Policy before existence before write.

The whole admission law, verbatim from the chapter — ten lines, three acts:

if string.sub(ARGV[1], 1, 3) ~= 'JOB' then
  return redis.error_reply('EMQKIND job id must be JOB-namespaced')
end
if redis.call('EXISTS', KEYS[1]) == 1 then
  return 0
end
redis.call('HSET', KEYS[1], 'state', 'pending', 'attempts', '0', 'payload', ARGV[2])
redis.call('ZADD', KEYS[2], 0, ARGV[1])
return 1

"Policy before existence before write: an invalid id is refused before it can half-exist, a duplicate is answered before anything is touched, and the row and the pending entry land in one atomic step or not at all. Both keys live in one queue's family, so the script is single-slot legal by 3.1's grammar without a thought spent." The act order is normative for every bundle script to come: refuse kinds first, answer duplicates second, mutate last.

J2 gates the duplicate path as a success shape: first call enqueued, second answered duplicate, the row untouched and pending holds 1. At-least-once producers retry; the bus answers calmly and changes nothing — duplicate is the normal vocabulary of a healthy producer, not a defect signal.

The rung's first run failed J3 on a real wire fact: the engine wraps class-less custom errors in its generic ERR prefix, and the connector's eval path surfaces server errors as {:error, {:server, msg}}. The fix was better protocol citizenship, not a looser match — the refusal now carries its own error class as its first word, EMQKIND, exactly the way the boot fence types its refusal, and the committed line reads an ORD id in the job position answers EMQKIND on the wire -- the key let it pass, the law did not. That last clause is 3.1's division performing: wellformedness at the key, policy at the script, each refusing in its own voice.

The decision generalizes: refusals carry their own wire class — every typed refusal a bundle script issues leads with its class word, never riding the generic ERR.

The Lua is the implementation; the client half is a pattern match on the typed classes, verbatim from the chapter:

case Connector.eval(conn, @enqueue, keys, [job_id, payload]) do
  {:ok, 1} -> {:ok, :enqueued}
  {:ok, 0} -> {:ok, :duplicate}
  {:error, {:server, "EMQKIND" <> _}} -> {:error, :kind}
  other -> other
end

The cross-runtime note from the chapter's How: the script is the contract — the same source string yields the same SHA1, and any client on any runtime that loads it speaks identical semantics. The Go consumer embeds the same bytes, computes the same digest, and gets the same three answers.