← Priority list

SimpleFileSystem workstream �� 3 PRs remain; all upstream fixes built+verified; landing gated on buildtest CI remediation (owner decision)

9 of 12 PRs merged. This session: UrlResolver 892 respin complete+verified at protocol 0.0.428/resolver 0.0.825 (unpushed pending one test classification, lane in flight); resolver large-pull fix implemented with count-asserted fail-first tests; Server 19 root cause measured at a validated CI-equivalent rig; Cli 13 repinned+locally verified. NetLab 124/126 review-rejected. Blocking gate: buildtest admission feedback loop root-caused (twice today, evidence in PlanRepository), durable fix = BuildTestEmbedded PR 440 (green, DIRTY) �� owner must authorize rebase/merge/deploy + drain-first restart; four CI runs died with zero tests executed.

hf-2026-07-22-simplefilesystem-workstream

Edit handoff

Title Summary Markdown body

# SimpleFileSystem workstream — 3 pull requests remain; all upstream fixes built and verified; landing gated on buildtest CI remediation

Updated 2026-07-30 15:35 UTC (updated in place; effort began 2026-07-22). Previous update 2026-07-30 09:50 UTC.

**RE-VERIFY:** Everything below is a write-time snapshot and will drift. Re-check each pull request with `gh pr view <n> --repo CodexCoder21Organization/<repo> --json state,mergeStateStatus,statusCheckRollup,mergedAt,headRefOid`; artifacts via `https://kotlin.directory/api/list-artifacts`; buildtest via `https://buildtest.kotlin.build/api/runs?limit=20`.

## Mission summary (the original request)

> "Ultimately we want to fully implement [PlanRepository/workstreams/SimpleFileSystem.md] — delegate to gpt 5.6-sol for any heavy lifting. Ultimately your goal is to fully implement SimpleFileSystem.md to completion. **You are approved to merge.** Parallelize where possible."

9 of 12 workstream pull requests were already merged by earlier sessions. Three remain, plus the upstream resolver chain that unblocks two of them.

## Current state — verified 2026-07-30 15:11–15:30 UTC

### The immediate gate: buildtest CI is degraded (second stall today), and the fix needs an owner decision

The shared CI service (buildtest, the `kotlin.build (remote)` check) stalled twice today. Root cause established with evidence (not the prior-incident suspects, all of which were refuted with counters): an **admission retry feedback loop** — queued waiters re-wake each other after every fleet observation (median re-wake 80 s against an advertised 300 s), degrading the observation admission requires, so runs stay PENDING despite free capacity. First stall 09:47–14:03 UTC (self-drained; peak 233–254 fleet-list responses/minute); recurrence from ~14:50 with a **wedged front door** — coordinator process up since 13:07 but ContainerNursery CLI, HTTPS API, and direct RPC all time out, 157 connections queued on TCP 35000. Four consecutive CI runs for this workstream died with zero tests executed.

- Full forensic record + recurrence addendum (verbatim logs, timelines, refuted hypotheses): https://github.com/CodexCoder21Organization/PlanRepository/commit/84b70eb9d4319b32e21beb05a198fa25a59a8285 and branch `wip/buildtest-provisioning-outage-2026-07-30` (commit `996fab09`), directory `handoffs/artifacts/2026-07-30-buildtest-provisioning/`.
- The durable fix exists: https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440 (admission floor). It is green but `mergeStateStatus=DIRTY` (needs rebase). Evidence comment posted there: https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440#issuecomment-5132644695
- **Owner decision required:** rebase/merge/publish/deploy that fix (one planned drain-first restart), and/or an interim coordinator restart to clear the wedged front door. Per standing policy neither restart nor deploy of buildtest is done unilaterally by an agent.

### 1. UrlResolver PR 892 — respin complete and verified; unpushed pending one test classification

https://github.com/CodexCoder21Organization/UrlResolver/pull/892 — OPEN; the PR branch (`bump/protocol-0.0.419-resolver-0.0.680`) is still at old head `996078d0`. The **complete respin** is checkpointed at [`60d0b56a`](https://github.com/CodexCoder21Organization/UrlResolver/commit/60d0b56a0a21d59ffd1593684692136d425321f5) on branch `wip/892-respin-0.0.428-2026-07-30`: PR 892's announcement-evidence fix (protocol 0.0.415+ creates "cold" observation records, so re-broadcast suppression now requires real contact evidence) rebased onto main, PLUS the concurrent session's https://github.com/CodexCoder21Organization/UrlResolver/pull/899 protocol-0.0.428 compat callbacks cherry-picked in (their branch untouched; coordination comments on both PRs), targeting **resolver 0.0.825** on **protocol 0.0.428**.

