fix: bind Web Push mutations to exact authority

WP-01: a CAS receipt is only evidence when it names the expected key and the
exact next revision. Write and remove now share one validator, so a stale or
arbitrary repository receipt can no longer be packaged as a confirmed control.

WP-05: a pre-aborted command records the operation the caller requested instead
of always reporting an inspection.

WP-06: bounded fan-out is reported honestly. The subscriptionchange client
handoff and the notification cleanup both emit countBucket and truncated, and an
incomplete cleanup returns { complete: false } and is observed as DEGRADED
separately from revoke authority.

WP-07: the user-visible native notification effect is tracked through
NOT_APPLIED, MAYBE_APPLIED and CONFIRMED phases and surfaced as observation
evidence, never as retry authorization.

WP-02, WP-03 and WP-04 stay open: they need the V2 wire protocol with server
request-shape negotiation, which belongs to the versioned-migration task rather
than this correctness pass. The ledger records them as DEFERRED_TO_MIGRATION.

Web Push remains NOT_SELECTED and AVAILABLE_NOT_COMPOSED.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/adapters/web-push/push-association-fence-store.ts

@@ -502,7 +502,7 @@ export function createPushAssociationFenceStore(
       operation,
     );
     if (!written.ok) return written;
-    if (!validWriteReceipt(written.value)) {
+    if (!validWriteReceipt(written.value, expectedRevision)) {
       return webPushFailure("CONTROL_CORRUPT", operation);
     }
     return webPushSuccess(
@@ -537,10 +537,7 @@ export function createPushAssociationFenceStore(
       "CONTROL_PURGE",
     );
     if (!removed.ok) return removed;
-    if (
-      !validWriteReceipt(removed.value) ||
-      removed.value.revision !== expectedRevision + 1
-    ) {
+    if (!validWriteReceipt(removed.value, expectedRevision)) {
       return webPushFailure("CONTROL_CORRUPT", "CONTROL_PURGE");
     }
     return webPushSuccess(undefined);
@@ -693,14 +690,25 @@ function validRepository(
   );
 }
 
+/**
+ * WP-01. One validator for both write and remove.
+ *
+ * A CAS receipt is only evidence when it names the expected key and the exact
+ * next revision. Accepting any well-typed revision let a stale or arbitrary
+ * repository receipt be packaged as a confirmed control, after which the whole
+ * CAS authority is wrong. A replayed receipt must still carry that exact
+ * revision, since replay means "this command already produced this revision".
+ */
 function validWriteReceipt(
   value: PushControlWriteReceipt,
+  expectedRevision: number | null,
 ): value is PushControlWriteReceipt {
   return (
     Boolean(value) &&
     value.key === CONTROL_KEY &&
     validRevision(value.revision) &&
-    typeof value.replayed === "boolean"
+    typeof value.replayed === "boolean" &&
+    value.revision === (expectedRevision ?? 0) + 1
   );
 }