Finish canonical remote verification of the UrlProtocol stall-rule repairs

Written 2026-10-21 09:11:27 UTC. Re-verify all live state before acting. The PR is https://github.com/CodexCoder21Organization/UrlProtocol/pull/729, OPEN and mergeable=true at source https://github.com/CodexCoder21Organization/UrlProtocol/commit/15c01b85747be9541723dd1f6487f9b39923c5e6. GitHub ruleset checks passed. The canonical remote log reports preparation failure before tests; its published check/run summary was still in progress / BUILDING at the last observation. No canonical pass is claimed.

Direction and constraints

The owner requirement is verbatim: “Progress at a minimum rate counts”. TinySite uploads stalled partly because UrlProtocol retired connections that were still writing. The requested rule renews the ten-second stall grace when same-child successful DATA sustains at least the configured floor (default 4 KiB/s); below-floor trickles remain subject to retirement.

The user says “Do NOT merge, enqueue, publish or deploy.” Never raise timeouts, reduce iterations, weaken/skip tests, use reflection, or rerun CI blindly. Do not change the shared 8 MiB pool, per-peer caps, or the paused capacity-wait countdown policy pending an owner decision. Keep testReview718PartialWritesCannotKeepPausedBudget and testWriteStuckConnectionRecoveredJustBeforeGraceIsNotRetired unchanged. Read ~/.claude/CLAUDE.md and https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md before work. Check disk and stop below 10 GB free. Stop only recorded own process IDs after identity verification; delete only owned ~/.aibuildcaches entries containing the lane name. Every commit ends Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>. Fresh clones belong under workspace/. Before local builds inspect uptime/free, build one at a time with capped memory, and preserve the 20-minute deadline.

Delivered source work

1. Record response lifetimes before mux handoff, using a per-mux FIFO rather than scanning in-flight responses. Bound tracked DATA so Yamux/Mplex successful incremental transport progress can count after the root becomes non-writable. Real public-API, ManualClock tests fail before the repair and pass afterward, including 8 KiB per simulated second and multi-window cases. Ordinary traffic, payloads, flags and promise aggregation are preserved.
2. Qualifying DATA moves only the deadline. The existing due callback re-arms after movement. Public timer-count observation fails against the previous per-frame scheduling behavior.
3. Include initial active idle time; exclude the existing capacity suspension from rate sampling while preserving pre-pause active idle. Publish pause state before cancellation can re-enter. The resumed capacity reproducer failed all three baseline attempts.
4. Saturate rejected-expiry retry arithmetic, cover the final clock timestamp, and classify root-close timer activity by registration/phase rather than a coincidental offset. Missing actual-child mux now reports the exact cause and closes before invoking the handler; direct-root bindings remain supported. Missing-mux reproducer failed all three baseline attempts.
5. A whole response completing at/after an active cutoff cannot replace a due owner and give queued same-child output fresh grace. That reproducer failed three baseline attempts. Accurate physical success remains successful and suspended grace policy is preserved.
6. Independent source and test reviews were completed against the actual final patch and native XML. A proposed physical-success/result-flag problem was refuted and withdrawn; cleanup flags and logical result CAS are separate.

Source is rebased onto push-time main https://github.com/CodexCoder21Organization/UrlProtocol/commit/a15cfb48d9a038271b737ec4919d4ec508f55402. Version 0.0.1431 was first free after checking published metadata, main and all 77 open immutable heads; https://github.com/CodexCoder21Organization/UrlProtocol/pull/727 reserved 0.0.1430. Force-with-lease push happened only after checking OPEN, against explicit old head ea6717f6b92ec2dd961e5926f1558e50c832c14c. No production source changed after final tests/push. The latest PR description was updated and read back exactly.

Native results and failed preparation attempts

• Final targeted native XML: 50 unique scenarios, 50 first passes, zero retries. All 48 new/changed tests plus both unchanged protected tests are included.
• Exact pushed-head full GitHub suite: 2,873 unique scenarios, 2,873 first passes, 2,873 attempts, zero retries or preparation errors. Eighteen build-rule rows passed (20 executions). Run https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39560502094/attempts/1; original artifact https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39560502094/artifacts/12331420231. Independent recount confirmed byte-identical XML and all 50 targeted names exactly once. The race used its LOCAL result; remote health/connect failed with STARTING / recovering local state. Do not call that a canonical remote pass.
• The one local-host full-suite invocation failed compiler preparation with repeated heap exhaustion at the capped 768 MiB heap: zero scenario executions, no XML. Logs, histogram and thread samples are durable. Four in-process Kotlin compile groups shared the heap; no retained-root leak was proven. The recorded runner was stopped and reaped. No heap/timeout increase, second local full suite, or custom batching workaround was used.
• Historical experiment accounting retains intended failures, fixture assertion corrections, compilation errors and retry history. Do not replace first failures with final green. The previous 5h21m remote check https://api.github.com/repos/CodexCoder21Organization/UrlProtocol/check-runs/118167126846 failed admission after all workers were occupied, 12,940 seconds in the deferred queue and a 19,259-second local submission deadline: zero admitted remote attempts. The cause of the worker backlog was not established.

Per-test first attempts and full XML: https://github.com/CodexCoder21Organization/UrlProtocol/tree/a72cc707e112dfdae2a8ff645a7e06147cd8f715/investigation/r102 . This evidence also contains complete local preparation traces and independent reviews.

