Handoff: finish UrlResolver draft relay recovery tests and its bld-build check

Written 2026-10-19. RE-VERIFY: This is a write-time snapshot. Query the live PR metadata/checks and branch refs before acting: gh pr view https://github.com/CodexCoder21Organization/UrlResolver/pull/1314 --json state,isDraft,headRefOid,mergeStateStatus,statusCheckRollup,mergedAt, plus git ls-remote for the checkpoint branches. Read the current PR description; it was updated through REST in this session. A fresh result takes precedence over this document.

Design decisions in force

The owner supplied these task requirements on 2026-10-19:

1. Get bld-build passing. Find the actual failure (logs, runner XML), and decide whether the PR caused it or it is already on main, using matched first-attempt counts on both heads. If the PR caused it, fix it at its cause.
2. Check the PR's tests are genuine: each new test must fail on main or with the fix reverted. If any doesn't, say so and strengthen it.
3. Check whether this draft overlaps or conflicts with the open PRs https://github.com/CodexCoder21Organization/UrlResolver/pull/1314, /1315, /1316, /1317, /1318 and https://github.com/CodexCoder21Organization/UrlProtocol/pull/723, /724. Overlap means the same file or the same behavior. Report it, and say whether this one is superseded.
4. Leave it as a draft. Update the description so it states the current verified state.

Read ~/.claude/CLAUDE.md, https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/playbooks/DELEGATION_BRIEFS.md and https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md first. Read the repository README and AGENTS.md. Clone fresh. Use ~/bin/cs, never /usr/local/bin/coursier. Run targeted tests (scripts/test.bash --remote --test <name>); for a push touching a shared contract also run the full suite once from the head you push. Record first-attempt counts from the runner XML. Never raise timeouts, reduce iteration counts, weaken or delete assertions, or disable tests. A failing existing test is a finding: compare it against main with matched first-attempt counts before deciding who caused it. Before pushing: git fetch origin && git rebase origin/main, confirm the PR is OPEN, push with --force-with-lease. End each commit with Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>. Edit PR descriptions only via REST (gh api -X PATCH repos/<owner>/<repo>/pulls/<n> -F body=@file), keeping the opening why-paragraph. Note: kotlin.build (remote) currently fails org-wide with "Provisioning deadline exceeded" on full UrlResolver suites until a BuildTestEmbedded fix is deployed; kotlin.build (kompile-remote-build) is informational. Do not try to fix those here, but do report each one red with its actual failure text, and say whether it is that known provisioning failure or something else. Do NOT mark ready, merge, enqueue, publish or deploy. Do not re-run CI blindly. Every background wait has a hard deadline and is killed before you finish; wait on a PID, never pgrep -f. Write progress to out/r59-findings.md as OBSERVED <UTC> — … lines. About 90 minutes. Remove your clone when done.

The global test rule read from ~/.claude/CLAUDE.md:407 says: “If you believe a test is genuinely wrong (asserting incorrect behavior, covering removed functionality, etc.), STOP, explain why to the user, and get explicit approval before changing or removing it.” Two such corrections were explained and asked asynchronously in this session; there has been no answer. They remain unchanged.

Mission and current boundary

The original draft comes from the 2026-10-18 TinySite outage investigation. Its opening why-paragraph records 502 “unknown stream ID” from08:44 until an idle restart at09:31 and the broader requested diagnosis/fix/merge/deploy effort. This brief permits only draft repair and verification; the broader historical merge/deploy request does not authorize those actions here.

The concrete test regressions are diagnosed, with matched runner XML. Some test repairs and stronger guards are preserved on isolated remote branches. The target PR remains at1168eddb5806770178cf95307b80918730fddc92 and is not green. No production deployment, restart, artifact publication, merge or queue entry was made in this session. The work is blocked on the two test-contract decisions described below; complete all remaining verification before applying/pushing a final PR head.

