fix(wake): #944 path becomes a hard-locator arm — detector-shape actionable entries can now pass the §2.1 gate + version 0.6.14

The _has_hard_locator gate tested only repo+issue / 40-hex sha / file —
the forge locator vocabulary. detector.sh (A1) builds board_file locators
as kind/id/observed_hash + path (+ snapshot_sha/_ts when attested, #940):
zero keys in common, so a class=actionable board_file entry could NEVER
pass and every heartbeat-planning delta dead-lettered (live seqs 63/68,
dragon-lin, 2026-07-30). Latent since #920; the #920 harness pinned the
detector pilot shape as its malformed example, ratifying the gap.

Fix: `path` becomes a hard-locator arm — and ONLY path. It carries the
same one-call re-verify precision as `file` (re-read <path>; upgrades to
git show <snapshot_sha>:<path> when snapshot-attested). Deliberate
NON-arms: observed_hash (content hash, not an address) and bare path-less
snapshot_sha (would widen the gate past the board_file vocabulary —
review-adopted criterion). The file-level HARD LOCATORS doc block now
names all four arms (wake-judge R2(a): shipping the fix while leaving
doc-vs-producer drift in the same file would re-seed the defect class).

Quarantine is a render-time filter (entries never leave pending.jsonl;
dead-letter.jsonl is ledger + alarm-dedup only), so existing UNCONSUMED
dead-letters re-deliver automatically on the first post-upgrade drain.
Consumed-past dead-letters are not requeued.

Tests: Q11 positive control renders the live seq-68 entry VERBATIM as
CLAIM@seq (real detector emission, not a hand-built dict); negative
controls assert address-free and bare path-less snapshot_sha siblings
still quarantine — the snapshot_sha control at all THREE lengths the
detector's attestation validation ^[0-9a-f]{7,64}$ admits (7-char
abbreviation, 40-hex, 64-char sha-256), so it distinguishes "no arm"
from "arm present but length-gated" (review finding E1). Q1/Q6–Q9
fixtures moved off the now-valid path-bearing shape. Q2's ENUM-B is
ADDRESS-FREE (wake-judge F1): with `path` an arm, path-bearing
reconciled fixtures no longer exercise the exemption at the gate —
mutation test (exemption disabled) now dies on the gate-level
assertion again, not merely tier labels. RED at base: exactly the 8
Q11 assertions fail; Q1–Q10 pass under both digests.

Doc follow-up: #948 amends CONVERGED-DESIGN.md §2.1 (add `path`; state
the operative test as "one targeted call, never a search") — sequenced
after the reseed as a live delivery test of the fixed gate.

Closes #944

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
Written-by: pepper (sb-it-1-dt)

packages/mosaic/framework/tools/wake/digest.sh

@@ -25,8 +25,8 @@
 #     sufficiency NEVER exempts a consequential action from its live gate.
 #
 # HARD LOCATORS (§2.1): every actionable claim MUST carry a precise locator
-# (repo + issue#, a 40-char SHA, or file:anchor) so re-verification is ONE
-# targeted call. A missing locator = malformed ACTIONABLE entry = FAIL-LOUD.
+# (repo + issue#, a 40-char SHA, file:anchor, or path — #944) so re-verification
+# is ONE targeted call. A missing locator = malformed ACTIONABLE entry = FAIL-LOUD.
 #
 # #920 (per-entry quarantine — fail-loud WITHOUT head-of-line blocking): a
 # render-refused entry (actionable-tier, no hard locator) is QUARANTINED — durably
@@ -209,13 +209,28 @@ _scrub_free() {
 # ---------------------------------------------------------------------------
 
