feat(cli): generate collision-safe service query wiring - #1664

[PHASE: RESEARCH]

Re-baselined #1355 and #1360 at 3fc0f2f9221a8246f0d26a26189bafb2647be08a; the cited naming defect has already landed, while the runtime key, invalidation, generator, and hydration-age defects remain.

Findings

1. Key mismatch remains — generated TanStack keys begin ['service', 'list', { input }], but the filter is ['<router>', 'list']; server keys also remain under literal service.
2. Identity source is available — the sorted NetScript.Services manifest key and canonical router-name transform can own client, query, server, and invalidation identity.
3. Naming acceptance drifted — all six exampleService* exports are already derived at this base; the new regression must preserve that and prove two modules coexist.
4. Generator gap remains — service generate exists but only regenerates Aspire helpers and exposes neither all-service client generation nor dry-run/force.
5. Cache age is discarded — both canonical island variants display cachedAt but omit it from initialDataUpdatedAt, resetting freshness at hydration.
6. Compatibility is generation-scoped — apps not regenerated remain unchanged; regenerated apps intentionally move off the colliding service namespace.

Evidence: research.md

Next

• Advance to PLAN and stop for the topic orchestrator's PLAN-EVAL determination.
• No product implementation or expensive gate starts from this comment.

[PHASE: PLAN]

Tier-A plan review returned CHANGES_REQUESTED; T-1 and T-2 are repaired at 7f20a34fee4e99ac17edb6ed4de06a3ec9c1934b. This leaf remains stopped before product code and formal PLAN-EVAL.

Plan

1. S1 — SDK contract: PLAN-EVAL chooses the additive bridgeInvalidation(queryKey) overload or direct generated { queryKey: queries.list.clientKey() }; then semantic mismatch/non-collision and type-negative coverage.
2. S2 — CLI generator: one sorted manifest-driven plan/write use case shared by add/generate; per-router identity; deterministic written/skipped, dry-run/force, two-service, collision, and atomic negatives.
3. S3 — hydration: both canonical islands pass initialDataUpdatedAt; generated-output omission regression; real-browser old/fresh snapshot coverage; approved package migration note.
4. S4 — cheap convergence: JSR/public-surface audits for CLI/Fresh/SDK, then catalog-backed check, test, publish-dry-run, and arch-check receipts at one committed head.
5. S5 — leased proof: only after cheap convergence and explicit release, capture suite-owned exact-head scaffold.runtime output plus the central lease/cleanup record, then the catalog-backed fresh-browser receipt.
6. S6 — IMPL-EVAL: fresh opposite-family verdict; repair findings only in new bounded slices.

T-1 — evidence class repaired

scaffold.runtime remains deliberately outside .llm/tools/gates/catalog.ts. No catalog entry, run-gate.ts routing, or handcrafted receipt is proposed. The exact binding receipt set is five files only: four cheap receipts plus receipts/s5-fresh-browser.json. Scaffold evidence is separately the canonical one-pass suite output at the exact head, central expensive-gate lease, and cleanup record.

T-2 — exact lease-precondition scenarios

• Generate canonical users, run netscript service add --name payments --with-client --project-root <generated-project>, then netscript service generate --project-root <generated-project> twice; assert second-run zero writes/byte identity and joint usersQueries + paymentsQueries consumer type-check.
• For identical list input, compare ['users','list',serializedInput] with ['payments','list',serializedInput], and ['users','list',{ input }] with ['payments','list',{ input }]; each pair differs only at index 0 and a users filter must not match the payments key.
• Issue users.update({ id: representativeId, data: { name: renamedName } }); require optimistic UI, mutation success, a second users.list network request from onSettled, and final server-confirmed renamed DOM content.
• Under one controlled hydrationNow, compare initialDataUpdatedAt = hydrationNow - 60_000 (one hydration refetch) against initialDataUpdatedAt = hydrationNow (zero first-paint refetches), with staleTime: 15_000.

Determinations

• PLAN-EVAL: required. The additive SDK fork, public generator overwrite/result contract, compatibility migration, three publishable members, and two runtime consumers make this decision-heavy.
• Both expensive gates: load-bearing after cheap convergence. No lease has been requested and neither gate has run.

Open decisions for PLAN-EVAL

1. Additive bridgeInvalidation(queryKey) overload versus a direct generated filter.
2. packages/fresh/README.md as the migration-note home under the docs/** prohibition.

Evidence: plan.md

Next

• Topic orchestrator verifies this repaired exact head and launches formal PLAN-EVAL separately.
• No scaffold.runtime, fresh-browser, evaluator, product code, ready transition, merge, or publication was started.

[PHASE: PLAN-EVAL] [VERDICT: FAIL_PLAN] — cycle 1/2

Plan 7f20a34fe is sound in archetype, scope, and gate set, but has one unflagged open decision and needs the fork ruling recorded. Evaluator artifact: .llm/runs/feat-app-service-client-wiring--1355/plan-eval.md @ ed34105e2. Fresh native Claude Fable 5 · medium · Remote Control (bridge cse_01TiYhwUCkdyjziEpFP3kgaS); requested == observed route (from respawnFlags).

