Handoff: Finish UrlProtocol 0.0.1431 consumer verification and CI failure attribution

Written: 2026-10-22 07:08 UTC.

RE-VERIFY: This is a snapshot. Check both linked PRs with gh pr view <url> --json state,headRefOid,statusCheckRollup,mergedAt, check all named Actions runs, and verify branch heads with git ls-remote before acting.

Lane s88 — consumer snapshot, 2026-10-22 09:43 UTC

RE-VERIFY: https://github.com/CodexCoder21Organization/UrlResolver/pull/1424 is OPEN at 2c334bb18294d23926cbe15ae6db53a89b4289cb, unmerged and not queued; required bld-build is SUCCESS. This narrower update supersedes the older consumer heads/pending-full-suite claims below. The s85 section and earlier publication/protocol history are retained as their own dated snapshots.

Remaining work

Finish attribution of testPersistentRelayFailureRetainsPreDialSelection using the fixed twenty-run exact-main/head comparison: https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39756529385. Both jobs are IN_PROGRESS at this snapshot. Do not call the full result first-attempt clean: this one case failed first, then passed. No source repair is justified before identifying and reproducing the mechanism, and no extra allowed error string, timeout change, retry, or workload reduction is authorized.

Pre-registered classification: an identical observed main failure proves that behavior can occur without adoption. Compare failed-first counts explicitly; reviewed minus main >=3/20 is flagged adoption-associated. Clean main trials alone do not prove a reviewed failure unrelated. A smaller difference is reported without converting absence of evidence into an unrelatedness claim.

Mission, changes and completed proofs

The lane brief asked to migrate all ManualClock/custom Clock fixtures affected by protocol 1431, preserve assertions/budgets/workload, prove relevant product mutations still fail and each migrated test passes twenty clean runner trials, push/rebase the open PR, and audit an exact-head full suite. The brief says “Time box 2 h” and “Do not merge or enqueue.” Publishing/deploying is not authorized here.

The audit found 463 actual simple-Clock constructions/custom implementations, 155 persistent/RPC candidates and 65 detailed relay/circuit/catalog candidates. Only testPersistentRelayReplyLossLogsSelectedRecord additionally needed migration; the Long.MAX fixture was already migrated. Five extra named clock constructions are HierarchicalClock metadata clocks, not transport waits. Detailed table: https://github.com/CodexCoder21Organization/UrlResolver/blob/wip/s88-audit/handoff-evidence/s88/clock-audit.md ; complete inventory, every test edit, reviews, invariant table and full stacks: https://github.com/CodexCoder21Organization/UrlResolver/blob/wip/s88-audit/handoff-evidence/s88/findings.md .

The reply-loss fixture formerly advanced its frozen clock only after a forwarding-failure log, while protocol 1431 now needed that clock to expire its relay wait before producing the log. It now observes the public Clock registration at the unchanged 5000ms deadline, advances that exact budget, and chooses relay expiry/logging before simultaneous caller expiry interrupts its adapter. All original metadata/error/provider interruption/shutdown assertions remain unchanged. Long.MAX still observes 251ms, asserts pending at clock=1, then advances the original 250ms fallback. Separate test/code review passes are recorded. No production source changed beyond dependency adoption.

Proof https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39744830721 has exactly 20 positive XMLs: 20/20 first-attempt passes per target, 40 passing records, zero histories. Old relay wait (pin 1430) fails the reply-loss schedule guard 9/9 attempts across three fixed invocations; old unbounded-budget classification fails the Long.MAX fallback guard 9/9 attempts across three fixed invocations. The workflow is intentionally red overall because its negative jobs fail; its positive job is green. Selected fixtures, production source and effective build dependency are byte-identical to the pushed rebased head.

Rebase base is main 71499899e547fb0cd62ff6e7fc04b25c0a97efc1. The only two conflicts were README/build.kts coordinates, resolved from main's 1430 to requested 1431. Main's new RPC 1.0 byte-array fixture has no direct protocol pin or clock, and consumes the updated dependency unchanged.

