Handoff: Settle remaining caller-getter fixture expectations and finish UrlProtocol candidate verification

Written 2026-10-20 19:34 UTC. RE-VERIFY: this is a write-time snapshot. Check gh pr view 738 --repo CodexCoder21Organization/UrlProtocol --json state,headRefOid,mergeStateStatus and git ls-remote origin refs/heads/wip/F738c-work refs/heads/wip/F738c-evidence refs/heads/fix/atomic-confirmation-removal-c2. No current CI success is claimed; this lane forbids CI watching.

Design decisions in force

2026-10-20 supervisor decision, verbatim (supersedes F738b's unresolved single-removal-fixture decision):

the design intent of this PR is that removal never invokes caller-supplied code under or around registry guards, so the old premise "a caller getter failure during removal's publication propagates" is no longer a contract. Rewrite that one test as two scenarios, keeping its assertion strength: (a) testPeerRegistryRemovalDoesNotInvokeCallerGettersAfterAcceptance — the same throwing getter, the same setup; assert removal succeeds, the getter was never called during removal (count its invocations), membership is gone, the handoff/listener completion still happens exactly once; (b) keep the original invariant "a failure during removal's publication still completes the handoff" alive by injecting the failure through a path removal still exercises — a removal listener/callback that throws, or a persistence write that fails (use whichever exists in the public API; do not add a hook for the test) — and assert the handoff completes exactly once and the failure is surfaced (thrown or reported through the documented effect), exactly as the original test asserted for its failure. If no such public failure path exists during removal, say so with evidence and keep only (a), stating in the description that the premise is unreachable by design. No other existing assertion changes; if one would, stop and name it.

2026-10-20 user: "No other existing assertion changes; if one would, stop and name it." Also: "No merge, enqueue, CI watching, publication." Native build/tests use --local; no timeout/iteration reduction, disabled tests, mocks, reflection, new test-only hooks or exposed private API.

Mission summary

Finish https://github.com/CodexCoder21Organization/UrlProtocol/pull/738 from F738b's 5bada11ba head. This is registry-owned, evidence-conditional peer removal in the ContainerNursery registry-stall correction and a prerequisite of https://github.com/CodexCoder21Organization/UrlProtocol/pull/740. F738c was asked to apply the approved two-scenario decision, verify it five times plus product-only reversal, run the 86-file manifest plus all added proofs and the four guard-neighbor families, adopt the hash-sibling Clock proof, record/abort a merge with https://github.com/CodexCoder21Organization/UrlProtocol/pull/739, then update the PR branch/body only when green.

Current F738c result and binding stop

1. Approved rewrite DONE. testPeerRegistryRemovalDoesNotInvokeCallerGettersAfterAcceptance keeps the same throwing getter/setup and proves successful removal, zero getter invocations, absent membership, exact callback completion, old snapshot stability and re-add. Existing testPeerRegistryRemovalPublicationFailureCompletesHandoff injects a failure through public onRemoval; exact wrapper text/original cause, continued callbacks, terminal lifetime and re-add are checked. Each passes native attempt 1 five times. Independent review found no substantive gap or weakened assertion.
2. Product-only reversal restores only RegistryAddressSnapshotPeer's delegated ID getter. Scenario (a) fails attempts 1/2/3 with the exact injected getter failure; exact source bytes restored. F738c commits no product changes.
3. Hash-sibling caller Clock proof adopted byte-for-byte from wip/r725adv-proofs-20261020 and PASS1 (1940 ms). Review selection = original 86 + both approved scenarios + five F738b proofs + hash-sibling proof = 94 distinct files: 93 PASS1, relay startup FAIL1/2/3. All five F738b proofs pass on this head.
4. Relay fixture uses a now-owned peer ID getter to block initial announcement, so entry latch is never decremented. A setup-only registry Clock experiment was refuted: PeerScorer never reads its compatibility Clock. That experiment is saved and fully restored; this fixture remains unchanged. No weaker assertion or longer timeout was tried.
5. Required guard neighbors = 26: 18 PASS1, 8 FAIL1/2/3. Seven expected-exception assertions depend on custom ID getter reads during publication that accepted-ID ownership intentionally prevents; another fixture uses that removed read to stage a later quarantine. Exact unchanged assertions appear in the findings table and full native XML/stacks in the evidence branch. Classification: candidate-induced fixture premise conflicts; no pre-existing-on-main claim. Required decision is now broader than the approved single-removal rewrite.
6. Binding stop reached. No further tests/product edits/merge reconnaissance/target push/body PATCH performed. Live target PR is OPEN, merge state BLOCKED, head b1d69eacf2e1a2ff1b53a41fc0531b44af22f220, branch/body unchanged. No source beyond the approved two-file rewrite and adopted proof changed. Source tree clean, no stashes/local-only commits/extra worktrees. Every F738c native process exited. No merge, enqueue, ready toggle, CI watch/rerun, buildtest mutation, publication, deployment or restart occurred.

