# KNOCK-169 JIT — read-only RCA on golden 32191618042's two NEW signatures

Dispatched by doyle 2026-08-18 as a RE-DISPATCH after the releases#188 ER hunt closed. **New lane,
new subject.** The prior lane's record is `PUMP-FIX-JIT.md` — that RCA is CLOSED (#188 CUT, #191/#192
minted, hertz's fixture fix green, my diag branch held pending doyle's retirement word).

## The situation
Golden **32191618042 @ `93c1130`** (candidate = v0.56.0 shape on doyle's gated W6) went RED on **two
NEW signatures**. Crucially: **the fixture fix WORKED** — both legs are past the barrier, elapsed
collapsed, ER-conjunction green. The ladder now reaches **#169-family cells that have NEVER EXECUTED
at this depth before.**

Jobs (deployah pulled both job-level): **A = 95894076412**, **B = 95894076175**.
doyle's triage is on **#181**. Logs downloading to `<scratchpad f0a4566c>/knock-a.log` /
`knock-b.log` via `gh api repos/BigscreenVR/spt-bs-core/actions/jobs/<id>/logs` (NO leading slash).

## ⚠ POPULATION DISCIPLINE (doyle, binding — say it in ANYTHING I write)
**These cells' denominator is ONE.** First executions, **1/1 each**. No rate argument, no rerun,
mechanism first. This is the same class I filed after the golden verdict
(`base-rate-is-over-cell-executions-not-suite-runs`) — a cell whose lane deferred int to the gate has
a denominator of one before its first gate, and "failed once" is structural wearing a flake's rate.

## SIGNATURE 1 — twohost-a, `twohost.rs:2406:9`, exit 1, 104.98s
Tag `[int->REQ-KNOCK-NOTIFY-INSTIGATOR]` (#169). The courtesy rung's **preceding asserts ALL pass**:
B's approval notice is created at A, `to_id=A`, `from_id=B`, body "approved your knock", and the prior
rung prints the ADDRESSED OK. Then **`row.seen.contains(ID_A)` fails with `seen: {}` (empty)**.
⇒ The notice EXISTS at the addressee and is never marked surfaced/seen for the instigator endpoint.

**Settle in this order (doyle's):**
- **(a)** What WRITES `seen` for a notif row — which actor, which process, sync or async relative to
  row creation?
- **(b)** Does the cell WAIT for that writer, or assert immediately after the prior rung? An
  async-surfacing race is a **TEST** artifact; a writer that never fires cross-node is a **PRODUCT**
  gap.
- **(c)** What does `REQ-KNOCK-NOTIFY-INSTIGATOR`'s registry text + doc stage actually promise —
  notice **EXISTS** vs notice **SURFACED**? **Read the contract before classifying.** The rung's
  predicate is a claim (same discipline that settled the ER rung; see `PUMP-FIX-JIT.md`'s
  PREDICATE CALL section for the shape of that argument).

## SIGNATURE 2 — twohost-b, `twohost.rs:1396:9`, exit 101, 311.58s
`assertion left == right`, **left `NoReply`, right `Ignored`**, message:
*"a plain knock arms nothing, so the receipt consumes nothing — the courtesy must not depend on this
outcome"*.

**The assert's own message says the courtesy must not depend on the outcome, yet the assert PINS one
variant.** Read the cell: is the pin the **SPEC** (`Ignored` ruled somewhere) or an **over-constraint
contradicting its own comment** (test defect)? Then the product side: what path returns `NoReply` vs
`Ignored` for an unarmed knock receipt, and which is contract-correct per the **#169/#184** knock
rulings.

