Finish the Actions attempt audit for corrected peer-removal notifications

RE-VERIFY: Written 2026-10-28 16:21 UTC. GraphQL at16:20 verified https://github.com/CodexCoder21Organization/UrlProtocol/pull/983 OPEN on a87adcd5f28d6e74d9de9e2a498f646036f15c2b, with bld-build SUCCESS, shard3SUCCESS and shards0/1/2 IN_PROGRESS. Shard3 XML is922/922 first attempts with0 retries and0 nested histories; full-suite counts remain incomplete. https://github.com/CodexCoder21Organization/UrlResolver/pull/1607 is OPEN/DRAFT on45d168ba1989a3cbb135b358e7743e7fdac330f8. Re-check live state before acting.

Design decisions in force

2026-10-28 owner override: "Never merge, enqueue, deploy or publish." "Poll GitHub at most once every 4 minutes, and use GraphQL for PR state while the REST limit is exhausted." "Never raise a timeout or weaken an assertion." The brief also forbids skipping/deleting tests, mocks, reflection, JVM tuning, production restarts and route changes. Use local targeted tests; watch Actions with plain build-watchman --pr. No production change or publication is authorized.

Mission and completed work

The owner reported "I feel like https://droplets.wasmserver.com/ is super unreliable ..." and "...super out of date when it should be fast and reliable". ContainerNursery's resolver repeatedly scans sender sets. Registry removals from the upstream PR let the resolver PR remove departed destinations directly.

The earlier wrapper fix queued captured removal completion until enclosing registry/persistence/lifetime ownership ended. REV983b found that direct getObservationLog().recordSuccess(A) bypassed the wrapper: its score diagnostic could remove B and run B's observer while A's record lock was held. A second thread updating A then waited for the callback to return. The unchanged public reproducer failed3/3.

FIX983b now joins the same shared queue before acquiring each observation record monitor and through log completion bookkeeping. The first enclosing owner across registries drains captured callbacks after releasing its locks. Captures, order, exactly-once delivery, failure retention, persisted cleanup and same-ID handoffs use the existing dispatcher.

All29 added tests have red assertion proof on all3 baseline attempts; the implementation was temporarily removed to prove them. Final upstream selected run55/55 first attempts; resolver integration15/15 first attempts. Both green XML files have zero attempt-history records. The broader first run52/55 exposed3 fixture mistakes after their lock checks passed: imported/discovery peer origin affected the expected capacity victim, and a quarantined ID needed later dial success before re-add. Fixtures were corrected in setup and reproved red; no assertion or timeout changed. An initial private-inline-type compile error was corrected before runtime green validation.

Current evidence: https://github.com/CodexCoder21Organization/UrlProtocol/tree/wip/FIX983b-evidence . Read findings.md, public-entry-points.md, red-proof-index.md and review-passes.md. The source/test checkouts are clean; all authored code is pushed. No code was deployed or published. The local corrected jar SHA256 is68bc30b264bdf89c4ba59cf76a378d7d6fba9e548d268ad5cb58e33309561995; build outputs and dependency caches are deliberately not pushed.

Resolver validation prepended a local Maven directory to build.kts dependencies, changed selected protocol test annotations to foundation.url.protocol.buildMaven(), and made its test workspace the common parent of both repositories. resolver-local-overrides.patch records this temporary setup. It is restored, and the resolver PR is unchanged. Ordinary resolver CI still needs a fresh upstream version and aligned pins; that publication is prohibited in this lane.

Separate review findings and earlier-head history

REV983b also reproduced unbounded pending listener retention:64 add/remove cycles with2MiB captured listeners exhaust the default128MiB heap3/3 despite closing every subscription. The earlier immediate-dispatch control passed1/1. This public-path correction does not claim to solve the pending-queue memory finding. Keep the upstream PR open; do not claim merge readiness from green Actions alone.