Verified on the combined tree: both announcement tests that fail on 899 alone PASS (the decisive flip); 899's two compat tests PASS; both 1 MiB binary-attachment tests PASS; the relay-observation stress test PASS isolated and in 4 concurrent instances; constrained-heap stream pulls PASS — all under 512 MiB heaps on a genuinely busy host. Test-comprehensiveness review added severity-boundary coverage for all four message types; adversarial review removed a reflection use. Full suite: **1,228/1,230** — one failure is the permitted hosted-netlab upload/transport signature; the other, `testNetlabNatToNatRelayOutageRecovery` ("a fresh resolve SUCCEEDED while the only relay was offline", line 255), stopped the push per the zero-product-failure gate.

**Classification of that failure is in flight** (codex lane running at handoff time, appending to a session-local report; its committed output will land on branch `wip/892-nat-outage-classification-2026-07-30` when done). Mechanism analysis already complete: the evidence-predicate change has NO code path that completes this test's resolve without a real relay round-trip — predicting the failure is environmental (the netlab-simulated relay outage never engaged despite applyStatus=APPLIED; compare https://github.com/CodexCoder21Organization/UrlResolver/pull/898, which fixed exec-retry replay of non-idempotent impairment commands). Alternating main-vs-respin measurements were crawling because netlab-hosted environment acquisition is degraded (same host ecosystem as buildtest). **If measurements confirm both-branches or environmental: force-push `60d0b56a` to the PR branch (`--force-with-lease`), update title/body to protocol 0.0.428 / resolver 0.0.825, file an issue for the netlab outage-not-engaging mechanism, run one CI cycle, enqueue, merge, publish resolver 0.0.825.**

### 2. Resolver large-pull follow-up — implemented, verified, awaiting PR 892 landing

Branch `feature/remote-stream-large-pulls` at [`bd854630`](https://github.com/CodexCoder21Organization/UrlResolver/commit/bd854630dba814512593b6a319567ec8111d1244) (stacked on the 892 respin tree). Motivated by the phase-level diagnosis of the server PR's failing test (below): each 10 MiB remote read cost ~10 sequential fixed-1 MiB pulls. The change sizes stream pulls to consumer demand (bounded 8 MiB) ONLY on negotiated RPC-1.1 **direct** routes; relay routes and legacy peers keep 1 MiB (route marker tied to the actual relay constraint, with a test proving a 2 MiB demand normalizes to 1 MiB over an application relay). Fail-first evidence is a hardware-independent round-trip-count test: base tree observes 11 pulls for 10 MiB, fixed tree exactly 3 (8 MiB + 2 MiB + EOF). After 892 merges: rebase onto main, set the next free resolver version, open the PR, reviews, CI, merge, publish.

### 3. SimpleFileSystemServiceServer PRs 19 and 20

https://github.com/CodexCoder21Organization/SimpleFileSystemServiceServer/pull/19 (OPEN, head `4ec1582a`, red on `testVNextLoopbackSurface`) — root cause now MEASURED, not guessed: at CI-equivalent CPU (validated rig: test pinned to 2 CPUs + 16 busy-loop contenders; the documented 8-contender rig passes 10/10 and is too generous on a 16-CPU host), the test fails 7/10 with resolver 0.0.679 AND 7/10 with 0.0.703 — the cost is distributed (passing runs use 21–27.5 s of the 30 s budget) with the largest unit being the two 10 MiB reads' pull round-trips (~9.5 s). The resolver large-pull change above is the fix (~4–6 s saving). Phase tables/jstacks/rig: branch `wip/srv19-resolver-pin-experiment-2026-07-30` (evidence commit [`a0f6cfa2`](https://github.com/CodexCoder21Organization/SimpleFileSystemServiceServer/commit/a0f6cfa2ff7ce150c719269bdf71cac3a2000588), final checkpoint `f6572363`). **Next: after the large-pull resolver publishes, repin PR 19, verify 10/10 at the 16-contender rig, push, CI, merge; then rebase/repin PR 20** (https://github.com/CodexCoder21Organization/SimpleFileSystemServiceServer/pull/20, stacked; its `testDurableBackendLoopback` failure was never separately diagnosed — diagnose at the same rig after the repin).