Ruling on the fork

Direct emit — no SDK overload. Generated constant becomes { queryKey: <svc>Queries.list.clientKey() } after the factory. Both options derive from clientKey(), so both fix the dead invalidation and are equally rename-safe; both leave the string bridgeInvalidation in place. The overload is an identity { queryKey } wrapper (fails A6 — clientKey() already is the discoverable typed path, #1265) and would couple service add --with-client to SDK ≥ 0.0.7, breaking generation into 0.0.6-pinned apps. Cost: no named SDK entry point; pay down with a JSDoc fix at key-bridge.ts:4-7 + pointer to clientKey(), and the semantic match/mismatch SDK test #1355 asks for. Migration notes: packages/fresh/README.md (hydration age) and packages/cli/README.md (verb + regeneration migration) — not docs/**.

Findings

1. Unflagged open decision — generator-owned output paths. init writes the showcase module to apps/<app>/routes/examples/service/(_lib)/service-query.ts (write-example-service-app-files.ts:69-72, islands import it); service add --with-client writes apps/<app>/lib/<service>.ts (client-scaffolder.ts:8-21). plan.md never says which the all-service generator owns; byte-identical second run, "regeneration upgrades existing modules", the two-service import, and scenario 3's proof all depend on it. Recommend: generator owns lib/<service>.ts only; (_lib)/service-query.ts stays init-owned from the same template; say so.
2. service generate compat unstated. The existing Aspire-regen verb will now also rewrite differing hand-edited client modules without --force (D4 mirrors generate-runtime-schemas.ts:115-129). State it in D6/Finding 5 and say whether --dry-run/--force govern the Aspire half.
3. "Documented verb" acceptance (feat(cli): app-side client/query wiring is a one-shot template with hardcoded names, colliding 'service' cache keys and a no-op invalidation #1355) has no home while docs/** is prohibited → packages/cli/README.md (also carries the six-symbol pre-fix(docs/sdk): teach one client module and query dialect #1424 rename list + namespace/orphaned-cache note).
4. Tighten scenario 3 to "list-request count +1 after mutation settles" so a post-fix(scaffold): the canonical island never passes initialDataUpdatedAt, so the loader's cachedAt is computed, displayed and discarded #1360 age refetch isn't mistaken for invalidation.
5. Housekeeping: per-slice file lists; qualify the workspace-mutator.ts citation (three files share the name).

Verified and holding: all diagnoses re-derived at source (key shapes, 'service' collision, both islands omit initialDataUpdatedAt, islands' useQuery is Fresh's useIslandQuery wrapper so fresh-browser proves the right path); citation drift honest; gate-class repair complete (catalog.ts has no scaffold.runtime, fresh-browser at catalog.ts:55); five-file receipt set honest; plan does not claim existing suites prove two-service isolation.

Next

• Codex author thread: amend plan.md/research.md per fixes 1–6 in plan-eval.md, push, and request PLAN-EVAL cycle 2 (topic orchestrator dispatches). No implementation slice before PASS.

[PHASE: PLAN-UPDATE] [CYCLE: 1]

Repaired all six FAIL_PLAN findings at f7225be98c01b38f86712c1df0782aec06e34445. This is a plan-text-only amendment; implementation remains stopped.

Rulings recorded

1. Direct emit; no SDK overload. Generated modules define <svc>Queries first, then emit { queryKey: <svc>Queries.list.clientKey() } as const. S1 now only corrects the stale key-bridge.ts server-key documentation, points factory users to clientKey(), and adds resource match/mismatch semantic tests.
2. Owned paths locked. The generator owns exactly apps/<app>/lib/<service>.ts. The init-owned route showcase at apps/<app>/routes/examples/service/(_lib)/service-query.ts remains separate while sharing the canonical template.
3. Compatibility locked. Differing owned client modules are rewritten without --force. --dry-run and --force govern both client and Aspire-helper output as a whole-command contract. Direct emission remains compilable in apps pinned to SDK 0.0.6.
4. README homes locked. packages/cli/README.md will document the verb, result/overwrite/flag contract, L1/L2 dialect, six pre-fix(docs/sdk): teach one client module and query dialect #1424 symbol renames, and literal-service namespace migration. packages/fresh/README.md will document hydration age.
5. Invalidation assertion tightened. After hydration settles, the test records the list count and requires exactly count + 1 only after the mutation response settles, plus server-confirmed final DOM state.
6. Housekeeping complete. Every slice now names its planned files, and the manifest citation is qualified as packages/cli/src/kernel/adapters/service/workspace-mutator.ts:75-97.

Preserved decisions

• scaffold.runtime remains suite-owned release-gate evidence, never a run-gate receipt.
• The binding receipt set remains exactly four cheap receipts plus receipts/s5-fresh-browser.json.
• Both expensive gates remain required only after cheap convergence, explicit release, and lease.

