feat(controller-status): stamp election time on both promotion roads (task 7.2)

Stamps ha_state_t.last_known_elected_at_ms (CLOCK_REALTIME, epoch-ms) in
both ha_do_promote (non-raft road) and raft_cb_become_leader (raft road),
placed at each road's genuine, final commit point to CTRL_PRIMARY -- past
every early-return refusal path in raft_cb_become_leader (first-boot
phase2 failure, the Live Apply Resource Fence re-check, the promotion
eligibility gate, config-serve-fenced, upgrade-materialization-fenced).
Purely observational: does not change whether/when a promotion succeeds
or is refused. Three new tests (2 positive, 1 negative) prove placement:
a refused promotion leaves the field at its pre-attempt value.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLSNJhNoULvVcUhXEFafQC

src/controller/ha.c

@@ -1960,6 +1960,28 @@ static void raft_cb_become_leader(void *ctx, uint64_t term)
      * (raft_cb_become_leader_for_test) reaches it. */
     atomic_store_explicit(&ha->role, (int32_t)CTRL_PRIMARY,
                           memory_order_release);
+
+    /* controller-status delta task 7.2 (Req 12.1, 12.5): stamp the wall-clock
+     * election time HERE — this is the raft road's genuine, final commit
+     * point to CTRL_PRIMARY, past every early-return refusal above (the
+     * first-boot cluster_init_phase2 failure, the first-boot Live Apply
+     * Resource Fence re-check, the ha_promotion_gate_decision eligibility
+     * gate, config_serve_fenced, and upgrade_materialization_fenced). Do
+     * NOT move this earlier — in particular NOT to the
+     * last_known_committed_lsn self-observe point above (inside
+     * `if (promo_ectx)`, ~line 1665): that point precedes the eligibility
+     * gate and can still be followed by a refusal, which must never produce
+     * a bogus election time. CLOCK_REALTIME (wall clock), same epoch-ms
+     * conversion as ctrlstatus_fill's responder_time_ms (Req 11 precedent,
+     * ctrlstatus.c). Purely observational: does not affect whether/when
+     * this promotion is refused. */
+    struct timespec elected_ts;
+    clock_gettime(CLOCK_REALTIME, &elected_ts);
+    atomic_store_explicit(&ha->last_known_elected_at_ms,
+                          (uint64_t)elected_ts.tv_sec * 1000u
+                              + (uint64_t)elected_ts.tv_nsec / 1000000u,
+                          memory_order_release);
+
     INFO("HA FSM (raft): → CTRL_PRIMARY (term=%" PRIu64
          ", first_boot=%d)", term, is_first_boot);
 
@@ -2931,6 +2953,25 @@ void ha_do_promote(ha_state_t *ha)
     atomic_store_explicit(&ha->role, (int32_t)CTRL_PRIMARY, memory_order_release);
     /* COH-5: new primary starts a fresh CRC chain; standbys reset their chain on catch-up */
     ha->last_received_crc = WAL_CRC_NONE;
+
+    /* controller-status delta task 7.2 (Req 12.1, 12.5): stamp the wall-clock
+     * election time now that this (non-raft) road has irrevocably committed
+     * to CTRL_PRIMARY. This function has no refusal path of its own — any
+     * eligibility/refusal gating for this road lives in its caller,
+     * ha_promote_to_primary, outside this task's boundary — so the stamp
+     * placement here is trivially "after every refusal check this function
+     * performs" (there are none). CLOCK_REALTIME (wall clock, NOT
+     * CLOCK_MONOTONIC — comparable to controller log timestamps), same
+     * epoch-ms conversion ctrlstatus_fill already uses for responder_time_ms
+     * (Req 11 precedent, ctrlstatus.c). Purely observational: does not affect
+     * whether/when promotion succeeds. */
+    struct timespec elected_ts;
+    clock_gettime(CLOCK_REALTIME, &elected_ts);
+    atomic_store_explicit(&ha->last_known_elected_at_ms,
+                          (uint64_t)elected_ts.tv_sec * 1000u
+                              + (uint64_t)elected_ts.tv_nsec / 1000000u,
+                          memory_order_release);
+
     /* Req 10.5: log FSM transition to PRIMARY */
     INFO("HA FSM: → CTRL_PRIMARY (term=%" PRIu64 ")",
          atomic_load_explicit(&ha->term, memory_order_acquire));