PortAllocator.Release takes an integer, so it can release a port you no longer own

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: motion-step. Today: rung 0. Device reaches: rung 1 (Control). Silent. MEASURED.

The mistake available

Release a port you no longer own. internal/relay/ports.go:57 is
delete(a.held, p) — an integer in, no notion of who held it.

internal/engine/destinations.go:1336 stopBackup deliberately does not
write to d (documented at length at :1324-1330), so after it runs
d.backupPort and d.backupSub still name released resources.

Reachable path: reconcileBackup:1232 calls stopBackup(prev) →
publishDest:1260 refuses (either e.stopped, or e.dests[id] != prev) →
prev stays in the map → StopWithin/teardownDest:1082 calls
stopBackup(prev) a second time.

Measured

HAZARD: after stopBackup the destination still records backupPort=65532
        and backupSub="dest:1:backup"
HAZARD: port 63981 is now held by two owners at once; Release() twice
        silently un-held B's port

What happens

Two engines are handed the same UDP port, and one programme's destination
receives another programme's stream — the exact failure PortAllocator's own
doc comment says the bind probe exists to prevent.

portFree() masks it only while the first owner's child is actually bound.
During supervisor restart backoff, or in the window between Allocate and
proc.Start(), it is wide open. Silent.

Today

None. The invariant lives in a doc comment.

Device → rung 1, Control

Allocate() (*Lease, error); Lease.Release() guarded by sync.Once; delete
the Release(int) method so a stale integer has no spelling.

Shares one device with the StopWithin leak issue — the same thirteen call
sites change shape for both, and doing them together is the only proposal in
this audit that reaches Control on two findings at once.

Interim → Warning: Release logs at error when !a.held[p].

[rainmanjam]

Device built — PR #722. Rung 1, Control.

The ledger from #707 doubles as the owner check: releasePort refuses — and
logs — a port this engine does not hold, so the stale integer stopBackup
leaves behind can no longer un-hold a port the pool has since reassigned.

Watched fail: the second engine takes the released port, the first engine
releases its stale copy, and the pool hands the same port out again while
another engine is using it.

Not Release(int) deleted outright, as proposed — the allocator's method stays
and the ownership check moved to the engine that holds the lease. Same rung,
thirteen fewer signature changes.

[rainmanjam]

Merged in #722. The device and its mutation proofs are in the comment above; this issue did not auto-close because the PR body listed seventeen numbers after one Closes, and GitHub only honours the first in that form.