What was found and done

1. The original Actions bld-build job compiled successfully, then returned2089/2092 canonical passes and3 failures. Full job: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39136628397/job/117702340315. It uploaded no artifacts, so original runnerXML was not available. Its log includes a retry warning; canonical2089 is not a first-attempt count. gh run view --log and --log-failed returned empty; REST actions/jobs/117702340315/logs retrieved the full log.
2. Matched fresh-head targeted runs used the same3 failing cases on PR1168 and main046396a677e14cf950dc7c3d102cbc2c187b75a1. Original local XML proves PR0/3 first-attempt passes, main3/3. Each PR case also failed automatic attempts2 and3: PRraw0/9, mainraw3/3. Remote targeted runs independently returned canonical0/3 versus3/3. Thus these are branch-induced test setup/contract regressions, not failures already present on main in this comparison.
3. testPersistentConnectionRecoversFromInFlightStreamClose assumed a4-second handler sleep under a2-second idle limit would close an in-flight stream. Protocol1424 incorporates pending-handler idle protection, so that handler now succeeds. Checkpoint8d07ada8 changes the fixture to wait for actual handler entry and explicitly disconnect its public accepted serving connection. It retains the full ambiguous/EOF error, exactly-one execution for the lost call, and independent recovery reaching exactly two total executions. Fixed remote case passed.
4. testPersistentConnectionReconnectFailsWhenNoAlternativePeers supplies a circuit-only record after direct loss but asserts a direct-only reconnect error. RelayConfig(enableRelay=false) means the client does not act as a relay; it does not opt out of outbound recovery. Generic openPersistentRpcConnection intentionally permits original-provider relay recovery. Actual error is the supplied relay route's complete RELAY_FORWARD_RETRYABLE/no-target error. The current assertion contradicts the draft's documented public contract.
5. testServerCloseCompletionIsNotCallerBarrier holds a real reader, performs a zero-byte preflight, closes the stream, then gets StreamClosedBeforeWriteException for the complete frame. It nevertheless expects ambiguity and zero reconnects. The draft correctly treats that local typed guarantee as safe to reconnect/replay. Preserve its independent close-future/held-reader assertions, and correct only the request outcome/reconnect contract after approval.
6. Original20 new tests: fixed local first20/20, raw20/20. Replacing only UrlResolver.kt with main's implementation, retaining tests, new type shim and published1424 pins: first7/20 passes and13 first failures, canonical7/20, raw7/46. All13 failing tests failed all3 attempts. Fixed and reverted remote canonical results match. These complete logs/XML are on the evidence branch.
7. Seven main-compatible tests were checked against the runtime blob from the draft's first implementation8c3273f1622cb634b4dbfcc74737fef582d8c2d5. Remote run https://buildtest.kotlin.build/run?id=f2c8e18c returned2/7 canonical passes and5 failures. Concrete failures: direct provider RELAY_ERROR lost server-error meaning; typed relay provider RELAY_ERROR lost application-error meaning; the original provider-error guard observed two during deliveries; provider FORWARD_FAILED code was misclassified; raw opt-out reached relay. These prove five review-fix regressions. Remote synthetic attempt-number1 rows do not establish raw first counts.
8. Two original guards passed both main and8c: legacy provider exception and unchanged-address recovery. They were support coverage rather than discriminating reproducers. The unchanged-address test is strengthened to prove direct delivery before cutting its owned gate, then original-provider relay fallback and same-address restoration. Fixed remote passed1/1; its remote negative control failed before test entry with a30-second dial/negotiation error, so that outcome is not mutation evidence. Both guards are now strengthened on the combined checkpoint. They await public connection.awaitCurrentTransportClosed after cutting their owned direct gate, making the intended post-retirement path deterministic. The legacy guard preserves the full error/open-controller contract and checks a second independent failure and subsequent health request on the recovered relay with exact delivery counts. Final fixed selection: first21/21, raw21/21, zero retries. Final main-runtime control of these two strengthened guards: first0/2, raw0/6, all failures at intended post-cut operations. Logs and original XML are in the evidence branch.
9. The provider-error guard originally allowed zero relay invocations and made its full-error assertions conditional. Checkpoint8d07ada8 requires exactly [during], with unconditional isServerError/full text. Fixed remote passed; main-runtime negative https://buildtest.kotlin.build/run?id=69a4c0a3 failed at the exact-one assertion: expected[during], actual[], after3.3seconds. It does not prove the later assertions were reached in the negative run. A further independent review found collected methods were never asserted; the combined checkpoint adds the exact two expected service/echo method names.
10. Original runtime/code review found a known upstream boundary: published Protocol1424 does not type one real closed-child/lagging-close-notification pre-write case. Resolver correctly returns ambiguity without typed local evidence. The separate candidate https://github.com/CodexCoder21Organization/UrlProtocol/commit/c6795bfefe5c3bf50f6f5c6eff59db0829a4e062 is outside the published pin and outside this brief's publication authorization. Do not replace conservative classification with text guessing. Historical raw opt-out failures exposed this boundary; one current20/20 first-pass selection does not prove that historical intermittent upstream case resolved.

