Handoff: Finish complete-suite validation for UrlProtocol review round 9

Written: 2026-10-21T12:08:49.609526+00:00.

RE-VERIFY: This is a write-time snapshot. Recheck the source and evidence branch heads with git ls-remote, and recheck https://github.com/CodexCoder21Organization/UrlProtocol/pull/740 and https://github.com/CodexCoder21Organization/UrlProtocol/pull/759 before acting. The complete suite is not verified.

Design decisions in effect

The user stated on 2026-10-21:

• "Readings belong to a Clock timeline." Each source read records the epoch current at its start. An earlier-epoch read keeps its own returned value for its caller, but cannot advance current retention, purge removal or token history, or grant usable current-epoch duration.
• "Within one epoch, keep round 8's rule: samples are ordered by returned value and completion."
• "Retention markers end only after the full interval has elapsed on the current epoch's timeline, measured by reads that started in that epoch."
• "K1: no Clock read under any registry guard or persistence ownership."
• "The depth limit stays withdrawn; an unbounded re-entrant Clock behaves as on main."
• Keep the exact round-6 storage-callback messages, cache measurement from 128 entries to 1, and wire compatibility.
• Run tests with --local, use the machine-wide complete-suite slot, and run git commands one at a time. Never weaken assertions, raise timeouts, reduce iterations or disable scenarios.
• No merge, queue entry, publication or deployment. Do not watch CI after updating the PR.

Mission summary

The owner reported that https://droplets.wasmserver.com/ "is super unreliable, frequently rendering various errors/notices due to bugs in UrlResolver or UrlProtocol or something else" and asked for the underlying root cause to be fixed; the ContainerNursery route stops the WUI after 5 idle minutes, so most human visits are cold starts.

This lane was asked to fix the round-8 review finding in https://github.com/CodexCoder21Organization/UrlProtocol/pull/740, beginning at https://github.com/CodexCoder21Organization/UrlProtocol/commit/c523c3de47ed89322317e862278f7dbc66710e1d. The code, permanent scenarios, negative controls, repetitions, historical scenarios and 275 gate cases are finished. The complete local suite and classification of its histories remain open. No complete-suite success is claimed.

What was found and done

1. OBSERVED: the three original reviewer scenarios are byte-identical permanent tests, one file each. Each is red3/3 at the original head, green10/10 on attempt1 after the fix, and red3/3 with the epoch policy reversed. The mechanism is a pending read returning601000 after a separate read observed0 and reset retention; the pending read previously advanced that new retention timeline and removed the retained identity or removal marker.
2. OBSERVED: per-Clock metadata captures a starting epoch outside source calls. A non-overlapping lower completion starts a new epoch. Prior-epoch samples cannot age the window, purge it, or grant duration. Within an epoch, larger values and completion ordering retain the earlier behavior. Clock source calls remain outside registry/persistence ownership; metadata methods contain no Clock calls.
3. OBSERVED: additional public scenarios exposed two related edges, each red3/3 before its adjustment. Scalar receipts could cross an epoch before admission; immutable receipt metadata now follows admission and local service/LAN exchanges. A removal prepared in an earlier epoch needs a full interval from the next current sample, including both individual markers and the bounded-window global hold. First-operation state retains its earlier epoch until current sampling can reset retained history.
4. OBSERVED: all12 new scenarios pass on attempt1 in additional.xml. This includes the three originals plus nine extra scenarios: two earlier epochs, prior reader duration, first removal, later removal, two receipt APIs, global hold, real local service query and real local LAN exchange. Existing tests are unchanged by this lane; no assertion, timeout or iteration count was weakened.
5. OBSERVED: the five historical scenarios pass5/5 first attempt. The five55-case gate runs pass275/275 first attempt. Their XML uses sibling attempt-history elements; those were read directly. Both exact storage messages and the cache128-to-1 scenario are in these gates. The three primary scenarios also passed after the final rebase.
6. OBSERVED: an independent correctness/test review found no remaining concrete issue or coverage gap in the reviewed paths. The getter's provenance fallback is always aged to zero at its two write sites. The review note is preserved on the evidence branch.
7. OBSERVED: the first complete-suite invocation was stopped, with exit143 and no result XML, when main advanced. It is not counted as a completed suite. The new main commit changes only tests/testPeerRegistryCapacityBatchRemovalCallbackRejectsLaterVictimReadd.kts, adding file-local coordination/assertions. The rebased code differs from the earlier checkpoint only in that upstream test. The changed main scenario plus the three primary scenarios pass4/4 first attempt after rebase.
8. OBSERVED: The final rebased suite request remained queued for the shared slot and was stopped before its Java runner started, with exit143, no runner output and no result XML. Zero tests started on the final invocation. The complete-suite bar and main history comparison remain unfinished. All own suite/probe processes were stopped and a process audit found zero own test/build workers.
9. OBSERVED: no production service was changed, no artifact was published, no PR was merged, and no queue entry was added. This is verified from the session's actions; no deployment or publication command was run.