## CONSTRAINTS (binding)
- **READ-ONLY.** No fixture edits, no product edits, **nothing pushed.**
- The diag branch + sink instrument remain **available** if a discriminating run is needed, but
  **EXHAUST source + the two job logs FIRST.**
- **Pre-register readings before any run.**
- If sink dumps are used: **grep from the `--- PUMP188_DIAG sink:` marker DOWNWARD, never the whole
  log** (measured: the convicted site was 0/47,958 above the marker, 16 below).
- **Classification lands with doyle:** product → my lane under a fresh operator fork · test/fixture →
  hertz per the split · spec-wrong → operator with the contract read.
- The milestone-shape question (a member cell failing against its own product) is **doyle's with the
  operator** once I bring the mechanism.

## FINDINGS (2026-08-18, source + the two job logs only; nothing run, nothing pushed)

Grounding: my checkout's HEAD IS `93c1130` (`93c11309c3275638f50ff94652690e9c40576a2f`, ancestry
checked) — no worktree, line numbers are the golden's own. **Denominator ONE, 1/1 each.**

**SIG 2 = a CASCADE of SIG 1, no independent information.** `answerop.rs:73-81` calls
`notify_knocker` (produce + first-fire) BEFORE returning `AnswerReply::ignored()` at :83, so B's ack
is the return value of a function still in flight. A's row is inserted 22:49:08.265Z, A's rig_wait
converges and panics 13.5 ms later at 22:49:08.2785Z, A exits at .2814 (104.98s) — the reply is never
returned, and B's `request_answer` yields `NoReply` at 22:50:08.3605Z (60.08 s after A's death). The
pin at 1396 is NOT an over-constraint: its comment is about the CONSUMPTION arm (Ignored vs
Consumed), and `NoReply` is a transport/liveness value that is neither. Side observation, no claim:
B's carrier deadline is 30 s, the NoReply landed at 60.08 s.

**SIG 1 = the rung's BARRIER and its CLAIM are different facts.**
- (a) ONE writer, synchronous, in the producing thread: `knocknotif.rs notify_knock_party` →
  `notif.rs:380 produce_addressed_and_first_fire` — `produce_addressed` commits the row (readable
  from here), then `first_fire`/`first_fire_at:263` resolves the target, `deliver_notify_quiet`
  spools, and only then `mark_seen` at `notif.rs:326`. `seen` is written THREE steps after the row
  becomes visible.
- (b) The cell does NOT wait for that writer: `rig_wait` at `twohost.rs:2362` polls on EXISTENCE
  (coalesce_key) and CLONES the row at first sighting; `2406` asserts `seen` off that snapshot and
  never re-reads. The file's own convention is the opposite at `1132`, `1875`, `2048` — those put
  `seen.contains(..)` INSIDE the wait predicate. The two #169 courtesy rungs are the only two that
  don't, and they are the two that had never executed.
- (c) Contract: the REQ promises SURFACED ("produce->fire->surface", "never lands on a bystander",
  "an absent addressee yields NoTarget ... the row waits for that endpoint's own next boundary") —
  so the predicate is a legitimate claim, and the same text makes surfacing a LATER event than the
  row. Legitimate claim, illegitimate observation.
- NOT shown by this run: that `mark_seen` ever landed (the process died 13.5 ms in). Source narrows
  the product residue hard — Node-scoped addressed rows resolve through `addressed_target` with an
  EMPTY registry, and all three local-leg admission conditions hold by evidence: ID_A is a bound self
  perch; `is_perch_alive` true (`InfoJson::new` leaves `status` None ⇒ `liveness.rs:142` pid branch ⇒
  the live test pid); `policy.visible(ID_A,"twohost")` PROVEN by `courtesy_subnet` having chosen that
  subnet (assert 2394 passed). ⚠ `KNOCK_NOTICE_UNPRODUCED` cannot discriminate — `NoTarget` is an
  `Ok`, so a never-surfaced row emits the same silence as a surfaced one.
- Pre-registered reading: TEST-SHAPE at the rung; product not indicted by this evidence.
- Discriminator if a run is wanted: barrier on `seen.contains(ID_A)` under the rig deadline —
  converges ⇒ TEST; times out with the row present and `seen` empty ⇒ PRODUCT. Zero-instrument split
  between "fired late" and "never fired" = the SPOOL, since delivery precedes `mark_seen`
  (`notif.rs:324-326`).
- LATENT SIBLING, unexploded: `twohost.rs:1417/1454` (redemption courtesy) has the identical
  wait-on-existence / assert-on-`seen` shape; it did not fire only because B died at 1396 first.