Exact-head full https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39746154833 is SUCCESS: 2392/2392 final tests, 17/17 build rules, both migrated fixtures pass first attempt; PreInterrupted has no history here. Exactly one other history: testPersistentRelayFailureRetainsPreDialSelection, first failure 8572ms, second attempt pass 6925ms. It receives the complete RELAY_FORWARD_FAILED envelope ending Timeout or invalid response waiting for relay response, while its assertion accepts only caller-deadline/provider-close envelopes. It uses default SystemClock, no ManualClock/custom Clock, so it was outside the manual-clock inventory. Its body is unchanged except the dependency coordinate. Its mechanism is not yet proven and it is not declared unrelated.

Two existing exact-base full runs https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39744350220 and https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39736755518 each have 2392/17 successes and only a PreInterrupted history. The new system-clock case passes first time on both; neither establishes unrelatedness. The new matched comparison is pending. The real PR description states these limits accurately; no speculative repair or relaxed assertion was pushed.

S88 remote checkpoints

All were verified by git ls-remote; evidence branches are not for merging.

Next steps and operational details

1. Re-verify the PR head/state/checks and both comparison jobs first. Never merge/enqueue. The comparison workflow checks out exact sources and does not alter tests.
2. gh run download 39756529385 --repo CodexCoder21Organization/UrlResolver --name s88-system-main-attempts --dir /tmp/s88-main; download s88-system-reviewed-attempts similarly. Use handoff-evidence/s88/audit-xml.py from the audit branch on all XMLs. Kompile's attempt-history is a sibling of test, so final success alone loses retries.
3. Report final and failed-first counts, exact messages, main/head differences and attribution honestly. If still unattributed, keep that explicit. If adoption-associated, reproduce its actual mechanism deterministically before changing code; preserve all assertions/budgets/workloads, prove relevant mutation sensitivity, twenty clean attempts and a new exact-head full suite. Do not merely admit another error string.
4. The full watcher ended GREEN/exit 0. gh run watch returned 0 with no useful summary while GraphQL showed both comparison jobs running; do not trust its exit. Use bounded GraphQL statusCheckRollup reads on comparison commit a55675b501478269ab248187eb2c4cfcd6c6f8ed, at least 60s apart. REST quota was exhausted until 08:42:19; GraphQL bridged reads. No account/token switch or informational App rerequest occurred.
5. Nothing was published or deployed by s88. Prior published 1431 provenance below is unchanged; do not overwrite that artifact. S88 did not merge or enqueue anything. Local monitor/checkout cleanup is recorded in the final lane report when stopping.

Lane s85 completion — 2026-10-22 09:26 UTC

This verified update supersedes the earlier protocol WriteStuck/ForwardedReply attribution below. Other source-state paragraphs are retained as the original dated snapshot and were not re-verified by this narrower lane. The broader release/consumer handoff remains open.

2026-10-22 09:24 UTC — Lane s85 DONE.

The first fixture now publishes a real whole-frame completion before its retirement deadline, preserving the full 920 KB response and root-survival assertions. The memory fixture uses ManualClock while retaining 1,536 chunks, 192 MiB, a 64 MiB child heap, exact digest/count and all existing timeouts. Both fixtures retain the original error and attach cleanup failures; production code is unchanged.

PR: https://github.com/CodexCoder21Organization/UrlProtocol/pull/834 — OPEN, ready for review, unmerged and not queued. Head: https://github.com/CodexCoder21Organization/UrlProtocol/commit/11f11d28c39c7ee15272682875f1b662e40107ca. Live main/base remains 50a481caa2b27d3883c3c9f6808d81ac3acb04b9; fetch/rebase was a no-op. Both required checks are SUCCESS: build https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39743048499 ; suite https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39743048777 .

First target: the policy boundary is https://github.com/CodexCoder21Organization/UrlProtocol/commit/3c3664f1687e6cea75410c198420dbeb1fe497a1. Restored credit alone no longer cancels a child's outstanding whole-response deadline, so an unfinished frame may correctly retire. Controlled late completion passes on the parent and fails 3/3 on that merge: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39741386698. The original test also passed all eight historical first attempts, refuting an always-red recent-merge boundary. The corrected final test still detects a stale retirement callback, 3/3: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39743100659.

Second target: https://github.com/CodexCoder21Organization/UrlProtocol/commit/e0e97dfb3b4b080077420382b5b7e02b47fe11ac caps all chunk reads at the original call deadline. A Clock advanced after the first chunk passes on its direct parent and fails 3/3 on that merge with got 1/1536: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39742602819. Its original full failure was got 1398/1536, hidden by cleanup. Whole-reply buffering still exhausts the unchanged heap 3/3: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39740958544.

