Netlab triage endgame: full fixed-transport chain built and verified — manager+worker PRs on resolver 0.0.705 + protocol 0.0.429, all three UrlResolver PRs rebased and code-clean; ONLY the coordinated netlab redeploy (owner approval) remains before the merges and the 7/7 netlab-e2e re-run

Written: 2026-07-30 16:30Z (supersedes the 09:40Z body; the 2026-07-30 working session is summarised here).

RE-VERIFY: everything below is a write-time snapshot. Before acting, re-check at minimum:

• gh pr view 128 --repo CodexCoder21Organization/NetLabManagerServer --json state,headRefOid,statusCheckRollup (head at write time cb21eca4acc1)
• gh pr view 63 --repo CodexCoder21Organization/NetLabWorkerServer --json state,headRefOid (head 9647490df450)
• gh pr view <n> --repo CodexCoder21Organization/UrlResolver for 659 (ed62df30cf71), 865 (8a4e05d32f7c), 868 (c03d057ee377), 901 (191d7a51a2ce)
• curl -s https://kotlin.directory/foundation/url/resolver/maven-metadata.xml | grep latest → 0.0.705 at write time; protocol <latest> 0.0.429.
• What netlab-manager/worker are actually running on the ContainerNursery host (the deploy had NOT happened at write time).

Mission

Unchanged from prior bodies: (Lane 1) land the validated W3Wallet NAT-regression pin bump — DONE: W3WalletJvmServerSideCoinCollectorDemo PR 100 MERGED 2026-07-30T11:45:06Z via the merge queue. (Lane 2) unblock and land the gated UrlResolver PRs, which requires publishing the netlab transport fix and redeploying netlab-manager/worker on it, then re-running the 7-suite netlab-e2e.

What was done 2026-07-30 (all verified at the time, re-verify before relying)

1. Published foundation.url:protocol:0.0.429 from UrlProtocol main d5db65adbbe6 — contains the byte-budgeted awaited-response outbox (UrlProtocol PR 430); served jar SHA-1 7b6c54dad59f82a8ebce218661ecace335e09dda verified equal to local build; outbox classes verified present.
2. Published foundation.url:resolver:0.0.704 (branch bump/protocol-0.0.429-outbox at 426260302b0e, based on the lane-h compat branch of UrlResolver PR 899) — compiled against 0.0.429, callback contract + persistent-RPC tests green.
3. Found a real regression in 0.0.704 during the worker rebuild: eager collection-return conversion (TypeMarshaling.extractCollectionFromSjvm, from UrlResolver PR 890 via batch 887) throws SandboxException: Cannot convert SJVM collection java/util/ArrayList with toArray() for host-RPC-originated list elements (mechanism: the managed Arrays.copyOf raises ArrayStoreException with a null message for host-originated element representations; internally-created lists work, which is why PR 890's own tests pass). Consumer evidence: NetLabWorkerServer testPartitionOverUrlProtocolRoundTrip fails on 0.0.704.
4. Fixed it upstream: UrlResolver PR 901 — indexed element-copy for host-originated values, live-proxy only as last resort; new regression test tests/testSandboxedRpcStringCollectionReturn.kts (fails on unfixed code); 8/8 targeted tests green (incl. PR 890's three collection tests + marshaling neighbors).
5. Published foundation.url:resolver:0.0.705 (branch bump/protocol-0.0.429-outbox-sjvm-fix at 63c375c43f97 = 0.0.704 basis + the 901 fix) — served jar SHA-1 cfd4ccad4d58da502cd0d9c10dbfcdca97a207ca, POM protocol dep 0.0.429, metadata flipped, 0.0.704 untouched.
6. Rebuilt BOTH netlab services on the common basis (resolver 0.0.705 + protocol 0.0.429):
   • Manager: NetLabManagerServer PR 128 (head cb21eca4acc1), 4/4 targeted transport tests green post-bump; jar SHA-256 332e7acd8e071e0ed1c3ce93cf12f9bce3d49eb69649e54bad57fe1f2f0f6ba4 (results comment: https://github.com/CodexCoder21Organization/NetLabManagerServer/pull/128#issuecomment-5133422698).
   • Worker: NetLabWorkerServer PR 63 (head 9647490df450), 3/3 targeted tests green including testPartitionOverUrlProtocolRoundTrip, which fails on 0.0.704 and passes on 0.0.705 — the regression proof; jar SHA-256 17e9351af680df39860ff2576cb3c0ec74cad5d99edba5040b130caade3a4bc4.
   • Jars are regenerable from the PR branches (each repo's buildFatJar rule); local copies live in a volatile scratchpad and should be rebuilt fresh at deploy time, verifying jar tf shows foundation/url/protocol/AwaitedResponseOutbox.class.
   • This constitutes "option 2" (coordinated source upgrade) of hf-2026-07-28-decide-immutable-transport-basis-for-netlab-manager-and-workers — that decision handoff should be resolved accordingly when the deploy is approved.
7. All three gated UrlResolver PRs rebased onto main 7c32d7a84b93 and verified code-clean:
   • PR 865 (teardown-cause attribution), head 8a4e05d32f7c — includes a follow-up strengthening two full-text assertions to the new attributed message (2/2 local). CI red decomposes to 1227/1231 pass; all failures are the netlab-infrastructure family.
   • PR 868 (gossip reservation release), head c03d057ee377 — its lane-cap test was root-caused as a test-determinism gap (drain gates unaligned with the 256 registry cap; 9/10 fail reproduction pre-fix) and rewritten deterministically; verified 20/20 consecutive passes + 4/4 sibling tests + gate-safety test (evidence comment: https://github.com/CodexCoder21Organization/UrlResolver/pull/868#issuecomment-5132862653). Production delivery behavior unchanged except the diagnostic gate bound (4 → the existing 256 ceiling).
   • PR 659 (pre-approved cleanup, reduced to deleting the dead servicelessPeerVerificationCount + its vacuous test), head ed62df30cf71, 3/3 targeted tests; artifact coordinate advanced to unclaimed 0.0.702-source lineage. CI red = netlab family only (1226/1228 pass).
8. Merged: W3Wallet demo PR 100 (Lane 1 deliverable).