 # _has_hard_locator LOCATORS_JSON — true iff the locators object carries at least
-# one PRECISE locator sufficient for one-call re-verification:
-#   repo + issue (issue#)  |  40-hex sha  |  file (file:anchor).
+# one PRECISE locator sufficient for one-call re-verification. BOTH locator
+# vocabularies in live use are accepted (the same two _locator_line documents
+# under #914b):
+#   forge shape (§2.1):   repo + issue (issue#) | 40-hex sha | file (file:anchor)
+#   detector shape (#944): path
+# The `path` arm was added by #944: detector.sh (A1) builds board_file locators
+# as kind/id/observed_hash + path (+ snapshot_sha when adapter-attested, #940)
+# — none of which the gate tested — so a class=actionable board_file entry
+# could NEVER pass and every heartbeat-planning delta dead-lettered (live seqs
+# 63/68). `path` mirrors `file` exactly (same one-call "re-read X" hint below;
+# with an attested snapshot_sha the hint upgrades to one-call
+# `git show <snapshot_sha>:<path>`). DELIBERATELY NOT ARMS: `observed_hash`
+# (a content hash, not an address) and bare `snapshot_sha` without `path`
+# (a path-less 40-hex would widen the gate past the board_file vocabulary —
+# review-adopted criterion on #944; snapshot_sha's precision is only reachable
+# THROUGH a path, so path is the address and snapshot_sha stays a refinement).
 _has_hard_locator() {
   jq -e '
     ((.repo // "") != "" and ((.issue // "") | tostring) != "")
     or (((.sha // "") | test("^[0-9a-f]{40}$")))
     or ((.file // "") != "")
+    or ((.path // "") != "")
   ' >/dev/null 2>&1 <<<"$1"
 }
 
@@ -223,16 +238,18 @@ _has_hard_locator() {
 # one-targeted-call re-verify hint, where available.
 #
 # #914b: covers BOTH locator vocabularies actually in use:
-#   - the HARD-locator shape (§2.1, gated by _has_hard_locator, unchanged):
+#   - the HARD-locator shape (§2.1, gated by _has_hard_locator):
 #     repo+issue | 40-hex sha | file(:anchor).
 #   - the shape detector.sh (A1) actually builds for a `digest`-class entry
 #     (see detector.sh's enqueue-locators jq filter): kind/id/observed_hash +
 #     whichever of repo/path/anchor/remote/branches the source def declares.
 #     None of kind/id/observed_hash/remote/path/branches were recognized here
 #     before, so a real digest-class pointer rendered a bare empty "locator:"
-#     line despite the entry carrying real (soft, non-hard) locator data. This
-#     is display-only: it does NOT feed _has_hard_locator, so the
-#     ACTIONABLE-tier hard-locator FAIL-LOUD gate is untouched.
+#     line despite the entry carrying real (soft, non-hard) locator data.
+#     (At #914b this was display-only; #944 later promoted `path` — and ONLY
+#     `path` — into _has_hard_locator, since it carries the same one-call
+#     re-verify precision as `file`. kind/id/observed_hash/remote/branches
+#     and bare snapshot_sha remain soft/display-only.)
 _locator_line() {
   local loc="$1" repo issue sha file anchor head parts='' reverify=''
   local remote path kind id ohash branches snap_sha snap_ts
@@ -477,7 +494,7 @@ _quarantine_entry() {
       return 0
     fi
   fi
-  echo "digest.sh: FAIL-LOUD QUARANTINE (#920) — malformed ACTIONABLE entry at observed_seq=$seq has no §2.1 hard locator (repo+issue#/40-char SHA/file:anchor). DEAD-LETTERED to $dlq and EXCLUDED from this digest; the rest of the cumulative set still renders (no head-of-line block). Re-feed the source with a valid hard locator." >&2
+  echo "digest.sh: FAIL-LOUD QUARANTINE (#920) — malformed ACTIONABLE entry at observed_seq=$seq has no §2.1 hard locator (repo+issue# / 40-hex sha / file:anchor / path). DEAD-LETTERED to $dlq and EXCLUDED from this digest; the rest of the cumulative set still renders (no head-of-line block). Re-feed the source with a valid hard locator." >&2
   # #924 (G2a): route the SAME per-entry alarm off-host too, deduped by
   # observed_seq so a still-dead-lettered entry re-drained every tick is
   # alarmed off-host EXACTLY ONCE (never once per re-render).