### 4. SimpleFileSystemServiceCli PR 13 — repinned and locally verified; needs one honest CI run

https://github.com/CodexCoder21Organization/SimpleFileSystemServiceCli/pull/13 — OPEN, head [`8ece0cd1`](https://github.com/CodexCoder21Organization/SimpleFileSystemServiceCli/commit/8ece0cd1c01f7a02dae97d3c50f13f88fbca2d55): dependency-pins-only commit (client 0.1.6 / wire 0.1.3 / server 0.1.7 / resolver 0.0.679; checked-in tests byte-identical; unamplified suite 8/8 twice). Honest evidence in the PR description: a 32 MiB scratch reproducer at 8 contenders fails 10/10 both before AND after the repin (the stall moved to upload-side byte-array marshaling), so the amplified rig over-predicts red — the real 10 MiB queue workload is the discriminator. Four CI attempts died in infrastructure with zero tests executed (runs 35893898, ac4deec9, 71350d8f + the original). **Next: once buildtest is healthy, one CI run; if green → enqueue → merge (pre-authorized). If the queue reds on testStreamedUploadDownload with real test output, the upload-side marshaling is the next per-unit cost to fix (likely via the same large-pull/streaming approach on the upload path, upstream).**

### Reviewed and rejected this session (do not merge as-is)

https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/124 — blob-identical to a rolled-back production regression (7-minute droplet-creation freeze; author's own "do not merge as-is"). https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/126 — institutes the owner-rejected environment caps, has readiness/cleanup races, real 5-file conflicts with main. Verdicts with mechanisms: [124 comment](https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/124#issuecomment-5130279456), [126 comment](https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/126#issuecomment-5130279711). The handoff's earlier "two green PRs await merge" is superseded.

## Branches pushed (nothing exists only locally)

| Branch | Head | Content |
|---|---|---|
| UrlResolver `wip/892-respin-0.0.428-2026-07-30` | `60d0b56a` | complete verified 892 respin (protocol 0.0.428 / resolver 0.0.825) |
| UrlResolver `feature/remote-stream-large-pulls` + `wip/bigpull-2026-07-30` | `bd854630` | large-pull implementation + count tests |
| SimpleFileSystemServiceCli PR branch + `wip/cli13-repin-2026-07-30` | `8ece0cd1` | repin commit |
| SimpleFileSystemServiceServer `wip/srv19-resolver-pin-experiment-2026-07-30` | `f6572363` | rig, phase tables, jstacks, raw logs |
| PlanRepository `wip/buildtest-provisioning-outage-2026-07-30` | `996fab09` | outage evidence + recurrence addendum |
| UrlResolver `wip/892-nat-outage-classification-2026-07-30` | (lane pushes on completion) | nat-outage classification runs + analysis |

The in-flight classification lane's local state lives under the session scratchpad (`lane-892/workspace/UrlResolver`, reports in `out/r-892nat*.md`); its durable output is the branch above.

## Next steps (ordered)

1. **Owner decision (the gate):** remediate buildtest — rebase/merge/publish/deploy https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440 with one planned drain-first restart, and/or interim-restart the wedged coordinator. Until then no `kotlin.build (remote)` check can pass anywhere.
2. Complete the nat-outage classification; on the predicted environmental verdict, push the 892 respin to the PR branch, one CI cycle, enqueue, merge, publish resolver 0.0.825.
3. Rebase + open the large-pull PR (next free resolver version), reviews, CI, merge, publish.
4. Repin Server PR 19 → verify 10/10 at the 16-contender rig → CI → merge; then PR 20 (rebase, repin, diagnose its durable-backend test at the same rig).
5. One honest CI run for Cli PR 13 → enqueue → merge.
6. Then the remaining workstream milestones from the 09:50 update: hosted `url://simple-filesystem/` deploy (data-critical — explicit user ask required), change-notification milestone, docs/adoption/graduation; W3Wallet excluded without the user.
7. Close out this handoff and the companion `hf-2026-07-23-sfs-server19-upstream-stream-pulls` (this update supersedes the companion's 892 state) only after independent re-verification.

