# JIT — the latent ticket/exemption ORDER defect (doyle RCA, golden 32341702157 Linux red)

STATUS: DISPATCHED as releases#203 (type BUGFIX, state WIP) — 2026-08-20, doyle via alchemy-0.
The implementing commit/PR carries `fixes #203` so merge-close flows back to the Hub, and progress
is commented on the issue.

TWO GATES BEFORE THE FIRST COMMAND, both held by others:
1. BOX QUIET — golden 32341702157 is live and this box is one of its runners. Nothing builds here
   until it concludes.
2. DEPLOYAH CALLS THE RUN. The build starts when the golden concludes AND deployah calls it.

LANE BASE IS NAMED: `24edc166` (`origin/assembly/concierge-183`) — doyle, 2026-08-20. I had read
"rides the RESPIN head" as "the base does not exist yet, wait for a new sha"; it means the rider
lands ON the current head and the respin carries it. Base is in hand, so nothing about the lane is
blocked except the box. Own worktree under `.worktrees/`, own pool claim FROM that worktree. The
rider is named in the greenlit-form record BEFORE the push (deployah's intake rule, #199
precedent).

EVERYTHING BELOW WAS RATIFIED IN THE RCA COMMENT rather than merely proposed: arm 1, arm 2 as the
non-widening control, the explicit conn-id assertion, the doc-comment argument, and the REQ routing.
The int witness is named and it is NOT a new cell: the existing `er_briefing_presented_e2e` Linux
leg going green.

## The defect

`OutputLog::bringup_refusal` matches the `AdmitTicket` FIRST and only then consults the
seated-connection exemption. So for a controller that was seated by a REDEEMED ticket:

1. seat: ticket redeems once, controller seated on conn N;
2. gap-resume / dispatcher reconstruction re-serves on the SAME conn N, re-presenting the SAME
   ticket string;
3. the ticket is now SPENT ⇒ `AdmitTicket::Unredeemed` ⇒ refusal returns at `broker.rs:1578`;
4. `bringup_required`'s exemption at `:1593` is never reached, and the controller is UNSEATED.

Line numbers MOVE and the RCA says so explicitly: the refusal is `:1578` on the golden head and
`:1559` on main `15abb525`, the exemption `:1593` / `:1574` — the #183 chain shifted the seam +19
lines and changed nothing inside it (deployah, independently). They are a READING AID, not the
finding. Re-read the seam at whatever sha the respin head turns out to be; a brief naming a sha is
naming a TREE.

FIELD SHAPE, from the census (golden 32341702157, Linux test job 96342231773): a four-beat cycle,
three occurrences — seat on a redeemed ticket; the SAME conn re-subscribes ~700ms later with
`old_by`=self and `req_gen` UNCHANGED (the documented gap-resume/reconstruction re-serve) and gets
`engine-room-admit-unredeemed`; `session-detach was_controller=true`; then bare retries on a fresh
conn get `engine-room-no-code` twice and the client exits. `req_gen` unchanged is worth carrying
into the rig: the re-serve is not a new attach generation, so arm 1 should hold the generation
fixed rather than bumping it.

## Why the chain is measured, not argued (doyle, and it answers my own precondition)

I raised one assumption: that the re-serve actually re-presents the spent ticket rather than
attaching with an empty secret — because an empty secret is `AdmitTicket::None`, falls through, and
the defect would belong somewhere else. doyle answered it by the log's OWN VOCABULARY: conn=11's
second subscribe carries the decision label `engine-room-admit-unredeemed`, whose single authoring
site is censused (`broker.rs:1586`, only hit in the tree) and lives in the `Unredeemed` arm —
reachable only for a TICKET-SHAPED secret. The LATER bare retries (conn=17/18) carry the *no-code*
label instead. Two different labels in one log ⇒ the discriminator ran both ways.

## The fix

Order swap: consult the seated-connection exemption BEFORE the ticket match. Nothing else moves —
same refusal sentence, same no-ledger rule, same `AdmitTicket::None` fall-through.

**The doc-comment must carry the non-widening argument** (doyle's ask, and it is the reviewable form
of "this is safe"): the exemption's discriminant is the SEATED CONNECTION ID, which belongs to
another process's socket and cannot be claimed by asking — the same reason `bringup_required`'s own
doc-comment gives for why an attach GENERATION is not the discriminator (a generation is a wall-ms
number an agent on this box can guess). Proceeding on a spent ticket presented BY THE CONNECTION
THAT IS ALREADY SEATED therefore grants that connection nothing it does not already hold. The swap
does not widen the gate; it stops one seat being paid for twice.

## The cell (unit, in `broker.rs`'s test module)

Rig vocabulary already exists — model on `the_admit_ticket_seats_a_subscribe_arriving_on_another_connection`
(`provision_engine_room`, `clear_bringup_ledger`, `admit_test_broker`, `engine_room_log`,
`controller_socket_pair`, `mint_bringup_admit`, `redeem_bringup_admit`, `mechanics_verdict`,
`resolve_subscribe_gated`).

ARM 1 — THE CLAIM (red pre-fix): mint a ticket for session 1, redeem it, seat the controller
through `resolve_subscribe_gated(..., Some(ticket.clone()), Redeemed(verdict))`. Then re-serve on
the **same conn**, re-presenting the **same, now-spent** ticket string — the second
`redeem_bringup_admit` answers `Unredeemed`, exactly as production's second subscribe does — and
assert the controller is STILL SEATED (outcome `Controller`, `log.controller.is_some()`, and its
conn id unchanged). Pre-fix this reds on the unseat, which is the field symptom itself.

ARM 2 — THE NON-WIDENING CONTROL, and it is not optional: the fix moves a REFUSAL behind an
exemption, so the cell must prove the refusal still fires where it must. A spent ticket presented by
a DIFFERENT connection (not the seated one) must still be refused with the same sentence and still
spend no ledger attempt. Without this arm, deleting the `Unredeemed` arm outright would pass arm 1.

RIG RISK TO SETTLE AT BUILD TIME: arm 1 needs a `SharedSend` carrying the SAME conn id for the
second call, since the first moves it. If `SharedSend` is `Clone` (Arc-shaped), clone before
seating; if not, find the production shape's own re-serve path rather than inventing one — a rig
that re-serves on a NEW conn is testing arm 2 while reading like arm 1, and would go green pre-fix.
Check `assert_ne!`-style identity on `send.id()` in the arm so the arrangement is pinned, exactly as
the sibling test pins the different-connection case.

## Open

- LANE BASE — SETTLED: `24edc166`. Nothing open here.
- REQ ROUTING — RULED: extend `REQ-ER-BRINGUP-SPAWNS-SESSION` (it owns both arms of this seam)
  with the EXEMPTION-PRECEDENCE clause. No new int stage is demanded — the int witness is the
  existing e2e leg. Read the requirement's current sentence at the dispatched tree before writing
  the clause.
- My W4 worktree still holds its source with `target/` reaped, so the first build on the next lane
  is a cold one. Budget for it; do not start it while the box is quiet.