fix(control): preserve consistent health and public state across rejected or failed mutations #200

What happened

Stability audit finding F01 / P1 (2026-09-27). Priority is an audit recommendation, not a claim of a production incident.

Two mutation failure boundaries leave inconsistent state:

1. An otherwise valid registration with an invalid final proof returns HTTP 400 invalid_proof, but DB revision advances from 1 to 2 while published state remains at revision 1. isHealthy() becomes false and /healthz returns 503.
2. In a synthetic deferred-constraint fault injection that fails only at COMMIT during revoke, publication completes before COMMIT. The DB rolls back to revoked=false, the published state remains revoked=true, and isHealthy() returns true.

A 60-second publication refresh may repair the first condition, while the deployment watchdog is 30 seconds and unhealthy Control suppresses heartbeats. A watchdog restart is a possible consequence, not a production restart reproduced by this audit. The second result is explicitly fault-injected, not an observed production DB failure.

What you expected

Rejected requests must not poison readiness. Failed commits must not expose rolled-back state as healthy. Preserve revision monotonicity; simply moving revision reservation into a transaction may violate the existing contract.

Environment

• Baseline: published session-peer v1.0.1, commit 55168c3bea5a49e81916fdead57d3634def6b1d6.
• Reproduction: isolated source/tag fixtures; no live message/ACK tests or production mutation.
• Audit environments: macOS arm64, Python 3.14.7; Control tests use Node 22.14.0. Linux evidence is explicitly identified above where applicable.
• Discovery output: not applicable to this fixture; no real session identifiers or credentials are included.

Source evidence

• control/src/server/relay-control.ts#L151
• control/src/server/relay-control.ts#L476
• control/src/server/main.ts#L129

Acceptance criteria

• Add invalid-proof and generation-conflict regression cases that preserve health and committed/public state consistency.
• Inject COMMIT failure and require DB/public state agreement or an explicit fail-closed state with bounded recovery.
• Test subsequent valid mutations, restart, and concurrency/retry behavior without revision reuse.

Scope and limitations

Control is a separate deployment unit: publishing the Python package alone does not deploy this fix.

Target: v1.0.2 stability work. This issue does not authorize a release or operating-service changes. Offline reproduction establishes the failure mechanism, not attribution of historical #161 incidents.

Checked

• Searched existing issues for duplicates.
• Removed credentials, conversation contents, private paths and real device/session identifiers.
• Used isolated fixtures without weakening inbound permissions.