# RP9 — a token is one-use
# mutation in internal/web/setup_gate.go:
#   - '\tif _, seen := s.gate.used[t.Nonce]; seen {'
#   + '\tif _, seen := s.gate.used[t.Nonce]; seen && false { // RED-PROOF RP9'
# go test -run ^TestSetupGate_TheHouseholdPassesWithItsSession$ ./internal/web
# verdict: RED (assertion)
=== RUN   TestSetupGate_TheHouseholdPassesWithItsSession
    setup_gate_test.go:163: a token worked twice: 302
--- FAIL: TestSetupGate_TheHouseholdPassesWithItsSession (0.06s)
