feat(sdk-java): Adopt a Managed Runtime only after attestation - #12552

Fixed the Lint & Static failure in f57765b.

fake-attestation-worker.mjs now imports process and Buffer from node:process and node:buffer, and compares the request path directly instead of new URL. That removes the 9 no-undef errors. LocalProcessRuntimeProvisionerTest still passes locally.

Two CI results since f57765b:

• Lint & Static failed on Prettier for fake-attestation-worker.mjs. Formatted in ac63adc.
• ubuntu-latest / Java 21 failed in Verify checkout includes expected head commit before tests started. The checked-out ref did not contain f57765b256. That is a runner checkout mismatch, not this diff. Reran the failed job.

Local verification against the real worker — head ac63adc4

Verdict: mergeable as a library slice, with one issue to fix before anything constructs LocalProcessRuntimeProvisioner in production. The headline claim holds against the real qwen managed-runtime-worker binary, not only against the Node double. The worker spawns, attests and reaches READY. Reusing the in-memory lease re-attests. A stopped or kill -9ed worker is refused. On main the same scenario hands back the dead lease every time.

The gap is recovery. Once a worker dies, its binding stays READY for the rest of the Broker's life. Every retry gets 503 retryable=true and no new worker is ever started. I have a patch for that (+61/−8, verified) and a test patch (+87/−6) that raises mutation kills from 2/14 to 11/14.

qqqys's blocking item is fixed. The .mjs passes eslint --max-warnings 0 and Prettier at head, and a20ea29 still reproduces the 9 no-undef errors locally. That CHANGES_REQUESTED review needs a re-review or a dismissal.

Environment

• The real worker came from an already-built bundle (node dist/cli.js managed-runtime-worker). Its sources are byte-identical to this head: git diff --quiet 075de399 ac63adc4 -- managed-runtime-attestation-worker.ts managed-runtime-attestation-contract.ts cli.ts.
• The PR's own LocalProcessRuntimeProvisioner + RuntimeBrokerService + HttpRuntimeTransport were driven by a Java harness, not mocks.
• JDK 25 (host) and JDK 21.0.12 (temurin container, the module's release), Node 22.
• Module suite: 76/76, 0 skipped on both JDKs. checkstyle:check is clean.

What holds up (real worker)

The same checks on JDK 21 give identical results. The Java↔TS boot/ready contract matches field for field against the real binary, which settles the "double could drift" gap from triage.

Findings

F1 — A dead worker bricks its binding for the Broker's lifetime, while the error says retryable (fix before wiring; not a regression).
confirm failure leaves the record READY and liveBindings populated. ensureBinding only provisions from PROVISIONING, so nothing ever replaces the dead worker. Three arms, same scenario:

• Arm A: main behaviour (head with the RuntimeBrokerService hunk reverted). After the worker is gone, warm() returns the READY lease 5/5 times, pointing at a dead port. This is the bug the PR fixes.
• Arm B: head. It is refused correctly, but 5/5 retries give 503 runtime_provision_failed retryable=true and 0 workers are spawned. Until a restart or reconcile, the caller is told to retry something that cannot succeed.
• Arm C: head + patch. The first retry provisions a new generation, and the next 5 warms are OK.

The patch has two parts:

• On confirm failure the service claims the operation, CASes READY→FAILED and drops liveBindings.
• The provisioner stops the process it failed to confirm.

The extended PR test is RED on head (Managed Runtime process is not alive. on the recovery step) and GREEN with the patch. With the patch plus the follow-up tests the full suite is 83/83 and checkstyle is clean. Two caveats:

• Recovery was exercised with the in-memory repository only.
• A transient attest failure now retires a healthy worker instead of sticking. I think that trade is right for a fail-closed gate, but it is the owner's call.