Failing unchanged neighbor assertions:

• testPeerRegistryPublicationFailureAggregatesReturnedCleanupFailure.kts:68: assertFails around addPeer.
• testPeerRegistryPublicationFailureInstallsConsistentMembership.kts:35: assertSame(failure, assertFails { ... }).
• testPeerRegistryPublicationFailureKeepsFirstCauseDuringFatalCleanup.kts:67: assertFails around addPeer.
• testPeerRegistryPublicationFailurePreservesCleanupWhenSuppressionDisabled.kts:71: assertFails around addPeer.
• testPeerRegistryPublicationFailureRepeatedTransitions.kts:40: assertSame(failure, assertFails { ... }).
• testPeerRegistryPublicationFailureSameIdReaddSnapshotConsistency.kts:35: assertSame(failure, assertFails { ... }).
• testPeerRegistryRefreshPublicationFailureReconcilesSnapshot.kts:31: assertSame(failure, assertFails { ... }).
• testPeerRegistryJoinedDialSuccessCannotClearNewerQuarantine.kts:118: expected getter-created outcome count 1, actual 0.

The seven error texts are java.lang.AssertionError: Expected an exception to be thrown, but was completed successfully. The relay error is java.lang.AssertionError: Real relay startup must reach its initial announcement. None are counted green via retries.

Relevant PRs / refs, verified 19:32 UTC

Nothing was deployed or published by this lane; command/activity audit contains only repository/test/evidence/handoff operations. Jars, dependency caches and other build outputs are deliberately omitted from evidence. Historical branches remain linked in the retained older snapshot below.

Next steps

1. Re-verify current state first. Supervisor must decide whether to authorize equivalent no-reread/public-failure-path rewrites for the seven remaining exception fixtures while preserving cleanup, cause/suppression ordering, membership/snapshot and re-add invariants. Do not restore caller getter reads just to make those fixtures throw.
2. Design genuine public triggers for the quarantine ordering and real relay startup/close ordering; preserve every assertion and timeout. Clock-based ranking is already refuted; do not repeat it. Any source correction needs a failing public proof first.
3. Resume native prescribed verification after the fixture decision; counts above are partial results, not a green selection. XML attempt-history means it is not PASS1. Keep failed native reports and update manifests when scenarios split.
4. Only when required green conditions hold, attempt/abort the sibling merge and record conflicts, verify target PR OPEN, force-with-lease push candidate to fix/atomic-confirmation-removal-c2, REST PATCH only the incomplete status paragraph and retain all other sections. Include supervisor decision verbatim in its existing-test-edits table, the three F738b generated-name predicate corrections and this rewrite, five proof/four guard correction summaries and exact counts. No CI watching, merge, publication or deployment under this lane.

Reusable knowledge

scripts/test.bash --local --test <name> --log <xml> runs native tests; its default retries can yield attempt histories, so count only un-retried records. Timeout long commands and track PIDs/cells; no loops were left. F738c records include both selector manifests (94 and 26) and the runner scripts; consoles are gzip-compressed. Public callback failure is wrapped in IllegalStateException with exact lifetime generation text and the original failure as cause, while handoff cleanup still runs.

Historical F738/F738b snapshot (superseded by current F738c result above)

Handoff: Settle the retained-ID publication fixture expectation and finish UrlProtocol candidate verification

Written 2026-10-20 18:54 UTC. RE-VERIFY: all state below is a write-time snapshot. Check gh pr view 738 --repo CodexCoder21Organization/UrlProtocol --json state,headRefOid and git ls-remote for the branches below. No CI state is claimed; the lane explicitly forbids CI watching.