Validation

• Markdown format check — PASS
• git diff --check — PASS
• Product/package files changed — none
• deno.lock / docs/** changed — none
• Expensive gates, lease, and evaluator dispatch — NOT_RUN / NOT_REQUESTED

Next

Coordinator verifies this exact head and separately grants PLAN-EVAL cycle 2. This implementation session does not launch it.

[PHASE: PLAN-EVAL] [VERDICT: PASS] — cycle 2/2

Repaired plan f7225be98 discharges all six cycle-1 fixes; no plan-gate box remains unchecked. Evaluator artifact: .llm/runs/feat-app-service-client-wiring--1355/plan-eval.md @ c53726c69 (cycle 1 text preserved). Fresh native Claude Fable 5 · medium · Remote Control (bridge cse_01UrhsQgBYpLZWHKAhCvESi6); requested == observed route (from respawnFlags). Local HEAD == remote ref == PR head; clean tree; repair delta touches run artifacts only.

Fork ruling

Cycle-1 ruling stands and is complied with: direct emit { queryKey: <svc>Queries.list.clientKey() } as const, no SDK overload (D8, Open-Decision, SDK contract, S1, Drift Watch, research aligned). Independently verified clientKey exists in published @netscript/sdk@0.0.6, so the SDK-0.0.6 compatibility rationale is true.

Checked

• Fixes 1–6: discharged in the file (paths locked to apps/<app>/lib/<service>.ts; whole-command --dry-run/--force incl. Aspire half; README homes with the six-symbol migration; scenario 3 = count +1 after settle + server-confirmed DOM; per-slice files; qualified workspace-mutator.ts:75-97).
• Diagnoses re-derived at source: key-shape mismatch, 'service' collision, both islands omit initialDataUpdatedAt; citation drift honest.
• Gate class: no scaffold.runtime in catalog.ts, fresh-browser at catalog.ts:55, five-file receipt set honest, no residue in plan/research/drift.
• Scenarios are falsifiable; plan does not claim existing suites prove two-service isolation or invalidation.

Implementation constraints (non-blocking; IMPL-EVAL to verify)

• C1 Make the "SDK-0.0.6 compatibility" test concrete: assert the literal emit expression and an allowlist on @netscript/sdk/* imports (createServiceClient, createQueryFactories); drop the now-unused bridgeInvalidation import from the template.
• C2 Document/error clearly that service generate now fails atomically (Aspire half withheld) when a manifest service lacks its contract; decide whether Enabled: false services get owned modules.
• C3 Mark generate-aspire_test.ts as new in S2.

Next

• Topic orchestrator: PLAN-EVAL PASS recorded; implementation slices S1–S3 may start on the Codex author thread. No expensive gate before coordinator lease.

[PHASE: IMPL] [SLICE: S1]

S1 is complete at 5ac6efa308599eac9290977215af5c951fcf46ee and stopped at its Tier-A boundary.

Scope delivered

• Corrected the public key-bridge module documentation to the live server key [resource, action, serializedInput] and query-factory key [resource, action, { input }].
• Added bridgeInvalidation JSDoc directing factory consumers to factory.<action>.clientKey().
• Added fail-capable semantic coverage for matching and mismatched resource prefixes.
• Kept the SDK surface unchanged: no export, overload, public type, callable signature, or named helper was added.
• Recorded PLAN-EVAL constraints C1/C2 in their owning S2/S3 slices, chose owned-module generation for Enabled: false services, and marked generate-aspire_test.ts new (C3).

Tests

• bridgeInvalidation matches a query-factory key when resource and action match
• bridgeInvalidation does not match a query-factory key when resource differs

Focused evidence at the committed content head

• Structured SDK check: PASS — 2 selected files, zero diagnostics.
• Structured focused test: PASS — 2/2.
• Changed-module SDK doc lint: PASS — zero errors.
• Repository quality:gate: PASS.
• Full SDK export-map doc lint remains baseline-failing on three out-of-slice private-type references in packages/sdk/src/ports/query-client.ts, packages/sdk/src/query-client/query-client-factory.ts, and packages/plugin-streams-core/src/application/create-durable-stream.ts; it reported no missing JSDoc attributable to S1.
• deno.lock, docs/**, expensive gates, lease state, and S2 are untouched.

Next: STOP. S2 requires a separate coordinator dispatch.

[PHASE: IMPL] [SLICE: F6] [BINDING-RECOVERY]

The first F6 binding-test receipt remains an append-only red:

• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-test.json
• invocation app-service-client-wiring-f6-test
• FAIL, exit 1, at gitHead == actualGitHead == 7fa29ad3ed10ad903b9cbbd518111e6bf2754761
• 4,228 passed / 1 failed / 19 ignored (4,248 total; one unique failure)

Coordinator review established the failure as environmental. F5 had 4,226/0/19 = 4,245 results; F6 attempt 1 had 4,228/1/19 = 4,248, so the F6 delta added three results and two additional passes. The sole failure was the forbidden-command walker receiving PermissionDenied at the root/dnsmasq-owned S5 attempt-4 Postgres tree.

