# FIX-193 JIT — same-exchange idempotent echo at the claim site (releases#193)

Dispatched by doyle 2026-08-19 after the operator confirmed branch 1 + attach (#193 WIP under the
milestone; instrument verdict + scorecard at #181 comment 5336029660). Product side, mine per the
standing split. **The (b) lane — cross-process exclusion + finished-row retirement for non-Attach
families — is #194, needs-operator, NOT attached; do not carry it here.**

## Lane
- Branch `fix/redeem-same-exchange-echo` off **`fd3dc5a`** (the ladder's landing chain tip — NOT the
  diag branch; diag instruments must not ride the product lane). Worktree `.worktrees/redeem-echo`.
- Pool: claim sequentially with the lane's own identity before any build.

## The measurement this is sited on (run 32200175631)
Two dispatcher PROCESSES on one home served the same redeem stream 21 ms apart; the winner (`spt`
livehost, pid 1685111) consumed + notified, the loser (test-hosted daemon, pid 1684652) hit
`claim-err:AlreadyConsumed` and its REFUSED reply beat the winner's REDEEMED by 88 ms. Invariant
ruled (a): one dispatcher set per node — but the gate is per-process and the violation is
abnormal-but-REACHABLE (socket squat, job-escaped autostart, resume-steal, boot race), so the fix
must be **honest under the violation**, not assume it away.

## Design
1. **Store carries the exchange identity.** `KnockCode` gains additive
   `consumed_exchange: Option<ConsumedExchange>` = `{ rec_id, redeemer, origin_node,
   reverse_requested }`. Serde-default so an N-1 record decodes clean (the `SubscribeReq.code`
   precedent). `rec_id` stops being tracing-only — **say that in the commit**.
   - `reverse_requested` is recorded because it is the ONE reply field not recomputable after the
     due is consumed; target/granted/admit_node all recompute from `code_rec` + `redemption_grant`.
2. **`consume_claim` takes the exchange** (one function, not a second copy): wire caller passes
   `Some(..)`, the local verb passes `None`.
3. **`consumed_by_same_exchange(code, rec_id, redeemer, origin_node)`** — Some only when the code is
   consumed AND all three match.
4. **Echo at BOTH already-spent refusal sites**, because the race lands either way:
   - `claim-err:AlreadyConsumed` (the arm that FIRED in the measurement), and
   - `consume_claim == false` (the loser at consume time) — re-load the store there, our copy is stale.
   Echo = **reply-only**: no notify_minter, no monic impart, no writes.
5. **Every foreign cause keeps the single anti-oracle REFUSED**, byte-identical
   (Unknown/Expired/RateLimited/foreign-AlreadyConsumed). The oracle does not grow: an echo needs the
   same proven origin + redeemer + rec_id, which a guesser without the exchange does not hold.
6. **REQ text**: `REQ-KNOCK-REDEEM-WIRE` currently promises REFUSED covers "unknown, expired,
   consumed AND rate-limited alike". The echo **MOVES** that promise (consumed now means consumed by
   a DIFFERENT exchange) — so the REQ edit rides this commit, and the report must say MOVES not
   sharpens so deployah prices the union at intake.
7. **Units, both polarities**: same-exchange echoes REDEEMED (and does not re-notify / re-write);
   foreign AlreadyConsumed still REFUSED with the refused reply byte-identity pinned; the three
   negative rows on the matcher (rec_id / redeemer / origin each differing); N-1 decode.
8. `traceable-reqs check` before declaring done.

## Known residue to REPORT, not fix here
`claim_code` charges the arrival window BEFORE the lookup, so an echo still spends rate budget. Left
as-is (it preserves the anti-guess ordering); named in the report.

## Side fact doyle asked for (answered, one grep)
Pid 1685111 (`exe=spt`) on B is the **notify shell adapter's livehost**: `seed_notify_shell`
(twohost.rs:570-600) builds a spawn template that launches the REAL `spt` binary
(`--spt <spt_bin>`), and B logged `notify instance notify-0 minted (real_mode=true)`; its first
sighting (wall 1787098464346) is ~4 s after the B-2 rung print, and its callers are
`livehost.rs:1096/577/796`. So it is a rig RUNG's live host, but the SHAPE — a live-agent host
process running a dispatcher beside the daemon — is production, not a test artifact. Not a rig defect
to fix in this lane; hertz/W9 if doyle wants it chased.

