Close the raw JSON reply gap with transport-owned encoding and resolver cleanup

Written 2026-10-21 08:13 UTC.

RE-VERIFY: This is a write-time snapshot. Read both PR heads/checks and remote branch SHAs before resuming. No product fix has been made by lane s15. Seven failing public tests and their full runner evidence are pushed. The existing result-check PR remains incomplete.

Mission and decisions in force

The user requested extreme-condition end-to-end tests that initially fail, then fixes in UrlResolver. Independent review of https://github.com/CodexCoder21Organization/UrlResolver/pull/1251 at 0588e82e582cac2d47fc597251bb22dc1932bd5d found raw JSON bypassing the result guard. The original central handoff is archived; this scoped handoff holds the unresolved raw JSON work.

The lane brief requires:

1. Every value the encoder cannot encode, anywhere in a result including raw JSONObject/JSONArray trees, nested maps/lists/arrays and boxed/primitive Double/Float NaN/±Infinity, must produce a prompt INTERNAL_ERROR naming value and path.
2. Use the encoder's own rules and preserve the exact bytes of every result main delivered.
3. Release every stream/observable registered for a refused result.
4. Every write path, including libp2p, provider, pre-encoded and segmented JSON, must return an error and release registrations on encoding failure, rather than only logging.
5. Refuse raw cycles descriptively, without overflowing.

No merging, enqueueing, production changes, Maven publication, subagents, timeout increases, assertion weakening or test removal is authorized. common.md explicitly says, “Do NOT publish Maven artifacts or deploy anything unless your brief grants it by name.” The lane has no publication exception. Its last section explicitly permits fail-first evidence through a draft PR's GitHub-runner bld-build rather than local tests on the loaded shared box. Only bld-build is required; App checks are informational. The original lane deadline is about 09:22 UTC on 2026-10-21.

A scope question is pending with the user: may this lane also implement and publish the required upstream UrlProtocol encoding-failure callback, or must publication remain prohibited? No answer or authority is assumed. The scope question was reissued after continuation through the asynchronous text tool.

Mechanism and evidence

UrlResolver's findUnencodableValue treats JSONObject/JSONArray as opaque. Its registration wrappers also preserve them. A raw JSONObject containing a primitive DoubleArray with NaN therefore passes the common check and fails only when UrlProtocol serializes the response. The pinned protocol's host only logs that failure, so the caller times out and result registrations can remain owned. Raw cycles overflow inside the published protocol's countBase64ByteArrayMarkers recursive scan.

The full fail-first runner https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39560096640 completed FAILURE on 2026-10-21 08:09 UTC at test-only head 9d91e376ed883096b8b4d7e1478de08432d5f66d. Build succeeded; test step reported TESTS FAILED (2271/2278 tests completed successfully, 7 failed). Exactly the seven new tests failed. One other test passed after the runner's automatic retry; no manual failing-test rerun was requested. All seven failures and the complete raw-cycle StackOverflowError trace are preserved at https://github.com/CodexCoder21Organization/UrlResolver/blob/wip/s15-rebased-tests/investigations/s15-raw-json/runner-evidence.md.

Numeric/cycle matrices stop at their first failed assertion. This baseline run proves the first NaN/container entry, not every later Infinity/boxed/array matrix entry. A fixed passing run must exercise them all. The writer-failure test supplements the exact review NaN example; it is not a replacement for it. Full writer-mode coverage, especially large segmented/interleaved responses and RPC 1.0/1.1, still needs review when the integration is implemented.

A blanket raw-tree scan in the common resolver handler would violate property 2. The protocol's raw base64-marker conversion depends on negotiated attachment mode and available slots: a marker with __type=bytes, __value=AQI= and ignored=doubleArrayOf(NaN) succeeds on 1.1 by turning into a binary_ref and discarding its extra field, but fails without attachments. A public-encoder experiment against published foundation.url:protocol:0.0.1421 produced BINARY_SUCCESS length=111 attachments=1 and LEGACY_FAILURE JSONException. The portable experiment and exact output are preserved at https://github.com/CodexCoder21Organization/UrlResolver/tree/wip/s15-rebased-tests/investigations/s15-raw-json. The successful wire-byte test includes this case and passed its comparison before the invalid diagnostic assertion failed.

Published-artifact javap confirmed RpcRequestHandler has only handleRequest, RpcResponse is final, and ServiceClientConnection offers id/peer/open/push/onClose, with no wire mode or encoding-failure event. After handleRequest returns, the resolver cannot observe a writer failure through this public contract. Re-encoding in the common handler would call user serializers twice, change acceptance or bytes, and still fail to guard a later writer failure. Replacing the host with another provider would route around an upstream bug. Those are ruled out by the brief's requirements.