CI and overlap snapshot

Live checks re-verified at 04:16 UTC, still on the original1168 head:

• bld-build is RED from the actual three test failures above.
• kotlin.build (remote) run1b467cae is RED: “has made no provisioning progress for5minutes” and “Droplet creation or boot appears to have stalled and the build has been marked as FAILED.” It stopped before test entry.
• Informational kotlin.build (kompile-remote-build) run591d13a6 is RED: no provisioning progress for6minutes against a five-minute maximum, then the same stalled-provisioning failure. These match the known provisioning class, not the literal deadline wording from the brief. Neither is a result of test assertions.

Overlap audit: Resolver1315 shares UrlResolver.kt/README but handles caller ownership of returned relay streams. Resolver1316 shares source/build/docs and4 tests but handles announce-address ownership; this draft changes only protocol pins in those4 shared tests. Resolver1317 shares README only and handles sandbox map conversion. Resolver1318 shares source/docs but handles stale-peer pruning. Protocol723 supplies the typed no-admission prerequisite; Protocol724 batches peer ranking. None supersedes this draft. git merge-tree --write-tree against the4 other Resolver heads returned no textual conflicts; this is not a combined behavior test. Resolver1317 advanced to cb112c5e515cc59761b33af933d6af555b321f02 in a source-only sandbox error-detail commit outside this draft's shared path. Repeated merge-tree returned no textual conflict. Protocol723 advanced to bccb7e231f70af6cca1198be509219760c1adad2 in two commits changing README and8 tests; no production source changed from published1424 implementation0e0895d. Its updated description still places the separate closed-child candidate outside this head/released implementation. Protocol724 advanced to cb02d38d095a075e741996a528e00635bbc7fa77 in a README-only commit. Reviewed all three comparisons; conclusions unchanged.

PR links: https://github.com/CodexCoder21Organization/UrlResolver/pull/1314 ; https://github.com/CodexCoder21Organization/UrlResolver/pull/1315 ; https://github.com/CodexCoder21Organization/UrlResolver/pull/1316 ; https://github.com/CodexCoder21Organization/UrlResolver/pull/1317 ; https://github.com/CodexCoder21Organization/UrlResolver/pull/1318 ; https://github.com/CodexCoder21Organization/UrlProtocol/pull/723 ; https://github.com/CodexCoder21Organization/UrlProtocol/pull/724 . Exact refreshed heads are in the evidence branch.

Relevant branches and unmerged state

Remote refs verified with git ls-remote at04:22 UTC. All6 checkouts swept: clean working trees, no stashes, no local-only branch commits, no extra worktrees.

Runner XML/logs are intentional forensic artifacts. No JARs, build outputs, dependency caches, credentials or broad environment/process dumps are committed. Remote projected pages are omitted where the selected rows and original XML already preserve the evidence. No deployed or published code was created: the action record contains only reads, isolated test runs, branch pushes and REST description edits; no production mutation command was run. Existing Protocol1424 was a prerequisite, not published here.