## STATE 2026-08-19 — both branches pushed, convergence run in flight
- **Product lane** `fix/redeem-same-exchange-echo` @ **`b05fea8`** off `fd3dc5a` — pushed. spt-store
  cells 45/45, spt-daemon redeemop cells 11/11, `traceable-reqs check` exit 0.
- **Diag child** `diag/pump-188-w9-redeem-echo` @ **`4828ad0`** = w8 instruments + `b05fea8`
  cherry-picked (3 conflicts, all in `redeemop.rs`, resolved to keep BOTH the fix and the tokens) —
  pushed, check exit 0, cells 11/11. Worktree `.worktrees/redeem-echo-diag`; pool taken over
  sequentially with the lane's identity.
- **Tested-vs-landing:** `knock.rs` + `traceable-reqs.toml` byte-identical lane↔child (0 diff lines);
  `redeemop.rs` differs by diag scaffolding only, calling the same `same_exchange_echo` and returning
  it unchanged. doyle re-verified this himself by rev-parse.
- **Negative control (run + recorded):** echo removed ⇒ exactly the two new-behaviour cells red
  (`a_repeat_of_the_same_exchange…`, the repaired arming arm), anti-oracle byte-identity cell green.
- **doyle's diff read PASSES** all pre-announced criteria (verdict pending run + full gate). His two
  non-blocking notes to carry into the run report: (1) the claim-arm echo runs on EVERY claim error,
  so **rate-limited + same-exchange now echoes REDEEMED** where it used to refuse — honest (spent +
  full triple required), but say it so an echo under rate pressure is not a surprise; (2) `admit_node`
  is recomputed post-consumption via a pure `redemption_grant`, and both cells pin `admit_node=false`
  fixtures, so the echo==first pin guards ONE polarity — note only, no cell this lane.
- **Spawner RULED (doyle):** pid 1685111 = the notify shell adapter's `spt` livehost. NOT hertz/W9 —
  a rig rung spawned it, but the shape is production, so it is a faithful field-window reproduction
  and the rig stays as-is (currently the only regression rig reaching #194's condition). The
  routine-vs-abnormal re-scope question is recorded on #194 comment 5336186644. No action for me.
- **Convergence run 32203048811** in flight (doyle has it too). Report against C1–C5 on landing,
  including WHICH reply A consumed where two serves occurred.
- Gate criteria doyle will apply, all pre-checked green: both-polarity cells at the claim arm ·
  refused byte-identity pinned by test (`encode_line()` bytes, not `PartialEq`) · echo payload the
  SAME computation as the first reply (`redeemed_reply`, extracted after his criterion caught it as
  parallel construction) · no new early-return before the arrival charge · traceable clean · blob
  identity.

## CONVERGENCE RUN 32203048811 @ `4828ad0` — BOTH LEGS GREEN, arm fired = C5 (not C1)

- twohost-a SUCCESS 3/3, 103.56 s, "invite code redeemed cross-node" — A ran PAST `:2479` to the end
  of the ladder. twohost-b SUCCESS, rung N3 green. **End-to-end green on both legs.**
- **C1 SATISFIED VACUOUSLY**: the redeem exchange was served ONCE — one `REDEEM_SERVE`
  (`serves_for_rec=1`), one `ARM arm=redeemed`, one `REPLY outcome=redeemed`, one `STREAM_SERVE`
  for `stream=504` (`family=Redeem`, `finished=true`, `floor_seq=0`) from ONE process. No pair to
  see ⇒ proves nothing. **C2** trivial for the same reason. **C3 REAL** (ladder complete, no next
  onion layer). **C4** not triggered. **C5 is the arm that fired.**
- **The CONDITION reproduced though**: both dispatchers live again on B — 716 `STREAM_SERVE` from
  the test-hosted daemon (pid 1729454), 154 from the livehost `spt` (pid 1729893). The livehost
  simply did not pick up stream 504. So #194's condition is 2/2 instrumented runs; the collision on
  the redeem stream is **1/2** (w8 yes, w9 no). Denominator TWO.
- **This green is NOT evidence the fix works.** The fix cannot prevent a double serve (that is #194);
  it only makes the answer honest when one happens, and none happened. The fix's evidence stays the
  both-polarity cells + the negative control.
- **doyle's echo-polarity question, answered from w8** (no new instance in w9): both replies DO reach
  the wire on one stream — `REPLY outcome=refused` wall 551786 (test daemon) and
  `REPLY outcome=redeemed` wall 551874 (livehost), both `stream=486` — and A consumed the FIRST to
  arrive, the refusal, panicking 4 ms later at 551790. Each serve loop holds its own `replied` latch.
  Post-fix both would be REDEEMED and ordering stops mattering — still a PREDICTION.
- Offered, not started: a DETERMINISTIC two-serve rig would witness the echo (test-side ⇒ hertz per
  the split). Re-firing the ladder against a 1-of-2 rate would be buying a rerun — refused.

