Handoff: Finish broad verification of ContainerNursery retention review fixes

Written 2026-10-19 13:32 UTC.

RE-VERIFY: this is a write-time snapshot. Check https://github.com/CodexCoder21Organization/ContainerNursery/pull/663 with gh pr view (state, headRefOid, mergeStateStatus, statusCheckRollup, mergedAt), and check the run URLs below before acting. Do not infer a present result from this document.

Design decisions in force

The owner requested recent JAR contents available for rollback and comprehensive test coverage. The lane brief says: "Forbidden: merging, enqueueing, publishing, deploying. The supervisor (not you) decides merges." It also says: "Never raise a timeout, test budget or iteration count, never add retries or sleeps, never weaken an assertion, no reflection, nothing made public for tests." Existing response fields and behavior must be preserved (contract I8). Hashing stays outside the global publication lock. These requirements remain in force; no merge or deployment is authorized here.

Mission and what remains

Resolve the five second-round review findings on the JAR retention PR, preserve ten recent distinct contents per JAR path beyond the24-hour floor, and verify the result. All five code/test fixes and documentation are pushed. What remains is the broad official local/remote suite verdict and required CI verdict. The original lane had a90-minute wall-clock limit; the local full run is bounded to stop before that limit and the standalone remote wait was bounded to25 minutes.

What was found and done

1. A retained pathname can be replaced and then rolled back to its original inode during an unlocked hash. Identity sampling alone accepted a SHA-256 for the intervening content and pruned a different distinct version. A deterministic forwarding-filesystem test uses only managed install/rollback for the interleaving. Managed mutations now advance a global generation; digest publication and final decisions reject work spanning that generation. An extra proven case showed the distinct-content ranking also needs a generation: an earlier ranked file can change while a middle candidate is read. The sweep now ends a stale ranking pass and recomputes later, while accounting for its own successful deletions. Final-generation-only mutation fails at the wrong persisted digest assertion with the ranking guard preserved.
2. Sidecar sink/write/flush/close used to own the global lock. An unrelated public rollback was blocked while a real filesystem sink was gated. Staging and temporary cleanup now run outside the lock; validation and atomic move remain inside. The regression passes and moving only the write back under the lock restores its failure.
3. Sweeps ignored missing-byte .sha256 files and abandoned temporaries, and both admin DELETE handlers removed only bytes. The sweep now removes derived orphans and unowned temporaries at least one hour old. It preserves owned temporaries by canonical path, including a sweep through a directory alias. Both real HTTP and HTTPS DELETE tests verify paired deletion and unchanged response fields/full404 message. Missing-byte/stale/young/unrelated-name recovery cases are tested. Removing recovery restores the failure.
4. The public ContainerProvider callback received the selected live JSONObject. A provider retaining and editing it changed the live route image and defeated deletion protection. Both creation and startup provider callbacks now receive deep copies. The public HTTP/provider test covers retained and nested edits and protects its retained JAR. Restoring only original ContainerNursery classes restores the failure.
5. The existing restart test's runtime javac scanned the full227-entry runtime classpath before compiling a tiny child. The exact standalone compiler exceeded its unchanged20-second limit with empty output; thread stacks show processor/plugin loader initialization and JAR manifest/classpath reads. The named old test also exceeded its unchanged30-second whole-test guard. The fixture now emits three equivalent child classes with existing ASM. Actual byte counting is preserved: a missing-sidecar fresh JVM reads4 bytes and repairs it; another fresh JVM reads0. The full updated HTTP/restart test passes under its original guard; restoring old javac setup restores whole-test failure.

README and docs/ManagementAPI describe generation discard/recompute, paired deletion, one-hour orphan/temp recovery, active writer protection and provider configuration ownership. Public response fields and artifact version are preserved. No tests were disabled, no limits/iterations were increased, and no retries or sleeps were added.

Verification

• Final new/updated local static-adapter batch:9/9 PASSED, first attempts, existing30-second guards and128MiB heap. Includes both DELETE paths and full updated restart test (10.59s).
• Retention/upload/rollback neighbors:65/65 PASSED, first attempts, original script/legacy test guards,128MiB heap. Includes the160MiB retained-JAR streaming case.
• Every changed production file and test source was checked against the selected compile copy:14/14 exact matches after removing only script WithArtifact metadata. The main product and changed-file overlays compiled successfully.
• Fail-first and mutation evidence is preserved on the artifact branch. Reproductions are the committed tests, through public APIs and real dependencies.
• Independent parent test-comprehensiveness and code-review passes are recorded in findings. Both delegates finished and stopped their own processes.
• Official full local command: JAVA_TOOL_OPTIONS='-Xmx512m -XX:ActiveProcessorCount=2' flock /tmp/cn-fullsuite.lock scripts/test.bash --local --test . --log <outside-repo report> began13:05 UTC from final head. At this snapshot it is active, has completed buildscript compilation, and has no test/result verdict. Its outer35-minute cap ends about13:40 UTC. See final findings for the eventual exit.
• One official full standalone remote command began13:05 UTC from the same head. It connected and reported PROVISIONING then PENDING, but no verdict or run URL before its25-minute cap (exit124). No manual rerun. Client shutdown logs/stacks are preserved. A run list contains candidate https://buildtest.kotlin.build/run?id=c3e18053 (ContainerNursery,692 tests, created13:06:41), matching the timing/count, but attribution is an INFERENCE because the client did not print its ID and test-index lookup returned503. Do not silently treat that candidate as proven.
• Authoritative final-commit CI remote run: https://buildtest.kotlin.build/run?id=dbf3ca61 . It progressed from queued to BUILDING; required bld-build is still pending at this snapshot. Watch-build reports zero completions before TESTING as normal and has not requeued/deleted anything. Re-verify current result.

Relevant PRs and branches

The source was rebased onto b8303c48 (an unrelated stdout fixture change), and both final code and evidence pushes were verified with git ls-remote. Worktree/stash/local-only commit/worktree sweeps were clean at13:31. No code was merged, enqueued, published as a Maven artifact or deployed by this effort. No running production version changed. The artifact branch deliberately excludes jars/classes, dependency caches, credentials, certificates/private keys and machine-specific compiler adapters; the authoritative reproduction source is committed on the code branch.

Next steps

1. Re-verify PR head/state and the CI run; read final findings and official full-run logs from the artifact branch (they may have been refreshed after this snapshot).
2. Establish the broad verdict without guessing from zero tests or stale run-list projections. Continue the existing CI run where possible. If the full local/standalone attempt ended without a verdict, the supervisor decides the next verification budget; do not blindly requeue a failed test. Diagnose actual failures locally and keep all existing limits intact.
3. Once broad checks have a verdict, update the PR's Second review fixes validation paragraph. Preserve its opening why paragraph.
4. Leave merge decisions to the supervisor. No publication or deployment is requested.

Operational notes

The installed gh pr edit command fails at repository.pullRequest.projectCards due to Projects(classic) deprecation. Use gh api --method PATCH repos/CodexCoder21Organization/ContainerNursery/pulls/663 --input <JSON body file> for the description. One HTTP/2 git push failed before landing; a transport-only git -c http.version=HTTP/1.1 push --force-with-lease ... succeeded and was verified. Existing jvm-libp2p snapshot20/27 pin diagnostics appeared during standard runner preparation; they are diagnostics, not an observed terminal verdict. Handoff CLI health hit its60-second outer cap with no result, so central handoff creation may be unavailable; this body and evidence are also saved on the artifact branch.