--- a/.../RuntimeBrokerService.java
+++ b/.../RuntimeBrokerService.java
@@ ensureBinding
             BindingContext live = requireLiveBinding(record);
             return safeStage(() -> provisioner.confirm(request, live.lease()))
-                    .thenApply(ignored -> live);
+                    .handle((ignored, error) -> {
+                        if (error == null) {
+                            return live;
+                        }
+                        retireUnconfirmedBinding(record);
+                        throw new CompletionException(unwrap(error));
+                    });
@@
+    /**
+     * A READY binding whose Runtime no longer attests cannot recover in
+     * place. Retire it so the next ensureBinding provisions a new generation.
+     */
+    private void retireUnconfirmedBinding(RuntimeBindingRecord record) {
+        RuntimeBindingRecord claimed = bindingRepository.claimOperation(
+                record.getBindingId(), brokerOwnerId, operationLeaseDuration);
+        if (claimed == null
+                || claimed.getState() != RuntimeBindingRecord.State.READY
+                || claimed.getGeneration() != record.getGeneration()) {
+            return;
+        }
+        if (bindingRepository.compareAndSet(claimed, claimed.withState(
+                RuntimeBindingRecord.State.FAILED, null, clock.instant()))
+                != null) {
+            liveBindings.remove(record.getBindingId());
+        }
+    }
--- a/.../LocalProcessRuntimeProvisioner.java
+++ b/.../LocalProcessRuntimeProvisioner.java
+    private static final Duration STOP_GRACE = Duration.ofSeconds(5);
@@ stop()
-            process.process.destroy();
+            terminate(process.process);
+    private static void terminate(Process process) {
+        process.destroy();
+        process.onExit().orTimeout(STOP_GRACE.toMillis(),
+                TimeUnit.MILLISECONDS).exceptionally(ignored -> {
+                    process.destroyForcibly();
+                    return null;
+                });
+    }
@@ start()
+            URI endpoint = URI.create(String.valueOf(ready.get("url")));
+            if (!"127.0.0.1".equals(endpoint.getHost())) {
+                throw failed("Managed Runtime ready record is invalid.");
+            }
             RuntimeLease lease = new RuntimeLease(runtimeInstanceId,
-                    URI.create(String.valueOf(ready.get("url"))), token,
-                    leaseId, 1);
+                    endpoint, token, leaseId, 1);
@@ both catch blocks
-                ownedProcess.process.destroy();
+                terminate(ownedProcess.process);
@@ attestOwned()
         if (process == null || !process.process.isAlive()) {
+            stop(lease);
             throw failed("Managed Runtime process is not alive.");
         }
-        attest(request, process.seed, lease);
+        try {
+            attest(request, process.seed, lease);
+        } catch (RuntimeException exception) {
+            stop(lease);
+            throw exception;
+        }

F2 — Failure paths only send SIGTERM (hardening). A worker that refuses attestation and ignores SIGTERM is still alive 6.5 s after the failure. Each retry adds another one: 2 alive after the second warm. The merged worker does exit on SIGTERM, so this only bites a hung worker. The patch above adds a 5 s grace and then destroyForcibly() (B3 → 0 alive).

F3 — A non-loopback url in the ready record receives the bearer token and identity (hardening; confirms triage's question). A double that reports http://172.16.1.234:<port> got Authorization: Bearer … plus tenant/workspace/cwd/capability digest. The patch pins the host to 127.0.0.1, which is the only address the worker binds, and the credentials are then never sent (B4).

F4 — A Broker crash orphans the worker (follow-up, worker side). I kill -9ed a JVM that had provisioned a real worker. 5 s later the worker had been re-parented to PID 1 and was still listening with a live token. stdin is closed right after the boot doc, so the worker has no lifeline, and Java cannot clean up after its own crash. That needs a worker-side parent watch or a held pipe. It was already visible in #12506 and now has an owner that can die.

F5 — The execute half: I confirm triage's facts. Keeping it here or not is the maintainers' scope call.

• The erasure clash is real. Making HttpRuntimeTransport implements RuntimeTransport fails javac with return type CompletionStage<Void> is not compatible with CompletionStage<Map<String,Object>>.
• The real-worker 404 is reported as Managed Runtime attestation endpoint is incompatible., which is misleading for a tool call.
• Mutant M14, which sends execute to a different unmounted path, survives every test, because nothing pins the execute wire shape.

I'd drop it from this slice, or rename it, and land it with the tool-execution contract.

Test strength (mutation)

The PR's tests kill 2/14. Only the re-attest path is pinned. "No attestation before READY" (M03), every ready-record identity check (M04–M08), and all teardown paths (M09–M11) survive.