The coordinator quarantined that tree recoverably:

• source .llm/tmp/cli-e2e/plugin-smoke-20260815-203755: verified absent
• destination /tmp/netscript-f6-quarantine.7kXcDX/plugin-smoke-20260815-203755: verified present

The leaf did not delete, chmod, move, or mutate the residue. Attribution was committed and pushed before the rerun at 91c50e2dfa1916d28ac6897f9437e4b582208cde.

Exactly one distinct environmental rerun then executed at the unchanged content head:

• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-test-attempt2.json
• invocation app-service-client-wiring-f6-test-attempt2
• PASS, exit 0
• 4,229 passed / 0 failed / 19 ignored (4,248 total; zero unique failures)
• gitHead == actualGitHead == 7fa29ad3ed10ad903b9cbbd518111e6bf2754761

All three F6-added results remain present and now pass, confirming the environmental attribution. The two conditional gates then ran serially and passed at the same content head.

Exact contracted passing set

• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-check.json
  • app-service-client-wiring-f6-check — PASS, exit 0
• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-test-attempt2.json
  • app-service-client-wiring-f6-test-attempt2 — PASS, exit 0
• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-publish-dry-run.json
  • app-service-client-wiring-f6-publish-dry-run — PASS, exit 0
• .llm/runs/feat-app-service-client-wiring--1355/receipts/f6-arch-check.json
  • app-service-client-wiring-f6-arch-check — PASS, exit 0

All four attest gitHead == actualGitHead == 7fa29ad3ed10ad903b9cbbd518111e6bf2754761 with no mismatch override. Fresh evaluateEvidenceSet recomputation over exactly those four files is SUFFICIENT, reasons [].

The original f6-test.json is retained as a superseded red and is deliberately outside the passing set. Recovery evidence is committed at a8a160285; the attempt-4 raw log remains append-only with SHA-256 b476da4ce039d03785e46669d51919b48c41fbae80ca41ca9188bcbb53e97f23.

No product, template, fixture, lockfile, documentation, expensive gate, browser, Aspire, Docker, lease, evaluator, readiness, label, or metadata change occurred.

[PHASE: IMPL] [SLICE: S5] [ATTEMPT: 5]

The singleton release-gate lease executed exactly once at immutable leaf evidence head a8a160285d4f9bddb95a5dac6cfbde85e1265ebc over product head 7fa29ad3ed10ad903b9cbbd518111e6bf2754761. No commit moved the leased head before or during execution.

Gate verdicts

• scaffold.runtime: FAIL
  • exact command: deno task e2e:cli run scaffold.runtime --cleanup --format pretty
  • inner deno task exit code: 1
  • suite-owned terminal report: 70 total steps — 69 passed / 1 failed / 0 skipped
  • family counts:
    • preflight: 2/2 passed
    • scaffold: 15/15 passed
    • generated: 11/11 passed
    • runtime: 21/21 passed
    • database: 5/5 passed
    • behavior: 13/14 passed
    • cleanup: 2/2 passed
• fresh-browser: NOT_RUN
  • scaffold prerequisite was red
  • no catalog receipt exists
  • no browser cleanup audit was required or reached

The complete pretty transcript is:
.llm/runs/feat-app-service-client-wiring--1355/reports/s5-attempt5-scaffold-runtime-20260815-2139.log

SHA-256: ff349b40f7f70341934e170df7c67d147c0ed983173b41871421755ad55e062b

The suite-owned NDJSON event log—containing all 70 exact step IDs, verdicts, durations, and evidence—is:
.llm/runs/feat-app-service-client-wiring--1355/reports/s5-attempt5-scaffold-runtime-20260815-2139.ndjson

SHA-256: e35d6fbcbdfc0b046be3fec29fa5dee0b0369094645b75cb42fca1e0350bbc16

The pretty stream has 68 explicit PASS lines plus one FAIL. The 69th pass is the suite runner's synthetic cleanup.docker-created-containers step, retained in the terminal NDJSON report. This reconciles the full 69/1/0 summary without relying on the summary line alone.

The complete transcript was streamed through tee; the outer pipeline status was 0. The inner task's exit is nevertheless recorded as 1 from the uncaught RemoteError(1, 'CLI E2E suite failed') and the suite-owned terminal report's ok: false plus one failed step. No retry replaced this evidence.

Runtime findings

The repaired generator/runtime seams remained green:

• scaffold.service-client-add — PASS
• scaffold.service-client-generate — PASS
• generated.service-client-contract — PASS
• generated.deno-check — PASS
• generated.deno-lint — PASS
• generated.deno-fmt-check — PASS

The sole red was behavior.service-client-refetch after 38,072 ms:

Error: timed out waiting for Chrome DevTools target
  at waitUntil (service-client-browser-probe.ts:339:9)
  at waitForDebugTarget (service-client-browser-probe.ts:357:3)
  at collectBrowserRefetchEvidence (service-client-browser-probe.ts:136:20)

The probe failed before CDP connection, navigation, mutation, or refetch-count assertions. This is not a refetch-behavior verdict; the behavior remains unproven.