Remaining canonical gate: failed shared preparation

The canonical check https://api.github.com/repos/CodexCoder21Organization/UrlProtocol/check-runs/119122378116 appeared automatically at 08:34:13, with source 15c01b85747be9541723dd1f6487f9b39923c5e6 and existing run https://buildtest.kotlin.build/run?id=48f1ffcd. This lane did not request or rerequest it.

Its final log reports at 09:05:26: TIMEOUT: Shared workspace module cache preparation exceeded its deadline. Elapsed: 1249375ms. Deadline: 1200000ms. All ten shards stopped; the nine followers' droplets were never created. Fourteen successful build-rule rows span 08:46:26–09:03:20; the main Maven rule passed in 525,371 ms. The snapshot does not attribute the remaining preparation time, or prove that packaging alone consumed it. Zero tests executed: whole aggregate was 0 completed / 0 running / 2,873 pending, structured attempt history empty. No public original-native-XML route was found in pinned API/WUI source; JSON is not XML.

At the last observation the run page itself warned that its log had ended while the stored summary still said BUILDING; the GitHub check remained in progress. Verify the final published conclusion before acting. This is preparation failure, not a runtime test failure or proof of a source compile error. No retry or deadline change was requested. Diagnostic evidence and exact failure log: https://github.com/CodexCoder21Organization/UrlProtocol/blob/dc873db5dcb8029c22cb429f80e745929a03dbaa/investigation/r102/canonical-final-assessment.md .

Testing Architecture explicitly requires canonical remote verification regardless of branch protection: https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md#kotlinbuild-remote-must-never-be-red . An earlier lane interpretation of the missing ruleset gate was wrong and is corrected in the PR/findings. The related BuildTest recovery handoff remains open: https://www.handoff.wasmserver.com/handoffs/hf-2026-10-21-establish-the-original-buildtest-feed-failure-and-finish-one-accepted-public-build . Do not assume its older admission problem is the same as this preparation deadline failure.

Wall-clock finding: explanation option exercised

No monotonic fix or wall-step test pass is claimed. Pinned Clock 0.0.16 combines wall reading and absolute wall scheduling; SystemClock uses Timer and ManualClock has one domain. nanoTime comparison alone leaves the scheduler vulnerable to a wall step and breaks manual controls. The smallest complete change is an upstream elapsed read plus elapsed-deadline scheduler and independently stepped wall/elapsed ManualClock, then injection into factory/direct bindings/relay-first roots. It requires an upstream API/artifact change; publication is forbidden in this brief. Detailed proposal: https://github.com/CodexCoder21Organization/UrlProtocol/blob/15c01b85747be9541723dd1f6487f9b39923c5e6/investigation/r102/monotonic-clock-assessment.md . The brief explicitly allowed explaining a separate PR, and this is that outcome.

All remote branches and live-code accounting

• Current PR source: https://github.com/CodexCoder21Organization/UrlProtocol/tree/fix/r83-outbox-minimum-progress-rate at https://github.com/CodexCoder21Organization/UrlProtocol/commit/15c01b85747be9541723dd1f6487f9b39923c5e6 . Open PR above; nothing merged/deployed/published by this lane.
• Resume/source checkpoint: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/r102-rebased-review at the same 15c01b85747be9541723dd1f6487f9b39923c5e6.
• Superseded reproduction branch: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/r102-review-reproductions at https://github.com/CodexCoder21Organization/UrlProtocol/commit/eaa0097bb25576f96b72dc2b01af00ff90f31118 . Do not resume it instead of the rebased source.
• Native evidence/diagnostic branch: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/r102-native-evidence at https://github.com/CodexCoder21Organization/UrlProtocol/commit/dc873db5dcb8029c22cb429f80e745929a03dbaa . Production files match 15c; added files are investigation records. Earlier stable milestones: https://github.com/CodexCoder21Organization/UrlProtocol/commit/a72cc707e112dfdae2a8ff645a7e06147cd8f715 and https://github.com/CodexCoder21Organization/UrlProtocol/commit/82d91741384a2ce54eced0579d474fe9e7ae5fd2 .

Cleanup and next actions

All three local clones and the sole owned r102 cache were removed. The canonical observer was stopped after verifying PID 1588441, start ticks 268847679 and command, then reaped with exit 130. Fresh audit: zero recorded lane processes, clones or lane caches remain. Cleanup proof is on evidence dc873db5. No local-only source work, stashes, watcher or build is left. Local out/ is retained as an additional record; no JARs were retained there.

1. Recheck the canonical published status and retained final log; never wait indefinitely on a stale BUILDING projection.
2. Establish where the unchanged shared-preparation budget is consumed using the existing timing/log evidence. Do not label this a runtime failure or simply increase its deadline. Any infrastructure code repair needs its own failing test and authorized scope.
3. Once that preparation problem is understood/resolved, obtain one accepted canonical run without blind retries, count actual first attempts, update/read back the PR, and close this handoff only after the required remote result is genuinely green. Source/test repairs do not need to be redone.

Read-only observations: legacy /api/test-results returns only the first 100 rows; use /api/test-progress.summary for whole-run totals. Paging is 1-based and capped at 500. A bounded /run HTML page includes the last 256 KiB log and its current byte cursor; walking 64 KiB SSE chunks from an old cursor can miss the current tail. /api/health can be stale dashboard data and /health is WUI liveness, not a fresh backend readiness check. Transient 503 is not proof of executor failure. Preferred Fabric forensic tooling lacks the default mTLS directory here; no SSH fallback or server mutation was used. The challenge reporter auto-merges, so it was not invoked under the no-merge constraint; the observations are preserved here instead.