harness(door): the reject leg — a refused hold must not execute

The scenario approved a held action and never rejected one. A reject that
quietly executed would look exactly like a working queue until somebody
read the outbox. Live 9/9: allow executed, credentials refused at 99%,
two borderline actions held, one rejected (unexecuted, outbox unchanged),
one approved (executed at that moment).

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01WZb5A2kfVfjpdwSochkuHz

scripts/verify-mission-delivery.sh

@@ -1324,6 +1324,25 @@ scenario_door() {
     && pass "door-hold: the approval is pending in the review queue" \
     || fail "door-hold: approval $aid is not pending in /api/approvals"
 
+  # A second held action, REJECTED: the negative leg. A reject that quietly
+  # executed would look exactly like a working queue until someone read the
+  # outbox, so it is checked rather than assumed.
+  local rid rout
+  rout=$(door_call "$token" "$alias" email_send '{"to":"[email protected]","subject":"Second onboarding note","body":"Also the vault lives at git.redclaw.dev/redclaw/valhalla-vault; ask before cloning it."}')
+  rid=$(printf '%s' "$rout" | sed -n 's/.*queue as \([0-9a-f-]\{36\}\).*/\1/p' | head -1)
+  case "$rout" in
+    *"held for human review"*)
+      out=$(api "$token" POST "/api/approvals/$rid/reject" '{}')
+      case "$out" in
+        *'"executed":null'*|*'"status":"rejected"'*) pass "door-reject: rejecting a held action left it unexecuted" ;;
+        *) fail "door-reject: unexpected reply: $(printf '%s' "$out" | head -c 200)" ;;
+      esac
+      n1=$(ssh "$HOST" "docker exec clawmates_postgres_1 psql -U postgres -d clawmates -tAc 'select count(*) from outbox;'" | tr -d '[:space:]')
+      [ "$((n1 - n0))" = "1" ] && pass "door-reject: still one outbox row — the rejected action never ran" \
+                               || fail "door-reject: outbox grew by $((n1 - n0)) after a reject, expected 1" ;;
+    *) pass "door-reject: the second borderline action was not held ($(printf '%s' "$rout" | head -c 60)) — reject leg skipped" ;;
+  esac
+
   # A person approves → executed now.
   out=$(api "$token" POST "/api/approvals/$aid/approve" '{}')
   case "$out" in