Unblock the ScreenshotTestWui repin with the final resolver release, then authorize both route deployments

RE-VERIFY — 2026-10-04 10:46 UTC, L5 board triage. This is a write-time snapshot. Re-check PR state/head/checks with gh pr view <full PR URL> --json state,headRefOid,mergeStateStatus,statusCheckRollup,mergedAt; verify branch SHAs using git ls-remote; verify artifacts on kotlin.directory; inspect ContainerNursery routes and containers with the CLI. No merge, enqueue, publish, deploy, restart, completion, or release occurred in this lane.

Mission and current blocker

The original mission was to land the BuildTestWui live timing card after the shared screenshot renderer could serve it. The BuildTestWui timing card and cache work have both landed. The remaining ScreenshotTest effort is the final typed-exception WUI repin and an explicitly owner-authorized deployment of both ScreenshotTest routes, followed by first-after-idle verification.

The necessary upstream release does not exist yet. https://github.com/CodexCoder21Organization/UrlResolver/pull/1116 remains OPEN at 11df5422ae456708df72a2c9645c722c0aae39eb; its required kotlin.build (remote) and bld-build checks are FAILURE, rather than still pending as the October 2 typed-exception handoff snapshot says. Its exact source coordinate is foundation.url:resolver:0.0.1303, pairing protocol 0.0.566. Both resolver 0.0.1303 POM and JAR returned 404; metadata latest/release is 0.0.1302. Protocol 0.0.566 is published (latest protocol is 0.0.603, which is not evidence it is the matched pair).

UrlResolver is explicitly excluded from this lane, and this lane cannot merge or publish. The WUI repin cannot honestly be finished with its final dependency until the upstream owner repairs the failed gates, reviews/merges the resolver change, and authorizes/publishes the release. The dependency effort is url://handoff/handoffs/hf-2026-09-23-finish-structured-remote-exception-details-across-url-sandbox-calls and https://www.handoff.wasmserver.com/handoffs/hf-2026-09-23-finish-structured-remote-exception-details-across-url-sandbox-calls.

What was verified and done

1. https://github.com/CodexCoder21Organization/UrlProtocol/pull/612 is MERGED (2026-09-30T20:10:31Z), superseding the old protocol-merge blocker.
2. https://github.com/CodexCoder21Organization/ScreenshotTestServerService/pull/15 is MERGED (2026-09-30T19:59:59Z); current main is 0e4b82086f6b683b21a3a727f802c8569568fcd4. Its build pins resolver 0.0.1262/protocol 0.0.527 and release 0.0.13. Historical required CI passed 26/26 at https://buildtest.kotlin.build/run?id=90b635ba; no new server tests were run here.
3. https://github.com/CodexCoder21Organization/ScreenshotTestWui/pull/4 remains OPEN at d1c9716a87b23a22e5a8c373f5efb8dce12d508d. Fresh clone, README read (no AGENTS.md), fetch and rebase on current origin/main: Git reported already up to date, HEAD unchanged. Working tree/stash empty. No source edits, new branches, commits, or pushes were required.
4. WUI historical kotlin.build (remote) passed 43/43 at https://buildtest.kotlin.build/run?id=5f0fb7d7, with a warning that one test passed only after retry. This is not fresh proof of a flake-free suite. The informational kompile check failed before running tests: provisioning deadline exceeded for afbef63f; droplet 603228227 did not become active within 300 seconds. No CI rerun was requested.
5. W65 includes real-provider coverage omitted from the PR head and remains the recovery base for the eventual repin. W71 is a preserved pin experiment using unpublished resolver 0.0.1264 and old protocol 0.0.533; do not adopt that stale recipe. The current final recipe derives from the eventual published resolver POM.
6. https://github.com/CodexCoder21Organization/BuildTestWui/pull/299 and https://github.com/CodexCoder21Organization/BuildTestWui/pull/336 are MERGED. No excluded repository was modified.
7. A single live GET https://screenshottest.nursery.wasmserver.com/ returned HTTP 200 in 19.46 seconds and a sessions page without a rendered error banner. This does not establish repeated cold-start reliability. No idle-gap stress probe or production render was performed.

