← Priority list

W3WalletTests PR 30 — relay contract fixed; hosted acceptance still blocked

PR 30 is open and clean at fcf2187 with all four standard checks green. The one authorized hosted NetLab run proved basic NAT, daemon restart, and browser JVM NAT pass after the assertion repair, but failed on a NetLab upload connection closure and an unresolved relay-unavailable body mismatch whose bytes were not retained. The branch now downloads that body on future failures. Local NetLab was unavailable. Recommendation: close as blocked; do not merge on current evidence.

hf-2026-07-19-w3wallettests-pr30-nat-shepherd

Edit handoff

Title Summary Markdown body

# W3WalletTests NAT acceptance investigation

## 2026-07-29 16:36 UTC — initial state

OBSERVED: The handoff service is healthy and returned `hf-2026-07-19-w3wallettests-pr30-nat-shepherd`. The handoff is a stale snapshot that reports two distinct prior signatures: an upstream JVM-demo redirect failure that was later fixed, and a relay-unavailable response mismatch that did not reproduce in the prior local check. A fresh GitHub query shows https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 is `OPEN`, `CLEAN`, at head `59b0a6720cd17c15137889ed1d02889481b1d26b`; its four reported standard checks are complete and successful. https://github.com/CodexCoder21Organization/W3WalletTests/issues/26 is closed. The repository was freshly cloned into this lane's isolated workspace, has no repository-specific `AGENTS.md`, and its root `README.md` has been read.

INFERRED: The handoff's current PR/check premise is supported. Its hosted-failure classification is not yet accepted as current because the two requested workflow logs have not yet been downloaded and inspected. No code change or hosted rerun is justified at this point.

## Working mechanism statement

The mechanism is not yet established, and the evidence needed is the exact failed command/assertion plus surrounding phase and transport output from hosted runs `28932493407` and `30279653970`, followed by the same scenario executed locally against the pull request's current dependency resolution.

## 2026-07-29 16:39 UTC — hosted-log extraction

OBSERVED: GitHub's old `gh` client returned no text for `gh run view --log`, but the job-log API returned the complete retained logs. Run https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/28932493407 was attempt 12 at older head `c01dd4216572b66d8dea9a75ef673e77546c10e7`. In its `Run NetLab NAT e2e` step, four of six suites failed:

- `test_daemon_restart_reregisters.test.ts` failed after 1,177,842 ms in phase 1, before restart, because the first relay connection did not render `Wallet Connected (Server-Side)`; the public JVM demo logged `Wallet daemon did not respond within 25000ms (unreachable?)`.
- `test_nat_traversal_basic.test.ts` failed after 1,469,363 ms at `expect(connectedProbe.exitCode).toBe(0)`, expected `0`, received `1`.
- `test_browser_nat_jvm_demo.test.ts` reached the overall Jest ceiling after 2,400,003 ms. Its later diagnostic log showed `RELAY_FORWARD_FAILED` for `add_spend_limit`, ending in `Handler error: Element class kotlinx.serialization.json.JsonLiteral is not a JsonObject`.
- `test_browser_nat_js_demo.test.ts` failed after 1,650,188 ms at `expect(pass).toBe(true)`, expected `true`, received `false`; the browser runner had connected the wallet but then hit `page.waitForFunction: Timeout 30000ms exceeded`.

The same older run passed `test_nat_relay_unavailable.test.ts` and `test_browser_nat_staging_integrity.test.ts`.

OBSERVED: Run https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30279653970 tested the current pull-request head `59b0a6720cd17c15137889ed1d02889481b1d26b`. Five of seven suites passed, including daemon restart, basic NAT traversal, browser JS, staging integrity, and lifecycle diagnostics. Two suites failed:

- `test_nat_relay_unavailable.test.ts` failed after 857,105 ms at `expect(unreachableProbe.exitCode).toBe(0)`, expected `0`, received `1`. The exact shell contract is: `curl -s -L -m 75` must either fail, or its response body must pass both `grep -q "Connection Error"` and `grep -q "w3wallet.daemon"`. The public JVM server logged `Error connecting to wallet: All 0 peers for service 'w3wallet.daemon.12D3KooWUnreachableDaemonForNatTestOnly' failed bytecode fetch (direct and relay). Direct candidate errors: []. Relay candidate errors: []`. The retained log does not contain the saved response body, so it does not identify which grep failed.
- `test_browser_nat_jvm_demo.test.ts` first logged `PASS: public JVM server reached the NATed daemon over relay and rendered the injected daemon URL`, then failed in the later mint-denial phase at `assertServerSideMintIsDenied`: `page.waitForNavigation: net::ERR_EMPTY_RESPONSE`. Jest reported `expect(pass).toBe(true)`, expected `true`, received `false`. This is the redirect failure already fixed upstream after that hosted run.

INFERRED: On the current pull-request head, the unresolved hosted observation is narrowly the response-content shell assertion in `test_nat_relay_unavailable.test.ts`; relay connection itself was working in the other current-head suites. The logs support the handoff's claim that the response body is the missing evidence. They do not support changing either grep because they do not show which expected string was absent.

## Local-run feasibility

OBSERVED: The lane host has Java 21 and coursier but no `docker` command. At 16:38 UTC it had 8 CPUs and load averages `38.54 42.57 47.43`, above the lane's `4 × cores` threshold, so a local JVM build is currently deferred. The repository documents a direct-worker path at `url://netlab/`; unlike the hosted manager, it does not provision a droplet and treats `create` as immediate.

INFERRED: The appropriate local experiment on this host is the same test and public APIs against the documented direct worker `url://netlab/`, with freshly built current daemon/JVM-demo artifacts once host load permits. Using `url://netlab-hosted/` now would consume the one authorized hosted verification before the local evidence exists.

## 2026-07-29 16:45 UTC — course-changing existing-run evidence

OBSERVED: The premise that https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30296458829 was merely “cancelled mid-step” is not supported by its retained job log. Jest completed all seven suites and printed its full summary before the 150-minute job deadline canceled the step during post-test non-exit/cleanup. The run used current W3WalletTests head `59b0a6720cd17c15137889ed1d02889481b1d26b`, cloned downstream `main` after both the JVM redirect fix and https://github.com/CodexCoder21Organization/W3WalletDaemon/pull/129 had merged, and produced five failures, two passes.

