Ralf, I am not seeing this with a working checkout of
5017c3422334 which is the tip.

I created an auditor that checks the title of the issue class.
If the word rejectme is in the title, it raises Reject.

I see the rejection in the web interface and I get the
bad title (with rejectme) redisplayed like I expect.

If I use the goto box to reload the same issue, I see the
original title and no history changes in the history.

Also I have an auditor for msg that check for more than 2 links in the 
body of the message. If I put in three, I get the reject and I do not 
have the message saved nor do I find the body of the message in the db 
directory.

How are you seeing the committed data that should be rejected?
I agree 100% what you describe is a critical failure.