[bug] archive cascade and scope-invalidation publish are not transactionally paired #554

Actual behavior

In crate/core/sinex-gateway/src/replay_control.rs:1779-1790, the archive-cascade flow is:

1. SQL transaction archives matching events into audit.archived_events and removes them from core.events. Transaction commits.
2. NATS sinex.derived.invalidation publish is issued so downstream automata know to re-derive.

If step 2 fails (NATS unavailable, transient publish error, sigterm between commit and publish), the DB transaction has already committed. Automata never receive the invalidation signal and continue serving stale derived state. The user-facing replay operation reports failure ("publish failed"), but the archival side effect persists.

The compensating logic at replay_control.rs:1839-1852 only fires on the abort path; in the normal success-then-publish-fail path there is no rollback.

Expected behavior

Archive and scope-invalidation must be atomic from the operator's perspective: either both succeed, or the system can deterministically recover and re-publish without leaving automata stranded.

Acceptable shapes:

• Two-phase: durable outbox row inside the same transaction as the archive; a publisher loop drains the outbox to NATS with retry. NATS failure no longer corrupts state.
• Inline retry with bounded backoff and a final failure path that re-archives or marks the operation for replay-republish.
• Server-side trigger that emits via pg_notify plus a daemon that bridges to NATS.

The right shape is a design decision, but the current "publish best effort after commit" is a silent split-brain.

Reproduction or trigger

1. Begin a replay operation with a non-empty cascade.
2. After the archive transaction commits, before the publish completes, kill the gateway (or block NATS publish via firewall rule).
3. Observe: events are in audit.archived_events, removed from core.events, but downstream automata never see the invalidation. Their derived outputs continue to reference archived parents.

Suspected scope

• crate/core/sinex-gateway/src/replay_control.rs (archive_cascade, scope-invalidation publish)
• crate/lib/sinex-db/src/replay/
• possibly a new outbox table in core schema
• VM / fault-injection test surface

Severity

p1 — silent automaton stale-state on transient NATS issue, no operator signal, no recovery path.

Evidence

• replay_control.rs:1779-1790 — archive then publish, no transactional pairing.
• replay_control.rs:1839-1852 — abort-path compensation only.
• Matches CLAUDE.md event-lifecycle.md step 18 caveat: "Per-event NATS confirmation publish failure ... event persisted but node doesn't know."

Fix acceptance criteria

• Archive completion guarantees that the corresponding invalidation signal is durable before the user is told the operation succeeded.
• NATS publish failure does not leave automata permanently stale; a retry path drains pending invalidations.
• Fault-injection test that kills the gateway between archive commit and publish; on restart, automata observe the invalidation.
• Operations log records archive commit and publish ack independently so operators can audit the gap.