The separate upstream effort https://github.com/CodexCoder21Organization/UrlProtocol/pull/697 remains OPEN at 1c82b2b816881a63c408596e18d327e0049d4389 (08:05 snapshot). Its encodeRpcResponseOrEncodingFailure takes response/method/binaryAttachments, catches encoder failures and returns a generic error, but has no resolver callback. Adopting that branch alone cannot release resolver-owned registrations or provide the required path. It is owned by another lane; s15 did not mutate it.

Ownership invariants

These objects have no persisted restart state. Existing connection shutdown still owns concurrent termination. Any new callback must preserve that lifecycle rather than retaining per-request state after completion.

Relevant PRs / refs

Original baseline run: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39556536502 — SUCCESS, 2271/2271, racing local/remote commands with kompile-cli 0.0.124. This proves the existing suite passes despite the gap, not that the new properties pass. A restored duplicate https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39558832301 was still executing at last check; it was restored because this lane accidentally cancelled an evidence run sharing the original product SHA before the first test commit. That administrative restoration is the only manual rerun; no failed-test rerun or informational check rerequest occurred.

The real PR description was updated via REST and read back. It now names raw JSON and the write-path blocker, links the failed runner/full evidence, and removes the stale claim that the completed behavior needs no upstream guard. Its head remains unchanged. Existing tests edited: NONE. New tests edited after the fail-first head: NONE.

Nothing was deployed, published, merged or enqueued by this lane. No dependency pin was changed. No local product fix exists. All meaningful artifacts are remote. Source downloads and machine-specific classpaths are disposable; the portable public experiment and complete runner failure evidence are remote.

Next steps

1. Resolve the explicit publication-scope question. The full brief cannot be completed through the pinned public API under the existing prohibition. Do not treat silence as authority.
2. Coordinate the separately owned upstream guard, adding an optional encoding-failure interface so existing RpcRequestHandler implementations remain compatible. The writer must invoke it after actual encoding fails, before any bytes of the refused result are committed, passing request, original response, effect/connection context and failure. Keep generic behavior when absent. Test callback cleanup and callback-failure behavior through a real public RPC host; establish fail-first evidence.
3. Ensure wrappers preserve the optional callback: UrlResolver's diagnosticProviderRpcHandler currently returns an RpcRequestHandler-by-delegate wrapper and would otherwise hide an optional interface implemented only by ClockStampingRpcRequestHandler. Enumerate every adapter and public host/write entry before relying on targeted tests.
4. Resolver should release the original result's registrations and format value/path diagnostics only after the actual encoder refuses it. Extend diagnostic traversal for raw objects/arrays and nested maps/lists/arrays with identity-cycle guarding and raw JSONString precedence. Do not introduce a second acceptance rule or invoke user serializers twice.
5. Use the same guarded behavior for provider/relay paths and every relevant pre-encoded/segmented branch; inspect fatal errors separately from ordinary serialization failures. Add/verify public tests for all required modes and ownership edges, including earlier successful registrations and reentrant close callbacks.
6. Publish a usable protocol only with explicit authority, then pin it in UrlResolver. Run the seven tests to passing and independently review tests/source. Fetch/rebase latest main, verify the real PR is still OPEN, push its head with --force-with-lease, update description/read back, and wait for bld-build using plain build-watchman. Do not merge or enqueue.
7. Stop at the lane's deadline with a pushed checkpoint if incomplete. Cleanup includes lane-owned tracked watchers, the checkout and its path-derived ~/.aibuildcaches entry; never kill another lane's process.

Documentation read

The lane brief and common.md; original central handoff and prior s13 review; repository README (no AGENTS.md exists); Testing Architecture relevant hermetic/TDD/extreme/public-API/clock/error/script/never-calibrate sections; Engineering Philosophy reproduction/failure/refutation sections; live racing-CI document; github-repos/status-report/watch-build/create-handoff skill instructions. The explicit lane runner override controls the older local-first guidance.

Final cleanup verified at 2026-10-21 08:15:53 UTC: the sole s15 checkout was deleted after the clean-tree/stash/local-commit audit and remote SHA verification. Its path-derived ~/.aibuildcaches entry was already absent. No build-watchman process targeting the lane's real or evidence PR remains. The handoff BLOCKED report was uploaded and the s15 claim released. Resume from the linked remote checkpoint; nothing needs recovery from local disk.