OBSERVED: W3WalletDaemon merge commit `275f78150d5fd0590d7cc58de95ae96192aad44e` landed at 2026-07-27 18:29 UTC, between the 15:22 run (where basic NAT and daemon restart passed) and the 19:02 run. The commit makes the real SJVM typed client throw whenever the daemon returns an application result envelope with `success: false`; before it, `listCapabilities()` silently turned the same refusal into an empty collection. The merged pull request explicitly called out W3WalletJvmServerSideCoinCollectorDemo's `listCapabilities()` call sites as needing an explicit handler because url:// origins are self-asserted and the daemon always refuses permission-table reads over that transport.

OBSERVED: In the 19:02 run, the daemon-restart and basic-NAT tests each reached the real NATed daemon over the in-topology relay. Their public-host logs contain the daemon's exact `PERMISSION_DENIED` response for `list_capabilities`, including the named target domain and the direction to use credential-based grant rendezvous for authenticated remote access. The tests then failed because they still required the demo page to say `Wallet Connected (Server-Side)`. The JVM browser suite failed in its initial relay-read phase with `Connection Error` for the same refusal, not with the already-fixed redirect error. The relay-unavailable suite also retained its exit-code mismatch. The browser JS suite hit its 2,400,000 ms test ceiling while staging; only staging integrity and lifecycle diagnostics passed.

INFERRED: The current deterministic mechanism is: W3WalletTests uses “the demo rendered wallet contents” as a proxy for “the relay transported an RPC,” but current W3WalletDaemon correctly refuses the unauthenticated `list_capabilities` application operation and current typed-client code correctly exposes that refusal. A received full-text daemon `PERMISSION_DENIED` proves the relay path worked, yet the tests classify it as transport failure. This stale test contract is independent of the same-tier relay-selection fix.

## Updated mechanism statement

The mechanism is that current NAT tests conflate transport reachability with application authorization: the relay delivers `list_capabilities` to the NATed daemon, the daemon returns its expected full-text `PERMISSION_DENIED` for a self-asserted url:// origin, and the now-correct typed client throws that refusal; the tests require `Wallet Connected (Server-Side)` and therefore fail. The evidence is the complete 19:02 hosted log showing the exact daemon denial on the relay path in multiple suites, together with W3WalletDaemon merge commit `275f78150d5fd0590d7cc58de95ae96192aad44e`, whose implementation and pull-request notes identify this precise downstream compatibility change.

## 2026-07-29 16:52 UTC — local boundary and proposed test contract

OBSERVED: A direct `url://netlab/` CLI request fails because no direct NetLab worker is reachable, and the lane host has neither Docker nor another container runtime. NetLabWorkerServer's own README requires Docker for every applied topology. The host remains above the lane's build threshold (`load average 57.72` on 8 CPUs), driven by an unrelated JVM, so I have not started another local build JVM. This means the actual two-switch/NAT-gateway topology cannot be executed locally in this lane's current environment; that is an environment boundary, not evidence that the product failure does or does not reproduce.

OBSERVED: The relevant public daemon API has a `health()` operation, but the demo currently calls `listCapabilities()` first. The retained hosted response is stronger than a health response for transport diagnosis: it contains the daemon-generated, operation-specific, origin-specific `PERMISSION_DENIED` text. The W3WalletTests comments state that these suites' NAT purpose is relay reachability, while authenticated capability administration is outside this transport's contract. The current assertions instead depend on the old client bug that converted the refusal to an empty list.

INFERRED: The owning defect is the acceptance-test contract in W3WalletTests. The narrow repair is to require the exact daemon authorization refusal as the successful relay-transport outcome, including operation, target domain, and asserted origin, while continuing to require a blocked direct private-subnet connection. This is not a weaker “any error means pass” condition: a resolver/relay failure has a different message and cannot satisfy the full daemon refusal. The existing completed hosted run is the fail-first end-to-end reproducer; it fails on every affected current-dependency relay read in that run. A final hosted topology run is still required because this host cannot supply Docker/NetLab locally.

## 2026-07-29 17:03 UTC — test-contract repair and local static checks

OBSERVED: The W3WalletTests branch now makes the basic NAT, daemon-restart, and JVM-browser scenarios require the full current daemon refusal for `list_capabilities`. The expected value includes the sandbox wrapper, operation, `PERMISSION_DENIED`, target domain, asserted HTTPS origin, issue reference, grant-rendezvous guidance, and local-WebSocket guidance. The basic/restart shell probes compare against the demo's HTML-escaped full value and print the complete response on mismatch. The browser runner reads the decoded `title` attribute through the real page DOM and compares the complete value, both before and after a fresh browser profile. Its later mint assertion was also updated from the obsolete resolver-error framing to the current typed-client sandbox framing, while retaining the full create-denial assertion and zero-coin check.

OBSERVED: The generated expected `127.0.0.1` refusal is byte-for-byte identical to the value retained in hosted run 30296458829; a direct `diff` produced no output. A POSIX-shell check also proved the generated shell argument matches the complete HTML-escaped value, including apostrophes and `<token>`. After rebasing on current `origin/main`, `npm run typecheck`, `node --check browser-nat-e2e/run-jvm-demo.mjs`, and `git diff --check` passed. The two local non-NetLab Jest suites also passed: 2 suites, 3 tests. No local JVM was started while this 8-CPU host remained at load average 65.76.

INFERRED: Static construction and exact-message fidelity are verified locally. The real NAT transition from red to green cannot be verified on this machine because no local NetLab execution backend exists; the authorized single hosted run is now the required end-to-end verdict. The relay-unavailable mismatch is deliberately unchanged because its archived body is absent and the prior local reproduction passed both existing greps.

## 2026-07-29 17:09 UTC — checkpoint and standard CI

OBSERVED: Commit `80872e3f` (`Align NAT relay assertions with daemon authorization`) was created after checking the existing pull request was still open, rebased immediately before push, and pushed to the assigned `add-use-tier-e2e-specs` branch. The relay-unavailable test's pass/fail contract was not changed; this first version attempted to echo the saved response body if either existing grep failed. The new commit triggered the ordinary pull-request checks. `Validate repository structure` and `Typecheck` have completed successfully; the Playwright suite remains in progress. The hosted NetLab workflow has not been dispatched, so there is still only one remote verification set in flight.

