Live pilot finding #6 (BLOCKING): a reconciler enumeration enqueued
class=actionable with soft locators {kind,id,path,observed_hash} failed
§2.1's ACTIONABLE hard-locator taxonomy, so digest render exit-4'd the
ENTIRE cumulative-state drain — 4 consecutive timer failures, NOTHING
delivered, including clean unrelated entries (head-of-line blocking).
FIX 1 (quarantine, don't wedge): digest.sh cmd_render's fail-loud pass is
now PER-ENTRY. A render-refused ACTIONABLE entry (no hard locator) is
DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm and
EXCLUDED, while the REST of the cumulative set still renders (exit 0). The
bad entry is accounted-for, never silently dropped; one malformed entry can
no longer wedge the whole drain.
FIX 2 (AMENDED — render-tier, NOT class=digest): reconcile.sh's store class
is UNCHANGED (non-coalescing) — the naive class=digest was rejected because
store §2.3/T2 coalescing would silently collapse distinct enumerations
(proven: reconcile R6 goes RED). Instead digest.sh's actionable-classifier
now treats locators.reconciled==true (set only by reconcile.sh; not
source-forgeable) as ORIENTATION-tier: gate-exempt, rendered as an
orientation pointer via _locator_line's digest-class vocabulary. No exit-4,
no wedge, no coalescing loss; §2.3/T2/G3-R6 intact.
RED-FIRST: new test-wake-digest-quarantine.sh (openssl-independent) proves
(a) malformed {kind,id,path,observed_hash} quarantines while a clean sibling
still delivers, (b) a reconciled enumeration renders orientation-tier (no
exit-4), (c) TWO distinct enumerations both survive as separate orientation
renders (anti-collapse — the class=digest silent-drop we rejected), and the
preserved per-entry actionable fail-loud. D2/D6 in test-wake-digest-hmac.sh
updated from whole-digest exit-4 to per-entry quarantine. Wake manifest
bumped 0.6.2 -> 0.6.3 + inventory.
Closes#920
Part of #892
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
