The #920 per-entry drain quarantine dead-letters a render-refused digest
entry and raises its fail-loud alarm to stderr/journal-LOCAL only. A
dead-lettered entry is STORE-ACCOUNTED (§2.3), so the reconciler never
re-flags it: journal-local-only visibility means an unattended operator
can PERMANENTLY MISS a real obligation (G2a silent-degradation).
digest.sh now ALSO routes the SAME per-entry quarantine alarm through
WAKE_ALARM_SINK_CMD, reusing beacon.sh's (W6/#910) exact pluggable
off-host alarm-sink adapter contract verbatim (operator target resolved
by-name inside the adapter, fail-closed) -- in addition to, never
instead of, the existing stderr diagnostic.
Dedup: entries carry no per-entry wake_id (that field is the per-render
ack copy-run id); the entry's durable identity is its store-allocated
observed_seq (#908's sole monotonic allocator). A durable alarmed-set
file under STATE_DIR (dead-letter-alarmed.set, atomic-written) records
which observed_seqs have already been routed off-host, so a
still-dead-lettered entry re-drained every timer tick -- or across a
process restart -- is alarmed off-host EXACTLY ONCE. A new distinct
dead-lettered entry (a new observed_seq) still routes its own one alarm.
An unconfigured or unreachable WAKE_ALARM_SINK_CMD is a LOUD per-entry
stderr diagnostic (mirrors beacon.sh's fail-closed wording) but does not
itself fail the whole render -- per-entry fail-loud, never a whole-drain
wedge, preserving #920's core no-head-of-line-blocking property.
RED-FIRST: extends test-wake-digest-quarantine.sh with Q6-Q9, proven RED
against the pre-fix stderr-only code (0 alarms ever captured; no
off-host fail-closed diagnostic exists) and GREEN after the fix, while
the pre-existing Q1-Q5 (#920) invariants remain green throughout.
Bumps the wake component manifest to 0.6.6.
Closes#924
Part of #892
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