The earlier head bf0a271 had a partial Actions audit1818/1819 first attempts (shards1/3), with stressTestRelayReceiveReconnectChargeProbeTransportAdmission passing on attempt2. The review traced a possible ordering gap: a drainer callback can start before the admission hook records its byte map. This classification was an inference; one unchanged-main run passed1/1. It is distinct from the shutdown fixture owned by https://github.com/CodexCoder21Organization/UrlProtocol/pull/984 . Do not attribute new retries without comparing the actual names and first-failure stacks. The earlier handoff body is preserved in prior-handoff.md on the current evidence branch, and all earlier source/evidence branches remain linked below. Earlier-head counts do not validate a87adcd5f.

Relevant PRs and refs

The current source rows belong to https://github.com/CodexCoder21Organization/UrlProtocol/pull/983; checkpoint/evidence rows have no separate PR. Resolver https://github.com/CodexCoder21Organization/UrlResolver/tree/wip/CNR-bounded-admission remains45d168ba1989a3cbb135b358e7743e7fdac330f8. Nothing was merged, enqueued, deployed, published or changed in production.

Remaining work

1. Watch the current test workflow https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/40716586022 and build https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/40716586019. Plain build-watchman0.0.21 is tracked by FIX983b stopped at16:20 UTC with timeout124 / watchman INTERRUPTED130. Process group76363 is empty. Launch your own tracked watcher with a deadline when resuming. Never use merge/enqueue modes. The non-required kotlin-build-ci-test suite110364545472 has zero dispatched runs; no rerequest was performed.
2. Download the4 test-attempt-history-* artifacts from that exact workflow, then count attempt1 from every test_log_file.xml. Any attempt2/3 success is a flake, not a first-attempt pass. Zero tests, missing artifacts, failed/cancelled jobs and a changed PR head must be reported explicitly. Use audit-attempts.py from the evidence branch to inspect all descendant histories; create review-data/ before invoking it. Shard3 XML and recursive-actions-counts.json are already saved, so only shards0/1/2 remain to collect. Keep all XML/counts in an evidence branch.
3. Diagnose any current-head first-attempt failure with a local reproducer, never blind CI re-queueing. Update the why-first upstream description with exact final counts, and preserve the pending-queue memory finding and resolver release gate. Leave both PRs open. Archive this audit handoff only when its final-head attempt audit is actually complete; record unresolved implementation findings separately.

Reproduction and operating notes

Clone a87adcd5f and run scripts/test.bash --local --test testReviewDirectObservationRemovalLeavesRecordLock --log green.xml. To repeat the red proof, restore only src/foundation/url/protocol/PeerRegistry.kt and PeerObservationLog.kt from bf0a271, keeping current tests, and run each name from red-proof-index.md. Restore current source afterwards. All29 regressions failed3/3 with the fix removed.

GitHub description updates use GraphQL updatePullRequest with a JSON input file; gh pr edit asks for deprecated projectCards here. The challenge-report CLI automatically merges, so it must not be invoked under this no-merge brief. General instructions say rebase before building, but this lane explicitly says rebase only for a real conflict; the latest-main merge-tree check found no conflict, so no rebase was done. No full local/remote suite was run; the brief assigns the full-suite gate to Actions.

OBSERVED 16:03 UTC: all4 current-head shards remain IN_PROGRESS; no XML uploaded. Shared REST quota was exhausted until15:55:13 and GraphQL supplied PR state meanwhile. REST reads now work. The bld-all-tests aggregate is expected to appear after its4 parent shards, per .github/workflows/bld-all-tests.yml needs:[test-shard]; do not rerequest it while those shards run.

FINAL LANE CHECKPOINT 16:21 UTC: source/local validation is complete, with55/55 upstream and15/15 resolver first attempts and29 regressions proved red3/3. Current Actions shard3 is922/922 first attempts; shards0/1/2 and their XML remain pending. The watcher is stopped and both source checkouts are clean. No merge, enqueue, deploy or publication occurred. Finish the remaining3-shard audit, retain the separate pending-queue memory finding, and leave both PRs open.