Handoff: Complete ContainerNursery lifecycle verification and update the existing PR

Written 2026-10-22 07:14 UTC.

RE-VERIFY: This is a write-time snapshot. Recheck https://github.com/CodexCoder21Organization/ContainerNursery/pull/686 with gh pr view --json state,headRefOid,baseRefName,statusCheckRollup,mergedAt. Confirm the evidence branch with git ls-remote and use a fresh checkout. Local queued processes are not durable verification.

Current requirements (2026-10-22)

• Owner provenance: The owner reported that https://droplets.wasmserver.com/ "is super unreliable, frequently rendering various errors/notices due to bugs in UrlResolver or UrlProtocol or something else" and asked for the underlying root cause to be fixed; the ContainerNursery route stops the WUI after 5 idle minutes, so most human visits are cold starts.
• User: "You own the PR branch: push fixes to it (rebase on origin/main first; base is now main; head was cdda0c21 = main+1). Never enqueue/merge/deploy."
• User: "Evidence on wip/laneC686-evidence, never on the PR branch."
• User: "Poll GitHub no faster than every 2 minutes"; use build-watchman 0.0.21 in plain --pr mode, and confirm Actions bld-build starts after the push. It has not run on the existing head because the PR was originally opened against a work branch.
• Run only local tests. Do not change existing limits or iteration counts, skip tests, publish artifacts, or change production state. Complete suites must run through the machine-wide suite-slot.sh supplied in the lane brief. Do not inspect other slot occupants or add an outer cap to that command.
• Preserve zero-byte close for unused connections and 408 for partial request lines from https://github.com/CodexCoder21Organization/ContainerNursery/pull/700.
• Keep the final lane report to ten lines or fewer and rC686-final.md in out. Use plain wording and neutral test names.

Mission and findings

Fix the review findings on https://github.com/CodexCoder21Organization/ContainerNursery/pull/686. Full review: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneR686-review/review/laneR686-current/rR686-final.md and its sibling findings/probe. It established one P1 and no additional P2/P3.

1. Repeated start replaces the provider's only per-port lease and accept-job references. Shutdown then closes only the later lease and leaves the earlier lease and selector open. The adapted real-socket public-API probe is red 3/3 on cdda0c21: two leases, one open after shutdown, parent still open.
2. Source callback re-entry also admits another start before started becomes true. That baseline is red 3/3. A starting reservation under stateLock rejects repeated or re-entrant start before opening a new lease or replacing scopes.
3. A later public-API probe confirmed that clearing starting before source-error reporting permits re-entry before cleanup. It is red 3/3 on the first corrected source, with three leases. The final correction reserves startup until error cleanup finishes; successful startup clears it under the existing monitor. Cleanup waits remain outside that monitor.
4. Root cause confidence is high: deterministic real-socket probes use the real systemHttpsListenerSource over an inherited parent TCP socket. No simulated listener or reflection is used. Five permanent tests cover repeated start, source re-entry, source-error cleanup re-entry, stop during accept and start after stop. They verify complete state messages, actual lease closure and parent listener retention/reuse.
5. Final targeted source passes 29/29 on attempt 1, with zero histories. This includes all 21 inherited-listener scenarios, five new cases and all three request-line cases. An earlier complete sweep passed 924/924 on attempt 1 on the preceding source. The final complete sweep began writing output by 07:14:54 UTC after waiting on the shared slot. It was stopped before the session limit without final XML; no final full-suite count is claimed. Do not attribute that earlier 924 result to the final cleanup correction.
6. Reversal controls: repeated/source entry red 6/6 attempts; cleanup lifetime correction red 3/3 again. Original source error identity is preserved after cleanup in the new case.
7. Ownership table and dedicated coverage/correctness passes are in the findings. No pre-existing main test or fixture was edited. Only the fixture introduced by this lane was extended for the fifth case. Existing test limits and iteration counts remain intact.

Relevant PRs and refs

The final local code commit is f24961778d5f6408a7cd3ca46739573f040c3f3f, with source tree 973b19465d13ae330cfd6365fd7a47613f65aa56. Its preceding lane commit is ef1d3665496eee6edc1a363f8ab3e506c51f6498. Both are preserved as raw commit records plus incremental patches under source-commits on the evidence branch. They are not yet part of the remote PR history. There are no remaining stashes or uncommitted source changes in the lane checkout.