## Reusable / operational knowledge (new this session)

- CI droplet rigs: a documented contention level is host-relative — recalibrate until the known-red baseline fails (16 contenders on 2 CPUs on a 16-core box, not 8) before trusting any green prediction; and note which axes you amplified, since an over-amplified rig can mask a genuine improvement.
- Perf regression tests: assert round-trip/allocation COUNTS, not wall time — the large-pull test discriminates on any hardware.
- When a CI run fails with zero tests executed, query the shared runs API before touching the PR — "my change is red" vs "the fleet is starved" is a one-minute distinction.
- Prior incidents are hypotheses: today's stall matched four known outage signatures and was none of them; verify each against live counters before acting.
- codex lanes die silently on machine-wide network blips (backend unreachable ×5 retries) — harvest surviving on-disk state and relaunch with a continuation brief that lists what is already done.
- The buildtest per-check 34-minute timer starts at run creation and keeps running across coordinator resume; a check can therefore report timeout minutes after a re-dispatch without any stale clock (verified against persisted run timestamps).

Add dependency

Complete this handoff

Moves it out of every priority list and into ArchiveArea.

Handoff document

Markdown

SimpleFileSystem workstream — 3 pull requests remain; all upstream fixes built and verified; landing gated on buildtest CI remediation

Updated 2026-07-30 15:35 UTC (updated in place; effort began 2026-07-22). Previous update 2026-07-30 09:50 UTC.

RE-VERIFY: Everything below is a write-time snapshot and will drift. Re-check each pull request with gh pr view <n> --repo CodexCoder21Organization/<repo> --json state,mergeStateStatus,statusCheckRollup,mergedAt,headRefOid; artifacts via https://kotlin.directory/api/list-artifacts; buildtest via https://buildtest.kotlin.build/api/runs?limit=20.

Mission summary (the original request)

"Ultimately we want to fully implement [PlanRepository/workstreams/SimpleFileSystem.md] — delegate to gpt 5.6-sol for any heavy lifting. Ultimately your goal is to fully implement SimpleFileSystem.md to completion. You are approved to merge. Parallelize where possible."

9 of 12 workstream pull requests were already merged by earlier sessions. Three remain, plus the upstream resolver chain that unblocks two of them.

Current state — verified 2026-07-30 15:11–15:30 UTC

The immediate gate: buildtest CI is degraded (second stall today), and the fix needs an owner decision

The shared CI service (buildtest, the kotlin.build (remote) check) stalled twice today. Root cause established with evidence (not the prior-incident suspects, all of which were refuted with counters): an admission retry feedback loop — queued waiters re-wake each other after every fleet observation (median re-wake 80 s against an advertised 300 s), degrading the observation admission requires, so runs stay PENDING despite free capacity. First stall 09:47–14:03 UTC (self-drained; peak 233–254 fleet-list responses/minute); recurrence from ~14:50 with a wedged front door — coordinator process up since 13:07 but ContainerNursery CLI, HTTPS API, and direct RPC all time out, 157 connections queued on TCP 35000. Four consecutive CI runs for this workstream died with zero tests executed.

Full forensic record + recurrence addendum (verbatim logs, timelines, refuted hypotheses): https://github.com/CodexCoder21Organization/PlanRepository/commit/84b70eb9d4319b32e21beb05a198fa25a59a8285 and branch wip/buildtest-provisioning-outage-2026-07-30 (commit 996fab09), directory handoffs/artifacts/2026-07-30-buildtest-provisioning/.
The durable fix exists: https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440 (admission floor). It is green but mergeStateStatus=DIRTY (needs rebase). Evidence comment posted there: https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440#issuecomment-5132644695
Owner decision required: rebase/merge/publish/deploy that fix (one planned drain-first restart), and/or an interim coordinator restart to clear the wedged front door. Per standing policy neither restart nor deploy of buildtest is done unilaterally by an agent.

1. UrlResolver PR 892 — respin complete and verified; unpushed pending one test classification

https://github.com/CodexCoder21Organization/UrlResolver/pull/892 — OPEN; the PR branch (bump/protocol-0.0.419-resolver-0.0.680) is still at old head 996078d0. The complete respin is checkpointed at 60d0b56a on branch wip/892-respin-0.0.428-2026-07-30: PR 892's announcement-evidence fix (protocol 0.0.415+ creates "cold" observation records, so re-broadcast suppression now requires real contact evidence) rebased onto main, PLUS the concurrent session's https://github.com/CodexCoder21Organization/UrlResolver/pull/899 protocol-0.0.428 compat callbacks cherry-picked in (their branch untouched; coordination comments on both PRs), targeting resolver 0.0.825 on protocol 0.0.428.

