#74 ticket half: generation = keyed permutation of the slot counter; a never-minted generation is a forgery (stacked on #1007)

[MattJackson]

Coordinator ruling C. DRAFT, stacked on #1007 (rule 19).

• Generation. A ticket's generation is now PRP_k(per-slot count): a 6-round Feistel network on 16-bit halves, SipHash-2-4 rounds under the #74 ABI half: HostCtx is a kernel-tagged handle verified before use (no host pointer crosses) #1007 key, tweak ("bb.tick1", worker, slot), mapped to nonzero values by cycle-walking.
  • It is a bijection, so per-slot uniqueness stays exact and the contract line is unchanged.
  • The layout is unchanged.
  • The instance is not in the tweak, because a slab ticket is minted before any instance uses it.
• The key. It is drawn at the dispatcher's boot (handle::ticket_key(), a TicketKey only that function makes) and held in the dispatcher's Env. Every worker gets it at construction. There is no fallback key: a failed draw refuses Dispatcher::try_new / try_with_services with LoadError::Entropy.
• Counter wrap. A slot whose counter reaches u32::MAX is retired. It is never put back on the free list, and the next mint takes a fresh slot. Worker replacement carries a retired slot as retired. A wrapped counter would re-mint generations the slot already handed out.
• Judgement. The worker's equality check is the MAC check. On a mismatch, the inverse permutation names the mint the generation would be:
  • A count the slot has reached is a late wake (H2): dropped and counted stale, as before. This is exact, with no ring.
  • Anything else is a forgery, and is blamed on the ticket's supplier.
• Supplier attribution. The supplier is carried explicitly with the wake (Msg::Wake(ticket, supplier)), never read off the thread the wake fires on.
  • host_wake names the instance its context resolved to.
  • A pended service's Completer, the connector's TicketWaker and the I/O Routed waker each carry the instance whose context created them (ticket::Waking).
  • The connection table's wakes name the caller the table registered the ticket for. The contract gains conn::ConnWake = Arc<dyn Fn(InstanceId, Ticket)>; the connector's WakeTicket is that type, and its TicketWake carries the owner. The dispatcher's conn_waker maps the owner to its handle entry, which becomes the supplier.
  • There is one numbering: an instance's connection-table identity is now its handle's id (handle::instance_id). The separate NEXT_INSTANCE counter is gone, so no second registry exists. The id is never 0, which stays the root's own (ROOT_OWNER). A wake under 0 names no supplier, and only such host-own wakes count to #74 ABI half: HostCtx is a kernel-tagged handle verified before use (no host pointer crosses) #1007's latch.
• No quarantine under the worker's lock. apply collects each supplier; the worker quarantines after the lock is dropped.
• Inline tickets (the calling-thread ops' slots, worker index INLINE_WORKER) are permuted as a worker slot's are: ticket_generation(key, INLINE_WORKER, slot, count), with a per-slot counter, retirement at u32::MAX (generation 0, never re-issued), and the same judgement.
  • A wake whose generation the slot minted is a late wake.
  • Any other wake, including a slot that does not exist, is Judged::Forged. The pool then calls forged_ticket(supplier, latch) with the inline table's lock already dropped.
  • One per-slot section. Each inline slot keeps its generation and its registered waker under one per-slot lock.
    • A recycle bumps or retires the generation and clears the waker inside it.
    • A wake checks the generation and takes the waker inside it, then wakes once the lock is released. A wake only schedules, and the waker taken belongs to that generation's task.
    • waker_of (what io.* hands the reactor) returns a waker bound to (slot, generation) that performs the same check. If it fires after a recycle and re-mint, it wakes nothing and blames no one.
• A worker the dispatcher does not run. A wake for encode(w, _) with workers <= w < INLINE_WORKER is a forgery blamed on its supplier, judged lock-free in Pool::wake. It is no longer just a stale wake.

What this claims, and what it does not:

• No false accusation. An instance is quarantined only for a generation its own context handed the host that the slot never minted. A wake that fires inside another instance's crossing does not blame that instance. A late wake for a generation the slot really minted is never a forgery, including on a retired slot.
• Judged after the answer. The worker judges the forgery when it applies the wake, which is after the crossing that supplied the ticket returned. The forging op's own answer is therefore judged before the forgery is found, and that answer stands. Quarantine faults every subsequent op of the instance; it does not reach back to that op.
• Every ticket a plugin can reach is either live or never-minted. A never-minted ticket is judged against its supplier: worker slot, inline slot, or a worker index nobody runs. A plugin cannot trip the process latch with tickets: every ticket it supplies, through a host service, its own wake or a connection slot, is blamed on it.

RED tests:

• The permutation exhausted at 8-bit width under three keys/tweaks: bijection, nonzero, inverse.
• Consecutive generations hide the counter.
• Worker-tweak separation: the same slot index on two workers shares no sequence, and worker 0's generations do not pass as minted on worker 1.
• A forged generation quarantines its supplier (honest control).
• Attribution: A's completion fires inside B's crossing; A is quarantined and B is not.
• Off-crossing: a host-own forged wake (root identity) counts toward the latch and blames no one. A plugin's own off-crossing wake quarantines its supplier and leaves the latch alone.
• Connection slot: a plugin's read slot is handed a forged ticket. The table parks it under (caller, ticket) and wakes it through conn_waker. The supplier is quarantined; the latch has forged == 1, unattributed == 0.
• Connector: every wake of a read parked by OWNER on ticket 7 is (OWNER, 7).
• One numbering: instance identities are never 0, never repeat, and name their own handle entry. The root's identity and an unminted one name none.
• Inline guess: a plugin wakes encode(INLINE_WORKER, i) at generation 1, which the old counter handed out first. No held inline generation is in 1..=1024. The miss quarantines the guesser and leaves another instance alone. A never-used inline slot is a forgery too, and the latch has forged == 2, unattributed == 0.
• Inline wrap: an inline slot seeded at u32::MAX - 1 is handed out at u32::MAX, then retired and never re-issued. Late wakes for both of its generations are not forgeries.
• I/O-held waker: the I/O holds a ticket's waker. The ticket is dropped and the slot re-minted to a new task, then the old waker fires: neither task is woken. Control: the new generation's own waker wakes the new task.
• Wake/recycle race: a test hook drops and re-mints the slot between a wake's lookup and its section. The wake reaches no task and is judged Stale, not a forgery.
• Unrun worker: a wake for encode(workers, 0) quarantines its supplier, and the latch has (1, 0).
• Counter wrap: seeded at u32::MAX - 1, the slot is handed out at u32::MAX, then retired, and never re-issued. A late wake on its last generation is not a forgery.
• A stale wake for a minted generation is counted stale and not as a forgery.
• The fixture's stale mode wakes recycled real tickets.