Handoff: Verify the latest UrlProtocol refusal-pool CI and finish the lane receipt

Written: 2026-10-21 18:34:56 UTC.

RE-VERIFY: This is a write-time snapshot. Run gh pr view https://github.com/CodexCoder21Organization/UrlProtocol/pull/772 --json state,headRefOid,statusCheckRollup,mergedAt and inspect the current required run before acting. Fresh state wins. This handoff leaves the PR open; it does not authorize merging, enqueueing, publication or deployment.

Design decisions in force

The 2026-10-21 user brief says, verbatim:

R1. Every reply-space reservation — normal replies, error replies, and the over-limit answers — is charged to the pool of its own request kind (long-poll pool for anything about a long-poll; ordinary pool for ordinary requests). List every reservation site and the pool it uses.

R2. Every release of reply space into a pool wakes the requests waiting on that pool (all of them, or enough to use the freed space); no waiter depends on an unrelated completion to proceed. List every release site.

R3. Long-poll over-limit answers stay bounded (their pool limits them) and never wait on the dispatcher or on space held by running handlers.

R4. Everything already proven still holds (ordinary 64 + reply bounds unchanged; undeclared handlers exactly as on main; exact release on every path; pool identity kept).

Do not merge, enqueue or publish. Time box 2.5 h.

The lane follows the brief's GitHub-runner override: do not block on local kompile execution on this host. Only required bld-build and bld-all-tests gate completion. Informational remote App checks do not gate and must not be rerequested. No disabled/weakened tests, timeout increases, iteration reductions, reflection, mocks, publication or deployment. The existing normal/priority payload-byte pools remain shared, as specified by the original PR/README; every request's pre-reserved completion/error space uses its request-kind pool, including normal/error replies and not-started answers.

Mission summary

Finish the review follow-up for https://github.com/CodexCoder21Organization/UrlProtocol/pull/772. The underlying user goal is ordinary requests continuing while declared long-polls wait. The prior head already had independent 192 poll slots and 64 ordinary slots, but the reviewer found that 24 queued long-poll refusals used all 1.5MiB of ordinary completion space, and closing their child returned bytes without waking a sibling request.

Implementation, fail-first proof, passing implementation proof, and two review passes are complete. Only the latest head's required full-suite receipt remains. The latest head is 45824c3cf224f929283815c4df9cde2f733333b1; build https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39647370387 is SUCCESS. Full suite https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39647370375 is IN_PROGRESS. The lane is closing out at its 2.5-hour time box after two clean main rebases. This is a focused continuation; the old aggregate handoff was already completed before S52 and is not reopened.

What was found and done

1. Exact mechanisms, confirmed by real hosts before the fix. rejectLongPollBeforeDispatch called tryReserveFailureSignal with default longPoll=false. Its queued refusals consumed ordinary FAILURE capacity. takeTerminalFramesForClose released entries but notified reservation waiters only if terminal frames were produced; refusals set preserveOnClose=false, so a sibling stayed asleep. Audit found the same missing wake when isolateFromProcessWideBudgetLocked returned shared failure bytes without a reply completing.
2. Fail-first evidence. Draft https://github.com/CodexCoder21Organization/UrlProtocol/pull/785 is CLOSED, not merged. Run https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39633275244 ran the unchanged reviewed production source 84492905d4133658a9d14e6237420b27d1823c27 plus four test changes. All four failed at intended runtime assertions, no compile error: ordinary sibling blocked behind 24 exact64KiB refusals; child close failed to wake its sibling; pausing a root failed to wake a shared-space waiter; full accepted-poll completion space still produced a refusal from ordinary space instead of closing only the excess child.
3. Fix. Refusal reservation explicitly passes longPoll=true. Local failure entry release, reservation detach, and shared failure-byte release call a notification helper through the existing notification scope. scheduleDrain uses withRpcNotificationMonitor so isolation wakes occur after ownership monitors exit. Existing explicit notifications remain. Count permits, byte limits, immutable pool identity, writer turns, observer labels, public API and relay defaults are unchanged. README describes accepted/refused polls sharing the poll completion pool and prompt child close if handlers hold all bytes.
4. Tests. Three new standalone real-host scripts: testLongPollRefusalsLeaveOrdinarySiblingCapacity, testClosingLongPollRefusalsWakesSiblingCapacityWaiter, testPausingLongPollReservationsWakesSharedCapacityWaiter. First fills2464KiB on a paused child while192 polls remain suspended and requires ordinary sibling entry. Second releases holder polls before submitting an ordinary and poll sibling, suspends the one that can enter, closes only refusal child and requires both to enter without another reply completing; it works before/after pool selection, so the pool fix cannot hide the wake bug. Third fills exactly3MiB with191 real polls (9616KiB on A,94*16KiB+32KiB on B), leaves one count slot, and requires pausing A to wake request192 without any handler completing.
5. Only lane edit to an existing test: testDeclaredLongPollFailureReservationsLeaveOrdinaryCapacity changes its two excess probes on full3MiB poll completion space to open a new child and require typed CONNECTION_CLOSED, preserving the ordinary stream. Previously they required LONG_POLL_NOT_STARTED by borrowing ordinary bytes. Every cohort count, refill/recovery assertion, timeout and iteration count remains. The modified test failed before the fix and passes with it. No other test was edited by S52. Upstream main later changed one separate clock test; that is not a lane edit.
6. Passing implementation evidence. https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39638518935 passed at exact source 489b42ef532a4eecf02a7ba18c9b07d270ca31ce: downloaded XML has2891/2891 tests and18/18 buildrules success=true, tags only tests/buildrule/test, no retry/attempt-history children. All14 long-poll scenarios and all17 unchanged testReview718 ordinary-bound/lifetime guards pass. New isolation7781ms, close wake9961ms, shared-space wake10703ms, modified full-byte test11123ms. Exact source has a durable branch below.
7. Main rebases. First main advanced to9635bf080 after https://github.com/CodexCoder21Organization/UrlProtocol/pull/697 merged; nineteen commits rebased without conflicts. New encoding-error replies keep the same pre-acquired completion reservation and response-owned permit. Then main advanced to5e3318589 via https://github.com/CodexCoder21Organization/UrlProtocol/pull/781, changing only testRpcReadIdleUsesHostClock.kts to wait for the renewed interval before advancing ManualClock. Rebased again without conflicts, range-diff all19 commits equal. Every production file, README and S52 test on latest45824c3c is byte-identical to fully passing489b42ef5; only that upstream clock test differs. The old passing suite is not claimed to satisfy latest-head required CI.
8. Dedicated reviews. Separate test-comprehensiveness and code passes checked real loopback hosts/port0, exact budget fills, cleanup, no unrelated wake source, bounds, cancellation/close/oversize/conversion paths, all reservation/release callers and lock-safe re-entry. No remaining identified code/test finding. Only final latest-head gate remains.

