Handoff: Finish the required full-suite check for the UrlProtocol snapshot traversal fix

Written 2026-10-21 14:55:52 UTC; runner state reverified at that time.

RE-VERIFY: This is a write-time snapshot. Recheck https://github.com/CodexCoder21Organization/UrlProtocol/pull/697 with gh pr view https://github.com/CodexCoder21Organization/UrlProtocol/pull/697 --json state,headRefOid,statusCheckRollup,mergedAt. The remaining required runner suite is https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39615916379. A fresh query takes precedence over this record.

Design decisions in force

From the 2026-10-21 S43 brief:

Rule: any error raised while walking the result — during the resource capture or the encoding — makes the request fail with its descriptive error reply (and releases every captured resource exactly once); a result is never reported as successfully encoded if any part of it could not be read. Fatal VM errors keep whatever handling the code already applies to them (state which). Keep the earlier guarantee: captured resources are released exactly once even if user code mutates the result or throws.

Add the reviewer's probe as a failing-first public-API test. Keep the change minimal.

Do not merge, enqueue or publish. Strict time box 60 min.

No deployment is authorized. No delegation was used. This continuation is verification only unless the remaining required runner check identifies a real failure.

Mission summary

Finish the required full-suite verification for the snapshot error follow-up on https://github.com/CodexCoder21Organization/UrlProtocol/pull/697. The broader original effort adds end-to-end tests exposing UrlResolver bugs under extreme conditions, then fixes them at their source. S43 fixes a specific regression in the pre-conversion resource snapshot: its saved traversal failures disappeared if subsequent conversion succeeded. Source and tests are complete and pushed; only the real head's full-suite gate remains.

The broad historical handoff is archived and was left unchanged: url://handoff/handoffs/hf-2026-10-14-land-the-urlresolver-extreme-condition-bug-fixes-fix-the-two-merge-queue-flakes-then-merge-the-reviewed-prs-and-finish-the-rest. This record covers the narrow S43 continuation, not the other workstreams.

What was found and done

1. Verified the original real head was 6cb903e34b9055c797af793f104144736e9da795. Rebased all 18 patches onto main https://github.com/CodexCoder21Organization/UrlProtocol/commit/5a5e1f5a43ef9bae291f1aa6db13aa9317e40ebb without conflicts. Range-diff shows all 18 patches identical. Three unrelated existing test edits in that main commit were carried unchanged; this lane edited no existing test.
2. Mechanism: captureRpcValueResources saves every thrown traversal error in cleanupFailures, but guard formerly returned encode() directly and consulted that list only after another failure. A collection whose first iterator throws and second succeeds could therefore yield success. A later conversion close failure could also replace the original traversal failure.
3. Added the reviewer's exact public-API probe, with unchanged source SHA256 f838d1b332f70cb0a2df43fa14aed2e9acf7a09661933dc754a4730b83645180, in tests/testS41PrewalkMustNotChangeSuccessfulValuesOrSwallowFatalErrors.kts. Added tests/testSnapshotTraversalFailureReleasesCapturedResourcesOnce.kts for original exception identity/full message, suppressed close failure, zero reads, aliased sibling release despite mutation; added tests/testSnapshotTraversalFailureGetsDescriptiveErrorReply.kts using isolated real libp2p nodes and both protocol versions, full error reply text, matching ID, no application marker, and a subsequent successful same-stream call.
4. Fail-first proof: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39614835237, run_attempt 1, all three scenarios fail on unchanged production code. Reviewer probe completed successfully instead of throwing LinkageError; wire test expected INTERNAL_ERROR and got null; cleanup test saw later IOException instead of original IllegalArgumentException. Complete stacks and evidence are preserved remotely below. The initial evidence run https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39614020782 executed zero tests because my disposable selector used an undiscovered directory. It is NOT bug reproduction evidence. Only the evidence workflow selector was corrected to the three existing test-file paths.
5. Minimal fix: two added lines in src/foundation/url/protocol/RpcEncodingResources.kt, a comment plus cleanupFailures.firstOrNull()?.let { throw it } inside the existing try before encode(). This sends the first snapshot error through the existing release/suppression path. Resource discovery still completes before conversion, and every remaining identity is claimed before any close callback. Nested guards share the released identity set. Existing fatal policy is unchanged: VirtualMachineError, ThreadDeath and LinkageError propagate after captured-resource cleanup, without diagnostic rendering or an RPC reply.
6. Dedicated independent test-comprehensiveness and code-review passes completed, no findings. No interface, shared fixture, timeout, iteration count, receiver/writer behavior, or real PR workflow was changed. README already promises this contract and needed no edit. No local builds/tests were run: the lane's explicit runner-only verification procedure overrides local-suite guidance.
7. Confirmed the real PR OPEN immediately before explicit force-with-lease to its original head; pushed final https://github.com/CodexCoder21Organization/UrlProtocol/commit/ade414089dbdc1ea13339fb7d50bf7df419d4fb4 and verified remote refs. Required build https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39615916375 is SUCCESS. Required full suite https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39615916379 is IN_PROGRESS at write time (Run Tests started 14:21:19 UTC).
8. Prompt passing proof on identical production/test bytes: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39616077887, run_attempt 1, all three unchanged tests pass their first attempts (787 ms, 2440 ms, 775 ms), zero attempt-history entries. Its only tree difference from real head is the explicit three-file workflow selection. Both disposable drafts are closed/unmerged. No manual failed-job rerun, App rerequest, merge, enqueue, deploy or publication was requested.