## CLOSED (2026-08-19) — gate red on clippy, respun, assembled, worktrees torn down

**Landing sha is `1d1b6e4`, NOT `b05fea8`.** The gate at `b05fea8` was RED — clippy tier, my lane,
three imports orphaned by the `redeemed_reply` extraction (`serve_one_redeem`'s `surface`, and both
`use` lines in `same_exchange_echo`); golden runs clippy with `-D warnings`, so it would have redded
the golden run. Everything else at that sha was green: nextest full `--no-fail-fast` 1554/1554, 0
skipped, 386 s (doyle's first-pass 3 reds were HIS rig's missing `capture-player.exe`, attach family,
gone after prebuild), `traceable-reqs` exit 0. Fixup = one commit, one file, +1/-4, imports only;
`redeemed_reply` keeps its own pair as the sole user. Verified statically (scope-grep of `surface::`
and `redemption_grant(` against fn boundaries) — NOT by build: doyle's gate held the main pool
throughout and I never ran cargo or claimed a pool in this lane's second half.

- **Assembled:** `stage/nameplate-181-w8-head` @ `1d1b6e4`, ff from `b05fea8`, ancestry-assert + ref
  move, no merge commit. Gate record #181 comment 5336334741; deployah has the head.
- **Diag child RULED (doyle):** `4828ad0` stays the UNTOUCHED convergence witness — no mirror commit,
  no ladder re-run, even though it carries the identical three dead imports. Post-respin the
  tested-vs-landing `redeemop.rs` delta is scaffolding + exactly those three lines, inert by
  construction (an import removal has no codegen); doyle enumerates it in the gate record per the
  byte-identity limit.
- **Teardown DONE** for `.worktrees/redeem-echo` + `.worktrees/redeem-echo-diag`. Both roots plain
  directories, no reparse point; **neither had a `target/` at all** (both built into the main pool
  sequentially), so no pool-shaped hazard was reachable. Inbound sweep 0 reparse points,
  `CARGO_TARGET_DIR` UNSET. 19.42 MB/789 files + 19.46 MB/791 files; free 114.39 → 114.44 GB,
  **reclaim 0.05 GB** — small because these were pure source checkouts. All three refs confirmed by
  `ls-remote` BEFORE deleting, which doubles as the second independent witness that the assembly
  landed.
- **Still held:** `.worktrees/pump-188`, `.worktrees/pump-188-diag` (+ `nameplate-asm`, `redeem-dup`)
  for the post-ship teardown batch — doyle wants that reclaim measured as ONE number, not dribbled.
  `diag/pump-188-heartbeat` @ `b20e770` has no further planned runs but the batch waits for the ship.
- **Pool:** doyle's `gate-b05fea8` claim holds the main pool until deployah's golden verdict (a red
  hands back to him for triage and may need it). Nothing for me to release.
- Open only on deployah's golden. If it goes RED I am first call for the product side.

## SUPERSEDED — the pre-gate open state (kept for the lane's shape)
- doyle's gate running at `b05fea8` in his own worktree (`gate-b05fea8`) on the main pool: clippy
  `--workspace --all-targets` (done, 42.85 s warm), nextest `-p spt-store -p spt-daemon`,
  `traceable-reqs check`. On green: ONE assembly onto the chain (`b05fea8` is a LINEAR child of
  `fd3dc5a` ⇒ ancestry-assert + ref move, no merge commit), then deployah's fresh intake over the
  real range `27d40b9..b05fea8` and his golden push.
- **HOLD until doyle confirms the assembly landed:** no re-claim, no cargo into the main pool, both
  worktrees (`.worktrees/redeem-echo`, `.worktrees/redeem-echo-diag`) standing. Teardown is
  classify-before-delete per the ruling, AFTER his confirmation.
- **Rig question CLOSED (doyle):** no deterministic two-serve rig pre-ship — the w8 race was
  SEQUENTIAL at the store level and the echo cell reproduces that interleave with a disk-backed
  reload between serves; the rig's delta is dispatch plumbing. It rides #194's build lane (hertz's
  side when cut), where the two-dispatcher shape is needed for the exclusion design anyway.
- **Pool thread CLOSED:** answer was (d) — `pool-claim` writes, the BUILD enforces. doyle
  source-verified it himself; register entry drafted with my corrective line as the exit condition
  (AGENTS.md wording) + an optional incumbent-print on overwrite, riding the post-ship register batch.
  My false warning + correction is the specimen in that entry. Nothing further owed.

## Convergence witness (to P-register BEFORE the re-run, doyle's ask)
After the fix, the diag ladder re-runs on a diag child carrying BOTH fix and instruments. Expect
either ONE `REDEEM_SERVE` for the courtesy rec_id, or TWO serves with **two REDEEMED replies**
(one real + one echo, the echo emitting no second minter courtesy), and A's leg running past `:2479`.