Handoff: Finish required full-suite verification for UrlProtocol listener retirement

Written 2026-10-22, 08:00:20 UTC.

RE-VERIFY: This is a write-time snapshot. Re-read https://github.com/CodexCoder21Organization/UrlProtocol/pull/826 and its current head/checks before acting. A fresh GraphQL PR query wins over this document. REST quota is shared and has returned HTTP 403; prefer GraphQL and keep status reads at least 60 seconds apart.

Design decisions in force

The 2026-10-22 brief requires: “retiring a listener generation (any reason: PONG timeout, admission failure, replacement, close) closes that generation's stream and settles every call/transfer outstanding on it promptly with a descriptive error, so each grant is returned exactly once; a new generation never inherits or waits on the old one's grants.”

“No timeout raised, no load reduced, no assertion weakened.” “Do not merge, enqueue or publish.” The current required checks are bld-build and bld-all-tests; the two kotlin.build App checks are informational. The original runner override requires verification on the GitHub runner, and prohibits subagents. Preserve all these requirements. Do not restart completed verification batches.

Mission and remaining work

Finish verification of the listener-retirement fix in https://github.com/CodexCoder21Organization/UrlProtocol/pull/826, head 66ad1e7c1a883986d0c8eab137e49cb93b463aec. The continuation completed the requested attempt audit, retirement-path table, PR description, closed evidence drafts and evidence checkpoints. Only the required full-suite result/native attempt counts and final closeout remain.

At 08:00:20 UTC, the product is OPEN/unmerged, bld-build is SUCCESS, and bld-all-tests is IN_PROGRESS. The active suite is https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39737331931/job/119686011179. It began around 06:59 UTC; build-watchman reported a recent repository median of about 75 minutes, so there is no evidence of a stall. Continue observing this run rather than starting another one. The prior broad handoff was already archived before this lane started; this handoff covers the new narrow verification continuation and does not reopen that archived record.

What was found and done

1. The existing change fixed one mechanism: a busy Yamux child could prevent keepalive PING admission while its physical connection remained writable. PING now uses the existing bounded queue; deadlines, PONG handling and workload are unchanged.
2. Independent review exposed a separate legitimate-retirement path. Clearing selected relay state and normal listener exit left the old stream open. Relay-side response futures also survived provider departure until their existing 30/45-second deadlines. Ten held response-chunk grants could therefore block a healthy sibling provider on the requester's root.
3. The adopted public-network probe holds ten genuine chunk fetches, drops two PONGs, restores the wire and requires prompt retired-caller errors plus exact-byte healthy-provider delivery before cancellation. The original reviewed code fails it. Gossip retirement, explicit service close and generation ownership also have failing-first evidence.
4. The fix closes the captured generation outside lifecycle locks and correlates pending responses with the exact sender. Departure settles remaining calls after preceding decoded frames and before catalog callbacks. Transfer cleanup returns each grant once; the shared budget is not reset. Late closes cannot settle a newer stream's calls.
5. Dedicated test/code review checked exact messages/bytes, gate/resource cleanup, sender implementation inventory, close-versus-publication and received-frame ordering. A first review caught and corrected ordering before final verification. Product source is unchanged since the final head above.
6. Final evidence workflow https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39737434016 completed successfully on workflow attempt 1. Native XML: testPongTimeoutReturnsSharedChunkCapacity 20/20 first-attempt passes, 20 total attempts, zero failures; unchanged testRelayedLargeAnswersWaitForOutboxSpace 20/20 first-attempt passes, 20 total attempts, zero failures; three neighbors 3/3 first-attempt passes, zero failures.
7. The same workflow's exact-source baseline replaces RelayService.kt with reviewed commit https://github.com/CodexCoder21Organization/UrlProtocol/commit/2a1440d4182f62c0fcf5877c590192f476df41fe. All four scenarios fail all three built-in attempts (12 failures total). Primary/gossip/service-close fail prompt retirement settlement; generation ownership gets TimeoutException instead of the required prompt ExecutionException. Original failing-first run: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39736017053. Native XML/full logs are archived remotely.
8. Important correction: attempt-history elements are siblings of test at the XML root. Earlier findings incorrectly said baseline scenarios had one attempt; the continuation explicitly corrected this. Never infer first-attempt success from a green job. Audit the root-level histories.
9. All four repetition artifacts name actual runner merge commit https://github.com/CodexCoder21Organization/UrlProtocol/commit/f4f4a85c7cdec5795ab34875f17b73b3b59ea353. Whole-tree diff against the product head lists only the two disposable workflow files; all product code/tests/config/docs are identical. The original large-answer workload also compares unchanged against the reviewed commit.
10. Product PR description already opens with why the change exists and describes both mechanisms, complete twenty-run evidence, root-history audit, ownership table and the running suite. It only needs its last validation paragraph updated after suite completion. Evidence https://github.com/CodexCoder21Organization/UrlProtocol/pull/833 and baseline https://github.com/CodexCoder21Organization/UrlProtocol/pull/832 are CLOSED/unmerged.

