stopAux takes a slot and a name that must correspond, with nothing linking them

[rainmanjam]

From the poka-yoke audit of 2026-09-04. Lens: contact. Today: rung 0. Device reaches: rung 1 (Control), cheaply.

Two mistakes available

internal/engine/engine.go:3051-3089, callers at :1734, :1746, :2108, :2192, :2210.

1. Pass a slot and a name that do not correspond. e.stopAux(&e.preview, "recorder")
compiles and reads correctly. It stops the preview, releases the recorder's
port, unsubscribes "recorder" from the ingest hub rather than the preview's
hub, and leaks the preview's port and subscription for ever.

2. Add a fourth aux consumer. The switch name at :3061 has no
default: an unknown name leaves port == 0, so if port != 0 skips the
release, the signature is never cleared, and reconcile believes the child is
still running. Nothing fails and nothing logs.

This is the inconsistent-member shape again

Every other subscriber name in the package is a constant or a builder —
silenceSubName, selectorSubName, clipSubName, captSubName,
loudnessSubPrefix, destSubName(id, role) — and every other teardown
unsubscribes using the name stored at subscribe time (d.subName,
r.subName, f.subName, m.subName, v.subName).

Exactly three consumers use a bare string literal recomputed at teardown:
"recorder" (:1758/:3085), "preview" (:2067), "meters" (:2219).
Those same three are the ones routed through this switch.

Device → rung 1, Control

One auxSlot value per consumer bundling
{proc **Process; port *int; hub **relay.Hub; sig *string; name string}, with
three package-level instances. stopAux(auxRecorder) takes one argument, so
there is no second argument to mismatch and no switch to fall through.

What stopped me going higher: nothing. This one is cheap and self-contained,
and is the best value-per-line in the audit.

Interim → Warning: a default: panic("unknown aux slot") arm plus three
name constants.

[rainmanjam]

Device built — PR #722. Rung 1, Control.

One auxSlot value per consumer — no second argument to mismatch, no switch
to fall through. e.stopAux(&e.preview, "recorder") is no longer expressible.

It also brings these three into line with every other subscriber in the package,
which stores its name at subscribe time rather than recomputing a literal at
teardown.

The test table now names the production slots instead of carrying its own
copy of the same correspondence — a table that repeats the mapping it is
checking cannot catch the mapping being wrong.