feat(watchdog): Sentry flags + quarantine on above-band Jev verdicts (#44)

ledger.go

@@ -55,9 +55,10 @@ type Requester struct {
 }
 
 type Ledger struct {
-	Crows      map[string]*Record    `json:"crows"` // key: crow|task_type
-	Flock      map[string]*Record    `json:"flock"` // key: task_type
-	Requesters map[string]*Requester `json:"requesters"`
+	Crows       map[string]*Record    `json:"crows"` // key: crow|task_type
+	Flock       map[string]*Record    `json:"flock"` // key: task_type
+	Requesters  map[string]*Requester `json:"requesters"`
+	Quarantined map[string]bool       `json:"quarantined,omitempty"` // crow -> silenced by the Sentry watchdog (E3)
 
 	path string
 	mu   sync.Mutex
@@ -83,6 +84,9 @@ func LoadLedger(path string) (*Ledger, error) {
 	if l.Requesters == nil {
 		l.Requesters = map[string]*Requester{}
 	}
+	if l.Quarantined == nil {
+		l.Quarantined = map[string]bool{}
+	}
 	return l, nil
 }
 
@@ -156,6 +160,32 @@ func (l *Ledger) MarshalSnapshot() ([]byte, error) {
 	return json.MarshalIndent(l, "", "  ")
 }
 
+// Quarantine silences a crow the Sentry flagged (E3): it may not claim,
+// deliver or speak unprompted until the owner lifts it. Fail-safe — the mark
+// sticks. Callers pair this with Save to persist it.
+func (l *Ledger) Quarantine(crow string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.Quarantined == nil {
+		l.Quarantined = map[string]bool{}
+	}
+	l.Quarantined[crow] = true
+}
+
+// LiftQuarantine restores a quarantined crow to the flock (owner decision, #45).
+func (l *Ledger) LiftQuarantine(crow string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.Quarantined, crow)
+}
+
+// IsQuarantined reports whether the Sentry watchdog has silenced a crow.
+func (l *Ledger) IsQuarantined(crow string) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.Quarantined[crow]
+}
+
 func (l *Ledger) requester(id string) *Requester {
 	r := l.Requesters[id]
 	if r == nil {