Finish the full UrlResolver gate for generation-owned released values

Updated 2026-10-21 17:23 UTC. RE-VERIFY before acting: check the PR state/head/checks with gh pr view, and the specific job conclusions below with gh api. All state is a write-time snapshot.

Design decisions in force

The lane brief requires: “Releasing a registration never clears (or makes unreadable) stored data that any reader can still reach.” This includes worker/external publications, callbacks, recalculation, reconciliation, generation reuse and shutdown/orphan drains. Data retention must be bounded. No new/raised production timeouts, callbacks/I/O under lifecycle locks, merges, enqueue, deployments or artifact publication. Keep previous tests; never weaken assertions, reduce iterations or skip tests. Verification runs on GitHub runners per the explicit common.md override; only bld-build gates UrlResolver, and remote App checks are informational and must not be re-requested.

Current mission and implementation

Complete https://github.com/CodexCoder21Organization/UrlResolver/pull/1250 through its full required green gate, then leave it open/unmerged. Original effort adds extreme-condition end-to-end tests that fail first and fixes the exposed bugs. Current product is https://github.com/CodexCoder21Organization/UrlResolver/commit/2ca2bce25eb9197636ba0f5841719e724b4d9dff, rebased without conflicts on https://github.com/CodexCoder21Organization/UrlResolver/commit/c5bc50c6ca5763271e4294c1ea3f34073e4fb333 . The latest full gate is PENDING, so the task is not done.

Review found two server writes that erase data while retained proxies can still read it: the FRESH/no-worker release shortcut, and the clear after final publication. An external publication commits FRESH before its onNewValue callback completes; a busy consumer bypasses its cached value while that publication is pending, then reads the cleared cell and gets null. Earlier worker-only drain accounting missed externally owned and future readers.

The repair removes both clearing writes. Each generation's calculator captures its own non-null value cell, and release removes only live registration/admission/index references. Final worker publication remains for existing notification/failure semantics, but its bookkeeping is proxy→Unit and never owns data cleanup. Only live marker/push commits replace the cell under the existing lifecycle lock. Reused ids create different proxies/cells. This makes every read safe independently of cache/worker/publication timing. The bound is one latest backing record per reachable proxy generation, no history, plus Observable's normal cache and actual in-flight reader references. GC reclaims the cell with its last reachable owner; the calculator captures no handler.

The exhaustive read-path table, proof map and exact assertion edits are in https://github.com/CodexCoder21Organization/UrlResolver/blob/wip/s47-evidence/handoff-artifacts/s47/proof-map.md and findings.md beside it. Client manager behavior is unchanged; original bounded threads, callback isolation, latest value, reconciliation freshness and close ordering remain covered.

Tests, the full-run finding, and repair

Eight new tests cover held external publication during close/shutdown/id reuse, cold/reconciled/reused-marker recalculation, external dispatch, and a result RPC retaining its parameter proxy. Seven existing fixtures were first changed from null-after-release to exact final values. Their old-runtime full baseline was 2307/2322 with exactly fifteen intended failures, no others: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39625632149/job/119309989759 . Focused fifteen-case records agree. Same new test binaries fail old/pass repaired handler.

The earlier full product then ran 2318/2322, all fifteen targets passing but four other fixtures still expecting null: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39625886014/job/119310894979 . This was our missed assertion audit, not an unrelated flake. The four fixtures are now corrected:

• FreshHandleForSameConnectionCanUpdateParameter: retain exact queued-before-close; a later must-not-revive push cannot change it. All connection/order/count/iteration checks remain.
• ReviewReconciliationEqualityCannotPublishAfterShutdown and ReconciliationEqualityDoesNotHoldLifecycleLock: retain exact original object identity; later pushes cannot replace it; original equality execution/cross-thread completion checks remain.
• BulkInvalidationCallbackCannotPublishAfterShutdown: the first callback is deferred, so its second commit could legally precede shutdown. Hold caller-owned second-value equality until the real first callback completes shutdown, forcing the commit recheck. Require original second object identity, one invalidation and rejection of a later push. Existing five-second budget is reused.

All four corrected fixtures fail old handler at intended retained-data assertions: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39638106348/job/119354118038 . The exact four files pass current handler: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39638226730/job/119354570158 . XML independently confirms 4/4 negative versus 4/4 positive, one test per file. Three pure-handler cases additionally flip on the same standalone binary. Their positive diagnostic's duplicate full job was cancelled only after proof preservation; it is not a full pass.

Nineteen final target files match between product and current tests-only branch. Earlier 24/24 positive cases remain preserved at https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39623788759/job/119303813982 ; current handler code is unchanged. Main's independent connection change and five tests arrived during fixture repair, so old 2322 totals are historical. A repository-wide follow-up search of assertNull around calculateCurrentValue leaves only genuine-null checks and unrelated failure-object assertions. No timeout, iteration or existing outcome assertion was loosened. Separate test/code review passes are complete; the runtime ownership fix did not need another change.

Relevant remote branches

All rows are in CodexCoder21Organization/UrlResolver. No source is deployed or published; all product work remains unmerged.

Exact remaining work

1. Re-verify current heads and job states. Product full: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39638117971/job/119354162693 . Current tests-only full: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39638106348/job/119354118552 . Both were executing full tests at last observation. Do not call this green from focused proof.
2. Follow product with plain ~/bin/coursier launch buildwatchman:build-watchman:0.0.21 -r https://kotlin.directory -- --repo CodexCoder21Organization/UrlResolver --pr 1250 --idle-timeout-minutes 120. Never --to-merged, never enqueue. App dispatch warnings are informational; do not re-request them. Direct gh job APIs were used after watcher HTTP connection errors.
3. On terminal jobs, collect complete logs/XML and exact head. handoff-artifacts/s47/collect-full.py accepts runId jobId label expectedHead and writes notes/<label>. Product expected head is 2ca2bce25eb9197636ba0f5841719e724b4d9dff; baseline is 784fa28778ff3f8f92f89377b18a62216d12b827. Expect main's five extra cases in the new totals, but verify actual count. If any required failure appears, investigate at its cause, never weaken assertions/timeouts or blindly rerun.
4. After the final full negative proof is saved, close the evidence draft, never merge it. After the exact final product full is green, update product description (currently explicitly PENDING) with actual counts/links, checkpoint all final records, and report requested head/read table/design/bound/test proofs/eleven existing-fixture edits/check status. Do not merge, enqueue, deploy or publish.
5. On final full green, checkpoint the complete result and complete this scoped handoff. S47 stopped at the required time-box checkpoint; all local watchers exited, both assigned clones and their build outputs were removed, and the exact cache entries were already absent. Remote full CI remains intact. Evidence includes watcher logs and complete standalone sources, but compiled JARs are intentionally omitted. Fresh-clone all work for continuation. No full green has been claimed.

Operational notes

Workspace was a fresh clone under s47-root/workspace/UrlResolver; Observable clone is read-only. No agents were spawned. No local full kompile suite ran; bounded standalone probes compiled exact handler/HandlerRequestBudget against published resolver0.0.1171/protocol0.0.1429/Observable0.3.25. All tests use real public APIs, no mocks/reflection or test-only visibility. No rebase conflict occurred. Findings path is cx/out/s47-findings.md, separate from final output. The original shared handoff was already archived; this scoped record is the continuation. Do not reopen the old shared handoff.