fix(server): reject a refused op instead of logging, deduping and acking it (C19)

[vieiralucas]

Hub::ingest_records appended to the store before Document::apply, discarded the bool, and did room.seen.insert + room.log.push unconditionally. handle_ops computes through as a max over the submitted batch, so the session replied Accepted { through } and the author's outbox dropped the op.

An op the replica refuses was therefore durably logged, permanently deduped (a corrected resend of the same OpId swallowed forever), fanned out to every peer, replayed on every room reload, and acked as landed while landing nowhere.

Reach — the board understated it

• C3 (fix(core): bound Tx.count, agree a group's size, and evict a partial tx (C3) #363) concluded "only an in-process caller reaches this refusal". True of its own Tx.count refusal (the codec bounds it); does not carry to the stamp predicates fix(core): mint above the replica's own id space, and bound the stored clock both ways (C17, C18) #366 added.
• codec.rs references none of stamp_names_its_author / stamp_occupies_a_mintable_position / reservation_end (grep count 0); decode_ops bounds neither stamp.offset, nor stamp.lamport, nor stamp.client vs id.client.
• The predicate gate at doc.rs:2172 is the state-decode path (a snapshot's buffered ops), not the wire op path. The wire refusal is in apply, after decode_ops succeeded.
• So a peer could send an op that decodes cleanly and still poison the durable log and draw a false ack. Pinned by a_refused_op_survives_a_codec_round_trip.

What apply's false meant

Three unrelated situations, only one permanent:

• duplicate — already applied or already held
• waiting — target not yet reachable, or atomic group incomplete; a later arrival commits it
• refused forever — stamp not naming its author, stamp off a mintable position, transaction size no group can have

Only the third may be dropped. Op::is_admissible names it: a public pure predicate over the op alone. apply and the snapshot decode both gate on it, so the rule has one home.

Why rejecting is safe

Every condition reads the op and nothing else. Two replicas at unrelated states reach the same verdict, so refusing converges the room on the op's absence rather than splitting it. Dropping state a peer might still apply would diverge; dropping state no peer will ever apply does not.

The gates

• handle_ops → OpsRejected / new ErrorCode::MalformedOp (tag 9; mirrored through wasm, FFI, Go, Python, and both codec round-trip lists). Recoverable, not a disconnect — the frame was well-formed.
• The whole batch, not the offending op: the ack frontier is a max over the batch, so acking the admissible half would acknowledge the refused op's sequence with it.
• Hub::ingest_records + ingest_branch filter independently — apply_replicate reaches Hub::ingest from a peer's Replicate frame without crossing handle_ops.
• The branch-tail restore path (install_room) filters too: it bypasses ingest_branch and installs a stored tail verbatim, and the bytes come from whoever hands the store over.
• The branch tail matters on its own: a tail folds into a document only at materialization, so an inadmissible op there sits durable and undetected until the fold.
• replay::canonical_tail takes the same filter — it numbers sequences from the tail the hub commits, so against bytes this node did not write an unfiltered tail slides every later op's sequence by one.

Untouched

A buffered op and an incomplete transaction member are logged, fanned out and acked exactly as before. Refusing a member for not applying yet would strand its whole group forever.

Not done — filed as C26

The bool→enum refactor across client.rs / FFI / wasm / JS / Python / Go. The public predicate makes "never" answerable at any seam that cares, and client.rs advancing last_seen_seq past a refused op is correct (no replica will hold it). What remains is the SDK apply paths reducing the result to a count.

Gates

• cargo test --workspace --no-fail-fast: 0 failed.
• Miri: -p crdtsync-server --test refused_op --test replay --test persistence and -p crdtsync-core --test state_doc --test transaction --test protocol --test lamport_ceiling clean, exit 0.
• Local cold review: three passes, findings addressed (vacuous buffered-op assertion, colliding op ids in the batch test, missing branch positive control, un-asserted Accepted frontier, replay tail mismatch, timeless-comment violations, and — from the final pass — the unfiltered branch-tail restore path).
• Mutation sweep (--no-fail-fast, isolated git archive copy), 9 mutations, none zero; unmutated tree fails 0:

mutation	tests failed
no ingress gate	4
no ingest_records filter	3
no branch-tail filter	1
gate filters the op instead of refusing the batch	4
is_admissible ignores the author check	4
is_admissible ignores the position check	11
is_admissible ignores the tx-count check	2
no branch-restore filter	1
no replay::canonical_tail filter	1
is_admissible refuses a held transaction member	1

Three of these survived an earlier sweep — the held transaction member, the replay tail, and the branch restore — and each is now killed by the test written in response. The sweep audited the suite, not only the source.