Next steps

1. Re-verify the PR, branches, main, checks and current description. Read the linked required docs and repository README/AGENTS in a fresh workspace clone. The description preserves the original why paragraph.
2. Resolve the pending owner decision: approve corrections to the direct-only assumption in the circuit-route test and to the zero-reconnect/ambiguous expectation after typed whole-frame no-admission in the close-barrier test. The recommendation is to correct these contracts while retaining exact errors, dispatch counts and close-future assertions. Do not change them without that approval under the rule quoted above.
3. Inspect the saved test checkpoints and their exact final controls. Apply them to the PR branch; do not assume a checkpoint is already on the PR. Finish any explicitly unverified item noted in the final execution section.
4. After approval, correct the two existing contracts, run their same targeted cases and the new-test register, review the final tests/code independently, and run the full suite from the exact head before a push touching the shared contract. No full-suite pass for a repaired final PR head is established here.
5. Fetch/rebase, confirm PR OPEN, and push with lease. Watch the new bld-build to terminal with bounded build-watchman; report the two remote checks separately with actual messages. Do not blindly rerun a red check, mark ready, merge, enqueue, publish or deploy.

Reusable operational knowledge

Local XML is compact: manager0.0.207's WorkspaceKt$prepareTests$4$executeAction$1 records every attempt but builds history entries only for lists longer than1. Thus original successful local test rows without history are single first passes. Remote summaries/projections strip histories and synthesize legacy attempt rows; do not carry that interpretation across.

Remote failed scripts often do not emit the requested --log file. The result API pages with1-based page, max limit=500; offset is rejected. A full2092-row result needs5pages. The read-only run/droplet HTML can contain the assertion/stack when API rows expose blank errors. Extract only the selected plain-text failure for preservation. Use bounded read retries for503, never a test/CI resubmission as a substitute.

The test script can leave dependency-version advisories before any execution; warnings alone do not indicate a test failure. An initial original-PR preparation exited137 before any test entered; it is excluded from all test counts. Subsequent serialized local runs used a512MiB default JVM cap and the shared local-build flock. This is not an explanation of the137 and not grounds to change test limits.

The central handoff service health returnedOK using ~/bin/cs and handoff:cli:0.0.8. The linked handoff README still contains a legacy merge-queue exception; the current skill explicitly retires it. This brief's no-merge/no-enqueue rule wins. report-challenge-cli also automatically enqueues/merges, so it was not invoked under these constraints; the documentation/tool mismatch is recorded here instead.

Final execution evidence and decisions

The exact combined checkpoint accbd77853bdd09be17d6d3f7ac1b86164f44dd2 passed all20 new tests plus the repaired existing in-flight case on first attempts,21/21 raw, zero retries. Final two guard controls with only main runtime substituted failed both first attempts and all automatic retries,0/2 first and0/6 raw. See evidence directory, especially r59-final21.xml, r59-final-negative2.xml, NEW_TEST_CONTROLS.md, RUNNER_XML_FORMAT.md, r59-final-test-review.md and r59-findings.md. Each of20 scenarios has a discriminating main or review-fix-revert control. The test checkpoint was independently reviewed; original runtime is unchanged by this continuation. Full suite on the eventual repaired PR head and final CI remain unperformed. Do not report green.

PR description was updated through REST at04:17:35 UTC, preserving the opening why and OPEN/draft state. Final head remains1168. All3 check contexts remain red with actual messages recorded above. No blind CI rerun was requested.

The owner decision is tracked separately: url://handoff/handoffs/hf-2026-10-19-approve-correcting-two-existing-urlresolver-relay-test-contracts . This handoff depends on that decision. No answer has arrived. Applying saved tests alone would knowingly leave two diagnosed existing contract failures, so no partial update was pushed to the target PR. After approval, correct the two contracts without loosening error/delivery/close assertions, verify them and the selected register, then full-suite/review/CI as specified.