Durable artifacts:

• Findings: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/rC686-findings.md
• Complete cumulative patch against cdda0c21: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/final-code.patch
• Exact source records and incremental patches: https://github.com/CodexCoder21Organization/ContainerNursery/tree/wip/laneC686-evidence/laneC686/source-commits
• Ready why-first PR body, with the provenance retained: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/pr-description-ready.md
• Final targeted XML: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/targeted-final-v2.xml
• Final target selection: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/targeted-final-selection.txt
• Earlier complete XML: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/pre-cleanup-suite.xml
• Red baselines and reversals: baseline.xml, reentry-baseline.xml, reversal.xml, cleanup-baseline.xml and cleanup-reversal.xml in the same directory.
• XML accounting helper: https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/audit_xml.py

Deployment/publication state

None performed by this lane. Work was confined to repository code/tests/evidence and read-only GitHub/CLI help checks; no production host, container, route or Maven publication was changed. No merge or queue action was performed. Production state was not inspected in this code-review correction pass. Native systemd checks remain separately required before a later authorized deployment; prior checklist is saved at https://github.com/CodexCoder21Organization/ContainerNursery/blob/wip/laneC686-evidence/laneC686/pr-description-before.md.

Next steps

1. Re-verify current state first, including the PR head/base and evidence branch SHA. Clone fresh into your own workspace directory. Read AGENTS.md, README.md and the Testing Architecture sections Test-Driven Development and Never Calibrate a Reproducer to a Machine before changing tests.
2. Recover final code from final-code.patch on top of cdda0c21141968fd3d000eac796bd43f579cba33. For exact commit reconstruction, apply source-commits/initial-code.patch with --index, write the tree, store the corresponding raw commit with git hash-object -t commit -w, then move the local branch to that commit; repeat with cleanup-code.patch and the final raw commit. source-tree.txt provides the expected final tree. All artifacts are in the one linked evidence branch; no local-only file is needed.
3. Fetch/rebase on latest origin/main before building. Run the final selected tests by repeating --test for the scripts in targeted-final-selection.txt, with scripts/test.bash --local and --log out/targeted.xml. Parse attempt-history nodes; final success alone is insufficient.
4. Run the final complete suite only through /tmp/claude-501/-code/79f96be0-ae83-4479-b38c-8894e2722ba8/scratchpad/out/suite-slot.sh scripts/test.bash --local --test . --log out/suite-final.xml. If resuming on a different host, obtain the corresponding global-slot command from the orchestrator. Keep source unchanged while that command waits or runs. Expected discovery is 925 tests, but report actual XML counts.
5. Once exact-source complete verification passes first attempt, recheck the PR is OPEN and its head has not changed. Push the recovered/rebased code only to wip/laneN3a, with an explicit lease against the freshly verified remote head. Do not merge, enqueue, deploy or publish.
6. Update the existing PR description from pr-description-ready.md, inserting current exact-head counts. Keep its why-first provenance and footer intact. No evidence belongs in the PR diff.
7. Start coursier launch buildwatchman:build-watchman:0.0.21 -r https://kotlin.directory -- --repo CodexCoder21Organization/ContainerNursery --pr 686 --interval-seconds 120. Confirm the Actions bld-build check starts on the pushed head. Keep no local watcher alive after your final report. Never use a merge-driving mode.
8. Update findings, write the brief final report, and complete/archive this handoff only when the remaining work is complete.

Operational details

• The original provider source was cdda0c21 directly above origin/main. The PR base was main at the live read. Current lane source changes touch ten code/test/documentation paths and contain no lane evidence paths.
• Full-suite retries can conceal a first-attempt problem; positive results here have zero attempt-history nodes. Red controls contain three unsuccessful attempts each.
• Initial complete verification took about fifteen minutes. The later final command waited on the shared lock from approximately 06:42 UTC until output first appeared by 07:14:54 UTC. All lane-owned processes were stopped before the final report; restart the final complete command when resuming. This is an observed queue wait, not a diagnosed infrastructure bug. No slot-owner scan was performed.
• Build outputs, dependency caches and duplicate compiler logs were intentionally excluded from evidence. XML retains the attempt results and relevant diagnostic text. No credentials were saved.
• The canonical handoff README still describes the former Git-based flow. Current create-handoff instructions and the user's no-merge rule take precedence: use the Handoff service CLI; do not create a handoff PR.

Final snapshot 2026-10-22 07:23 UTC

PR remains OPEN at cdda0c21141968fd3d000eac796bd43f579cba33. No PR push, description update or new Actions dispatch was performed. The final suite did not complete before the session ended; all owned processes were stopped and ps was checked. The next step is fresh exact-source full verification, then the existing PR update and Actions confirmation.