fix: bind Web Push mutations to exact authority

WP-01: a CAS receipt is only evidence when it names the expected key and the
exact next revision. Write and remove now share one validator, so a stale or
arbitrary repository receipt can no longer be packaged as a confirmed control.

WP-05: a pre-aborted command records the operation the caller requested instead
of always reporting an inspection.

WP-06: bounded fan-out is reported honestly. The subscriptionchange client
handoff and the notification cleanup both emit countBucket and truncated, and an
incomplete cleanup returns { complete: false } and is observed as DEGRADED
separately from revoke authority.

WP-07: the user-visible native notification effect is tracked through
NOT_APPLIED, MAYBE_APPLIED and CONFIRMED phases and surfaced as observation
evidence, never as retry authorization.

WP-02, WP-03 and WP-04 stay open: they need the V2 wire protocol with server
request-shape negotiation, which belongs to the versioned-migration task rather
than this correctness pass. The ledger records them as DEFERRED_TO_MIGRATION.

Web Push remains NOT_SELECTED and AVAILABLE_NOT_COMPOSED.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/service-worker-runtime.test.ts

@@ -193,20 +193,13 @@ describe("service worker static cache authority", () => {
     const previousMatch = vi.fn(
       async () => new Response("previous", { status: 200 }),
     );
+    const deleteEntry = async (): Promise<boolean> => true;
+    const emptyMatch = async (): Promise<Response | undefined> => undefined;
+    const previousCache = { match: previousMatch, delete: deleteEntry };
+    const emptyCache = { match: emptyMatch, delete: deleteEntry };
     const runtime = staticRuntime({
-      open: vi.fn(
-        async (
-          name: string,
-        ): Promise<Readonly<{ match: unknown; delete: unknown }>> =>
-          name === previousCacheName
-            ? {
-                match: previousMatch,
-                delete: async (): Promise<boolean> => true,
-              }
-            : {
-                match: async (): Promise<Response | undefined> => undefined,
-                delete: async (): Promise<boolean> => true,
-              },
+      open: vi.fn(async (name: string) =>
+        name === previousCacheName ? previousCache : emptyCache,
       ),
       keys: vi.fn(async () => [currentCacheName, previousCacheName]),
       delete: vi.fn(async () => true),
@@ -226,13 +219,16 @@ describe("service worker static cache authority", () => {
   it("deletes an invalid hit only from the current release cache", async () => {
     const deletes: string[] = [];
     const runtime = staticRuntime({
-      open: vi.fn(async (name: string) => ({
-        match: async () => new Response("bad", { status: 500 }),
-        delete: async (url: string): Promise<boolean> => {
+      open: vi.fn(async (name: string) => {
+        const recordDelete = async (url: string): Promise<boolean> => {
           deletes.push(`${name}:${url}`);
           return true;
-        },
-      })),
+        };
+        return {
+          match: async () => new Response("bad", { status: 500 }),
+          delete: recordDelete,
+        };
+      }),
       keys: vi.fn(async () => [currentCacheName]),
       delete: vi.fn(async () => true),
     });

tests/unit/web-push-fence-store.test.ts

@@ -42,6 +42,37 @@ function manualScheduler() {
 }
 
 describe("Web Push durable control fence", () => {
+  it.each([0, 2, 3, 9_999])(
+    "rejects a CAS receipt that is not the exact next revision (%i)",
+    async (revision) => {
+      // WP-01. Only the exact next revision is evidence that this command
+      // actually wrote the control it claims to have written.
+      const dependencies = createFakePushControlStoreDependencies();
+      const repository = dependencies.repository;
+      const compareAndSwap = repository.compareAndSwap.bind(repository);
+      repository.compareAndSwap = async (input) => {
+        const written = await compareAndSwap(input);
+        return written.ok
+          ? {
+              ok: true as const,
+              value: { ...written.value, revision },
+            }
+          : written;
+      };
+      const store = createPushAssociationFenceStore(dependencies);
+
+      await expect(
+        store.prepare({
+          authority: firstAuthority,
+          updatedAt: "2026-07-28T00:00:00.000Z",
+        }),
+      ).resolves.toMatchObject({
+        ok: false,
+        error: { code: "CONTROL_CORRUPT" },
+      });
+    },
+  );
+
   it("CASes UNASSOCIATED to ACTIVE and prevents tombstone resurrection", async () => {
     const store = createPushAssociationFenceStore(
       createFakePushControlStoreDependencies(),

tests/unit/web-push-worker-runtime.test.ts

@@ -445,6 +445,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "DEADLINE_EXCEEDED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
     runtime.dispose();
   });
@@ -489,6 +491,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "ABORTED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
 
     const throwingStore = await activeFence();
@@ -540,6 +544,8 @@ describe("Web Push worker runtime", () => {
       event: "web_push_subscription_rotated",
       outcome: "DEGRADED",
       reason: "ABORTED",
+      countBucket: expect.any(String),
+      truncated: expect.any(Boolean),
     });
     throwingRuntime.dispose();
   });