Handoff: Diagnose the UrlProtocol descriptor-return and initial relay-announcement failures

Updated 2026-10-23T07:31:59.833994+00:00.

RE-VERIFY: This is a write-time snapshot. Re-check current main, https://github.com/CodexCoder21Organization/UrlProtocol/pull/857 and the related toolchain PR before acting. Use gh pr view <full PR URL> --json state,headRefOid,statusCheckRollup and a fresh fetch. Do not assume the two failures share a cause.

Design decisions in force

Owner request, 2026-10-21: "Then, do another round, Your goal is to add end-to-end integration tests which identify bugs (the tests should initially fail), and then fix the bug in the implementation."

The observing lane forbids merges, enqueues, publishing artifacts, deploys, service restarts, remote tests and buildtest mutations. Never raise timeouts, reduce iterations, skip/disable/delete tests, weaken assertions, use mocks or reflection, or make private members public for tests. Use real isolated dependencies and public APIs. The shared full-suite command is flock /tmp/claude-501/complete-suite.lock scripts/test.bash --local --test . --log <xml>. Record cgroup memory before and during it. A native retry is not a first-attempt pass. Read TESTING.md and PHILOSOPHY.md before changing tests.

Mission and observed state

Reproduce and fix two broader failures found during the required full local run while finishing the name-format change in https://github.com/CodexCoder21Organization/UrlProtocol/pull/857. The runner reported aggregate 3194/3194 and exit 0, but the correct first-attempt result is 3192 passes and 2 failures. Both failures passed their second native attempt. This is not a clean full-suite proof, and no flake fix is claimed.

The full run was on 2099e158c1402a9665ddd9d8873a4ed69c6df037, using CLI 0.0.124. It waited 3450.98 seconds for the lock, executed from 06:01:02 to 06:49:15 UTC, and did not change global oom_kill (1 before/after). Complete native evidence is linked below. The name-format work itself passed all 45 added/modified scenarios on attempt one, plus its six focused scenarios three times and its required negative mutation. Its later rebase only changes publication coordinates 0.0.1433 to 0.0.1434; application and test trees are byte-identical.

Failure 1: announcement-flood descriptor return

testAnnouncementFloodChurnReturnsResourceBaseline, attempt 1, 64160ms, failed at test line 541 in cohort 85:

Network descriptors must return to the warmed live-host baseline in round 85. Expected <{socket=6, anon_inode:[eventpoll]=35, anon_inode:[eventfd]=34}>, actual <{socket=7, anon_inode:[eventpoll]=35, anon_inode:[eventfd]=34}>.

Attempt 2 passed in 67187ms. The failure dump supplies counts, not the identity/creation trace of the extra socket. No underlying mechanism is established. Do not add a delay or accept an extra socket. Capture the actual socket, endpoints/owner and closure ordering when making the failure reproducible.

The test constructs raw Libp2pHostFactory hosts. Its only Libp2pRpcStream is the non-gossip flood.churn.echo service, which takes the unchanged input-getter arm. It does not instantiate UrlProtocol or the changed gossip-input policy. Test and factory bytes are unchanged from the previous PR head. This is evidence about independence from this continuation, not a diagnosis of the resource defect.

Failure 2: initial relay announcements

testRelayReRegistrationCancelsTransportCloseWithdrawalTombstone, attempt 1, 8005ms, failed at test line 147:

The observer must see both original provider announcements before transport close

Attempt 2 passed in 3942ms. The failure happens before provider close, replacement registration or withdrawal. It creates three raw factory hosts and RelayService instances, with no UrlProtocol/NetworkProvider gossip-input policy. Its test and RelayService bytes are unchanged from the previous PR head. Do not treat the failed initial-delivery precondition as proof of a tombstone defect, and do not lengthen the five-second wait. Capture registration/listener state and message delivery through the real relay.

Related context, not established causes

https://github.com/CodexCoder21Organization/UrlProtocol/pull/888 updates a CLI that ignores existing @TestWorkerSlots(4) reservations. Both failing tests declare four slots. Its relationship to these two failures is unproven; do not assume a pin update fixes them. https://github.com/CodexCoder21Organization/UrlProtocol/pull/890 fixes a different observed keepalive-admission loss. Neither PR is identified as the owner/fix for these exact failures.

The full runner also emitted a terminal-memory record warning after later stdout. The complete stack and the recorded challenge are separate evidence. No test outcome is inferred from that warning.

Relevant PRs and refs

Full native XML, all retry stacks/output, full result metadata, changed-case audit, phase/memory counters, and findings. The XML retains both attempts for each failure. No source fix or reliable reproducer has yet been written for these two defects.

Next steps

1. Re-verify live main and PR state first; preserve this full-run snapshot. Read both entire test files and their relevant host/relay implementations.
2. Establish each mechanism separately. Use real concurrent callers and the exact public path to amplify, then force the identified ordering deterministically. Baseline needs reliable first-attempt failure, not repeated successes until a green report appears.
3. For the extra socket, instrument observable resource ownership and closure barriers without relaxing descriptor equality. For relay delivery, establish which of the two original announcements is missing and where delivery stops before changing code.
4. Write public-API fail-first regressions and fix the owning layer. Keep all original assertions, iteration counts and time budgets. If the defect is in a dependency, fix there rather than wrapping the consumer.
5. Independently review tests and code, verify first-attempt passes, run one locked full suite with memory evidence, then create separate fix PRs and watch required Actions. No merge or deployment is authorized by this handoff.

Operational state and omissions

This lane deployed, published, restarted, merged and enqueued nothing; its command/action ledger contains local verification, source/evidence pushes, the authorized PR-branch push and PR/handoff metadata updates. Main's publication metadata was changed by another effort. Generated build jars/classes were removed and are deliberately not preserved; source and lossless test evidence are remote. No stable failure rate is claimed from one failed attempt followed by one passing retry. Investigation owner at discovery is BUG8i; this record transfers the unresolved diagnosis without calling it fixed.