Handoff: obtain the remote full-suite verdict for the ContainerNursery cleanup fixes

Written 2026-10-27T06:55:31.406996+00:00.

RE-VERIFY: this is a write-time snapshot. Re-check https://github.com/CodexCoder21Organization/ContainerNursery/pull/743 with gh pr view --json state,headRefOid,mergedAt, confirm branch SHAs with git ls-remote, and verify buildtest health before attempting remote execution. CI was deliberately not watched after the push.

Design decisions in force

User requirements, 2026-10-27:

• “F1: a destructive action happens only on a positive, fresh, readable proof. Any read or parse failure means: do nothing destructive, keep the record, keep a retry scheduled, surface it.”
• “F2: ownership is re-checked immediately before each signal.”
• “F3: proof of completion is never deleted unless the thing it proves is removed in the same step.”
• “Directory rule: cleanup never follows symbolic links into directories it does not own.”
• “Run the full suite with --remote only. Read counts from the first-attempt XML; a retry counts as a failure to investigate.”
• “Do not merge or enqueue.”
• “Kill processes only by PID, and only ones your own runs started.”
• “Wait loops need a hard deadline and must be killed before you finish.”
• “Fix the cause; never loosen a test, raise a timeout, or skip anything.”
• “No other model sessions.”

No deployment was requested; production deployment remains unauthorized. These requirements remain in force for this verification task.

Mission and remaining work

The request was to “fix round-7 findings and the CI failures” on https://github.com/CodexCoder21Organization/ContainerNursery/pull/743, with a report within 90 minutes. Source fixes, imported failing-first tests, neighbour checks, per-finding checkpoints, final push, PR description and site-table updates are complete. The required remote full-suite verdict remains unavailable because buildtest refused health before a run was created. This handoff is for obtaining and recording that verdict; it does not authorize merging, enqueueing, deployment or CI reruns for diagnosis.

What was found and done

1. Imported the five review reproducer files by cherry-picking all three commits from https://github.com/CodexCoder21Organization/ContainerNursery/tree/wip/hd22-L204-review-reproducers, original review head https://github.com/CodexCoder21Organization/ContainerNursery/commit/89fcaa103fb878249c8dc334ab3038f3263256dd. Fresh clone, README/AGENTS read, PR branch rebased on main. The original PR head was https://github.com/CodexCoder21Organization/ContainerNursery/commit/3f0292c012ee2acb6e0a26fec9a1d1ae5de93cf7.
2. Conditional unregister allowed an unreadable PID with no owner to remain while returning success. NurseryPidFile.kt:414 now refuses confirmation, preserving the raw row, cleanup owner and retry. The public reproducer failed first; the corrected register passed 5/5 first attempts. Checkpoint https://github.com/CodexCoder21Organization/ContainerNursery/commit/d37a4e5057d4092c3c9b8d6ed07d9c619bc633f4.
3. Lexical proof paths failed through symlinked ancestors. ContainerNurseryServer.kt:562,564 and the analogous final release in DangerJarFileBackedContainer.kt:1063,1064 now compare real paths and preserve proof on resolution errors. Both public cases failed first; 5/5 final register passes. The extra release fixture was corrected from a final-directory link (intentionally rejected by the receipt reader) to a genuine ancestor link, then reconfirmed failing against unchanged source. Checkpoint https://github.com/CodexCoder21Organization/ContainerNursery/commit/5c39869ba.
4. Failed-launch and heap-generation Java recursion followed directory links. DirectoryCleanup.kt:7 is now the one checked no-follow helper for all 13 production recursive deletions. Its throwing directory reads also preserve ownership on a list failure that the previous Okio path did not surface. Both imported tests and the extra public JarHistory listing-failure scenario failed first; final register 10/10 first attempts. Checkpoint https://github.com/CodexCoder21Organization/ContainerNursery/commit/46666c78a.
5. The temp sweep held PID mutation ownership across /proc command-line reads. NurseryPidFile.kt:621,630 and ContainerNurseryServer.kt:559–561 now capture a revision, inspect outside the lock, then lock/re-read saved references and reject revision changes before deletion. Existing reentry validation remains active. Reproducer failed first; final register 8/8 first attempts. Checkpoint https://github.com/CodexCoder21Organization/ContainerNursery/commit/d8c1217f6.
6. CI's conditional-removal test expected success with a missing owner. It now asserts the complete F1 refusal and exact unchanged record, retaining both successor preservation and unconditional legacy deletion coverage. CI's temp-sweep test failed at its chmod probe because the runner could still read a mode-000 file, before production cleanup. The original test passed locally as uid 501; the privileged CI account condition was not reproduced locally. The fixture now injects AccessDeniedException through the real filesystem boundary, checks exactly three denied reads, and retains receipt/recovery assertions.
7. The original CI attempt-history artifact identifies testNurseryPidFile_pendingSignalMustKeepOwnership as the retried case. The kernel checker can confirm stopped execution before the Java Process object finishes exit bookkeeping. Joining the signal worker did not wait for that Java bookkeeping. Genuine concurrent public callers reproduced the original assertion: all three 64-case baseline attempts failed; the 640-case baseline failed first attempts 1 and 2 then passed native retry 3. The test now waits for process exit before inspecting isAlive, using the accepted existing 5-second bound. Five independent 640-case post-fix native executions pass first attempts, zero retries (3,200 scenarios). Final CI/alias register passed 5/5 first attempts. Final checkpoint/source commit is https://github.com/CodexCoder21Organization/ContainerNursery/commit/927943b8d666062081e80f586c56ee6126bad551.
8. Separate test-completeness and code-review passes checked malformed rows, proof lifetimes and resolution failures, public recovery, all recursive sites, filesystem implementations, reentry, lock progress and callback compensation. No mocks/reflection, disabled cases, reduced iterations or raised test limits. The README records the public no-follow/alias/registration-progress behavior. Product diff is source/tests/README only; git status is clean, no stash or unpublished source remains.
9. The full command scripts/test.bash --remote --test . --log /tmp/L205-evidence/full-remote.xml --result-file /tmp/L205-evidence/full-remote.json exited 1 at 06:29 UTC before submitting a run. Exact error: Build service RPC 'health' to url://buildtest/ returned invalid health value "STARTING: recovering local state (elapsedMs=5551390)." (runtime class java.lang.String); expected exactly "OK". The result is ERROR, testsRun=0, runId=null. There is no XML and no full-suite count to report. The reason buildtest recovery has not completed was not investigated in this scoped fix. Do not substitute a full local suite or call this a passing full suite.
10. A supplementary repeat spent most of its shell budget resolving a snapshot dependency (stack parked in CoursierProgressDeadline.await/unifiedResolve on TLS reads), then reached the 300-second shell deadline without XML. It is not counted as a passing test. Four subsequent exact-file runs completed first-attempt clean with unchanged test limits. Eight temporary fixture records remained from the interrupted run, but all saved child/parent PIDs were verified absent; no signal was needed. No tracked wait, test, search or remote client remains running.
11. The source branch and checkpoint were pushed and verified at 927943b8d666062081e80f586c56ee6126bad551. The older gh pr edit failed on deprecated repository.pullRequest.projectCards; the exact description and site-comment JSON bodies were applied successfully with REST PATCH at 06:50:48/50 UTC. Fresh state is OPEN/unmerged, mergeable_state=blocked. The updated site table is https://github.com/CodexCoder21Organization/ContainerNursery/pull/743#issuecomment-6434170795. No CI watcher, merge, queue entry, CI rerun or production action was performed.

