Implements W2 of the wake/heartbeat canon (EPIC #892), honoring the
CONVERGED-DESIGN contracts exactly.
A2 store.sh — three-cursor durable queue (§1.2/§2.3/§2.4):
- observed_seq authoritative monotonic cursor (detector assigns, lib records);
SHAs are descriptors, not the cursor.
- durable pending-inbox {observed_seq, locators, class, emit_ts, hmac}; hmac is
an UNSIGNED placeholder (signing is W3/A5).
- consumed_seq advances ONLY on a CONSUMED ack over a CONTIGUOUS gapless prefix
<=N; never on enqueue/exit-0/paste.
- coalesce: digest REPLACES the pending cumulative-state entry; actionable/human
APPEND; ALL classes durable (durability never bypassed); absent class => actionable.
- drain returns the deliverable set; every mutation is atomic write-tmp+rename.
A4 ack.sh — RECEIVED/CONSUMED wrapper (§2.2):
- RECEIVED dedups DELIVERY via wake_id (dup = re-RECEIVE, never re-action).
- CONSUMED N local-write-only to the XDG ledger, cumulative, gapless-prefix
enforced; background sync ships the ack (never blocks on network).
- `embed` prints the one copy-run line a digest embeds.
Watch-list SCHEMA contract (defaults/wake-watch-list.schema.json) with
schema_version; wake manifest.txt declares component semver + supported schema
range (schema_min/schema_max, Gate B — version metadata only, NOT path ownership).
RED-first shell harness wired into test:framework-shell covers each invariant
(three-cursor, coalesce-vs-append, contiguous-prefix CONSUMED, wake_id dedup,
atomic tmp+rename crash-safety, durability-across-restart, ack-never-blocks-on-net).
shellcheck clean; sanitization gate + operator firewall pass.
Part of #892
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
