Finish ContainerNursery standby takeover

Next action

Continue the unfinished ownership, facade and startup work on draft https://github.com/CodexCoder21Organization/ContainerNursery/pull/687. Lane N3f is a partial checkpoint. Current source is d601fc7b, rebased on main 7dd1ba457ecb9c5f629ee43b3b5217cc8064665e. The six exact scenarios pass attempt 1 on this source. Complete-suite results below belong to f09cf1bb, before the latest build/test-only main update. A complete suite on the current source has not been run. Keep the PR a draft.

Why

The owner reported that https://droplets.wasmserver.com/ "is super unreliable, frequently rendering various errors/notices due to bugs in UrlResolver or UrlProtocol or something else" and asked for the underlying root cause to be fixed; the ContainerNursery route stops the WUI after 5 idle minutes, so most human visits are cold starts.

The standby work is intended to shorten the shared HTTPS wait during ContainerNursery replacement. The listener work keeps the port open. This lane has not completed the takeover brief.

Remote checkpoints

All lane source and experimental cases are pushed. No lane deployment, publication, merge or queue action occurred. Local-only XML, logs and helper scripts are build/review artifacts, not source.

Verified implementation

The predecessor records preparation PID/start-ticks identities over its control socket before standby-ready. The existing independent application watcher retains established applications after predecessor exit while a registered preparation remains live; committed ownership follows generation selection and acknowledgment. One preparation closing preserves another, and the last preparation ending closes the remaining application. Writer selection and its lock remain in place. Control input errors remain local to a client connection.

Controlled handover waits for accepted HTTPS handlers before closing their dependent facades. The new real-process scenario sends a TLS request through a frontend application, the old loopback libp2p URL facade and a backend application held at a completion gate. It completes after handover starts. This does not establish draining directly accepted work on every facade.

Relevant source: src/main/kotlin/org/example/StandbyHandover.kt, StandbyPreparation.kt, ContainerNurseryServer.kt, and container/DangerJarFileBackedContainer.kt. The invariant table and review record are on the verified branch under notes/laneN3f-ownership-invariants.md and notes/laneN3f-review-round.md.

Counts

The selected standby/CLI batch was 20/20 on the first attempt. The six cases also passed attempt 1 in the complete suite at f09cf1bb. The newest source checks are each one real first attempt, not a new 10-run claim. A shorthand invocation selected zero tests and is excluded.

Complete local suite

Complete-suite source f09cf1bb: 855/857 eventual passes; 854/857 first-attempt passes; three attempt histories; zero build-rule errors. The run used the required machine-wide slot with no outer time cap. All six implemented scenarios passed attempt 1 in this complete run as well.

The complete earlier source feee7f6e run had 854/856 eventual passes, 853/856 first-attempt passes and three histories. Its additional main stress history passes attempt 1 in the final run; it was red/red/green in the earlier suite and red/red/red in the separate main comparison. All counts and comparisons are saved in the comparison note. Existing tests, assertions, iteration counts and time bounds remain unchanged.

Remaining implementation and verification

1. Extend the invariant table before changing ownership code. Established applications are covered, but DangerJarFileBackedContainer.kt starts a process at the public processLauncher boundary before watcher installation (the prior review recorded lines 446 and 462). Construct the exact real-process ordering where the predecessor exits between these steps. No reproduced result exists for this ordering. Resolve every creation ordering without leaving an application without an owner, and preserve its PID if adopted.
2. Finish direct-facade accepted-work drain. On wip/laneN3f-direct-facade-cases, the real URL, HTTP and TCP cases are each red 3/3. URL nursery admission can remain owned by a persistent idle backend bridge; awaiting admission count alone is insufficient, so returned-stream/request lifetimes need accounting. HTTP must close admission while accepted responses continue. TCP must await accepted proxy coroutines. UDP must retain its response socket through accepted packet completion. The UDP experiment is incomplete: CLI port 0 is rejected, so it has no valid feature/control count. Use a real programmatic ephemeral endpoint without reserving then releasing a port. Do not change production validation to fit the fixture. A desired handover-facades-draining acknowledgment is not implemented; the valid three cases currently report an earlier pending-work condition.
3. Add separate fail-first real-process cases and implementations for prepared startup reuse, transfer-aware timers, dependency wakes and JAR history. No new case or implementation for these items is claimed.
4. Perform independent test and correctness reviews. Each completed case needs isolated red 3/3 controls and green 10/10 first-attempt runs on the final review source. Read sibling attempt histories from XML. An eventual pass does not satisfy the count.
5. Run the complete local suite on the final source through the mandatory machine-wide slot. The latest rebase changed 18 test files and two build files, with no production source change; complete counts shown above remain tied to f09cf1bb. Classify every new history against the main revision actually tested. Do not weaken the older conflicting stop assertion.
6. Fetch/rebase, verify the draft is OPEN, push with the expected remote lease, update its Review round counts, and keep it a draft. Do not watch CI under this lane workflow.

Operating rules

Use --local. Git commands run one at a time. Do not raise test bounds, lower iterations, skip tests, use mocks or reflection, publish artifacts, merge, enqueue, deploy, restart or change production. Application heap stays at 128 MB without JVM tuning; Restart=no; one active writer; an uncommitted standby leaves the predecessor in charge. Fetch/rebase before building as instructed in the brief, and attribute results to exact source/build inputs when main advances.

Complete suites run only through /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/suite-slot.sh scripts/test.bash --local --test . --log <xml>. Do not add an outer cap shorter than 150 minutes. Slot waiting does not count toward the lane stop rule. Keep long jobs tracked, recognize terminal states, and close owned processes before stopping.

Required reading used in lane N3f: repository AGENTS/README, testing architecture, engineering philosophy, UrlResolver README/public API metadata, and the central handoff format README. New work must read the relevant documents itself.

Local evidence and brief state

Findings: /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/rN3f-findings.md. Primary checkout: /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/workspace/laneN3f/ContainerNursery; comparison checkout is sibling ContainerNursery-main. Logs/XML are under each checkout's .git/laneN3f/; they are volatile evidence, with durable counts in the linked comparison note, PR and this record.

Brief states: (1) partial, established ownership and scenario (c) green; creation boundary unverified. (2) partial, accepted HTTPS-to-old-URL green; direct facades unfinished. (3) unfinished. (4) six scenarios have earlier prescribed counts; newest-source checks are 1/1 each. (5) complete suites recorded on feee7f6e and f09cf1bb; newest rebased source suite remains. (6) current checkpoint pushed and draft description updated. The scope is larger than the completed lane checkpoint, so this open record carries the remaining work. Final process audit is recorded in the findings at lane exit.