Verified on the combined tree: both announcement tests that fail on 899 alone PASS (the decisive flip); 899's two compat tests PASS; both 1 MiB binary-attachment tests PASS; the relay-observation stress test PASS isolated and in 4 concurrent instances; constrained-heap stream pulls PASS — all under 512 MiB heaps on a genuinely busy host. Test-comprehensiveness review added severity-boundary coverage for all four message types; adversarial review removed a reflection use. Full suite: 1,228/1,230 — one failure is the permitted hosted-netlab upload/transport signature; the other, testNetlabNatToNatRelayOutageRecovery ("a fresh resolve SUCCEEDED while the only relay was offline", line 255), stopped the push per the zero-product-failure gate.

Classification of that failure is in flight (codex lane running at handoff time, appending to a session-local report; its committed output will land on branch wip/892-nat-outage-classification-2026-07-30 when done). Mechanism analysis already complete: the evidence-predicate change has NO code path that completes this test's resolve without a real relay round-trip — predicting the failure is environmental (the netlab-simulated relay outage never engaged despite applyStatus=APPLIED; compare https://github.com/CodexCoder21Organization/UrlResolver/pull/898, which fixed exec-retry replay of non-idempotent impairment commands). Alternating main-vs-respin measurements were crawling because netlab-hosted environment acquisition is degraded (same host ecosystem as buildtest). If measurements confirm both-branches or environmental: force-push 60d0b56a to the PR branch (--force-with-lease), update title/body to protocol 0.0.428 / resolver 0.0.825, file an issue for the netlab outage-not-engaging mechanism, run one CI cycle, enqueue, merge, publish resolver 0.0.825.

2. Resolver large-pull follow-up — implemented, verified, awaiting PR 892 landing

Branch feature/remote-stream-large-pulls at bd854630 (stacked on the 892 respin tree). Motivated by the phase-level diagnosis of the server PR's failing test (below): each 10 MiB remote read cost ~10 sequential fixed-1 MiB pulls. The change sizes stream pulls to consumer demand (bounded 8 MiB) ONLY on negotiated RPC-1.1 direct routes; relay routes and legacy peers keep 1 MiB (route marker tied to the actual relay constraint, with a test proving a 2 MiB demand normalizes to 1 MiB over an application relay). Fail-first evidence is a hardware-independent round-trip-count test: base tree observes 11 pulls for 10 MiB, fixed tree exactly 3 (8 MiB + 2 MiB + EOF). After 892 merges: rebase onto main, set the next free resolver version, open the PR, reviews, CI, merge, publish.

3. SimpleFileSystemServiceServer PRs 19 and 20

https://github.com/CodexCoder21Organization/SimpleFileSystemServiceServer/pull/19 (OPEN, head 4ec1582a, red on testVNextLoopbackSurface) — root cause now MEASURED, not guessed: at CI-equivalent CPU (validated rig: test pinned to 2 CPUs + 16 busy-loop contenders; the documented 8-contender rig passes 10/10 and is too generous on a 16-CPU host), the test fails 7/10 with resolver 0.0.679 AND 7/10 with 0.0.703 — the cost is distributed (passing runs use 21–27.5 s of the 30 s budget) with the largest unit being the two 10 MiB reads' pull round-trips (~9.5 s). The resolver large-pull change above is the fix (~4–6 s saving). Phase tables/jstacks/rig: branch wip/srv19-resolver-pin-experiment-2026-07-30 (evidence commit a0f6cfa2, final checkpoint f6572363). Next: after the large-pull resolver publishes, repin PR 19, verify 10/10 at the 16-contender rig, push, CI, merge; then rebase/repin PR 20 (https://github.com/CodexCoder21Organization/SimpleFileSystemServiceServer/pull/20, stacked; its testDurableBackendLoopback failure was never separately diagnosed — diagnose at the same rig after the repin).

