`/export/ticket` mints before charging the daily limit, deliberately: charging
first meant a store-capacity 503 — a server-side condition the guest cannot see
or cause — still cost one of their three daily downloads, with no refund path.
But a mint refused with 429 left its ticket in the store. Download tickets live
six hours (they must, so a 1.4 GB transfer can resume with `Range`), and the
per-session cap is four tickets OF THE SAME KIND. So:
the transfer starts on ticket A -> the bar looks stuck on venue wifi -> the
guest taps "Herunterladen" again -> mints 2 and 3 succeed, 4 and 5 return 429
but still mint -> the fifth evicts the oldest download ticket for the session,
which is A -> the transfer drops, resumes, and 401s -> re-minting is
impossible, they are at the daily limit
The keepsake is unreachable until the next day, for tapping a button that
appeared to do nothing. This is the failure `sse_churn_cannot_evict_a_running_
download` was written to prevent, reintroduced through the one channel that test
does not cover: download tickets evicting each other.
Discarding the ticket on the refusal path keeps both properties that put the
mint first — a capacity 503 still costs no download, and a refused download now
costs no slot.
Also corrects three doc comments in this path still describing download tickets
as "single-use, 30s TTL", false since they were made resumable. Stale comments
here have already sent one review down the wrong path.
The new spec asserts the two 429s explicitly, so it cannot pass vacuously if the
daily limit stops being enforced.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
06e0bea0e9