INFERRED: The durable branch checkpoint is complete. The remaining sequence is ordinary checks green, then exactly one hosted NetLab workflow dispatch at this commit, followed by review and handoff reporting.

## 2026-07-29 17:19 UTC — reviews and final hosted run

OBSERVED: All ordinary checks on commit `80872e39238558bc163f1dd6d5c66594f4c84e73` completed successfully under build-watchman: `Typecheck`, repository validation, Playwright, and `kotlin.build (remote)`. No merge action was taken. The one authorized hosted verification was dispatched once as https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975; it is currently in progress. The branch worktree is clean and contains no tracked build, test-result, Playwright-report, node_modules, or log artifacts.

### Test-comprehensiveness review

OBSERVED: The fail-first evidence is a real end-to-end NetLab topology at current W3WalletTests head and current downstream source: run 30296458829 completed Jest and produced the same exact daemon refusal on every affected relay read. The updated tests cover the basic two-switch NAT path, the first and rotated daemon identities in the restart scenario, browser header injection through the HTTPS proxy, a fresh browser profile, the later create denial, zero created coins, and the direct private-subnet connection remaining blocked. They assert the complete application response, not a substring, and retain real daemon, demo, relay, browser, proxy, and NAT components. No mock, reflection, skip, reduced iteration count, increased timeout, new retry, or production service was introduced.

INFERRED: This is comprehensive for the identified contract defect: a transport failure cannot manufacture the named daemon operation, target domain, asserted origin, permission code, and complete guidance. Credential-based grant-rendezvous behavior is deliberately outside this NAT-transport acceptance change. The material coverage gap is environmental rather than hidden: this lane has no runnable local NetLab backend, so the post-change real-topology verdict is the single hosted run now in progress.

### Adversarial code review

OBSERVED: I checked the changed values against both the W3WalletDaemon source and the retained hosted output. The `127.0.0.1` expected string matches the hosted response byte-for-byte. The browser variant derives `10.0.0.20` from the same `WEB_URL` whose Host header the HTTPS proxy forwards to Jetty. Shell arguments are quoted, HTML escaping matches the demo's five replacements, and an executed POSIX-shell comparison passed with the full message including apostrophes, the em dash, and `<token>`. Cleanup, retry counts, and time budgets are unchanged. The relay-unavailable change only prints the already-saved body on the existing failure path and does not alter its verdict.

INFERRED: I found no correctness or quality issue in the new diff. The full list-denial text exists in both the TypeScript shell tests and the standalone uploaded `.mjs` runner because that runner is copied into an isolated container without the TypeScript module; this duplication can drift, but drift fails the exact end-to-end assertions rather than creating a false pass. A pre-existing limitation remains in the restart scenario: its old-URL check only proves a bounded response, not that the stale URL is unusable. That is not part of this change and does not affect the new proof that the rotated URL reaches the restarted daemon, but it should remain visible to the pull-request reviewer.

## 2026-07-29 17:26 UTC — hosted verification progress

OBSERVED: Hosted run 30474654975 checked out commit `80872e39238558bc163f1dd6d5c66594f4c84e73`, cloned current downstream sources, built the current W3WalletDaemon and JVM demo, staged the resolver 0.0.673 relay harness, installed the browser dependencies, and completed the `url://netlab-hosted/` warm-up. It is now inside the single `Run NetLab NAT e2e` step. GitHub's job-log endpoint returns `BlobNotFound` while this job is active, so there is no retained partial per-suite output to interpret yet.

INFERRED: The final verification is exercising the intended current-dependency topology. No second run will be launched regardless of its result.

## 2026-07-29 17:32 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in its one NAT-e2e step about fifteen minutes after dispatch. Every setup/build/warm-up step is complete and successful; GitHub has not started failure cleanup or produced a terminal conclusion.

INFERRED: This duration is still inside the suite's normal provisioning and artifact-staging phase. There is no new failure evidence to act on.

## 2026-07-29 17:37 UTC — waiting on the only hosted run

OBSERVED: The hosted NAT step has run for about twenty minutes without a terminal result. GitHub still shows every preceding step successful and has not entered trace upload or post-job cleanup. Live per-suite logs remain unavailable.

INFERRED: This is an expected wait on seven real hosted topologies, not an investigation impasse. There is no in-scope action to take until the run supplies a verdict.

## 2026-07-29 17:42 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the same NAT-e2e step at about twenty-five minutes. All prior steps remain successful and no terminal log blob exists yet.

INFERRED: Continue monitoring this run only.

## 2026-07-29 17:49 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in `Run NetLab NAT e2e` at about thirty-two minutes. No terminal conclusion or partial log is available.

INFERRED: Continue waiting for this one run's evidence.

## 2026-07-29 17:56 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about thirty-nine minutes, with no terminal output or step transition.

INFERRED: No action is warranted before the retained job log becomes available.

## 2026-07-29 18:02 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about forty-five minutes. No terminal conclusion is available.

INFERRED: Continue monitoring the authorized run without intervention.

## 2026-07-29 18:07 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in its NAT-e2e step at about fifty minutes. No terminal log is available.

INFERRED: Continue waiting for this run's final evidence.

## 2026-07-29 18:12 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about fifty-five minutes, with all earlier steps successful and no terminal log.

INFERRED: Continue monitoring this one run.

## 2026-07-29 18:20 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in `Run NetLab NAT e2e` at about one hour. Every setup, build, artifact-staging, and NetLab warm-up step remains successful. GitHub has not exposed a terminal job log.

INFERRED: The run is still executing its seven real topology scenarios. Continue monitoring this authorized run only.

## 2026-07-29 18:25 UTC — hosted verification still active

OBSERVED: Run 30474654975 is still in the NAT-e2e step after roughly sixty-eight minutes. The step list is unchanged and GitHub still has no terminal job log.

INFERRED: Continue monitoring; do not dispatch another run.

## 2026-07-29 18:31 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains active in the NAT-e2e step at roughly seventy-four minutes. The workflow has a 150-minute job limit and its seven Jest suites run serially, so this remains within the declared run budget.

INFERRED: Continue monitoring this run. Its duration alone is not a failure mechanism.

## 2026-07-29 18:36 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains active in `Run NetLab NAT e2e` at roughly seventy-nine minutes. No post-step or terminal log is available.

