The TUI switch leg waited for "any session.title" after turn 0, which the instant
derived title (emitted at turn START) satisfies immediately. The model title upgrade
runs on a background thread started as the turn settles (self-hosted custom defers
it, #117296) and its aux POST to main lands ~15-80 ms before the harness takes leg 1's
marks at idle; a delayed thread lands it after the marks and leg 1 reports
"unselected host 'main' got aux ... key of 'main'" although the request was
validated against, and reached, main before the switch committed.
Repro: a 0.1 s sleep at the start of the title thread (before its runtime validator)
turns base red 3/3 with the CI signature; aux POST at marks+0.14 s, switch committed
at marks+0.40 s. Fix: wait for the upgraded title main's aux endpoint answered, so
the request is checked in leg 0 (main + main's key). A sabotage that makes the title
call follow the stale pre-switch runtime still raises RoutingLeak at leg 1.
f2aabb7ac9