Design decisions in force

2026-10-20, F738b user: “Supervisor decision: this correction is approved” for the two capacity fixtures' JVM name predicates: accept beginRemoval or a name starting beginRemoval$; “every other assertion, timeout and iteration in those tests stays byte-identical.” This supersedes the prior handoff's blocked reason about that exact correction.

2026-10-20, F738b user: “If any other existing assertion would need to change, stop and name it.”

2026-10-20, F738b user: “No merge, enqueue, CI watching, publication.” The lane may not mark ready, close PRs, deploy, restart services, rerun CI, delete/rerequest buildtest runs or publish artifacts. Builds and tests must use --local; no timeout increases, iteration reductions, disabled/skipped/deleted tests, weaker assertions, mocks, reflection or new public test-only API are allowed. Native runner retries do not count as first-attempt success.

The retained design claims global order lifetime → dial outcome → publication → capacity → stripe → peer-map bucket → observation record → observation score, and public conditional removal only for the same lifetime, revision and successful evidence. The final-head public proof requirement includes no caller route/JSON/Clock/getter code under registry guards, failed serialization with no partial admission, stale capture versus in-flight admission, and both success/removal bucket orderings.

Mission summary

The user asked F738b to finish verifying the C5 candidate for https://github.com/CodexCoder21Organization/UrlProtocol/pull/738, apply only the approved JVM-name correction, run both fixtures five times each and the 86-case review selection once, complete public invariant proofs, attempt/abort a merge against https://github.com/CodexCoder21Organization/UrlProtocol/pull/739 and record conflicts, then force-with-lease update the actual PR branch and replace its current-status paragraph by REST PATCH only if green. This is a prerequisite of https://github.com/CodexCoder21Organization/UrlProtocol/pull/740 and part of the ContainerNursery registry-stall correction described at https://github.com/CodexCoder21Organization/PlanRepository/blob/main/handoffs/2026-10-19-containernursery-peerregistry-stall-tinysite-publish-timeouts.md.

The lane stopped under the exact existing-assertion rule after identifying an additional fixture conflict. It did not run out its 75-minute allowance, and did not claim completion.

