Handoff: Finish peer-freshness compatibility and verification, then open the protocol PR

Written 2026-10-20T09:34:37.147083+00:00.

RE-VERIFY: This is a write-time snapshot. Recheck the linked prerequisite PRs with gh pr view and branch heads with git ls-remote before editing. The source was based on prerequisite commit 8568eceff2f13cd4385dac18d5780ad6114bf597; that prerequisite has advanced to b617b916fe04e8efdafe1ec20eba2f7985829fb7. Rebase and review its PeerRegistry and PeerObservationLog changes first. This lane has no PR.

Mission

The owner reported that https://droplets.wasmserver.com/ "is super unreliable, frequently rendering various errors/notices due to bugs in UrlResolver or UrlProtocol or something else" and asked for the underlying root cause to be fixed. This lane adds source freshness to presence records so repeated referrals cannot manufacture a new source lifetime. A later resolver lane owns bounded verification and pruning against the published protocol. Do not merge, publish, deploy, change the resolver pin, or watch CI after opening the requested protocol PR.

Findings and implementation

1. A received descriptor currently lacks a source lifetime. Local successful observation and imported catalogue evidence must remain distinct. The contract uses observer identity, observation identity, and remaining duration; no comparison of clocks on different nodes is required. A correlated request consumes its full request-to-admission elapsed time, and forwarding consumes residence time. Unsolicited records are hints, since their transit duration is not established.
2. Legacy receipts do not renew an existing membership. Following removal, the same identity cannot be admitted from legacy hints for 300 seconds in the current process. A genuinely newer usable source observation may be admitted. After that interval a legacy record may again be admitted unverified; consequently this policy is not a finite-total-work guarantee under unlimited legacy input.
3. Optional fields and tolerant JSON parsing exist on presence carriers. Copy and conversion fixes preserve subject identity; elapsed helpers consume duration. The current ServiceInfo constructor is preserved; its new-field secondary constructor requires explicit empty transport lists when appropriate.
4. PeerFreshnessWindow retains original token expiry, best source evidence, removal markers and an evidence revision. Registry admission and captured removal share the prerequisite's peer stripe. Removal rechecks membership lifetime, routes, successful local observation, and imported evidence revision. Markers are installed before releasing the stripe. Source samples capture observation/sample revisions before reading the clock, and reject changed or removed records afterward.
5. Persisted evidence keeps source identifiers but restores duration as zero, because elapsed clock continuity across a stopped process is unknown. Default elapsed sampling uses the JVM duration clock; custom Clock implementations must model elapsed time, with visible backward movement treated conservatively.
6. Actual LAN responses consume request-to-response age and validate direction/id. LAN beacons and relay announcements use legacy imported admission. Active service-query responses consume request-to-admission age, including queue residence, and return aged ServiceInfo records to their caller.
7. The original 4096-token default was an added implementation proposal and proved incorrect: after many prior observations, it silently omitted a newer usable observation. Production history now expires by TTL without a default count limit. Memory scales with distinct observations during that interval. Explicit helper limits remain available, but callers choosing them must handle declined evidence. The original user brief bounds pruning work, not fixed memory independent of input rate. The design records this correction.

Verification snapshot

Imported receipt/removal, persistence, overlapping source observation, window boundary/clock/history scenarios, carrier copy/conversion/legacy/age, and ServiceInfo compatibility each have focused passing runs. See tracked investigation progress files for exact scenario names and earlier checks. The full local suite was launched once on source commit 6dcad8d66822b91021f3714955e90aa01c2a3398; final outcome will be appended. The prior-reader separate-JVM draft is NOT passing: test compilation reports a String/Any mismatch before the Java bridge starts. It is isolated at carrier branch head 6f0e5af3af5b7ef4a5892816fee08129df73310e and is not integrated into the main lane branch.

Earlier invalid experiments are not evidence: the first ServiceQuery fixture exposed the RPC protocol rather than the requested query protocol, so its responder was not reached. The corrected fixture uses Libp2pNetworkProvider.registerInboundStreamHandler(GossipProtocol.PROTOCOL_ID), and asserts request delivery before lifetime checks. Two test drafts had API/cleanup compile errors; those were corrected before counting results.