Relevant PRs and refs

No deployed or published code came from this session. Only GitHub branch, PR and comment writes were performed. No Maven artifact, JAR or production process was changed; there is no deployed-but-unmerged artifact to reconcile.

Next steps

1. Re-verify the PR head and service health first. The full-suite attempt has no run ID; there is no old run to poll, cancel or rerun.
2. Have the buildtest owner inspect and resolve its incomplete recovery in the service that owns that state. No service restart or deploy is authorized by this handoff. The scoped task has no diagnosis of that service's underlying recovery cause.
3. Once health returns OK, clone fresh, read README/AGENTS, rebase on current main, and run the full suite with scripts/test.bash --remote --test . --log <outside-repo-path> --result-file <outside-repo-path>.
4. Read first-attempt outcomes from test plus attempt-history XML, counting any first failure as a failure even if a later retry passes. Reproduce every actual failure locally with targeted tests before editing; never debug by requeueing CI. Keep evidence off the product branch.
5. Update the PR description/site comment with the full-suite counts and any fixes. Report back without merging or enqueueing; the user's no-merge and no-CI-watching instructions remain in force.

Operational notes and evidence

• Evidence root: https://github.com/CodexCoder21Organization/ContainerNursery/tree/wip/hd22-L205-evidence. PROGRESS.md contains the invariant table, read sources, per-checkpoint outcomes and two separate review passes. recursive-after.txt lists every production caller; original-ci-test_log_file.xml holds the original 1485-case attempt history. Full stacks are in the XML and logs.
• The original compile/test CLI is pinned to kompile-cli 0.0.124. The verified architecture-specific Coursier is bootstrapped by the repository scripts. No toolchain or dependency version changed.
• Name-based test selection caused a supplementary dependency refresh delay. The successful independent repeat commands used scripts/test.bash --local --test tests/testL205PendingSignalWithConcurrentCallers.kts --log <outside-repo-path>; every completed run is separately saved in the evidence branch.
• xml-summary.py shows how to read first native attempts from the custom XML. No first-attempt full-suite XML exists for this source head.
• CHALLENGE-buildtest-health.md records the exact blocker. CHALLENGE-gh-pr-edit.md records the REST fallback. The automatic report-challenge CLI was not used because it enqueues and merges, contrary to this task's explicit instruction.