INFERRED: Continue waiting for the run's retained evidence.

## 2026-07-29 18:38 UTC — one authorized hosted verification completed

OBSERVED: The only authorized hosted run, https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975, finished `failure` after 1h20m9s at exact head `80872e39238558bc163f1dd6d5c66594f4c84e73`. Jest completed normally: 2 suites failed, 5 passed; 2 tests failed, 6 passed; 4526.603 seconds total.

OBSERVED: All three current-dependency acceptance paths changed by this lane passed:

- `test_daemon_restart_reregisters` passed in 965.451 seconds.
- `test_nat_traversal_basic` passed in 770.524 seconds.
- `test_browser_nat_jvm_demo` passed in 1134.065 seconds.

These are the exact paths that failed in retained run 30296458829 after a real relay response began surfacing as the daemon's full `PERMISSION_DENIED` refusal. The fresh hosted passes prove the updated assertions accept that current, application-level refusal while preserving the direct-private-subnet and browser behavior checks.

OBSERVED: `test_nat_relay_unavailable` failed in 762.976 seconds at the unchanged verdict `expect(unreachableProbe.exitCode).toBe(0)`, expected 0, received 1. The public-host log again contains:

`Error connecting to wallet: All 0 peers for service 'w3wallet.daemon.12D3KooWUnreachableDaemonForNatTestOnly' failed bytecode fetch (direct and relay). Direct candidate errors: []. Relay candidate errors: []`

The remote shell only exits 1 when curl itself succeeds but the saved body does not satisfy both `Connection Error` and `w3wallet.daemon`. The response body itself is still absent from the retained log. The diagnostic added before this run echoed it from the NetLab exec process, but `w3wallet-test-harness` documents that exec stdout is not returned; the fetched main-container log did not contain that output. Therefore the exact missing marker remains unknown. This is a contradiction with the JVM demo source: after logging that caught error, `IndexServlet` deterministically renders status text `Connection Error` and the supplied daemon URL. It must not be classified as harmless without the actual response bytes.

OBSERVED: `test_browser_nat_js_demo` failed before topology apply or browser execution while staging `pw-node_modules.tar.part002`. All six genuine upload attempts ended with:

`RPC request 'uploadFile' to service 'netlab-worker-806963c3-1ae1-43e2-8bce-33cc8b0821eb' has an ambiguous outcome because its transport failed after the request write began. The request was not replayed because the remote handler may already have run. Original transport failure: Persistent RPC connection to service 'netlab-worker-806963c3-1ae1-43e2-8bce-33cc8b0821eb' was closed while requests were still pending.`

Artifact retrieval then reported that `browser-host` did not exist because apply had never run. This failure cannot exercise the PR's JS browser behavior and belongs to the hosted NetLab worker/manager transport path.

OBSERVED: The other suites passed: browser staging integrity and both lifecycle diagnostic tests.

INFERRED: The current NAT relay-authorization mechanism found and repaired in this lane is validated by three real hosted passes. The overall acceptance is not green, however. One remaining failure is clearly hosted staging infrastructure; the repeated relay-unavailable mismatch still lacks the decisive response-body evidence and cannot honestly be called fixed or infrastructure-only. The run allowance is exhausted, and another hosted run would violate the user's instruction.

## 2026-07-29 18:45 UTC — corrected the response-body diagnostic

OBSERVED: Review of the failed run and the installed `w3wallet-test-harness` source showed why the added echo did not survive: `execInHost` returns the command exit code while command stdout remains remote and is not included in the Jest log. I changed the relay-unavailable test to save the curl body at a fixed topology path and, only when the existing assertion is about to fail, download it through NetLab's public `downloadFileFromTopology` API and print its full contents from Jest before teardown. The acceptance condition, curl budget, iteration count, topology, and verdict are unchanged.

OBSERVED: After fetching and rebasing on current `origin/main`, `npm run typecheck` passed; the two local non-NetLab suites passed (2 suites, 3 tests); and `git diff --check` passed. Commit `fcf2187` (`Preserve unreachable response diagnostics`) was rebased and pushed to the assigned branch. Build-watchman is now following the new head's standard PR checks. No second hosted NetLab run was started.

INFERRED: A future authorized execution will retain the decisive response bytes instead of repeating this evidence gap. That instrumentation cannot retroactively recover this run's deleted topology.

## 2026-07-29 18:50 UTC — standard checks progressing

OBSERVED: On head `fcf2187`, `Typecheck` and `Validate repository structure` completed successfully. `Run Playwright suite` remains in progress under build-watchman. No check is failed.

INFERRED: Continue following this branch-CI gate to a terminal result.

## 2026-07-29 18:54 UTC — final branch state

OBSERVED: Build-watchman reached `OK: all checks ... completed green` for exact head `fcf21871fd930d539ead0031a2b6d4bfca3e5fa8`. A fresh pull-request query shows https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 remains `OPEN` and `CLEAN`. Its four standard checks are all complete and successful: Typecheck, repository validation, Playwright, and `kotlin.build (remote)`. The worktree is clean. Nothing was merged, enqueued, deployed, or restarted.

### Final test-comprehensiveness review

OBSERVED: The repaired transport-versus-authorization contract has fail-first evidence in retained current-dependency run 30296458829 and real hosted post-fix passes in run 30474654975 for all three changed topology paths: basic NAT, daemon restart/identity rotation, and JVM browser NAT. The exact assertion distinguishes a daemon-generated authorization refusal from resolver or relay failure by requiring the complete operation-specific response. The tests retain direct-subnet blocking, fresh browser session, zero coins, and mint denial. The follow-up diagnostic uses NetLab's real file-download API only on the existing failure path, cleans its runner temp directory in `finally`, and does not alter the verdict. Local type checking and all runnable non-NetLab tests pass. No mocks, reflection, skip, timeout increase, retry increase, or iteration reduction was introduced.

INFERRED: Coverage is sufficient for the test-contract repair itself. It is not sufficient to clear the whole hosted acceptance: local NetLab could not be run on this host, the JS suite never reached apply/browser execution in the one final run, and the relay-unavailable response bytes were not retained. The new diagnostic closes that future evidence gap but is not retroactive.