Relevant PRs and refs

• https://github.com/CodexCoder21Organization/UrlProtocol/pull/738 — OPEN at last check; head advanced to b617b916fe04e8efdafe1ec20eba2f7985829fb7. Its changes are the required base, not part of this lane's intended diff.
• https://github.com/CodexCoder21Organization/UrlResolver/pull/1329 — OPEN at last check, head 15fb9c937528087c495d03893a43cfe0cc0011ea.
• https://github.com/CodexCoder21Organization/UrlResolver/pull/1318 — OPEN at last check, head 71a7acaba808d22d26eac6b95e40435f5336c340.

No production deployment, restart, Maven publication, merge, or resolver pin change was performed. This is verified from the lane's executed actions; production state was not changed or revalidated as part of this implementation lane.

Next steps

1. Re-verify current prerequisite state, then rebase the integrated branch onto the latest prerequisite branch. Review the exact interaction points in PeerRegistry and PeerObservationLog; do not count prior-base checks as current-base proof.
2. Repair the isolated published-prior-reader test harness and run the real older/newer-reader exchange. Its draft and Java bridge are preserved on the carrier branch. Do not treat source compatibility or same-version JSON checks as that result.
3. Complete the required 5-before/5-after first-attempt counts for newer behavioral scenarios and reversal controls. Add direct LAN beacon-after-removal and mismatched response ID/direction tests. Independently review the revised default history policy, full source runtime surface, and tests.
4. Run all required existing carrier/relay/catalogue scenarios and the full local suite on the exact final source head. The suite contains over 2600 scenarios, including about 640 requested carrier/relay scenarios. Use --local only. No full-suite green result is claimed here.
5. Once the bar is met, fetch/rebase main, run targeted checks again, push, and open the protocol PR with the user's exact provenance and required footer from the original brief. Report the PR URL and stop; do not monitor CI, merge, publish, deploy, or change resolver dependencies.

Reusable details

Use scripts/test.bash --local --test <scenario> --log <xml> for focused runs. A successful first attempt has one successful test element and no attempt-history entries; inspect attempt-history for a repeated run. For the full suite, specify --test ./tests when adding log/result flags; otherwise this wrapper prints CLI usage. The full invocation was scripts/test.bash --local --test ./tests --log .git/c5b-full.xml --result-file .git/c5b-full-result.json.

Some compile diagnostics appear only once in a multi-megabyte build log without a source location. Inspect the actual compiler message before attributing it to connection diagnostics. The compatibility runner's normal java.class.path does not include all artifacts loaded by its context class loader; its draft uses public resource URLs and a separate Java bridge, without reflective field or method access.

One worker accidentally started a remote test contrary to the local-only instruction. The tracked client session was stopped and exited 130; no remote run id was returned and no remote state change was issued. Subsequent checks used --local.

Raw generated XML/stdout and build outputs are deliberately omitted from Git. Scenario sources, exact commands, first-attempt summaries, design decisions, and review notes are retained on the linked branches. The local detailed findings path is /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/rC5b-findings.md; its final copy will be committed in the integrated branch so pickup does not depend on this machine.

Final suite outcome

The frozen-source full-suite run stopped at the lane time cap during preparation. Structured result: INTERRUPTED; testsRun 0, testsPassed 0, testsFailed 0, executor exitCode 143. The bounded wrapper returned 124 after 605 seconds. There is no broad suite result. All lane workers completed; the tracked suite processes were stopped. Final findings are committed at investigations/laneC5b-peer-freshness/FINDINGS.md on the integrated branch. Generated stdout/XML are omitted; retained scenario sources, control commits, and summaries are enough to reproduce each focused check.

Final durable findings: https://github.com/CodexCoder21Organization/UrlProtocol/blob/wip/laneC5b-peer-freshness/investigations/laneC5b-peer-freshness/FINDINGS.md . The final notes commit changes documentation only; the tested source remains https://github.com/CodexCoder21Organization/UrlProtocol/commit/6dcad8d66822b91021f3714955e90aa01c2a3398 .