[poitee]

Retained job reads took a serializer permit and dropped it before the response body existed, so a refused read and a dropped client were not the same path.

The handler still allows two overlapping JSON encodings. A missing job or a failed encode drops the permit before the error JSON returns. A successful body keeps the permit until hyper finishes that body or drops it. Read-one JSON is the public snapshot and omits updated_at. The list still includes updated_at. Routes are unchanged and stay behind desktop_rebuild plus PP_DESKTOP_REBUILD.

Definition of done

See the definition of done.

• One job, under about 1,500 lines. Work for other tickets is noted on those tickets.
• Unslop pass run on code, comments and docs. No filler comments, dead code or speculative abstractions.
• Docs updated in this PR, or the PR changes no behavior, setup or interface.
• Reviewed by a different model vendor than the author, on the exact head commit, with CI green.

Evidence

Feature-off stubs were proved on 1ea702645104f9b8c0f0459c1697e3edd6da5645. The permit-hold test was proved on 1fd1d9fb3cffb374140fb86795d95655851b71d3. Both used CARGO_TARGET_DIR=/persist/targets/gre-797-retained-job and CARGO_BUILD_JOBS=2.

Feature off:

• cargo test -p pp-api --locked --manifest-path rust/Cargo.toml --test jobs_http job_response_refusal_releases_permit → 1 passed
• cargo test -p pp-api --locked --manifest-path rust/Cargo.toml --test jobs_http retained_job_response_preserves_public_json → 1 passed

Feature on (--features desktop_rebuild):

• --lib jobs::tests on 1fd1d9fb → 2 passed (retained_body_drop_releases_permit, retained_response_holds_permit_until_drop)
• --test jobs_http job_response_refusal_releases_permit → 1 passed
• --test jobs_http retained_job_response_preserves_public_json → 1 passed
• --test jobs_http job_detail_ → 4 passed
• cargo clippy -p pp-api --locked --manifest-path rust/Cargo.toml --features desktop_rebuild --all-targets -- -D warnings → clean

Council review

Rounds: 2. Scores are for the behavior diff. Round 2 is exact head 1fd1d9fb3cffb374140fb86795d95655851b71d3.

Delegate	Round 1	Round 2
Claude Opus 5.5	8/10	9/10
Grok 4.7	no score	9/10
Qwen3.8-Flash	no score	9/10, retry 8/10

Round 1 Claude approved and asked for a test that a live response holds the permit. That test is retained_response_holds_permit_until_drop. Round 2 approved on this head: Claude 9/10, Grok 9/10, Qwen 9/10, and the Qwen retry 8/10. No merge blockers.

Qwen re-ran cargo fmt --check -p pp-api, cargo check --no-default-features, clippy with and without desktop_rebuild, the feature-on jobs_http suite (12 passed), both feature-off filters (1 each), and ticket_t_10_fixtures with the feature (11 passed, including the Node jobs parity test). The ast-grep ratchet passed with 0 hits in jobs.rs.

Notes left for a later slice:

• A stalled client holds a serializer permit until hyper drops the body, so two stalled reads can fill the bound of 2 and later reads answer 503. jobs_router has no caller outside tests, and admit() is loopback. A write or header timeout belongs with the mount in GRE-798 and after.
• The admission permit ends when the handler future returns. The serializer permit stays with the body. The bounds stay 2 and 64.
• The 503 text has no HTTP assertion, and there is no stalled-socket test like the drafts hold hook. retained_response_holds_permit_until_drop covers the live hold. An HTTP test on Body::from is unreliable because hyper ends a full body before the client finishes reading.
• RetainedBody stays local to jobs. A shared permit body would edit the drafts router.
• The no-session 401 stays in the guard, before a serializer permit. A permit count during that 401 is a later test.
• docs/desktop-rebuild.md and docs/gre-795-jobs-http.md have no GRE-797 index line. The ticket doc omits the two cargo check lines above. Those checks already passed on this head.
• The two-line GRE-796 cross-reference only points at this ticket.
• The failure-path comment, the HEAD empty body with the real Content-Length, the duplicated test preamble, and the finish_retained signature stay as they are.

Exemption

Exemption: none

Reviewed with sol-loop: 1 round with Claude Opus 5.5. Sol verdict: approved.

Created with Grok 4.7 in Grok Build. Claude Opus 5.5 reviewed.