At pre-implementation c53726c69, the browser-probe path is absent (git cat-file -e exit 128) and the gate ID has no match (git grep exit 1), so attribution is a leaf-caused probe/runtime-integration failure, not a carried baseline or generated-app failure. No Linux Chrome candidate exists; Windows Chrome and Edge do. That is observed context, not a proven cause, because browser stderr was drained without retention. No repair or retry occurred under the lease.

Cleanup and lease release

• Suite cleanup.aspire-stop: PASS, 576 ms
• Suite cleanup.docker-created-containers: PASS
• Run-owned teardown: applied; 0 AppHosts stopped, 0 containers removed, 0 escalations
• Final agentic:leak-check:
  • probes.aspire.state = ok
  • probes.docker.state = ok
  • survivors = []
• aspire ps --format Json: []
• Docker inventory: empty
• Process audit: no AppHost, DCP, application, browser, or runtime process; only protected aspire mcp start helpers remain
• Relevant TCP listener audit: empty

Three run-owned stopped NuGet helper processes were observed, but all exited naturally between ownership verification and the targeted TERM call; every signal attempt returned No such process, so no signal was delivered. The Aspire MCP start helpers were untouched.

The host is proven empty and the leaf releases the singleton lease. The post-browser cleanup audit is NOT_REACHED / NOT_APPLICABLE because fresh-browser did not run.

Durable report: .llm/runs/feat-app-service-client-wiring--1355/reports/s5-attempt5-runtime-failure.md

Evidence commit: 6204a7171. All four earlier S5 attempts, f6-test.json, prior reports/receipts, and the carried Fresh 45 / SDK 3 baselines—including plugin-streams separately—remain append-only.

[PHASE: PLAN] [SLICE: F7]

F7 is committed as a plan-only amendment at ff0ede997. No product, test, template, fixture, lockfile, or docs path changed, and no gate, browser, Aspire, Docker, lease, evaluator, or attempt 6 ran.

Measured disposition

• Attempt 5 remains an honest 69/1/0 red and not a refetch-behavior verdict.
• The opaque timeout is a leaf-caused diagnostic defect over an environmental capability gap: no Linux browser exists, Windows Chrome is selected without WSL binfmt interop, and the child exits 2 with actionable stderr that the probe currently discards.
• Windows-path conversion and 127.0.0.1 handling are refuted and excluded.

Reviewed ceiling for a later repair

1. packages/cli/e2e/src/application/gates/scaffold/service-client-browser-probe.ts
2. packages/cli/e2e/tests/application/gates/service-client-runtime-probe_test.ts

The plan names captureBrowserStderr (continuous drain with a 32 KiB retained tail) and awaitBrowserStartup (DevTools-target versus child-status race). Early exit must report code, signal, and bounded stderr rather than a timeout; the same raw drain remains owned by F6 cleanup. findBrowserExecutable() behavior is explicitly unchanged.

Deterministic cheap proof

• real immediate code-2 child with sentinel stderr;
• output beyond 32 KiB proves bounded tail retention and completed drain;
• a live-child target timeout remains distinguishable and propagates unchanged;
• production wiring forbids the discard sink and preserves all F6 termination proofs.

Explicit precondition failure, recorded skip, and host provisioning remain coordinator-owned alternatives; this amendment chooses none. See plan.md and reports/f7-plan-amendment.md.

Next

Fresh Tier-A review. No implementation before approval.

[PHASE: PLAN] [SLICE: F7-C1]

F7-C1 is committed at a2e9515f5 and supersedes the unreviewed F7 plan/comment at ff0ede997. The correction is run-artifact-only: no source, test, template, fixture, README, lockfile, or docs path changed, and no gate, browser, Aspire, Docker, lease, attempt 6, or evaluator ran.

Corrected classification

• Runnable Playwright-managed Linux Chromium exists:
  • chromium-1232/.../chrome → Google Chrome for Testing 151.0.7922.10
  • chromium-1234/.../chrome → Google Chrome for Testing 151.0.7922.34
• Attempt 5 is therefore an allowlist/selection defect plus a startup-diagnostic defect, not an environmental capability gap.
• The six built-in candidates omit managed browsers, select Windows Chrome without WSL binfmt interop, and then discard its code-2 stderr behind a DevTools timeout.
• Path conversion and loopback remain refuted causes. Skip is not an outcome; the runtime gate must prove settled refetch.

Strict selection contract

The portable override is NETSCRIPT_E2E_BROWSER_EXECUTABLE.

• If present—even empty—it is the only candidate.
• Empty, missing, non-file, non-executable, spawn-failing, timed-out/non-zero, or unrecognized values fail with the variable name, exact path/<empty>, and specific reason.
• An invalid override never falls back.
• Without an override, built-ins must pass the same bounded executable --version probe before selection.
• Versioned Playwright/Puppeteer cache paths remain runtime values and are forbidden from source/test literals.

Bounded diagnostics and proof

The existing two-path ceiling remains:

1. packages/cli/e2e/src/application/gates/scaffold/service-client-browser-probe.ts
2. packages/cli/e2e/tests/application/gates/service-client-runtime-probe_test.ts

The 32 KiB continuously drained tail and target/status race remain. Early exit reports selection source/path, code, signal, and stderr; live target timeout preserves its cause/text and adds source/path without inventing an exit code. The proof matrix binds managed-binary version selection, override precedence, exhaustive invalid/no-fallback cases, immediate code-2 stderr, bounded chatty output, live timeout, and all F6 proofs.

