (see §5). |
+| **W0** | A11 WAKE-DOCTRINE.md | docs-only, independent; lands first as normative reference. Supersedes/informs #889; closure Mos-owned (see §5). |
 | **W1** | A9 `agent-send.sh` digest-class validator + test | tiny, independent, red-first (like Patch 2b). Good opener. |
-| **W2** | A2 store+drain lib **+** A4 ack-wrapper | core three-cursor transaction; red-first heavy. The heart. |
+| **W2** | A2 store+drain lib **+** A4 ack-wrapper **+** watch-list SCHEMA contract (framework `.schema.json` + `schema_version`) | core three-cursor transaction **+ the public schema W4/W5 validate against** (W-jarvis gap 2 — schema lands ≤ its first consumer, not W7); red-first heavy. |
 | **W3** | A3 digest renderer **+** A5 HMAC signer | depends on W2 store; hard-locator + scrub + non-circular MAC tests. |
-| **W4** | A1 detector daemon | depends on W2/W3; repo-section/anchor-scoped hashing; flock; in mos-comms loop. |
+| **W4** | A1 detector daemon | depends on W2 (incl. schema)/W3; **validates watch-list `schema_version` → FAIL-LOUD**; repo-section/anchor-scoped hashing; flock; in mos-comms loop. |
 | **W5** | A6 FN-oracle **+** A7 reconciler | depends on W4; the non-optional G3/§4 cost, built explicitly. |
-| **W6** | A8 off-host beacon + alarm | semi-independent; the independent liveness leg (G1). |
-| **W7** | A10 idempotent install.sh (blank-reset idiom + snapshot-guard) + `mosaic-wake.service` + C1 schema | LAST; **absorbs batch (d)**; #869 publish-gate (enforcement path). |
+| **W6** | A8 off-host beacon + **pluggable alarm-sink adapter** | semi-independent; independent liveness leg (G1). Framework = emitter+adapter iface; operator = target (§5 boundaries). |
+| **W7** | A10 idempotent install.sh (**component-manifest install** + snapshot-guard + blank-reset on **legacy timer** drop-ins during retire) + `mosaic-wake.service` | LAST; **absorbs batch (d)**; #869 publish-gate. Operator schema VALUES deploy here; schema CONTRACT is W2. |
 
 ~8 PRs pipelined; at ≤2 lanes this is several convergence cycles. Each: fresh-clone builder
 (`mosaic-coder`), author≠reviewer independent review at exact head, RoR packet, Mos id-11 stamp+merge.
@@ -57,11 +60,18 @@ Red-first mandatory on all code PRs; `test:framework-shell` chain extended per P
 
