Handoff: Resolve the upstream registry transaction before folding the pruning successor into the retention PR

Written 2026-10-20 06:26 UTC. RE-VERIFY all state before acting: gh pr view on the two resolver PR URLs with headRefOid,state,mergeStateStatus,statusCheckRollup; git fetch; artifact metadata at https://kotlin.directory/foundation/url/protocol/maven-metadata.xml. This is a write-time snapshot.

Mission summary

The user requested one deliverable: https://github.com/CodexCoder21Organization/UrlResolver/pull/1318 on fix/peer-referral-retention-r42, carrying the successor product from https://github.com/CodexCoder21Organization/UrlResolver/pull/1329 plus the union of tests, rebased on main, pushed, with bld-build green. No merge, enqueue, close of the successor, publication or production action was authorized. The brief explicitly permits stopping if the change is unsafe. This lane used that exit after reproducing four required failures on the folded product. The requested deliverable is incomplete; target source and description remain unchanged.

Motivation: repeated referrals keep departed peers from age-based confirmation, retaining registry membership and contributing to expensive registry work during TinySite publish timeouts. Required production context: https://github.com/CodexCoder21Organization/PlanRepository/blob/main/handoffs/2026-10-19-containernursery-peerregistry-stall-tinysite-publish-timeouts.md . Target's opening motivation also covers the ExternalBrain load failure; preserve both when a safe delivery is possible.

What was found and done

1. Fresh clone in the requested L8 directory. Target head remained 71a7acaba808d22d26eac6b95e40435f5336c340 throughout; main was 838e44df4974b0fa1d6d7139b727fbeb349b354f. All fetch/rebases were clean and no target remote movement occurred.
2. Read successor description, https://github.com/CodexCoder21Organization/UrlResolver/pull/1318#issuecomment-6270879574 and required testing/review/philosophy/check documents. Read https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39373017570 failed log: five intended removal-ordering test failures, not merely provisioning. Each expected zero removals, actual one. Their names and full stacks are in the records branch.
3. The failed-contact gap is real: testPeerExchangeFirstFailedObservationDoesNotRenewPruneAge fails attempts 1/2/3 on the current target product, expected one removal, actual zero. PeerObservationLog.recordContact marks the first authenticated observation for a counted failed contact (current source lines 458-459); firstSeenMs then returns it (287-288), while discoveredAtMs (285) is immutable. The successor changes only the stalePeers age selector to read discoveredAt and nullable lastSuccessfulObservationAt from getRecordJson.
4. Copied all four reviewer proofs and the stronger later-success control byte-for-byte from https://github.com/CodexCoder21Organization/UrlResolver/commit/6abaeb59bfb08e41c7c06a1a16f7df56a2335354 . On target product, all four proofs fail attempts 1/2/3; later-success control passes attempt 1.
5. Locally applied exactly the successor's age-selector block, keeping the rest of current target source. The failed-contact test and later-success control pass attempt 1. All four reviewer proofs still fail attempts 1/2/3: testReferralPruneRetainsPeerAfterSuccessfulObservationDuringFailure, testRealReferralPruneRetainsConcurrentKeepalive, testReferralPruneRemovesPeerDespiteSameAddressReferralDuringFailure, testRealReferralPruneRemovesPeerDuringIdenticalReferral. This directly refutes the brief's suggestion that the successor already fixes R2/R3. All XML histories and full stacks are preserved remotely.
6. R2 mechanism: descriptor identity changes on identical receipt and the precheck discards failed confirmation. R3 mechanism: the resolver checks before calling removePeer(id,lifetime), and the registry commit checks no successful-evidence revision, so it can erase newer success. Extra resolver locking cannot order direct public registry/log mutations and moving removal under its stripe violates documented callback order. Source current target UrlResolver.kt:3089-3091 and 3116-3128.
7. javap of pinned protocol 0.0.1421 and latest published 0.0.1425 shows neither provides evidence-capture/conditional-removal API. Both expose only removePeer(String) and removePeer(String,PeerLifetime). Metadata still reports latest/release 0.0.1425. Successor description explicitly documents the missing API and says upstream final source https://github.com/CodexCoder21Organization/UrlProtocol/commit/4a4a4918551679931ed354c6ded22d3ea0539111 has zero native green attempts. This lane did not validate it. No unpublished coordinate or downstream workaround was introduced.
8. Restored target source and removed copied test files after preserving exact inputs as .kts.txt records. No existing test has a final edit; no source change was committed to the target. No description update, final-head delivery, full union run, neighbor run, or reversal gate is claimed after the safety refutation. These are explicitly recorded as refuted delivery steps, not passing deferrals.

Relevant PRs / refs

Required target check snapshot: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39379118236/job/118483893494 IN_PROGRESS at 06:25 UTC. No informational red check returned in the exact-target commit snapshot. No check was rerun. Latest-main controls are unnecessary to classify the four failures: they are expressly required product invariants and fail on the proposed product itself.

Deployed/published by this lane: nothing. Command history consists of repository/API reads, local builds/tests, evidence-only pushes and handoff recording. No host, ContainerNursery, artifact publication, merge, enqueue or close command occurred. No full-suite process or remote build request was started by this lane.

Next steps

1. Re-verify all state first. Coordinate with the owner of the upstream source above; do not duplicate the transaction implementation or treat its unvalidated source as a published API.
2. The original lane forbids publishing. Obtain a separately authorized release/adoption path if the owner wants the fold resumed. Validate upstream at its source, publish only with that separate authority, then update the consumer to the actual published version. No permission to do so is conveyed by this handoff.
3. Once the atomic API is available, capture before age eligibility, adapt removal to its registry-owned evidence transaction and run all four unchanged reviewer proofs. Preserve identical-referral failure validity, caller/route/lifetime replacement guards, and success-evidence ordering without locks across dials/callbacks.
4. Resume the original union/test/bar checklist from the L8 brief: keep original relay test, preserve both original scenarios when adopting the successor's corrected full-capacity test, take all twelve successor tests, run zero-success/persistence/boundary/churn controls, add composed joined exchange/live-control proof for R7, run reversals and named neighbors with native attempt-1 XML, fetch/read any target movement, rebase and push only with lease. Keep why-first description including ExternalBrain and TinySite provenance, and watch bld-build on the final head. No merge, enqueue, close, publish or deploy under the original authorization.

Reusable knowledge

Evidence is entirely in lane-l8-records on the remote evidence branch. Copy .kts.txt sources into tests/ without .txt. The original target product is exactly its pinned SHA; apply folded-age-selector.patch to reproduce the successor selector on that product. Commands used scripts/test.bash --local with one --test per file and --log XML. Look at top-level attempt-history elements: all four failures have explicit 1/2/3 false records; the two folded passes have none. No retry-assisted pass is claimed.

No delegated work was used. All tracked clone/test/health commands have exited; no watcher was launched because the proposed product failed before the final CI gate. Build outputs, caches and downloaded jars are intentionally not included in the evidence branch. No source, stash or local-only commit remains outside remote checkpoints.