Reservation-site table

All host factory locations are in src/foundation/url/protocol/Libp2pHostFactory.kt.

Release-site table

Relevant PRs / refs

Nothing was deployed, published, merged or enqueued by S52. Session actions were source/test commits, branch pushes, one draft PR (closed), PR-description edits and read-only CI/metadata checks. No deployment or artifact-publication command was executed. No service version changed.

Raw runner logs/XML remain downloadable from the linked Actions runs (gh run download ... --name test-attempt-history; negative stack traces also in gh run view ... --log-failed). They were not duplicated into source control as test artifacts. One-off test-generation helpers are superseded by committed tests; downloaded documentation copies have authoritative upstream URLs. No build output, dependency cache, credential file or local stash is needed. The S52 checkout/cache and owned local watchers are removed/stopped and verified: checkout and exact cache absent, watcher PID887042 absent; no local build/test or active goal.

Next steps

1. Re-verify PR state/current head and required checks first. If someone moved the head or merged the PR, do not push to the old branch. No merge/queue/publication/deployment is authorized.
2. Follow only the current required gates with a tracked plain-mode watcher: timeout 2h ~/bin/coursier launch buildwatchman:build-watchman:0.0.21 -r https://kotlin.directory -- --repo CodexCoder21Organization/UrlProtocol --pr 772 --idle-timeout-minutes 120. Never --to-merged. The original watch is stopped on handoff; do not assume it still runs.
3. If latest full suite is green, download test-attempt-history for the actual current run and verify its head, test count, all14 long-poll tests, all17 ordinary718 guards and attempt history. Expected count2891 if main/head still match this snapshot. Update PR description and findings with the latest exact run link/count, then complete this focused handoff. Stop; no extra verification batch and no merge.
4. If a required job fails, read gh run view <id> --repo CodexCoder21Organization/UrlProtocol --log-failed. Follow runner-only fail-first verification. Fix an actual code/test issue at its cause; no blind requeue, no timeout/count changes. Prove a different failure on main before calling it unrelated; the brief permits only one failed-job rerun after that proof. Do not rerequest informational App checks.
5. No source checkout is needed merely to read checks/artifacts. If a source change is necessary, clone fresh beneath your own workspace, read README/instructions, fetch/rebase before a build/push, confirm the PR is OPEN before updating and use --force-with-lease. All code needed is on the branches above.

Reusable / operational knowledge

• Required workflow commands use --local-and-remote, kompile-cli0.0.124, and GitHub runner execution can finish independently of BuildTest. TESTING.md's older remote-App/local-first paragraphs conflict with the explicit lane override; follow the override.
• The installed gh's pr edit has an old Projects GraphQL issue; update multiline bodies with structured JSON through gh api -X PATCH .../pulls/772 --input file.json. Do not print tokens.
• rg is unavailable; grep/find work. No local build/test was started in S52.
• Handoff service is the authority. Historical aggregate handoff was already completed2026-10-21T06:53Z; this focused continuation is distinct. Canonical README still describes retired git PR/merge steps; current create-handoff skill and the user's no-merge instruction override those.
• No user question or approval is pending. The only remaining condition is the latest required check finishing green.