Relevant PRs / refs

All remote SHAs below were independently checked with git ls-remote. No uncommitted changes, stashes, local-only commits or additional worktrees remained at the checkpoint.

Full downloaded CI logs/XML are already remote in the linked Actions runs and their test-attempt-history artifacts. The evidence branch records the conclusions and full test assertion stacks, so the continuation does not need the local workspace. No build outputs or dependency caches were committed.

Deployed/published but not merged: none. This lane issued only repository, runner observation, and handoff operations; it issued no deployment, server-management or Maven publication command. The open PR remains the only implementation change to integrate, and merging is not authorized by this brief.

Final checkpoint

The remaining full-suite run is still IN_PROGRESS on the exact real head, run_attempt 1. The required build and three focused tests have passed; the lane is approaching its strict 15:01 UTC limit. The evidence branch now includes the current continuation link and latest findings. No required failure has been observed and no job rerun was requested.

Next steps

1. Re-verify current state and exact real head first. If it moved from ade414089, establish what changed before relying on this record.
2. Watch only the current required checks (bld-build, bld-all-tests) in plain mode: ~/bin/coursier launch buildwatchman:build-watchman:0.0.21 -r https://kotlin.directory -- --repo CodexCoder21Organization/UrlProtocol --pr 697 --idle-timeout-minutes 120. Use a tracked process and stop it before finishing. Never add --to-merged. Do not re-request informational App checks.
3. When the real full suite finishes, download its test-attempt-history artifact; report full pass/fail counts, failed-attempt history, and the three new regressions' results. On green, stop: do not launch more verification batches. Leave the PR OPEN/unmerged and report head SHA, fail-first/passing links and required-check status.
4. If a required check fails, read its complete log. Do not label a failure unrelated without evidence on main, do not blindly rerun it, and never increase timeouts, reduce iterations, disable tests, swallow errors or merge around a red gate.
5. Complete/archive this narrow handoff only once the remaining gate is genuinely verified. No merge, enqueue, publication or deployment is authorized.

Operational knowledge

• Runner verification is authoritative for this lane. scripts/test.bash --local-and-remote races execution on the GitHub runner against BuildTest; an unavailable remote side leaves the runner side running. The real workflow keeps --test .; only disposable evidence branches narrow selection.
• Required checks were verified live via rules/branches/main. kotlin.build (remote) and kotlin.build (kompile-remote-build) are informational, even though an older Testing doc calls the former mandatory. The explicit current procedure at https://my.externalbrain.wasmserver.com/doc/github-builders-racing-remote-ci.md and current rules supersede that old passage.
• BuildTest reported STARTING during the baseline; runner execution continued and produced valid failing/passing runtime results. Plain watchman sometimes reports GitHub HttpConnectTimeoutException while gh succeeds. It keeps polling; use bounded independent reads, at most once per minute, when needed.
• gh pr edit can hit Projects-classic deprecation; the PR description was updated with a JSON body file via gh api PATCH. The real PR description has both fail-first and passing evidence.
• rg was unavailable in the clone shell; grep/find were used. Use ~/bin/coursier rather than the broken system binary if needed. Fresh checkouts belong under the assigned workspace; read README/AGENTS first.
• Historical shared handoff is archived. Do not reopen or mark that broader mission complete to update this narrow lane.