Reported to doyle 2026-08-18 (SENT). Classification is his.

## LAYER 2 — run 32196005249 @ `c3ac672`, `twohost.rs:2479` redemption Refused (2026-08-18)

doyle re-dispatch after hertz's W7 courtesy-barrier repair validated GREEN on both repaired cells
(my layer-1 test-shape mechanism confirmed by execution; the pre-registered product arm did NOT
fire). Read-only, nothing pushed, nothing run. **Denominator ONE.**

Grounding: `c3ac672` is NOT a descendant of `93c1130` — it descends from `b20e770` (my diag branch)
via `b604e60`; product + test both read at `c3ac672`. `twohost.rs` blob `dffc8af` identical at
`c3ac672` and `fd3dc5a`. My sink IS present at this sha (`spt-store/src/pump188.rs`) but instruments
ENGINE-ROOM info reads only — blind to knock/redeem.

- **Role B's red is a VERIFIED cascade** (not carried as doyle's presumption): B panicked at
  `twohost.rs:384` rig_wait "done-file pushed by A", 23:43:14.975 / 1155.23s, after A died
  23:28:14.73 / 109.54s. B's 71 failed-addr pump dials START 23:28:54 — 40 s AFTER A's death, so
  post-mortem churn, not a pre-existing link fault.
- **Refusal authorship:** `classify_redeem_reply` returns `Refused` ONLY for token::REFUSED;
  dispatch's `serve_redeem_feed` is pure transport. Four authoring sites in
  `redeemop::serve_one_redeem`: `:71` empty redeemer · `:100` `claim_code` Err (RateLimited /
  Unknown / AlreadyConsumed / Expired — four causes, one Err) · `:103` row vanished after claim ·
  `:151` `consume_claim` lost race.
- **Refuted by this run:** empty redeemer (arg order verified on the struct); never-minted (B logged
  fixtures seeded 23:23:59.921, 4m15s prior); expired (24h TTL off B's own clock); already-consumed /
  double-serve (one `RedeemRecord`, one `codes.push`, dispatch has a `replied` latch).
- **Survivors, both invisible:** (1) RATE-LIMITED — `claim_code` charges `admit_arrival(origin)`
  BEFORE the lookup, against a bucket SHARED with knock arrivals (limit 10 / 1 h). Rig fires 2 knocks
  + 1 redeem = 3 charges IF each arrived once; arrivals are charged PER DELIVERY, never per unique
  knock (`upsert` dedupes the knock, `admit_arrival` does not dedupe), so any replay inflates it
  untraceably. (2) STORE-CONTENT MISS — whole-file load-mutate-save knock store with several B-side
  writers; a lost update leaves no trace.
- **Structural point:** the cell can never name its own failure. By CONTRACT
  (`REQ-KNOCK-REDEEM-WIRE`: one anti-oracle message for all four causes, "REFUSED CARRIES NOTHING")
  and by OMISSION (the serve path emits no local diagnostic — B's whole log has zero
  `KNOCK_STORE_*`/rate/redeem tokens). Asked doyle, not ruled: a per-arm `eprintln` at the MINTING
  node is not an oracle for a remote guesser, and would have made this RCA a grep.
- **Contract read:** `REQ-KNOCK-REDEEM-WIRE` and `REQ-KNOCK-REDEEM-SERVE-INTENT` both carry
  `required_stages = ["doc","impl","unit"]` at `c3ac672` — **int NOT activated**. The cell is tagged
  `[int->REQ-KNOCK-NOTIFY-INSTIGATOR]`, so redemption execution is its PRECONDITION, not its promise.
  The wire REQ itself rules the rate bucket SHARED with knocks from that origin; the fixture seeds the
  code record but NOT the arrival budget, which earlier rungs spend from the same origin. First cell
  in the ladder to depend on a resource its own earlier rungs consume.
- **Pre-registered probe (test-tier, next diag iteration):** at B, on a barrier that cannot fire
  before A's attempt (A signals — not an existence poll), read the knock store and print: code row
  present? · `consumed_by` · `expires_ms` vs now · arrival count for A's hex in-window. Predictions:
  absent ⇒ lost update; consumed ⇒ replay, escalate; unconsumed + arrivals ≥10 ⇒ shared-bucket
  exhaustion (fixture must reserve/reset, or the rung moves ahead of the knock rungs); unconsumed +
  arrivals <10 ⇒ a refusal no documented arm explains ⇒ genuine product defect worth a fork.