The exact final source passed 20/20 first attempts per target, zero failed attempts across all 40 records: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39743098810. In the full suite, 26/26 build rules and 3126/3126 final tests pass; 3125/3126 pass first attempt. Both lane targets pass first attempt (15.706s / 65.275s). One real main defect remains: testRelayedLargeAnswersWaitForOutboxSpace failed once, then passed. Earlier main https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39726416306 fails that same unchanged test twice before passing; its test, production sources and build.kts have an empty diff to this PR. This defect is not claimed fixed or first-attempt clean.

The watcher itself parked in an informational HTTP body read. The full thread dump and bounded workaround are preserved at https://www.handoff.wasmserver.com/handoffs/hf-2026-10-22-bound-build-watchman-log-body-reads-so-required-check-observation-keeps-running. Plain watch mode with the optional probe unavailable returned GREEN exit=0 for the unchanged real GitHub gate. That independent tool defect remains unfixed.

Evidence and complete failure stacks: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/s85-evidence/handoff-evidence/s85 . Source and all diagnostic branches are pushed. Only three existing test/support files changed; no build artifacts entered the PR. Dedicated test and code reviews addressed self-suppression and event-loop ordering, then reviewed final source again.

No delegated agents, no lane blocker, no unnecessary holds and no idle landing gates. Owner direction captured: none new. The parent handoff covers a broader release/consumer effort, so this completed lane does not archive it; its remaining work and the existing main defect stay with that parent effort.

Next steps for lane s85: none — the request is complete. Merge, queue entry and publishing are outside this lane's authority.

Lessons: prove contract boundaries with controlled ordering or Clock; inspect the original error before cleanup errors; measure watcher liveness from fresh output and bound response-body reads independently of response headers.

Final housekeeping verified: owned watchers are gone, working tree/stash were clean, remote refs verified, and the disposable checkout plus its matching cache have been removed. The broader parent handoff was updated in place and is not archived by this narrower lane.

S85 remote checkpoints

Diagnostic/evidence branches are not for merging. The final evidence commit is 51a57722be0cf67f0c15493cc8a16650ed47059b. The disposable checkout and matching cache are removed; source and all evidence remain remote.

Design decisions in force

The 2026-10-22 publication brief explicitly grants publishing the UrlProtocol Maven artifact by name, says “No deploys”, and says “Do not merge or enqueue.” Those limits remain in force. It asks for focused verification on GitHub runners and full required-check confirmation, with failures attributed against main. Never increase timeouts, reduce iterations, disable a test, weaken an assertion, or guess at a production fix without a reliable reproducer. The original brief says “Time box 2 h.” Publication of 0.0.1431 is complete and must not be repeated or overwritten; a later necessary source fix would require its own new release after the required review.

Mission summary

The brief requested publication of UrlProtocol main at/after e0e97dfb3b4b080077420382b5b7e02b47fe11ac, then a fresh-main UrlResolver pin-bump PR. The release must contain the merged long-poll and relay fixes from https://github.com/CodexCoder21Organization/UrlProtocol/pull/772, https://github.com/CodexCoder21Organization/UrlProtocol/pull/808 and https://github.com/CodexCoder21Organization/UrlProtocol/pull/699. This supplies the dependency needed by https://github.com/CodexCoder21Organization/UrlResolver/pull/1163 and supersedes the 0.0.1430 pin on https://github.com/CodexCoder21Organization/UrlResolver/pull/1364. The four allowance tests on the former PR were not claimed as verified here; they live on its separate branch.

Publication and pin updates are complete. Remaining work is full confirmation of the corrected resolver head and proper attribution/repair of outstanding test failures. The older broad context handoff (https://www.handoff.wasmserver.com/handoffs/hf-2026-10-14-land-the-urlresolver-extreme-condition-bug-fixes-fix-the-two-merge-queue-flakes-then-merge-the-reviewed-prs-and-finish-the-rest) was already archived when read; this record covers the new release verification rather than reopening that completed snapshot.