See plan.md and reports/f7-plan-amendment.md. Fresh Tier-A is required before either owned source/test path changes.

[PHASE: IMPL] [SLICE: F7] [GATE-STOP]

F7 stayed inside the reviewed browser-probe/test pair. Strict NETSCRIPT_E2E_BROWSER_EXECUTABLE selection, runnable built-in validation, bounded startup stderr/status evidence, and all F6 teardown behavior are implemented at content head e45144db643f6bde85552a615812c8371e4ce792. The managed-browser focused suite passed 22/0.

The serial binding sequence stopped honestly at test:

The sole failure is the unchanged teardown walker receiving PermissionDenied at the preserved S5 attempt-5 path .llm/tmp/cli-e2e/plugin-smoke-20260815-213942/.data/postgres/18/docker (mode 0700, owner dnsmasq:root). The walker has no diff from c53726c69. F6 had 4,248 total results; F7 has exactly eight more, matching the focused file's 14→22 increase, and all eight pass in the focused run.

No retry or residue mutation occurred, and the downstream gates were not started. Exact-set recomputation over the four paths is INSUFFICIENT: test is FAIL and the publish/architecture receipts are missing. Full attribution: .llm/runs/feat-app-service-client-wiring--1355/reports/f7-binding-test-failure.md.

Evidence head pushed: 885f352e7. No runtime lease, expensive gate, browser, Aspire, Docker, evaluator, readiness, or metadata action ran.

[PHASE: IMPL] [SLICE: F7] [BINDING-RECOVERY]

Environment-only binding recovery completed at immutable content e45144db643f6bde85552a615812c8371e4ce792 from clean detached checkout /home/codex/worktrees/netscript-f7-binding-e45144db6. No allowGitHeadMismatch waiver was used.

The original receipts/f7-test.json remains append-only as a superseded environmental FAIL at evidence commit 885f352e7; it is deliberately excluded from the passing set. The original check PASS was retained and was not rerun.

Exact passing set:

• receipts/f7-check.json — app-service-client-wiring-f7-check — PASS — attested e45144db643f6bde85552a615812c8371e4ce792
• receipts/f7-test-attempt2.json — app-service-client-wiring-f7-test-attempt2 — PASS — 4,237 passed / 0 failed / 19 ignored / 4,256 total — attested e45144db643f6bde85552a615812c8371e4ce792
• receipts/f7-publish-dry-run.json — app-service-client-wiring-f7-publish-dry-run — PASS — attested e45144db643f6bde85552a615812c8371e4ce792
• receipts/f7-arch-check.json — app-service-client-wiring-f7-arch-check — PASS — attested e45144db643f6bde85552a615812c8371e4ce792

Exact-set recomputation: SUFFICIENT, reasons []. Including the original red would correctly make the set insufficient through both its FAIL and the duplicate test gate ID.

Recovery evidence is committed at ed3f78e0d. No source/test change, runtime attempt, lease, expensive gate, browser, Aspire, Docker, evaluator, readiness, deletion, or quarantine mutation occurred.

[PHASE: IMPL] [SLICE: S5-A6] [VERDICT: FAIL]

Attempt 6 executed exactly once from a clean detached checkout at the leased evidence head ed3f78e0d87784b1869166bd2574737c62fac0af; no commit occurred between grant and execution.

Gate verdicts

• scaffold.runtime: FAIL — raw exit code 1; 69 passed / 1 failed / 0 skipped.
• Sole red: behavior.service-client-refetch — child exited 143 after 900,030 ms, with empty stdout/stderr tails. No retry.
• generated.service-client-contract, generated.deno-fmt-check, cleanup.aspire-stop, and suite-owned Docker cleanup passed.
• fresh-browser: NOT_RUN because the scaffold prerequisite failed. No catalog receipt exists.

Browser selection evidence

• Source: NETSCRIPT_E2E_BROWSER_EXECUTABLE
• Path: /home/codex/.cache/ms-playwright/chromium-1234/chrome-linux64/chrome
• Version: Google Chrome for Testing 151.0.7922.34
• Durable selector record: reports/s5-attempt6-browser-selection-20260815-205715.json
• SHA-256: fd208b82c31497801ab4d396321685d7858ecbf07788a66353a6618f24f0e1da

Suite-owned evidence

• Pretty raw log: reports/s5-attempt6-scaffold-runtime-20260815-205715.log
  • SHA-256: 1bf8cb03aaa3be0ba900254abdaf3065aa9f7c8cae5989bac37ed396a919aaa0
• Complete per-gate NDJSON: reports/s5-attempt6-scaffold-runtime-20260815-205715.ndjson
  • SHA-256: ffab7e7f0b7764c7d2e0eca5873fa9d5cfee7c5f278743a8886e7bbba53de356

Cleanup and audits

• First and final agentic:leak-check: Aspire ok, Docker ok, survivors: [].
• Three run-owned Aspire NuGet search children were validated by cwd containment and exited after TERM+CONT; no KILL and no foreign-helper action.
• D-18 found one unreadable run-owned Postgres directory. The complete generated project and suite log were moved, not deleted, to /tmp/netscript-s5-a6-quarantine-20260815-4M9v8k/.
• Final audit: aspire ps --format json = []; docker ps -aq empty; run-owned processes []; run-owned listeners []; both leaf and detached .llm/tmp unreadable scans exit 0 with no findings.
• Final host state: empty of attempt-6 resources. The leaf relinquished lease use only after this proof; central release remains coordinator-owned.