Reported to doyle 2026-08-18 (SENT). Classification is his. Pace: no further golden per layer — the
diag workflow iterates to end-to-end green, then one assembly + intake + golden.

## LAYER 2 RESOLVED BEFORE THE PROBE — the redemption EXECUTED and A was told Refused

doyle lifted read-only for the pre-registered probe (test-tier, my diag ref, workflow_dispatch) and
pre-committed four routes. **The probe was never needed to reach one of them, and nothing was pushed
or run.** Two facts from the SAME run settle it:

1. **B's rung N3 PASSED** — w7b 23:28:14.7488 "courtesy: the cross-node redemption notified the
   MINTER" + 23:28:14.7502 (so `from_id == ID_A`, real member subnet, body "redeemed by" all passed).
   That courtesy has ONE producer: `redeemop.rs:240 notify_minter`, which sits after the access
   mutation, after `store.save()`, after `consume_claim` returned true. **Grant written, code spent,
   in A's name.**
2. **A's `request_redeem` returned `Refused`** at 23:28:14.706 — 43 ms EARLIER. Only
   `RedeemReply::refused()` produces that token. A cannot self-manufacture it: it subscribes its own
   stream `from_seq=0`, but `RedeemReply::outcome` has NO serde default, so a `RedeemRecord` cannot
   decode as a reply and the decoder skips it.

⇒ **One serve cannot do both** (every refusal site returns before `:240`; `:151`, the consume-race
loser, returns without notifying). So TWO executions of `serve_one_redeem` against one redemption:
the first executed, the second lost the consume race and answered the anti-oracle refusal — and that
refusal is what the redeemer read. Not a precondition failure, not a rate bound: **honest reporting
failing under self-collision.** The nodes now disagree — B's minter holds "redeemed by
ling-twohost-a" while A believes it holds no grant.

- CORROBORATION (labelled, not proof): two subscriber attaches to the SAME stream 458 at `from_seq=0`
  14 ms apart at B (conn 1396 @ .6889, conn 1398 @ .7029), overlapping, inside the window — the shape
  a second `serve_redeem_feed` makes (it subscribes from seq 0, so a re-subscribe replays the record).
  No family token is ever printed, so stream 458 cannot be bound to the redeem family from the log.
- SEAM TO LOOK AT (question for the fork, not a ruling): dedupe is per-SERVE, not per-EXCHANGE. The
  `replied` latch stops ONE loop answering twice; nothing stops two loops each serving and each
  replying on the same stream, so which answer the caller reads is a race. The store layer is already
  exactly-once and is what makes the damage visible. `rec.id` ("correlation id ... tracing only") is
  the obvious candidate for per-exchange idempotence.
- The cell at `:2479` is HONEST and its expectation was right — the minting node did execute; what
  failed is what it TOLD the redeemer. hertz's W7 barrier repair confirmed green in the same run.

Landed in doyle's route "consumed_by Some ⇒ product replay path, fresh operator fork, stop and
report, don't chase". STOPPED: no branch, no push, no dispatch. Offered doyle a choice for the next
instrument — the four store facts, or a DUPLICATION instrument (which family a stream was served as,
how many times one `rec.id` was served), which answers the mechanism the fork will be about.

