aTokenMintedForAnotherRoomIsRefused

The negative half of joinerLearnsHostRoomIdOnAdmission. That test asserts a joiner's token names the host's room, and its own comment reasons about a room that would "refuse its own members' resumes" — but nothing ever presented a room with a token naming a different room and checked that it said no. Only ResumeResult.Success had a property in this suite; every refusal branch was covered by the reference implementation's private tests (RoomResumeTest, JoinerReconnectControllerTest), which a second RoomFactory inherits nothing from.

The contrast pair is the property, not the refusal alone

A lone "the foreign token is refused" would be satisfied by a room that refuses everything — a dead host, a window that never opened, a resume path that silently drops. So the two resumes happen against the same host at the same instant, one with a token whose RoomId has been tampered with and one with the genuine token, and the property is that they get different answers. That contrast is what pins the refusal to the token rather than to the moment; it is also what proves the refused attempt did not spend the single-use window, which is the denial-of-service shape a room that consumed a window on an invalid token would have.

What the Room.resume surface can and cannot observe — read before strengthening this

#2306 asked for ResumeResult.TokenInvalid here, and at the time it was not observable through Room.resume: the reference host produced it (DefaultJoinerReconnectController checks the room id before it touches any window, which is why this test needs no window state of its own for the refusal half), it travelled the wire as an AdmitMessage.Reject(RejectCode.ResumeTokenInvalid), and the joiner's resume machine completed every reject as ResumeResult.WindowClosed — so an elapsed window, a foreign token and a window the host had not opened yet were one value.

#2364 fixed that. A reject now completes as ResumeResult.Refused carrying the host's own us.tractat.kuilt.session.admit.RejectCode, and the host-side verdicts are a different half of the hierarchy (ResumeResult.HostVerdict) that a joiner cannot receive at all — refused is ResumeResult.TokenInvalid is now a compile error here, which is how this KDoc's own warning stopped needing to be prose. So Room.resume's reachable range is {Success, Refused, TimedOut, WindowClosed}, and this test asserts the strongest thing the surface admits: a refusal that is a host verdict (not local silence) and whose code is terminal. It still excludes ResumeResult.TimedOut, which is the rig receipt — TimedOut means no verdict arrived at all, so a host that never saw the frame reds here instead of passing as a refusal it never made — and now also excludes ResumeResult.WindowClosed, which after #2364 means the joiner gave up locally without asking.

The code itself is left unpinned to one constant on purpose: a room may honestly answer us.tractat.kuilt.session.admit.RejectCode.ResumeTokenInvalid or us.tractat.kuilt.session.admit.RejectCode.RoomMismatch for a token naming a room it does not serve. What every implementation owes is that the answer is not retryable — re-presenting that token can never work, and a room that said otherwise would send the joiner into a doomed retry loop for its whole window.

Mutation receipt

Deleting the token.roomId != roomId guard in us.tractat.kuilt.session.partition.DefaultJoinerReconnectController.tryResume makes the foreign token indistinguishable from the genuine one: it consumes the window, so the first resume returns ResumeResult.Success (reddening the refusal assertions) and the second returns a refusal (reddening the positive control). Measured: all three assertions red, every pre-existing test of this suite green.

Weakening the guard to answer RejectCode.ResumeWindowNotYetOpen (retryable) instead of removing it keeps the first two assertions green and reds only the third — which is why the terminality of the code, not merely the presence of a refusal, is the assertion that carries this test.

Not invisible everywhere, though — say what the row actually claims. That same mutation reds two tests in :kuilt-session's own JoinerReconnectControllerTest. What was missing is narrower: the guard was proven by the implementation's private suite and by nothing in the contract, so a second RoomFactory subclassing this suite inherited no such property at all. Making a room refuse a foreign token is the kind of obligation every implementation owes and only one had been asked for.