Evidence commit: 2385cdb72. Full report: reports/s5-attempt6-runtime-failure.md.

No product/test mutation, second runtime attempt, browser gate, evaluator, readiness/label/acceptance change, merge, or quarantine deletion occurred.

[PHASE: PLAN] [SLICE: F8]

Edited in place. This comment originally cited d8d5ee619 as the plan head. That head was an intermediate contaminated plan head and is not the final F8 plan state. The corrected head is 4255a57b9.

Contamination and repair. d8d5ee619 carried a change to .llm/runs/feat-app-service-client-wiring--1355/leak-report.md that the plan author did not produce: a supervisor host audit ran into the author's checkout and rewrote the report's Generated timestamp and Worktree line to 2026-08-15T21:33:41.742Z / /home/codex/repos/netscript-007-features-1355. The author's own values are 2026-08-15T21:24:46.689Z / /home/codex/worktrees/netscript-s5-a6-ed3f78e0d, from the attempt-6 detached checkout.

4255a57b9 restores leak-report.md byte-for-byte to its blob at 2385cdb72 (blob 8408f6299 on both sides; git diff 2385cdb72 HEAD -- <path> is empty) and records the provenance correction in worklog.md, superseding the earlier sentence that described those bytes as a preserved coordinator audit refresh. The repair was made append-only by a separate corrective owner in a dedicated detached worktree: d8d5ee619 is not amended, reset, rebased, or rewritten, and it remains in history as the contaminated intermediate. No gate, audit, leak-check, browser, Aspire, Docker, lease, evaluator, readiness, metadata, issue, label, lockfile, or docs action was taken during the repair.

Plan content (unchanged by the repair). Attempt 6 is attributed exactly: managed Chromium selection and launch are proven, while behavior.service-client-refetch returned no evidence before the suite boundary. The preserved NDJSON has no CDP-stage marker, so it cannot distinguish CdpClient.connect from CdpClient.send.

The amendment keeps the exact two-path ceiling: service-client-browser-probe.ts and service-client-runtime-probe_test.ts. It binds separate inert-socket and missing-response watchdog proofs, operation-specific URL/method diagnostics at the existing 20,000 ms bound, stale pending-id cleanup, and unchanged F6 teardown plus F7 selection/startup coverage.

Artifacts at 4255a57b9: plan.md F8, reports/f8-plan-amendment.md, worklog.md, context-pack.md, and drift.md. 2385cdb72..4255a57b9 contains only legitimate F8 plan artifacts — no source or test mutation, and no expensive gate, browser, Aspire, Docker, lease, evaluator, readiness, metadata, issue, lockfile, docs, or quarantine mutation. Attempt 7 remains prohibited until repair receipts and fresh Tier-A.

F8 — bounded CDP transport waits: implemented, corrected, Tier-A ACCEPTED

Content head (attested by every gate): 4f50b5a026120b5a3b0195fa1b6f495f08e2b46c
Final head (supervisor evidence only): 388f2b642a0d6e0ece4e346ea60f857928409beb

Slices

Path ceiling held on both product slices: service-client-browser-probe.ts,
service-client-runtime-probe_test.ts, and the append-only leaf worklog. No third path.

What changed

CdpClient.connect and CdpClient.send were the only two unbounded promises in the 605-line probe
(verified by enumerating all three new Promise sites; every while loop and both Promise.race
sites were already bounded). Both now carry the existing TIMEOUT_MS = 20_000 default behind an
injectable structural socket seam, and reject with separately attributable diagnostics —
CDP WebSocket connection to <url> timed out after <n> ms vs
CDP response to <method> timed out after <n> ms. A send timeout deletes its id before rejecting, so
a late response is inert and the pending map cannot grow; a connection timeout detaches both handlers
and closes through the seam, and a failing close() still rejects with its cause rather than becoming
a success. Normal CDP error responses and socket errors are unchanged.

Three new deterministic tests use a 25 ms production bound against a 1,000 ms watchdog — a 40× margin,
so deleting either bound fails the test in a second instead of hanging the suite. No browser, network,
Aspire, or Docker is required.

