Framework-ship the canon-side FALLBACK WAKE (F7 replacement-before-retirement)
so hosts get it out of the box instead of hand-wiring it per host. ADDITIVE;
honors #869 / Gate A/B discipline.
1. New framework units systemd/user/mosaic-wake-fallback.{timer,service}: a
low-frequency SAFETY drain (oneshot service running the canon drain
`digest.sh render --from-store`) fired by a per-class cadence timer,
INDEPENDENT of the event-driven detector, so a stalled detector/daemon can
never silently starve delivery. Owned via the existing `systemd/**` glob in
framework-manifest.txt (Gate A) — no new owned path, no second authority.
2. Optional additive per-class `fallback_cadence` bound in
wake-watch-list.schema.json (config, not code). Backward-compatible within
schema_version 1, so [schema_min, schema_max] stays [1,1] and the detector's
Gate B range check is unchanged.
3. A10 wake-install.sh enumerates + links + validates the two units into the
user systemd search path (idempotent, fail-closed); write-fallback-cadence
writes the per-class cadence as a blank-reset drop-in (exactly one
effective OnUnitActiveUSec).
4. F7 install-validate: the §5 legacy reap now REFUSES unless the canon
fallback wake is proven live (installed + schedulable floor always; enabled
+ proven-firing when a live user manager is probeable, mirroring #913).
Red-first: test-wake-install.sh I11 (F7 reap-refuses-without-live-fallback),
I12 (stalled detector still drains), I13 (install links+validates units),
I14 (per-class cadence blank-reset = exactly one); test-wake-detector.sh D9
(optional fallback_cadence in-range accepted; out-of-range still fails loud).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb
Part of #869
Mos (id-11) Gate-16 merge: independent APPROVE @75235ef8 (9/9, no live host mutation), author id2 != approver id11, CI green wp1971.
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