### Final adversarial code review

OBSERVED: A first review incorrectly assumed stdout from `execInHost` would appear in retained Jest logs. The final hosted run disproved that assumption, and the installed harness source explains the mechanism. Commit `fcf2187` addresses it by downloading the fixed-path body before topology deletion and printing it from the Jest process. I re-reviewed path quoting, temporary-file cleanup, failure behavior if the download itself fails, exact-message construction and escaping, branch artifacts, and the final diff. The diagnostic download failure is reported but cannot hide the original nonzero assertion. All acceptance predicates and time budgets are unchanged.

INFERRED: I found no remaining code-quality or correctness issue in this lane's final diff. The pre-existing restart test limitation remains: its old-URL probe proves bounded completion rather than proving the old URL is unusable. The unresolved hosted contradiction remains outside the completed repair: server source and logs imply an error page containing both required values, while curl's saved body failed at least one grep.

## DONE-STATE SUMMARY

- Ready and green: https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 at head `fcf21871fd930d539ead0031a2b6d4bfca3e5fa8`; all four standard required checks are green.
- Ready and pushed: commit `80872e39238558bc163f1dd6d5c66594f4c84e73` aligns three NAT relay assertions with current daemon authorization behavior; commit `fcf21871fd930d539ead0031a2b6d4bfca3e5fa8` preserves the full relay-unavailable response on a future failure.
- Proven in the one authorized hosted run: basic NAT, daemon restart, and browser JVM NAT all pass against current downstream dependencies.
- Not green: https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975 ended with two unrelated remaining failures. Browser JS stopped during NetLab artifact upload after six closed persistent RPC connections. Relay-unavailable repeated its body-content mismatch, but the actual body was lost by the old diagnostic path.
- Local NetLab result: not established. `url://netlab/` had zero reachable peers, and this host has no Docker-compatible runtime even though NetLabWorker requires Docker. This is an explicit environment boundary, not a local pass.
- Recommendation: do not merge on the present acceptance evidence. Close https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 as blocked on the unavailable local NetLab path and incomplete hosted evidence. The named authorization-contract defect is fixed, but the hosted gate as a whole is not proven green, and the one-run allowance is exhausted.

## NEEDS-USER

None. A further hosted run could use the corrected response-body diagnostic, but it is outside this lane's one-run authorization. The proposed answer is not to authorize or launch it as part of this handoff.

## SUPERVISOR REVIEW AND MERGE

The supervisor must review the two final commits on https://github.com/CodexCoder21Organization/W3WalletTests/pull/30, the three post-fix hosted passes and two remaining failures in https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975, and this report's local-environment boundary. The evidence-backed recommendation is to close the pull request as blocked rather than merge it. If the supervisor chooses to accept the remaining hosted risk, the only merge target is https://github.com/CodexCoder21Organization/W3WalletTests/pull/30; do not merge any other pull request and do not deploy anything.

Add dependency

Complete this handoff

Moves it out of every priority list and into ArchiveArea.

Handoff document

Markdown

W3WalletTests NAT acceptance investigation

2026-07-29 16:36 UTC — initial state

OBSERVED: The handoff service is healthy and returned hf-2026-07-19-w3wallettests-pr30-nat-shepherd. The handoff is a stale snapshot that reports two distinct prior signatures: an upstream JVM-demo redirect failure that was later fixed, and a relay-unavailable response mismatch that did not reproduce in the prior local check. A fresh GitHub query shows https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 is OPEN, CLEAN, at head 59b0a6720cd17c15137889ed1d02889481b1d26b; its four reported standard checks are complete and successful. https://github.com/CodexCoder21Organization/W3WalletTests/issues/26 is closed. The repository was freshly cloned into this lane's isolated workspace, has no repository-specific AGENTS.md, and its root README.md has been read.

Working mechanism statement

The mechanism is not yet established, and the evidence needed is the exact failed command/assertion plus surrounding phase and transport output from hosted runs 28932493407 and 30279653970, followed by the same scenario executed locally against the pull request's current dependency resolution.

2026-07-29 16:39 UTC — hosted-log extraction

OBSERVED: GitHub's old gh client returned no text for gh run view --log, but the job-log API returned the complete retained logs. Run https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/28932493407 was attempt 12 at older head c01dd4216572b66d8dea9a75ef673e77546c10e7. In its Run NetLab NAT e2e step, four of six suites failed:

test_daemon_restart_reregisters.test.ts failed after 1,177,842 ms in phase 1, before restart, because the first relay connection did not render Wallet Connected (Server-Side); the public JVM demo logged Wallet daemon did not respond within 25000ms (unreachable?).
test_nat_traversal_basic.test.ts failed after 1,469,363 ms at expect(connectedProbe.exitCode).toBe(0), expected 0, received 1.
test_browser_nat_jvm_demo.test.ts reached the overall Jest ceiling after 2,400,003 ms. Its later diagnostic log showed RELAY_FORWARD_FAILED for add_spend_limit, ending in Handler error: Element class kotlinx.serialization.json.JsonLiteral is not a JsonObject.
test_browser_nat_js_demo.test.ts failed after 1,650,188 ms at expect(pass).toBe(true), expected true, received false; the browser runner had connected the wallet but then hit page.waitForFunction: Timeout 30000ms exceeded.

The same older run passed test_nat_relay_unavailable.test.ts and test_browser_nat_staging_integrity.test.ts.

OBSERVED: Run https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30279653970 tested the current pull-request head 59b0a6720cd17c15137889ed1d02889481b1d26b. Five of seven suites passed, including daemon restart, basic NAT traversal, browser JS, staging integrity, and lifecycle diagnostics. Two suites failed:

test_nat_relay_unavailable.test.ts failed after 857,105 ms at expect(unreachableProbe.exitCode).toBe(0), expected 0, received 1. The exact shell contract is: curl -s -L -m 75 must either fail, or its response body must pass both grep -q "Connection Error" and grep -q "w3wallet.daemon". The public JVM server logged Error connecting to wallet: All 0 peers for service 'w3wallet.daemon.12D3KooWUnreachableDaemonForNatTestOnly' failed bytecode fetch (direct and relay). Direct candidate errors: []. Relay candidate errors: []. The retained log does not contain the saved response body, so it does not identify which grep failed.
test_browser_nat_jvm_demo.test.ts first logged PASS: public JVM server reached the NATed daemon over relay and rendered the injected daemon URL, then failed in the later mint-denial phase at assertServerSideMintIsDenied: page.waitForNavigation: net::ERR_EMPTY_RESPONSE. Jest reported expect(pass).toBe(true), expected true, received false. This is the redirect failure already fixed upstream after that hosted run.