THE ONE REMAINING GATE

Redeploy netlab-manager and netlab-worker onto the (resolver 0.0.705, protocol 0.0.429) basis — requires explicit owner approval; do NOT deploy unilaterally. The transport defect executes on the deployed responder, so no UrlResolver CI goes green until this happens. Deploy via the container-nursery-deploy flow (rebuild jars fresh from the two PR branches first). After the redeploy, in order:

1. Re-run CI on 865, 868, 901; merge when green (Fable-mode merge authority applies; 659's merge is pre-approved per its own handoffs).
2. Enqueue 659.
3. Land the two netlab PRs (128, 63) so deployed = repo.
4. Re-dispatch the 7-suite netlab-e2e on fix/netlab-nat-regression for the formal 7/7 and complete hf-2026-07-11-w3wallet-nat-flow-regression-reds-netlab-e2e.
5. Resolve hf-2026-07-28-decide-immutable-transport-basis-for-netlab-manager-and-workers (option 2 executed) and unblock hf-2026-07-28-netlab-worker-transport-parity....
6. Carry the honest caveat from the prior body: only the attempts=0 gossip signature is fixed; issue 864's other signature (attempts=8, successes=0, failures=6) remains unexplained, so 659's unblocking is probable, not certain.

Branches: nothing exists only locally — verified

All work is on remote branches/PRs listed above. Additionally: wip/868-rebase-lanecap-flake-2026-07-30 (b4b0193dfe40, superseded by 868's head), wip/868-stabilized-2026-07-30 (c03d057ee377, identical to 868's head), fix/sjvm-collection-return-jvmresult-exception (191d7a51a2ce = PR 901). No stashes, no local-only commits (the scratchpad workspaces are disposable clones of pushed refs).

Reusable / operational knowledge (new this session; prior body's list still applies)

• Publishing foundation.url:* requires the re-stamp recipe (buildMaven does not auto-increment): build, rename jar/pom to latest+1, edit ONLY the artifact's own POM <version>, regenerate bare-hex no-newline checksums, publish via --artifact-dir with publisher 0.0.5, verify served sha1 == local and metadata flip. Collision probe: 200=taken, 404=free.
• Delegates are preemptible: three worker deaths in one day (codex content-filter false positive on bytecode-fixture generation; two backend network outages) — push/publish at every milestone; sweep dead workspaces for uncommitted work immediately (git status/log --branches --not --remotes), push to wip branches, resume successors from refs.
• Bound delegate verification budgets explicitly ("these N tests, nothing broader") or they escalate to multi-hour full suites; full local suites in this repo traverse the broken deployed netlab transport and produce misleading reds.
• kotlin.directory under fleet load answers health probes in <1s but data reads in 15s+ — use curl -m 90 + bounded retries in publish flows; slow ≠ down.
• A red UrlResolver CI decomposes in two minutes: grep the failed run log for non-testNetlab* assertion failures; the netlab family signature is "could not acquire a READY netlab environment" / uploadBlob/pollUntilReady 40-min hangs / AmbiguousRpcRequestException ... teardown origin 'reader EOF'.
• Stale kompile build caches can silently reuse pre-change bytecode after a source edit (challenge filed: PlanRepository/challenges/2026-07-30-1300-kompile-test-cache-reused-an-old-source-artifact-after.md) — verify with a fresh --cache-location when results look impossible.
• Git identity was unset on this box (git config --global user.email now set) — it silently stops delegate commits.