 ## 3. Versioning + #869 compatibility
 
-- Component ships **inside the framework** (`packages/mosaic/framework/`) → inherits framework version.
-- **§5.4 decoupling requirement:** a host must adopt "just the component + its watch-list without a full
-  framework bump." Enabler: the **watch-list carries an explicit `schema_version`**; the detector
-  **validates schema-version and FAILS LOUD on incompatible** (no silent degrade — #869 discipline,
-  same fail-loud posture as Patch 2b). WAKE-DOCTRINE is version-agnostic doctrine.
+- **Two independent version axes** (resolves the inherit-vs-adopt-independently contradiction — W-jarvis gap 1):
+  1. **Component artifact version** — the wake component ships its OWN manifest+semver
+     (`framework/tools/wake/manifest.txt`, mirroring the existing `framework/framework-manifest.txt`
+     pattern), **independently addressable**. A10's installer can install/update **just the wake
+     component subtree** keyed to that version (`install.sh --component wake` / component-scoped copy),
+     decoupled from a full framework-manifest bump — this is the concrete enabler that lets a host adopt
+     the component alone (design §5.4). The component manifest is the artifact-selection/update unit;
+     the framework version is NOT.
+  2. **Watch-list `schema_version`** — config-compat only, orthogonal to axis 1. The detector validates
+     the installed **component version against the watch-list `schema_version`** and **FAILS LOUD on
+     incompatible** (no silent degrade — #869 discipline, Patch-2b posture).
+- WAKE-DOCTRINE is version-agnostic doctrine.
 - **A10 installer is an enforcement path** → #869 publish-gate: fail-closed, idempotent, snapshot-guard
   blocks a reap/clean-checkout without a snapshot; post-apply verify = exactly one `OnUnitActiveUSec`.
 - **web1 rides #869 Point-2** (currently HELD/non-autonomous). **dragon-lin pilots NOW** (separate host,
@@ -86,12 +96,29 @@ Red-first mandatory on all code PRs; `test:framework-shell` chain extended per P
   already corrected + live-verified 2026-07-25 (planner-opus/planner-sol now fire 30min not 15min).
   **Nothing standalone to land**; the proven idiom (byte-identical to `installer-7`) becomes an A10
   requirement + a post-apply test. Batch item (d) is therefore closed-as-absorbed, not a separate PR.
-- **PR #889 (my layering note) — recommend CLOSE-SUPERSEDED.** Its constraints (one liveness substrate,
-  framework-vs-product split, state location, blank-reset invariant) are now **canonized in
-  CONVERGED-DESIGN §0/§1.1/§1.4/§5.2** (W-jarvis confirmed the constraint was accepted for relay). The
-  canonical heartbeat docs live in jarvis-brain `heartbeat-planning/`; keeping a superseded duplicate in
-  `mosaicstack/stack docs/scratchpads/` is cross-repo drift. **Lean: close #889 without merge** (design
-  input delivered + absorbed). Defer to Mos: close-superseded (my rec) vs merge-as-historical-record.
+  **Blank-reset TARGET + lifecycle (W-jarvis gap 3):** the component is a long-lived `mosaic-wake.service`
+  (NOT a timer), so blank-reset does NOT apply to the service. It applies to the **legacy
+  `mosaic-heartbeat@<agent>.timer` cadence drop-ins** (`.../interval.conf`) during the §5 overlap→retire
+  lifecycle: A10 installer (1) **snapshots** the legacy unit; (2) IF a per-class **fallback-cadence**
+  timer is used, writes its drop-in in the blank-reset form (byte-identical to `installer-7`; verify =
+  exactly one `OnUnitActiveUSec`); (3) on §4-vector pass, **removes the legacy `mosaic-heartbeat@`
+  units** (retire-last). Named units + reset→verify→retire steps make the invariant a **testable
+  acceptance criterion**, not an orphaned idiom.
+- **Framework/operator boundaries + fail-closed criteria (W-jarvis gap 4):**
+  - **W6 off-host alarm:** framework ships the beacon emitter + a **pluggable alarm-sink adapter
+    interface**; the operator owns the **target endpoint** (off-host monitor address/credential, by-name
+    via `load_credentials`). **Fail-closed:** an unconfigured/unreachable alarm target **fails loud at
+    install** — no silent no-alarm host (G1/G2a).
+  - **W3/W7 HMAC key:** operator-owned secret, provisioned **by-name via `load_credentials`**, NEVER
+    inlined, NEVER in units or digests. Framework ships the signer using the named key. **Fail-closed:**
+    missing key → **fail loud, no unsigned wake emitted.** Same-uid key-read boundary documented
+    (§2.5/G6); off-uid signer tracked as a gate, not assumed away.
+- **PR #889 (my layering note) — W0 supersedes/informs it; CLOSURE remains Mos-owned.** Its constraints
+  (one liveness substrate, framework-vs-product split, state location, blank-reset invariant) are now
+  canonized in CONVERGED-DESIGN §0/§1.1/§1.4/§5.2. The canonical heartbeat docs live in jarvis-brain
+  `heartbeat-planning/`; a `mosaicstack/stack docs/scratchpads/` duplicate is cross-repo drift. **My rec:
+  close #889 without merge** (design input delivered + absorbed) — but W0 does not itself resolve #889;
+  Mos decides close-superseded vs merge-as-record.
 
 ## 6. Open questions for Mos (before I cut W0)