INFERRED: On the current pull-request head, the unresolved hosted observation is narrowly the response-content shell assertion in test_nat_relay_unavailable.test.ts; relay connection itself was working in the other current-head suites. The logs support the handoff's claim that the response body is the missing evidence. They do not support changing either grep because they do not show which expected string was absent.

Local-run feasibility

OBSERVED: The lane host has Java 21 and coursier but no docker command. At 16:38 UTC it had 8 CPUs and load averages 38.54 42.57 47.43, above the lane's 4 × cores threshold, so a local JVM build is currently deferred. The repository documents a direct-worker path at url://netlab/; unlike the hosted manager, it does not provision a droplet and treats create as immediate.

INFERRED: The appropriate local experiment on this host is the same test and public APIs against the documented direct worker url://netlab/, with freshly built current daemon/JVM-demo artifacts once host load permits. Using url://netlab-hosted/ now would consume the one authorized hosted verification before the local evidence exists.

2026-07-29 16:45 UTC — course-changing existing-run evidence

OBSERVED: The premise that https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30296458829 was merely “cancelled mid-step” is not supported by its retained job log. Jest completed all seven suites and printed its full summary before the 150-minute job deadline canceled the step during post-test non-exit/cleanup. The run used current W3WalletTests head 59b0a6720cd17c15137889ed1d02889481b1d26b, cloned downstream main after both the JVM redirect fix and https://github.com/CodexCoder21Organization/W3WalletDaemon/pull/129 had merged, and produced five failures, two passes.

OBSERVED: W3WalletDaemon merge commit 275f78150d5fd0590d7cc58de95ae96192aad44e landed at 2026-07-27 18:29 UTC, between the 15:22 run (where basic NAT and daemon restart passed) and the 19:02 run. The commit makes the real SJVM typed client throw whenever the daemon returns an application result envelope with success: false; before it, listCapabilities() silently turned the same refusal into an empty collection. The merged pull request explicitly called out W3WalletJvmServerSideCoinCollectorDemo's listCapabilities() call sites as needing an explicit handler because url:// origins are self-asserted and the daemon always refuses permission-table reads over that transport.

OBSERVED: In the 19:02 run, the daemon-restart and basic-NAT tests each reached the real NATed daemon over the in-topology relay. Their public-host logs contain the daemon's exact PERMISSION_DENIED response for list_capabilities, including the named target domain and the direction to use credential-based grant rendezvous for authenticated remote access. The tests then failed because they still required the demo page to say Wallet Connected (Server-Side). The JVM browser suite failed in its initial relay-read phase with Connection Error for the same refusal, not with the already-fixed redirect error. The relay-unavailable suite also retained its exit-code mismatch. The browser JS suite hit its 2,400,000 ms test ceiling while staging; only staging integrity and lifecycle diagnostics passed.

INFERRED: The current deterministic mechanism is: W3WalletTests uses “the demo rendered wallet contents” as a proxy for “the relay transported an RPC,” but current W3WalletDaemon correctly refuses the unauthenticated list_capabilities application operation and current typed-client code correctly exposes that refusal. A received full-text daemon PERMISSION_DENIED proves the relay path worked, yet the tests classify it as transport failure. This stale test contract is independent of the same-tier relay-selection fix.

Updated mechanism statement

The mechanism is that current NAT tests conflate transport reachability with application authorization: the relay delivers list_capabilities to the NATed daemon, the daemon returns its expected full-text PERMISSION_DENIED for a self-asserted url:// origin, and the now-correct typed client throws that refusal; the tests require Wallet Connected (Server-Side) and therefore fail. The evidence is the complete 19:02 hosted log showing the exact daemon denial on the relay path in multiple suites, together with W3WalletDaemon merge commit 275f78150d5fd0590d7cc58de95ae96192aad44e, whose implementation and pull-request notes identify this precise downstream compatibility change.

2026-07-29 16:52 UTC — local boundary and proposed test contract

OBSERVED: A direct url://netlab/ CLI request fails because no direct NetLab worker is reachable, and the lane host has neither Docker nor another container runtime. NetLabWorkerServer's own README requires Docker for every applied topology. The host remains above the lane's build threshold (load average 57.72 on 8 CPUs), driven by an unrelated JVM, so I have not started another local build JVM. This means the actual two-switch/NAT-gateway topology cannot be executed locally in this lane's current environment; that is an environment boundary, not evidence that the product failure does or does not reproduce.

OBSERVED: The relevant public daemon API has a health() operation, but the demo currently calls listCapabilities() first. The retained hosted response is stronger than a health response for transport diagnosis: it contains the daemon-generated, operation-specific, origin-specific PERMISSION_DENIED text. The W3WalletTests comments state that these suites' NAT purpose is relay reachability, while authenticated capability administration is outside this transport's contract. The current assertions instead depend on the old client bug that converted the refusal to an empty list.

2026-07-29 17:03 UTC — test-contract repair and local static checks

OBSERVED: The W3WalletTests branch now makes the basic NAT, daemon-restart, and JVM-browser scenarios require the full current daemon refusal for list_capabilities. The expected value includes the sandbox wrapper, operation, PERMISSION_DENIED, target domain, asserted HTTPS origin, issue reference, grant-rendezvous guidance, and local-WebSocket guidance. The basic/restart shell probes compare against the demo's HTML-escaped full value and print the complete response on mismatch. The browser runner reads the decoded title attribute through the real page DOM and compares the complete value, both before and after a fresh browser profile. Its later mint assertion was also updated from the obsolete resolver-error framing to the current typed-client sandbox framing, while retaining the full create-denial assertion and zero-coin check.

OBSERVED: The generated expected 127.0.0.1 refusal is byte-for-byte identical to the value retained in hosted run 30296458829; a direct diff produced no output. A POSIX-shell check also proved the generated shell argument matches the complete HTML-escaped value, including apostrophes and <token>. After rebasing on current origin/main, npm run typecheck, node --check browser-nat-e2e/run-jvm-demo.mjs, and git diff --check passed. The two local non-NetLab Jest suites also passed: 2 suites, 3 tests. No local JVM was started while this 8-CPU host remained at load average 65.76.

