The seq-integrity fault-injection tests T9 (#908 arrow-1 no-burn) and T11 (#917
final-cursor gate + observed.set rollback) forced a write to fail via
`unshare --mount --user --map-root-user` + a bind-mount EBUSY-on-mountpoint. The
real Woodpecker runner is NON-privileged and DENIES mount-in-userns, so both
injections SKIPPED in CI — the allocator's most safety-critical invariants were
not exercised by the pipeline that gates merges (skipped-trust-layer, the class
#912 cured for the digest suite).
Replace the mount-based mechanism with a MOUNT-FREE, PROD-INERT fault seam in
_wake-common.sh _atomic_write, honored ONLY when the test-only env var
WAKE_TEST_FAULT explicitly names a write point (pending->pending.jsonl,
cursor->observed_seq). It forces the ALREADY-EXISTING fail-loud/rollback PATH
(#908/#917) to be taken for that one target and RUNS UNPRIVILEGED. No production
input can set a process env var, so with WAKE_TEST_FAULT unset the seam is a
no-op: on-disk format + allocator semantics are byte-for-byte unchanged in prod.
T9/T11 are converted to the seam; the unshare+bind-mount path and its
skip-when-unavailable guard/witness-marker are REMOVED. Both tests now RUN and
ASSERT their failure paths in every environment including non-priv CI.
Verified in a NON-privileged node:24-alpine container (unshare --mount DENIED):
T9 and T11 execute their injection (no SKIP), the failure paths fire, and the
fail-loud/rollback assertions pass; full `pnpm run test:framework-shell` rc=0.
Closes#934
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