Relevant PRs / refs

All remote heads were verified with git ls-remote. Every local branch commit is reachable remotely; no stash or uncommitted product work remains.

Records directory: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/s84-records/investigation/s84. attempt-audit.json includes each record's file, first-attempt outcome, attempt/failure counts and XML hash. final-repetition-evidence.tar.gz, final-baseline-evidence.tar.gz and the earlier failfirst-evidence.tar.gz preserve full evidence. retirement-paths.md contains all retirement paths and source anchors. original-brief.md, continuation-brief.md, lane-rules.md preserve the inputs.

No production deploy, Maven publication, merge or queue operation was issued in this lane; no code was put live by this work. The product remains unmerged as verified above. Local checkout and its build-cache entries are removed at closeout; recover from these remote branches, not local paths.

Existing-test edits

Only testRelayRefreshGenerationOwnershipSurvivesCrossGenerationCloses changed in the retirement work: old behavior deliberately kept the old stream/refresh pending after send failure; now it requires prompt complete-message failure at retirement and preserves the same failure object across later closes. All newer-generation isolation assertions remain. The exact-source baseline demonstrates that this stronger behavior fails without the fix. The original large-answer workload is unchanged. An unrelated long-poll test-ordering change entered via main during rebase, not this lane.

Next steps

1. Re-verify current product state/head first. If it is still this head, do not rebase/push or rerun the already completed twenty-run evidence simply to monitor. Use plain build-watchman if REST works; never --to-merged. If REST quota prevents it, use bounded GraphQL status reads, at least 60 seconds apart.
2. Wait for the active required suite at https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39737331931. If it fails, inspect its full logs and reproduce the exact failure under the runner override before fixing; do not blindly rerun. Do not call a failure unrelated unless shown on main.
3. Once complete, collect workflow run_attempt plus test-attempt-history artifact using gh run download. Audit the full native XML: root test elements and root attempt-history grouped by name. For tests without history, their single test record is the attempt. Report total tests, first-attempt passes, total attempts and failed attempts; list any failing names/messages explicitly.
4. Update only the validation paragraph of https://github.com/CodexCoder21Organization/UrlProtocol/pull/826 with the final required-suite result/counts. Old gh pr edit can fail due deprecated projectCards; use updatePullRequest GraphQL with a structured body/file. Product node id is PR_kwDOQugs888AAAABJ8niig. Do not modify product code unless evidence requires a fix.
5. Push final findings, required-suite XML/logs and audited counts to the records branch, verify the push, close this handoff when the assigned verification is truly complete, and remove your checkout/cache. Stop at green required gates; no extra verification batches. Do not merge, enqueue, publish or deploy.

Reusable knowledge and documents read

Read the original brief/common rules, repository README, cached Testing Architecture/Engineering Philosophy sections, current racing-CI procedure, watch-build/status-report/create-handoff skills, and PlanRepository/handoffs/README.md. Links: https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md and https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/PHILOSOPHY.md. The brief's runner/current-check overrides take precedence over older local-first/remote-check-required passages. The handoff README's older git-PR merge flow conflicts with the current service-only skill and explicit no-merge instruction; use handoff-cli, not a handoff PR.

GitHub REST quota is shared; prefer GraphQL and local git. The prior plain watcher was stopped after HTTP 403. All local watcher processes were stopped. No new failure is inferred from elapsed time or from informational remote check failures. A failing-first preparation run hit git safe.directory; that preparation error is not test evidence. The fixed evidence runner configures safe.directory for the baseline replacement command.