2026-07-29 17:09 UTC — checkpoint and standard CI

OBSERVED: Commit 80872e3f (Align NAT relay assertions with daemon authorization) was created after checking the existing pull request was still open, rebased immediately before push, and pushed to the assigned add-use-tier-e2e-specs branch. The relay-unavailable test's pass/fail contract was not changed; this first version attempted to echo the saved response body if either existing grep failed. The new commit triggered the ordinary pull-request checks. Validate repository structure and Typecheck have completed successfully; the Playwright suite remains in progress. The hosted NetLab workflow has not been dispatched, so there is still only one remote verification set in flight.

2026-07-29 17:19 UTC — reviews and final hosted run

OBSERVED: All ordinary checks on commit 80872e39238558bc163f1dd6d5c66594f4c84e73 completed successfully under build-watchman: Typecheck, repository validation, Playwright, and kotlin.build (remote). No merge action was taken. The one authorized hosted verification was dispatched once as https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975; it is currently in progress. The branch worktree is clean and contains no tracked build, test-result, Playwright-report, node_modules, or log artifacts.

Test-comprehensiveness review

Adversarial code review

OBSERVED: I checked the changed values against both the W3WalletDaemon source and the retained hosted output. The 127.0.0.1 expected string matches the hosted response byte-for-byte. The browser variant derives 10.0.0.20 from the same WEB_URL whose Host header the HTTPS proxy forwards to Jetty. Shell arguments are quoted, HTML escaping matches the demo's five replacements, and an executed POSIX-shell comparison passed with the full message including apostrophes, the em dash, and <token>. Cleanup, retry counts, and time budgets are unchanged. The relay-unavailable change only prints the already-saved body on the existing failure path and does not alter its verdict.

INFERRED: I found no correctness or quality issue in the new diff. The full list-denial text exists in both the TypeScript shell tests and the standalone uploaded .mjs runner because that runner is copied into an isolated container without the TypeScript module; this duplication can drift, but drift fails the exact end-to-end assertions rather than creating a false pass. A pre-existing limitation remains in the restart scenario: its old-URL check only proves a bounded response, not that the stale URL is unusable. That is not part of this change and does not affect the new proof that the rotated URL reaches the restarted daemon, but it should remain visible to the pull-request reviewer.

2026-07-29 17:26 UTC — hosted verification progress

OBSERVED: Hosted run 30474654975 checked out commit 80872e39238558bc163f1dd6d5c66594f4c84e73, cloned current downstream sources, built the current W3WalletDaemon and JVM demo, staged the resolver 0.0.673 relay harness, installed the browser dependencies, and completed the url://netlab-hosted/ warm-up. It is now inside the single Run NetLab NAT e2e step. GitHub's job-log endpoint returns BlobNotFound while this job is active, so there is no retained partial per-suite output to interpret yet.

INFERRED: The final verification is exercising the intended current-dependency topology. No second run will be launched regardless of its result.

2026-07-29 17:32 UTC — hosted verification still active

INFERRED: This duration is still inside the suite's normal provisioning and artifact-staging phase. There is no new failure evidence to act on.

2026-07-29 17:37 UTC — waiting on the only hosted run

INFERRED: This is an expected wait on seven real hosted topologies, not an investigation impasse. There is no in-scope action to take until the run supplies a verdict.

2026-07-29 17:42 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the same NAT-e2e step at about twenty-five minutes. All prior steps remain successful and no terminal log blob exists yet.

INFERRED: Continue monitoring this run only.

2026-07-29 17:49 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in Run NetLab NAT e2e at about thirty-two minutes. No terminal conclusion or partial log is available.

INFERRED: Continue waiting for this one run's evidence.

2026-07-29 17:56 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about thirty-nine minutes, with no terminal output or step transition.

INFERRED: No action is warranted before the retained job log becomes available.

2026-07-29 18:02 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about forty-five minutes. No terminal conclusion is available.

INFERRED: Continue monitoring the authorized run without intervention.

2026-07-29 18:07 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in its NAT-e2e step at about fifty minutes. No terminal log is available.

INFERRED: Continue waiting for this run's final evidence.

2026-07-29 18:12 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in the NAT-e2e step at about fifty-five minutes, with all earlier steps successful and no terminal log.

INFERRED: Continue monitoring this one run.

2026-07-29 18:20 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains in Run NetLab NAT e2e at about one hour. Every setup, build, artifact-staging, and NetLab warm-up step remains successful. GitHub has not exposed a terminal job log.

INFERRED: The run is still executing its seven real topology scenarios. Continue monitoring this authorized run only.

2026-07-29 18:25 UTC — hosted verification still active

OBSERVED: Run 30474654975 is still in the NAT-e2e step after roughly sixty-eight minutes. The step list is unchanged and GitHub still has no terminal job log.

INFERRED: Continue monitoring; do not dispatch another run.

2026-07-29 18:31 UTC — hosted verification still active

INFERRED: Continue monitoring this run. Its duration alone is not a failure mechanism.

2026-07-29 18:36 UTC — hosted verification still active

OBSERVED: Run 30474654975 remains active in Run NetLab NAT e2e at roughly seventy-nine minutes. No post-step or terminal log is available.

INFERRED: Continue waiting for the run's retained evidence.

2026-07-29 18:38 UTC — one authorized hosted verification completed

OBSERVED: The only authorized hosted run, https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975, finished failure after 1h20m9s at exact head 80872e39238558bc163f1dd6d5c66594f4c84e73. Jest completed normally: 2 suites failed, 5 passed; 2 tests failed, 6 passed; 4526.603 seconds total.

OBSERVED: All three current-dependency acceptance paths changed by this lane passed:

test_daemon_restart_reregisters passed in 965.451 seconds.
test_nat_traversal_basic passed in 770.524 seconds.
test_browser_nat_jvm_demo passed in 1134.065 seconds.

These are the exact paths that failed in retained run 30296458829 after a real relay response began surfacing as the daemon's full PERMISSION_DENIED refusal. The fresh hosted passes prove the updated assertions accept that current, application-level refusal while preserving the direct-private-subnet and browser behavior checks.