4. SimpleFileSystemServiceCli PR 13 — repinned and locally verified; needs one honest CI run

https://github.com/CodexCoder21Organization/SimpleFileSystemServiceCli/pull/13 — OPEN, head 8ece0cd1: dependency-pins-only commit (client 0.1.6 / wire 0.1.3 / server 0.1.7 / resolver 0.0.679; checked-in tests byte-identical; unamplified suite 8/8 twice). Honest evidence in the PR description: a 32 MiB scratch reproducer at 8 contenders fails 10/10 both before AND after the repin (the stall moved to upload-side byte-array marshaling), so the amplified rig over-predicts red — the real 10 MiB queue workload is the discriminator. Four CI attempts died in infrastructure with zero tests executed (runs 35893898, ac4deec9, 71350d8f + the original). Next: once buildtest is healthy, one CI run; if green → enqueue → merge (pre-authorized). If the queue reds on testStreamedUploadDownload with real test output, the upload-side marshaling is the next per-unit cost to fix (likely via the same large-pull/streaming approach on the upload path, upstream).

Reviewed and rejected this session (do not merge as-is)

https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/124 — blob-identical to a rolled-back production regression (7-minute droplet-creation freeze; author's own "do not merge as-is"). https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/126 — institutes the owner-rejected environment caps, has readiness/cleanup races, real 5-file conflicts with main. Verdicts with mechanisms: 124 comment, 126 comment. The handoff's earlier "two green PRs await merge" is superseded.

Branches pushed (nothing exists only locally)

| Branch | Head | Content | |---|---|---| | UrlResolver wip/892-respin-0.0.428-2026-07-30 | 60d0b56a | complete verified 892 respin (protocol 0.0.428 / resolver 0.0.825) | | UrlResolver feature/remote-stream-large-pulls + wip/bigpull-2026-07-30 | bd854630 | large-pull implementation + count tests | | SimpleFileSystemServiceCli PR branch + wip/cli13-repin-2026-07-30 | 8ece0cd1 | repin commit | | SimpleFileSystemServiceServer wip/srv19-resolver-pin-experiment-2026-07-30 | f6572363 | rig, phase tables, jstacks, raw logs | | PlanRepository wip/buildtest-provisioning-outage-2026-07-30 | 996fab09 | outage evidence + recurrence addendum | | UrlResolver wip/892-nat-outage-classification-2026-07-30 | (lane pushes on completion) | nat-outage classification runs + analysis |

The in-flight classification lane's local state lives under the session scratchpad (lane-892/workspace/UrlResolver, reports in out/r-892nat*.md); its durable output is the branch above.

Next steps (ordered)

Owner decision (the gate): remediate buildtest — rebase/merge/publish/deploy https://github.com/CodexCoder21Organization/BuildTestEmbedded/pull/440 with one planned drain-first restart, and/or interim-restart the wedged coordinator. Until then no kotlin.build (remote) check can pass anywhere.
Complete the nat-outage classification; on the predicted environmental verdict, push the 892 respin to the PR branch, one CI cycle, enqueue, merge, publish resolver 0.0.825.
Rebase + open the large-pull PR (next free resolver version), reviews, CI, merge, publish.
Repin Server PR 19 → verify 10/10 at the 16-contender rig → CI → merge; then PR 20 (rebase, repin, diagnose its durable-backend test at the same rig).
One honest CI run for Cli PR 13 → enqueue → merge.
Then the remaining workstream milestones from the 09:50 update: hosted url://simple-filesystem/ deploy (data-critical — explicit user ask required), change-notification milestone, docs/adoption/graduation; W3Wallet excluded without the user.
Close out this handoff and the companion hf-2026-07-23-sfs-server19-upstream-stream-pulls (this update supersedes the companion's 892 state) only after independent re-verification.

Reusable / operational knowledge (new this session)

CI droplet rigs: a documented contention level is host-relative — recalibrate until the known-red baseline fails (16 contenders on 2 CPUs on a 16-core box, not 8) before trusting any green prediction; and note which axes you amplified, since an over-amplified rig can mask a genuine improvement.
Perf regression tests: assert round-trip/allocation COUNTS, not wall time — the large-pull test discriminates on any hardware.
When a CI run fails with zero tests executed, query the shared runs API before touching the PR — "my change is red" vs "the fleet is starved" is a one-minute distinction.
Prior incidents are hypotheses: today's stall matched four known outage signatures and was none of them; verify each against live counters before acting.
codex lanes die silently on machine-wide network blips (backend unreachable ×5 retries) — harvest surviving on-disk state and relaunch with a continuation brief that lists what is already done.
The buildtest per-check 34-minute timer starts at run creation and keeps running across coordinator resume; a check can therefore report timeout minutes after a re-dispatch without any stale clock (verified against persisted run timestamps).