Relevant PRs and durable refs

All code/checkpoint work already exists on the linked remote branches. This lane produced no partial code. Its findings and live evidence are recorded in the handoff service reports, so no local clone is needed to resume.

Live deployment state

ContainerNursery routes and containers both identify these paths; both containers were RUNNING when queried:

Both use keepWarmSeconds=300. The server log shows lazy-start at 10:39:17 and bound successfully at 10:39:21; the observed page's listSessions call is logged at 10:41:26. Default HardwareControlFabric certificate files are absent on this lane host, so jar-content verification was not attempted through it. No SSH was used. No code was deployed or published by this lane.

Exact next steps

1. Re-verify all state above. Upstream owner handles failed required UrlResolver gates, review/merge, then authorized publication of its final coordinate. Re-check the POM and JAR, not only metadata, and derive matching protocol/libp2p/SJVM pins from that POM. This prerequisite is outside this lane's allowed repositories.
2. In ScreenshotTestWui, recover W65's omitted coverage, fetch/rebase current main, repin build.kts/tests/README to the published final pair, run targeted real-provider and concurrency tests, complete independent test/code review, capture changed visible error states through webapp-screenshots, push/update https://github.com/CodexCoder21Organization/ScreenshotTestWui/pull/4 and obtain fresh required green CI. Do not weaken tests or accept the historical retry warning as proof.
3. Orchestrator makes the WUI merge decision. No delegate enqueues or merges.
4. On the owner's explicit deployment instruction, fresh-checkout merged WUI and server main, fetch/rebase, build with scripts/build.bash --remote screenshottest.wui.buildFatJar build-fats/screenshottest-wui.jar and scripts/build.bash --remote screenshottest.server.buildFatJar build-fats/screenshottest-server-service.jar respectively.
5. Using ContainerNursery CLI 0.0.20 and --url https://api.nursery.wasmserver.com, upload the server jar with upload-jar --file <server-jar> --route url:screenshottest: and WUI jar with upload-jar --file <wui-jar> --route https:screenshottest.nursery.wasmserver.com:443. Each upload restarts that route; no extra restart is needed. Preserve current route settings and persisted /root/screenshottest-data. Record exact source SHAs and deployed hashes.
6. Verify both service health and WUI content. Then verify the first request after an idle gap longer than keepWarmSeconds 300 returns 200 and no error banner, several times. This is owner deployment verification; it was not performed here.

Historical mechanism and scope decisions

The previous lane reported a deterministic harness showing resolver 0.0.600 rethrows the first bytecode provider's early stream close rather than trying the next provider: 0.0.600 0/10 passes versus 0.0.1171, 0.0.1261, 0.0.1262 and 0.0.1301 each 10/10. Harness/evidence: https://github.com/CodexCoder21Organization/UrlResolver/tree/wip/K29-coldstart-verdict/investigations/coldstart-first-bytecode-stream (previous recorded commit prefix 04b53358). This is historical evidence, not a test reproduced by L5. Existing WUI main already pins 0.0.1171; the old server route has not been updated to the merged 0.0.1262 repin according to its named image.

The original body explicitly marked uploadFileChunk ambiguous-outcome/idempotency work as non-blocking follow-up and keep-warm policy as optional. Neither is required to manufacture a solution for the missing upstream release, and neither was changed here. All BuildTest/kompile/UrlResolver/UrlProtocol modifications were excluded; no downstream workaround was added for an upstream defect.

Tool finding / workaround

ContainerNursery CLI 0.0.20 container --route-key https:screenshottest.nursery.wasmserver.com:443 --json returned Error: Endpoint not found: GET /containers/https%3Ascreenshottest.nursery.wasmserver.com%3A443 with process exit 0. Use containers --json and filter ScreenshotTest rows for this read-only inspection. A maintainer should check route-key encoding/endpoint compatibility and return nonzero on CLI errors. The report-challenge CLI auto-enqueues/merges a PlanRepository PR, so it was not invoked under this lane's hard no-merge/no-enqueue rule; this report preserves the finding instead.