Why one slice was returned

At 3299992e4 all four contracted gates were PASS and the named receipt set recomputed
SUFFICIENT — and the slice had still regressed quality. Under --root packages/cli/e2e the probe
carried a prefer-const occurrence at :101 and one deno fmt finding; both were clean at
20337441788 under the identical command. deno task lint and fmt:check exclude
^(packages/(cli)|…), so CI and the contracted four could not have caught it. Green gates plus
SUFFICIENT did not mean clean code. It was returned to the author rather than fixed by the
supervisor, and closed in 8 insertions / 10 deletions with both diagnostic strings byte-identical.

Evidence at 4f50b5a02

Sufficiency recomputed over the explicitly named four-receipt attempt-2 set (not a glob):
SUFFICIENT, zero reasons, every receipt gitHead == actualGitHead == 4f50b5a02. No any,
deno-lint-ignore, or as unknown as introduced. Attempt-1 receipts retained append-only.

Carried, none blocking

• terminateBrowserProcess :448-449 remains unbounded — F6-owned, out of F8 scope, and only now
  reachable. For a later leaf.
• The 20 s bound on Runtime.evaluate narrows one theoretical slow-but-successful case; that is the
  intended trade.
• pendingCommandCountForTest is a contained test-only accessor: e2e/ is excluded from the
  @netscript/cli publish set, @netscript/cli-e2e is "publish": false, and e2e/mod.ts does not
  re-export the probe.

Status

No scaffold.runtime, browser, Aspire, Docker, or lease was used; docker ps -a is empty.
Runtime attempt 7 is not granted — it is prohibited for this leaf and not the topic supervisor's
to grant. The green reviewed content head is reported to the coordinator for the singleton
runtime-lease decision. PR remains draft; no readiness flip, relabel, merge, or issue mutation.

S5 attempt 7 — runtime red, now attributable; cleanup and quarantine complete

Executed exactly once under coordinator lease 6c5d54082f9dc80a9fe8f0b00176eccad651f0eb, at
leased evidence head 388f2b642a0d6e0ece4e346ea60f857928409beb (content 4f50b5a02), in a dedicated
detached checkout clean before the gate, with the strict browser override
(Google Chrome for Testing 151.0.7922.34) and the suite-owned command. No retry.
Terminal evidence commit: a257807d8.

Verdict

Raw exit 1 — 68 passed / 1 failed / 0 skipped. Sole red: behavior.service-client-refetch.
cleanup.aspire-stop PASS; generated.service-client-contract and generated.deno-fmt-check PASS.

The failure mode changed categorically

timed out waiting for browser expression (… 'Rename' … "Seed User*" …)
  at waitUntil (service-client-browser-probe.ts:623)
  at waitForExpression (:610)
  at collectBrowserRefetchEvidence (:286)

The 900-second silent boundary kill did not recur; the gate now stops in a fifteenth of the time and
says where.

What this proves — and what it does not

Neither CDP bound fired. Zero matches for CDP WebSocket connection or CDP response to in
either artifact. Both F8 timeouts were present and neither triggered, so the transport connected and
every command settled. The browser genuinely ran — the failing assertion is a DOM expression
evaluated inside the page.

This does not prove F8 repaired attempt 6's hang. With no CDP timeout fired, there is no evidence
a CDP wait was ever the attempt-6 stopping stage; what is shown is that the transport was healthy
this run and the stall did not recur. F8 delivered its stated purpose — attributability. Causation is
not claimed.

The remaining red is behavioral, not transport. The optimistic row Seed User* never appeared
after the Rename click, hitting the pre-existing 20 s waitUntil bound. That is a real product
question about the optimistic-update/refetch path — a deeper frontier than any prior attempt reached
— and is not classified here as a pass or fail of that feature.

fresh-browser was not run: the lease conditioned it on a scaffold.runtime PASS.

The inter-gate audit read empty and was wrong

cleanup.aspire-stop PASS and leak-check survivors: [] both missed three surviving
aspire-managed processes (646406, 646408, 646415), found only by a cwd-containment sweep,
all rooted in this run's worktree and orphaned to the WSL /init relay. Containment proved
run-ownership; foreign siblings (tmux, claude, codex, browser_crashpad) were left untouched.
All three ignored SIGTERM and required SIGKILL, with containment re-verified before each signal.

The one run-owned unreadable residue (.data/postgres/18/docker, mode 700, container-uid) was then
moved, not deleted, with its exact enclosing tree to
/tmp/netscript-s5-a7-quarantine.Cy2tNS/plugin-smoke-20260823-095547 (843 MB, recoverable).

Post-quarantine re-audit is empty on every class: unreadable 0, processes 0, containers 0,
ports 0, leak-check aspire ok / docker ok / survivors []. leak-check wrote to a scratch
slice dir throughout, so the leaf's leak-report.md was never regenerated.

Preserved evidence

• reports/s5-attempt7-scaffold-runtime-20260823-075547.log — SHA-256 a4ee67d2…94a042
• reports/s5-attempt7-scaffold-runtime-20260823-075547.ndjson — SHA-256 c0b1a450…6a0eff4
• reports/s5-attempt7-runtime-failure.md

No retry, no product or test mutation, no evaluator, no readiness/merge/metadata action, no relabel.
All prior quarantines and reds remain append-only. Stopped for the coordinator's IMPL-EVAL
decision.