Exact primary assertions

• testReviewEarlierHighReadKeepsRemovalAfterClockStep: "A legacy receipt at time 0 must keep the recent removal after an earlier read returns 601000".
• testReviewEarlierHighReadKeepsTokenAfterClockStep: "The same token at time 0 must keep zero duration after an earlier read returns 601000".
• testReviewEarlierHighReadKeepsRestoredTokenAfterClockStep: "The restored token at time 0 must keep zero duration after an earlier read returns 601000".

Each has baseline3/3 negative attempts, fixed10/10 first-attempt positives, and reversal3/3 negative attempts. Intentional XML review records and the computed validation-summary.json are saved on the evidence branch below.

Relevant PRs / refs

Latest included main: https://github.com/CodexCoder21Organization/UrlProtocol/commit/c64fee18d8cb94be3dd43b175366a520639f9e3f. The related https://github.com/CodexCoder21Organization/UrlProtocol/pull/759 is OPEN at the last check; include it if it has since landed. No code is deployed or published by this lane, so there is no live unmerged version to reconcile.

Next steps

1. Re-verify current state first. Read project README and instructions, the testing guide at https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md, and the saved evidence. Use a fresh clone in your own new lane directory; never reuse another delegate's checkout.

2. Fetch and rebase the code checkpoint onto current main. Confirm the target PR is OPEN. If main changed only standalone tests, the saved production proof remains source-equivalent, but validate the new tests as well.

3. Run the complete local suite from the final head, only through the machine-wide wrapper on this host:

   /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/suite-slot.sh scripts/test.bash --local --test . --log <owned-path>.xml

   Use a tracked background task. Do not add slot scans or a competing suite. Read test and sibling attempt-history elements; report both first-attempt and final counts. Classify every history against fresh main using public targeted tests and source comparison. Do not use CI to diagnose it.

4. Recheck the three primary scenarios after the final fetch/rebase, then update the OPEN target PR branch with the authorized lease-checked push. Update the Review round9 description with the complete-suite counts and every history classification. Preserve the required owner provenance first, and end with the required Claude Code footer. Do not merge, enqueue, publish, deploy, or watch CI afterward.

5. Before stopping, complete the tracked-process cleanup and confirm with ps -eo pid,args -ww that no own workers remain. The prior lane's final process result is zero active tracked suite/probe processes and zero own test/build workers in the final ps audit.

Operational notes

• The initial partial-name test filter selected zero scenarios. Use exact function filters, repeated --test flags, or the requested directory filter. Zero-selection and compilation-only setup results are excluded from scenario counts.
• Core GitHub API quota was at its limit early in the lane; GraphQL remained available. No credential value was printed. Read-only GraphQL can fetch PR state and documentation text.
• The canonical handoff README still has a git-era merge section. The current create-handoff skill and the user's no-merge instruction control: use handoff-cli against url://handoff/, with no handoff PR or merge queue.
• The original findings contain estimated time labels that were explicitly corrected by a later clock audit. Entry order and test counts are valid; later entries have system-derived timestamps.
• The local primary findings file is /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/rC25-findings.md. Its durable snapshot and XML records are linked on the evidence branch. Build outputs, dependency caches and process command lines were intentionally excluded.