Wraith: coordinator_redundancy is built but unwired, so a seat is a single point of failure

[defenwycke]

crates/wraith-protocol/src/coordinator_redundancy.rs provides redundancy, rotation, failover and optional k-of-n coordination, with a considered trust-model note. Nothing references it — the only mentions anywhere are comments in lite_session.rs ("task #38 wires this up", "task #40 wires this up") and a scope note in ghost-pool's election module saying it deliberately does not touch it.

This is the one part of #697's original claim that was accurate. The election itself is wired (computed, published, activated when elected, and consumed by the wallet); redundancy is not.

What it means today

A seat is a single point of failure for the sessions it owns. If the node holding it goes dark mid-epoch, wallets sharded onto that seat have nowhere to go until the epoch flips — pick_seat_endpoint returns the owning seat's endpoint or None, and the caller falls back to a manually configured coordinator.

That is survivable at the current scale (#708: one seat, one candidate) and stops being survivable as soon as the roster is real and sessions are actually distributed.

Worth deciding first

• Whether failover should be automatic (the wallet tries the next seat by rank) or explicit (the mesh republishes a view with the dead seat removed). Automatic failover changes which coordinator a wallet talks to without the wallet being told, which has an anonymity-set consequence: wallets that fall back at different moments stop converging on one seat, which is the property shard_key_for_tier_epoch exists to create.
• Whether k-of-n coordination is wanted at all in v1, or whether single-seat-with-failover is the right scope.