Docs actually read: ~/.claude/CLAUDE.md; repository README (no AGENTS.md existed); full DELEGATION_BRIEFS.md, architecture/TESTING.md, PHILOSOPHY.md, CODE_REVIEW.md from DocumentationRepository; original and refreshed descriptions of all seven linked PRs; create-handoff skill and full linked PlanRepository handoff format. Relevant contradictions are recorded above. No factual premise was silently deferred: classification, novelty controls and overlap are complete; bld-build green is blocked on the explicit decision plus remaining integration/full-suite/CI.

Reproduce selected fixed tests from the combined branch using ~/bin/cs via scripts/test.bash --remote --test <name>, beginning with the two strengthened route guards and repaired in-flight case. Original20 names and historical controls are in NEW_TEST_CONTROLS.md. For authoritative local first attempts, the bounded scripts r59-run-final-targets.py and r59-run-final-controls.py record original XML and restore runtime in finally; inspect their source paths and adjust only workspace paths when cloning fresh. Both use512MiB default JVM cap, serialize the local build and retain original test limits. No timeout/iteration/assertion weakening is authorized.

Cleanup verified 2026-10-19 04:23:09 UTC: all6 fresh clones removed after clean/stash/local-commit/worktree sweep and remote verification; all per-clone build caches removed. No tracked test wait remains alive. The local out directory retains convenient copies, but all required evidence is on the remote evidence branch and this central handoff.

Handoff status-write transport finding

At04:23 UTC the separate decision handoff report command returned exit1 while setting its blocked reason. Its error says the request may already have run: AmbiguousRpcRequestException for setBlockedReason, transport closed with pending requests, EOF reading0of4 message bytes. Full returned error follows; no stack trace beyond this text was provided. A read-only get was issued before any retry. The main handoff BLOCKED report succeeded. This service issue does not change the code/test evidence or grant approval. No publication/deployment or production workaround is authorized.

Blocked reason for handoff 'hf-2026-10-19-approve-correcting-two-existing-urlresolver-relay-test-contracts' may have been stored, but could not be confirmed: Sandboxed code threw an exception: java.lang.InternalError: Exception encountered in implementation of foundation/url/sjvm/intrinsics/ServiceBridge:rpc(Ljava/lang/String;Ljava/util/Map;)Ljava/util/Map; :
foundation.url.resolver.PersistentRpcConnection$AmbiguousRpcRequestException: RPC request 'setBlockedReason' to service 'handoff' has an ambiguous outcome because its transport failed after the request write began. The request was not replayed because the remote handler may already have run. Original transport failure: Persistent RPC connection to service 'handoff' was closed while requests were still pending. Reader transport failure: java.io.EOFException: Stream closed while reading message data (read 0 of 4 bytes). cause: foundation.url.resolver.UrlResolutionException: Persistent RPC connection to service 'handoff' was closed while requests were still pending. Reader transport failure: java.io.EOFException: Stream closed while reading message data (read 0 of 4 bytes). Check the handoff before retrying.

Read-only decision get at04:24 UTC confirmed blockedReason=null and statusORANGE, so the failed reason write did not take effect. The main report is durable and BLOCKED. A subsequent main releaseClaim command also returned ambiguous EOF0of4; read-only claims verification follows before deciding whether a release retry is needed. Exact release error:

Sandboxed code threw an exception: java.lang.InternalError: Exception encountered in implementation of foundation/url/sjvm/intrinsics/ServiceBridge:rpc(Ljava/lang/String;Ljava/util/Map;)Ljava/util/Map; :
foundation.url.resolver.PersistentRpcConnection$AmbiguousRpcRequestException: RPC request 'releaseClaim' to service 'handoff' has an ambiguous outcome because its transport failed after the request write began. The request was not replayed because the remote handler may already have run. Original transport failure: Persistent RPC connection to service 'handoff' was closed while requests were still pending. Reader transport failure: java.io.EOFException: Stream closed while reading message data (read 0 of 4 bytes). cause: foundation.url.resolver.UrlResolutionException: Persistent RPC connection to service 'handoff' was closed while requests were still pending. Reader transport failure: java.io.EOFException: Stream closed while reading message data (read 0 of 4 bytes).