## LAYER 3 MEASURED — two DISPATCHER PROCESSES served one redeem stream (run 32200175631)

doyle ruled layer 3 a PRODUCT DEFECT (#181 comment 5335785245) off the two-facts argument, opened the
operator fork, and dispatched the duplication instrument. Lane `diag/pump-188-w8-redeem-dup` @
`df92e71` (child of `c3ac672`), worktree `.worktrees/redeem-dup`, pool claimed with the lane's own
identity. Pre-registration P1–P5 sent BEFORE the push (doyle recorded it verbatim, #181 comment
5335832570). Instrument = 5 diag tokens through the existing pump188 sink; **wire reply byte-identical**.

**REPRODUCED 2/2 and the mechanism is measured** — and it is NOT the locus I hypothesised:

    STREAM_SERVE stream=486 family=Redeem finished=true floor_seq=0 serve_seq=147 wall=551764 pid=1685111 exe=spt
    STREAM_SERVE stream=486 family=Redeem finished=true floor_seq=0 serve_seq=335 wall=551785 pid=1684652 exe=twohost-<hash>
    551765 pid 1685111 REDEEM_SERVE rec_id=twohost-redeem-1000000021 serves_for_rec=1
    551786 pid 1684652 REDEEM_SERVE same rec_id · ARM refused:claim-err:AlreadyConsumed · REPLY refused  <-- A read this
    551874 pid 1685111 ARM redeemed · REPLY redeemed                                                      <-- 88 ms late

- **Two dispatcher PROCESSES on one home**, not two loops in one process: a livehost `spt` (147 serves
  this run) and the test-hosted daemon (670). Both took the same `finished=true` row from `floor_seq=0`.
- The winner consumed + notified the minter (B's rung N3 passed again 00:15:52.084); the loser refused
  at CLAIM time and its reply beat the winner's by 88 ms. A panicked at `:2479` at 00:15:51.79.
- **P1 confirmed in substance, WRONG SITE named:** the arm is `refused:claim-err:AlreadyConsumed`, not
  the `refused:consume-lost` I nominated — the loser lost at CLAIM because the winner had consumed
  21 ms earlier. A guard has to sit where the claim is charged, not only at consume.
- **P2 confirmed + refined** (same stream, family=Redeem both — the twin `from_seq=0` attaches ARE the
  redeem exchange; the doubling is cross-PROCESS). **P3 confirmed** (two REPLY lines, per-loop latch ⇒
  the caller's answer is a race). **P4 refuted. P5 n/a.**
- **Blast radius:** the second dispatcher is a livehost `spt` — production shape, not a rig artifact —
  and it served SIX families this run (Sync 48, Notif 42, Registry 40, Update 14, Attach 2, Redeem 1).
  REDEEM is only the first family whose exactly-once store makes the doubling VISIBLE; the others took
  the same double-serve silently. Question handed to doyle+operator: is one-dispatcher-per-node the
  real invariant (claim can never see a sibling), or must the claim become broker-side (much larger lane)?

Instrument stays in the diag lane. Nothing merged, fix lane NOT started, worktree + pool claim held.

## Immediate next steps
1. Read `twohost.rs:2406` and `twohost.rs:1396` cells in full (worktree `.worktrees/pump-188-diag`
   is off `a8c3227`; the golden ran `93c1130` — **check ancestry / read at the sha that ran** before
   quoting line numbers, per `source-read-needs-its-sha-and-ancestry`).
2. `traceable-reqs` registry text + doc stage for `REQ-KNOCK-NOTIFY-INSTIGATOR` — EXISTS vs SURFACED.
3. Enumerate `seen` writers by code read (who, which process, sync/async) — enumerate BEFORE
   proposing any instrument, per doyle's step-1 ruling last lane.
4. Read both job logs around each failing rung.
5. Report either polarity to doyle; bring the NAME/mechanism, never the classification.