OBSERVED: test_nat_relay_unavailable failed in 762.976 seconds at the unchanged verdict expect(unreachableProbe.exitCode).toBe(0), expected 0, received 1. The public-host log again contains:

Error connecting to wallet: All 0 peers for service 'w3wallet.daemon.12D3KooWUnreachableDaemonForNatTestOnly' failed bytecode fetch (direct and relay). Direct candidate errors: []. Relay candidate errors: []

The remote shell only exits 1 when curl itself succeeds but the saved body does not satisfy both Connection Error and w3wallet.daemon. The response body itself is still absent from the retained log. The diagnostic added before this run echoed it from the NetLab exec process, but w3wallet-test-harness documents that exec stdout is not returned; the fetched main-container log did not contain that output. Therefore the exact missing marker remains unknown. This is a contradiction with the JVM demo source: after logging that caught error, IndexServlet deterministically renders status text Connection Error and the supplied daemon URL. It must not be classified as harmless without the actual response bytes.

OBSERVED: test_browser_nat_js_demo failed before topology apply or browser execution while staging pw-node_modules.tar.part002. All six genuine upload attempts ended with:

RPC request 'uploadFile' to service 'netlab-worker-806963c3-1ae1-43e2-8bce-33cc8b0821eb' has an ambiguous outcome because its transport failed after the request write began. The request was not replayed because the remote handler may already have run. Original transport failure: Persistent RPC connection to service 'netlab-worker-806963c3-1ae1-43e2-8bce-33cc8b0821eb' was closed while requests were still pending.

Artifact retrieval then reported that browser-host did not exist because apply had never run. This failure cannot exercise the PR's JS browser behavior and belongs to the hosted NetLab worker/manager transport path.

OBSERVED: The other suites passed: browser staging integrity and both lifecycle diagnostic tests.

2026-07-29 18:45 UTC — corrected the response-body diagnostic

OBSERVED: Review of the failed run and the installed w3wallet-test-harness source showed why the added echo did not survive: execInHost returns the command exit code while command stdout remains remote and is not included in the Jest log. I changed the relay-unavailable test to save the curl body at a fixed topology path and, only when the existing assertion is about to fail, download it through NetLab's public downloadFileFromTopology API and print its full contents from Jest before teardown. The acceptance condition, curl budget, iteration count, topology, and verdict are unchanged.

OBSERVED: After fetching and rebasing on current origin/main, npm run typecheck passed; the two local non-NetLab suites passed (2 suites, 3 tests); and git diff --check passed. Commit fcf2187 (Preserve unreachable response diagnostics) was rebased and pushed to the assigned branch. Build-watchman is now following the new head's standard PR checks. No second hosted NetLab run was started.

INFERRED: A future authorized execution will retain the decisive response bytes instead of repeating this evidence gap. That instrumentation cannot retroactively recover this run's deleted topology.

2026-07-29 18:50 UTC — standard checks progressing

OBSERVED: On head fcf2187, Typecheck and Validate repository structure completed successfully. Run Playwright suite remains in progress under build-watchman. No check is failed.

INFERRED: Continue following this branch-CI gate to a terminal result.

2026-07-29 18:54 UTC — final branch state

OBSERVED: Build-watchman reached OK: all checks ... completed green for exact head fcf21871fd930d539ead0031a2b6d4bfca3e5fa8. A fresh pull-request query shows https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 remains OPEN and CLEAN. Its four standard checks are all complete and successful: Typecheck, repository validation, Playwright, and kotlin.build (remote). The worktree is clean. Nothing was merged, enqueued, deployed, or restarted.

Final test-comprehensiveness review

OBSERVED: The repaired transport-versus-authorization contract has fail-first evidence in retained current-dependency run 30296458829 and real hosted post-fix passes in run 30474654975 for all three changed topology paths: basic NAT, daemon restart/identity rotation, and JVM browser NAT. The exact assertion distinguishes a daemon-generated authorization refusal from resolver or relay failure by requiring the complete operation-specific response. The tests retain direct-subnet blocking, fresh browser session, zero coins, and mint denial. The follow-up diagnostic uses NetLab's real file-download API only on the existing failure path, cleans its runner temp directory in finally, and does not alter the verdict. Local type checking and all runnable non-NetLab tests pass. No mocks, reflection, skip, timeout increase, retry increase, or iteration reduction was introduced.

Final adversarial code review

OBSERVED: A first review incorrectly assumed stdout from execInHost would appear in retained Jest logs. The final hosted run disproved that assumption, and the installed harness source explains the mechanism. Commit fcf2187 addresses it by downloading the fixed-path body before topology deletion and printing it from the Jest process. I re-reviewed path quoting, temporary-file cleanup, failure behavior if the download itself fails, exact-message construction and escaping, branch artifacts, and the final diff. The diagnostic download failure is reported but cannot hide the original nonzero assertion. All acceptance predicates and time budgets are unchanged.

DONE-STATE SUMMARY

Ready and green: https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 at head fcf21871fd930d539ead0031a2b6d4bfca3e5fa8; all four standard required checks are green.
Ready and pushed: commit 80872e39238558bc163f1dd6d5c66594f4c84e73 aligns three NAT relay assertions with current daemon authorization behavior; commit fcf21871fd930d539ead0031a2b6d4bfca3e5fa8 preserves the full relay-unavailable response on a future failure.
Proven in the one authorized hosted run: basic NAT, daemon restart, and browser JVM NAT all pass against current downstream dependencies.
Not green: https://github.com/CodexCoder21Organization/W3WalletTests/actions/runs/30474654975 ended with two unrelated remaining failures. Browser JS stopped during NetLab artifact upload after six closed persistent RPC connections. Relay-unavailable repeated its body-content mismatch, but the actual body was lost by the old diagnostic path.
Local NetLab result: not established. url://netlab/ had zero reachable peers, and this host has no Docker-compatible runtime even though NetLabWorker requires Docker. This is an explicit environment boundary, not a local pass.
Recommendation: do not merge on the present acceptance evidence. Close https://github.com/CodexCoder21Organization/W3WalletTests/pull/30 as blocked on the unavailable local NetLab path and incomplete hosted evidence. The named authorization-contract defect is fixed, but the hosted gate as a whole is not proven green, and the one-run allowance is exhausted.