fix(wake): #946 digest ack watermark clamped at quarantined seqs — disclose AND clamp

The embedded ack suggestion covered dead-lettered entries: quarantine is a
render-time filter (0.6.14), so `ack.sh consumed --upto <observed_seq>`
stepped the cursor past quarantined seqs and _record_last_consumed wrote
consumed-hash witness rows for deliveries that never happened (live: mos-dt
seq 68 buried under five successive digests; Finding A: a false
9d0f639f…@63 witness row).

Fix, per the ruled disposition on #946:

- digest.sh: rendered digest gains a QUARANTINED section (seq + class +
  HELD only — ids and locator values stay withheld, preserving the
  exclusion property); embedded ack clamped to
  min(observed_seq, min quarantined seq - 1) with a loud
  "# ACK CLAMPED (#946)" note; render --from-store syncs the store-owned
  quarantined.set via `store.sh quarantine-sync` (full replace — a gate
  fix self-heals stale quarantine); --from-file/--stdin never touch the
  set.

- store.sh: consume REFUSES to cross an unconsumed quarantined seq;
  `--force-past-quarantine` is the ONLY way past, loud per-seq on stderr,
  and even the forced path never writes a consumed-hash witness for a
  quarantined seq; crossed seqs are pruned from the set after the cursor
  moves. New `quarantine-sync` (stdin seqs, full replace, invalid input is
  a loud no-op) and `quarantine-audit [--repair]` (sweeps consumed-hashes
  for rows provably contradicted by the dead-letter ledger; report exits
  1; --repair removes only provably-false rows; the ledger is history and
  never modified; rows whose dead-letter evidence was pruned are
  unprovable and untouched).

- ack.sh: plumbs --force-past-quarantine through to store consume; forced-
  path loudness is re-emitted on stderr while `CONSUMED <n>` stays clean.

Tests: test-wake-store-ack.sh T13-T16 (34 assertions RED at base),
test-wake-digest-quarantine.sh Q12-Q16 (10 RED at base; Q13/Q16
green-by-design controls). All nine wake suites green. version=0.6.15.

Closes #946

Written-by: pepper (sb-it-1-dt)
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

packages/mosaic/framework/tools/wake/ack.sh

@@ -54,6 +54,16 @@ Commands:
                                          Local-write only; a background sync
                                          ships it (never blocks on network).
                                          --no-sync suppresses the background ship.
+                                         --force-past-quarantine passes the #946
+                                         force flag through to store.sh consume:
+                                         the ONLY way to advance past a
+                                         QUARANTINED (dead-lettered, never
+                                         delivered) seq. The store's per-seq
+                                         step-over diagnostics are re-emitted on
+                                         stderr; no consumed-hash witness is
+                                         recorded for the quarantined entry.
+                                         Without the flag, a consume that would
+                                         cross a quarantined seq is REFUSED.
   embed --upto N [--wake-id ID] [--agent A]
                                          Print the copy-run ack line to EMBED in
                                          a digest (does not perform the ack).
@@ -169,7 +179,7 @@ cmd_received() {
 
 cmd_consumed() {
   _need_jq
-  local upto='' wake_id='' do_sync="1"
+  local upto='' wake_id='' do_sync="1" force="0"
   while [ $# -gt 0 ]; do
     case "$1" in
     --upto)
@@ -184,6 +194,10 @@ cmd_consumed() {
       do_sync="0"
       shift
       ;;
+    --force-past-quarantine)
+      force="1"
+      shift
+      ;;
     *)
       echo "ack.sh consumed: unknown option '$1'" >&2
       exit 2
@@ -200,11 +214,25 @@ cmd_consumed() {
   # Advance consumed_seq via the store. The store enforces the CONTIGUOUS
   # gapless-prefix rule and rejects a gap (cannot ack N while N-1 unconsumed).
   # This is a LOCAL-WRITE cursor advance — no network.
-  local new_cursor
-  if ! new_cursor="$("$STORE_SH" consume --upto "$upto" 2>&1)"; then
+  local new_cursor store_args
+  store_args=(consume --upto "$upto")
+  if [ "$force" = "1" ]; then
+    store_args+=(--force-past-quarantine)
+  fi
+  if ! new_cursor="$("$STORE_SH" "${store_args[@]}" 2>&1)"; then
     echo "ack.sh consumed: refused — $new_cursor" >&2
     exit 1
   fi
+  if [ "$force" = "1" ]; then
+    # #946: on the forced path the store's LOUD per-seq step-over diagnostics
+    # were captured together with the cursor line (2>&1 above). Re-emit them on
+    # OUR stderr — the loudness must survive the wrapper — and keep only the
+    # final line (the cursor) for the CONSUMED report below.
+    local cursor_line
+    cursor_line="$(printf '%s\n' "$new_cursor" | tail -n1)"
+    printf '%s\n' "$new_cursor" | sed '$d' | grep -v '^[[:space:]]*$' >&2 || true
+    new_cursor="$cursor_line"
+  fi
 
   # Record the CONSUMED ack in the local ledger (still no network).
   local record