What was found and done

1. Fresh clone in scratchpad/workspace/F738b. Confirmed origin/wip/F738-work = 5ef414287da6a17dc4e00e4e89e22d8229a5821c and rebased onto current main without changes. Read README, full live PR description, required TESTING.md/PHILOSOPHY.md, original ContainerNursery handoff, previous F738 records/drafts and relevant source. No project-root AGENTS.md exists.
2. Approved fixture-only commit https://github.com/CodexCoder21Organization/UrlProtocol/commit/8684f2954 changes exactly three predicates: ConcurrentBatchSnapshotsAreComplete line 181; PendingAdditionsPreserveVisibilityOrder lines 123 and 146. Before: it.className.endsWith(".PeerLifetime") && it.methodName == "beginRemoval". After: it.className.endsWith(".PeerLifetime") && (it.methodName == "beginRemoval" || it.methodName.startsWith("beginRemoval\$")). Source comparison proved both bodies otherwise byte-identical to 5ef414287. This exact row still needs to reach the actual PR description's Existing test edits table when its green gate is met.
3. Built locally, ran both fixtures five times each: ten PASS1 invocations, zero attempt histories. Ran the original 86-file review selection once: 86 PASS1, zero histories. This evidence belongs to 8684f2954, not the later source correction.
4. Adopted/reviewed the five prior public proof drafts. Clock probes inspect every caller-thread sample until a guard conflict is found. Test-only commit https://github.com/CodexCoder21Organization/UrlProtocol/commit/62e3c260a: stale-candidate versus in-flight admission PASS1; retained getter, dial success Clock, dial failure Clock and quarantine count Clock FAIL attempts 1/2/3. Each probe launches another real public registry call from caller-supplied code and records the worker waiting for a guard owned by the callback thread. XML and full dumps/stacks are saved. No main-baseline claim is made.
5. Root-cause source correction https://github.com/CodexCoder21Organization/UrlProtocol/commit/5bada11baceca3fa1e7c0554b1c02b95299136cc: dial methods sample Clock before guards and pass owned times to internal observation methods; pending success samples again after joining outside guards; failure respects quarantine identity across sampling; quarantine count samples outside its guard and retries on owned identity changes. Custom RegistryAddressSnapshotPeer also retains the accepted peer ID, preventing caller peerId getters during capacity indexes/snapshot scans. Public observation methods retain their old behavior. All five public proofs PASS1 on this head, zero histories.
6. The new retained-getter test explicitly reads the raw caller getter after admission as a positive control: ownership may eliminate all internal rereads, and that must not make the proof fail merely because the callback disappeared. No pre-existing assertion changed. Root reviewed the source delta and the independently implemented four internal timestamp methods.
7. Directly affected unchanged existing fixture testPeerRegistryRemovalPublicationFailureCompletesHandoff FAILS attempts 1/2/3 on 5bada11ba at tests/testPeerRegistryRemovalPublicationFailureCompletesHandoff.kts:37: assertSame(failure, assertFails { registry.removePeer("target") }). Error: java.lang.AssertionError: Expected an exception to be thrown, but was completed successfully. Its custom peerId getter throws only after target membership disappears. The owned identity removes that getter from removal publication, so removal completes successfully. The fixture assertion was not changed. No extra caller getter invocation was added solely to make this fixture throw.
8. This is the binding stop. Continuing requires a fixture/contract decision, or a reviewed source design that preserves a meaningful outside-guard getter phase while satisfying the invariant. The simple ownership candidate has a known existing-test failure and is not approved for the PR. Other ID-getter publication-failure and closed-batch fixtures also require audit; their current results are unverified, not declared unrelated.
9. Fresh PR read: OPEN at b1d69eacf2e1a2ff1b53a41fc0531b44af22f220, body byte-identical to start. Source and evidence remote heads verified. Both touched checkouts clean, no stashes or extra worktrees. No source/test verification continued after the stop. No merge, enqueue, CI watching, publication, deployment or restart occurred.

Relevant PRs / refs

Evidence index: https://github.com/CodexCoder21Organization/UrlResolver/tree/wip/F738b-evidence/lane-f738b-records . The 8684f fixture-only checkpoint remains available within wip/F738b-work history. Build jars/caches are deliberately omitted. No code was deployed, published or left only locally.

Next steps

1. Re-verify live PR and remote heads first. Resolve the exact existing assertion conflict at RemovalPublicationFailureCompletesHandoff:37 before altering any assertion. The approved three JVM-name changes are settled; do not reopen that old blocked reason.
2. Review the source identity approach and existing public behavior. Preserve the required no-caller-code-under-guards invariant without adding a purposeless foreign getter call just for a fixture. The native proof of the original guard defect is already saved; do not repeat diagnosis.
3. After a permitted resolution, finish directly affected public/neighbor coverage, both success/removal bucket-wait orderings and final-head selection. Current evidence is split by head: 86 selection + ten fixture runs on 8684f; five proofs on 5bada. No 91-case final-head/full-suite, complete independent review, green CI or complete deterministic bucket-order proof is claimed.
4. Attempt git merge --no-commit pr739, record file/region conflicts and abort. This lane did not attempt it after its ordered stop.
5. Only once required green preconditions hold, verify PR OPEN, force-with-lease push to fix/atomic-confirmation-removal-c2, PATCH only the status paragraph plus the requested Existing test edits correction row via REST, read back, then stop. Do not merge, enqueue, watch CI or publish under this lane's authorization.

Reusable / operational knowledge

Use scripts/test.bash --local --test <name> --log <xml> with a tracked hard outer deadline. Native XML has root-level test and attempt-history elements. Aggregate pass counts alone do not establish attempt 1. The exact serial fixture/selection driver is saved as f738b-step1.py in the evidence branch.

Caller callbacks used as test pause/error points can disappear when ownership is corrected. Preserve a callback-exercised control while checking the public contract, and separately audit older fixtures that assume that same callback occurs inside guarded publication.

Sparse evidence clone tracks only its original fetched branch; after pushing a new evidence branch, fetch it explicitly into refs/remotes/origin/wip/F738b-evidence before using local-only-commit diagnostics. Always compare the actual remote SHA with local HEAD.