What was found and done

1. UrlProtocol main was e0e97dfb3b4b080077420382b5b7e02b47fe11ac, declaring 0.0.1429. The live Maven endpoint reported latest 0.0.1430, so 0.0.1431 was selected. Local scripts/build.bash --local foundation.url.protocol.buildMaven /tmp/s81-protocol-maven succeeded. Publisher CLI 0.0.6 with --artifact-dir and the HTTP API exited 0. Coursier fetched POM and JAR from kotlin.directory; both match the build output. The downloaded JAR contains foundation/url/protocol/LongPollRpcRequestHandler.class.
2. Published JAR SHA-256 is 4259816acfa12671d50ddebd7c8d04158624b1f8099f676e92303c3f1c030ff8; POM SHA-256 is a79d63bae9f36a135b9b073c8fd572fa0fe23a03ee34d7dcc4cfb7aaa1497585. The live POM returned HTTP 200 and JAR checksum matched again at 06:52 UTC.
3. UrlResolver main was 762720922485c932894be30fe507e497fdc925b0. All active protocol pins were updated: build.kts, README and 2,257 test declarations. One declaration had doNotUpgrade=true at 0.0.524; its flag is retained while its explicit coordinate moves to 0.0.1431. It is a real interleaved-host test, not a prior-version-only contract, and passed full verification. An initial claim that no such flag existed was corrected in findings and PR text. Historical version comments remain historical.
4. Initial focused proof https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39727076333 passed 13/13 tests with no failed-attempt histories. Full run https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39727154742 passed 17/17 build rules and 2,390/2,391 final tests. Its consistent failure was testRelayBackedLongMaxRequestUsesFallbackAfterClockAdvances (3/3), because the fixture leaves ManualClock at 1 ms but the newly adopted relay wait correctly uses that clock. The old test waited for wall time instead. Unchanged-main comparison https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39733699249 passed that scenario.
5. The corrected fixture observes the exact 251 ms deadline through public Clock.schedule, retains the initial clock=1 assertion before advancing the unchanged 250 ms fallback, verifies no completion before expiry, then advances the clock. It retains full error text, one dispatch/no replay, caller clock-read count and all original wall-clock guards. Proof https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39734387175 passed four scenarios plus eight extra clock repetitions, all with zero failed-attempt histories. Control https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39734391490 restores only the original faulty remaining-time classification of isUnbounded; the strengthened fallback-deadline assertion fails 3/3. Dedicated test and code review passes found no gaps. The verified correction is now on the PR at e64d90fc75dbb8f04cc429aef20bada4209dc38b, rebased on unchanged main. Full confirmation is https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39735743728, still pending at 07:07 UTC; build passed and tests started.
6. Two resolver tests passed only after one failed attempt in the initial full run: testPreInterruptedTimedPeerControllerKeepsSharedConnection (handshake deadline) and testPersistentRelayReplyLossLogsSelectedRecord (response timeout instead of controlled shutdown). Neither reproduced in an exact-main full run or 20 fixed comparison trials (40 clean test records) at https://github.com/CodexCoder21Organization/UrlResolver/actions/runs/39734512291. These remain UNATTRIBUTED. Clean comparisons do not prove the failures unrelated.
7. Release metadata full test run https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39726872717 passed 3,124/3,126 final tests, with two final failures, each 3/3: testWriteStuckConnectionRecoveredJustBeforeGraceIsNotRetired (partial response stream closes) and testForwardedReplyStreamsBeyondReceiverHeap (identity-publication/executor cleanup failure). Hidden histories also occurred in testF671hAbandonedRequestStreamsReleaseTheirReplies and testRelayedLargeAnswersWaitForOutboxSpace. Exact-main full run https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39726416306 has failed attempts in the latter large-answer test. Exact-main focused comparison https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39735228282 reproduces the WriteStuck failure 3/3 with matching partial-frame errors; this is PROVEN ON MAIN. It passes ForwardedReply and F671h once each, so those remain UNATTRIBUTED. Three fixed further main comparisons at https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39736202134 produced six clean final passing records with no attempt histories. They did not reproduce those two release histories; both remain UNATTRIBUTED. Their three XML files are preserved in the evidence branch.

At 07:03 UTC protocol main advanced to 50a481caa2b27d3883c3c9f6808d81ac3acb04b9 through https://github.com/CodexCoder21Organization/UrlProtocol/pull/818. Only the unrelated ClosingLongPollRefusals test changed from the publication base; production and build coordinate are unchanged. The artifact implementation still matches current main. Rebase the metadata branch before any future build/update rather than assuming its original base is latest. Resolver main remains 762720922485c932894be30fe507e497fdc925b0.

Relevant PRs / refs

• https://github.com/CodexCoder21Organization/UrlResolver/pull/1424 — OPEN at 2c334bb18294d23926cbe15ae6db53a89b4289cb; required bld-build SUCCESS, 2392 final passes / 17 rules; one failed-first attribution open (s88 section).
• https://github.com/CodexCoder21Organization/UrlProtocol/pull/825 — OPEN at 775268c6de71fb3116db019b202ae1e261c28271; bld-build passed, bld-all-tests red as detailed above.

<!-- begin refs -->

<!-- end refs -->

Published but not merged

foundation.url:protocol:0.0.1431 is live at https://kotlin.directory/foundation/url/protocol/0.0.1431/ . It was built from 775268c6de71fb3116db019b202ae1e261c28271: main implementation e0e97dfb3b4b080077420382b5b7e02b47fe11ac plus only the coordinate update. The implementation is on main; the release-coordinate change is unmerged in https://github.com/CodexCoder21Organization/UrlProtocol/pull/825. Reconcile the coordinate through normal review after CI failures are addressed; do not republish or overwrite 0.0.1431. Nothing was deployed, merged or enqueued. No resolver artifact was published.

Next steps

1. Re-verify live PR heads/checks, Actions runs and branch refs. Do not restart work from a stale status paragraph.
2. Own a plain build-watchman watch on the corrected resolver PR, using ~/bin/coursier launch buildwatchman:build-watchman:0.0.21 -r https://kotlin.directory -- --repo CodexCoder21Organization/UrlResolver --pr 1424 --idle-timeout-minutes 120. Never use --to-merged. On completion, download test-attempt-records and audit every failed attempt, not only final statuses.
3. Read the preserved protocol three-trial main comparison records under protocol-main-repeat/. They are clean, so they do not establish unrelatedness. Continue a reliable public-API reproducer for the unresolved cases rather than using another blind full-suite rerun. The already demonstrated WriteStuck main defect must not be called fixed by this metadata release.
4. Investigate remaining failures at their owning layer with reliable public-API reproducers. No guessed timeout, resource or assertion changes. The two intermittent resolver histories have not been shown on main despite clean comparisons; do not label them unrelated. The cleanup and F671h protocol histories likewise need observed evidence or a source-level explanation supported by a reproducer.
5. Keep PR descriptions/finding records current, obtain required green checks or report proven main failures accurately. No merge, enqueue or deployment is authorized by this handoff.

Reusable / operational knowledge

• Read https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md and https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/PHILOSOPHY.md before changing tests. Current CI procedure is https://my.externalbrain.wasmserver.com/doc/github-builders-racing-remote-ci.md . It supersedes the stale kotlin-ci-setup skill's remote-only guidance. Required gates: resolver=bld-build; protocol=bld-build and bld-all-tests. App remote checks are informational; do not rerequest them.
• Use fresh clones under workspace/, read README/AGENTS, and use ~/bin/coursier. This box lacks rg; grep was used. The prescribed runner mode is scripts/test.bash --local-and-remote --test <selector>. The box itself is not a reliable full-suite executor.
• The installed gh pr edit fails through obsolete projectCards GraphQL fields. Update bodies with REST PATCH pulls/<id> and JSON via --input instead. Do not expose tokens.
• REST core quota is shared. It reached 0/5000 and reset at 06:42:13 UTC; wait for a reset rather than polling tightly. One gh run watch returned 0 while its last printed state was still active during that exhaustion; verify API state and uploaded records before believing the exit alone.
• All raw proof XML, full failure XML/stack traces, the exhaustive before/after pin ledger and incremental findings live at https://github.com/CodexCoder21Organization/UrlResolver/tree/wip/s81-artifacts/handoff-evidence/s81 . No build outputs or dependency caches are intentionally retained there. The local JAR/output/cache can be deleted after publication verification; immutable Maven URLs and checksums preserve the release proof.
• No local source, stash or unpushed branch was left at the 06:51 sweep. Refresh this fact and the branch table before handover. Remote Actions may continue; local watchers must be stopped before the final message.

Final local housekeeping: all owned monitor processes were stopped and both disposable checkouts/build caches were removed before the final message. The remote corrected-head Actions run continues; the next session must establish its own watcher. No source, stash or unpublished branch is left only on this machine.