The follow-up tests (followup-tests-ac63adc4.patch, +87/−6) add these to the fake worker:

• a mode argument (wrong-type|wrong-instance|wrong-incarnation|wrong-lease|wrong-epoch|no-attest)
• a pid file, so each refusal also asserts the process exited, and so do stop() and close()

That brings kills to 11/14. M12 and M13 are equivalent, and M14 is the unpinned execute route from F5. The fixture stays eslint/Prettier clean.

CI

The two red lanes are infra, not this diff:

• Integration Tests (no-AK) failed in Verify checkout includes expected head commit before any test ran.
• web-shell E2E Smoke was cancelled at 20 min with the web server refusing on :4170.

All Java lanes (11/17/21, macOS, Windows, MariaDB) and Lint & Static are green at ac63adc4.

Evidence (harness sources, raw logs, patches, mutant driver): wenshao/qwen-code@asserts/pr-12552

🤖 Generated with Claude Code — Claude Opus 5.5 (1M context)

Review round addressed in 8157a21 (fix(sdk-java): Reap discarded workers and retire dead bindings). All 84 module tests pass locally (mvn clean test), checkstyle is clean, and each fix is pinned by a test that goes red when the fix is reverted (verified by mutation).

Fixed (14 threads, resolved):

• R1-1: RuntimeProvisioner.release default; called at both runtime_provision_fenced exits — a fenced attempt no longer orphans a live worker.
• R1-25: start() cleanup is a finally keyed on adoption, so an Error between spawn and adoption cannot leak the process.
• R1-3: confirm failure evicts the lease and retires the record (claim → fail), so the next call re-provisions instead of returning a retryable 503 forever; attest no longer flattens transport 4xx (e.g. 409 identity conflict) into 503.
• R2-1: dispatch/control/cancel/releaseSession consult provisioner.isUsable(lease) before using the lease; a dead process retires the binding. No per-call HTTP attestation on the hot path.
• R1-10 + R1-31 + R1-30: bounded (32 KiB) ready-record read, reader catches Throwable, and the "closed before ready" diagnostic is no longer swallowed.
• R1-26: capabilityDigest shape validated before spawn (non-retryable 400).
• R1-33: RuntimeProvisioner extends AutoCloseable; RuntimeBrokerService.close() closes the provisioner.
• R1-20: dropped the unread OwnedProcess.request component.
• R1-12: hosted CI provisions Node 22 for the runtime-broker tests; the test fails loudly on hosted runners without node.
• R1-24: design doc (EN + zh-CN) and PR description now scope re-attestation to the binding entrance.
• wenshao R1-1: README boundary statement updated.
• wenshao R1-2: worker stdout stays open and drained for the worker's lifetime.

Deferred (7 threads, resolved with reasons): R1-4 (env scrub needs a deliberate allowlist; prerequisite for the tools slice), R1-5 / R1-6 / R1-7 (unwired execute path, rework lands with the tools slice), R1-11 (bounded redacted stderr capture), R1-16 (fixture contract conformance), R1-18 (confirm coalescing / bounded executor), R1-23 (SIGTERM→SIGKILL escalation semantics).

Partially addressed (left open): R1-13 — lifecycle/diagnostic behaviors are now pinned; the execute-route request assertions (M3/M4/M7b) and the mismatched-identity fixture (M9/M5) remain for the tools slice.

CI note: the earlier Integration Tests (no-AK) failure was a self-hosted runner environment issue (dubious ownership at checkout-verify), unrelated to this diff; rerun requested. The 4 Qwen Autofix cancellations were a trigger storm cancel-in-progress; the latest was rerun.

Round 2 local verification against the real worker — head 8157a218

Verdict: the round-1 blocker is fixed. Two smaller gaps sit in the same fix, and a 27-line patch closes both (verified). I'd take that patch, or an equivalent, before merging. Everything else here is hardening or a follow-up.

Fixed and verified against the real qwen managed-runtime-worker:

• Round-1 F1 (a dead worker bricks its binding) is fixed. After SIGTERM or kill -9, the first warm gets 503 and the next warm provisions a new generation (A3/A4). The hung-worker case works too: after SIGSTOP, the re-attest times out at 30 s and the next warm re-provisions (D1).
• service.close() now ends the workers (A5).
• control refuses a dead lease before it reaches the transport (B1). A dispatch on a dead lease goes to UNKNOWN without calling execute (B2).
• A failed adoption kills a worker that ignores SIGTERM (E1, via destroyForcibly in the new finally).

Still open:

Environment

• The real worker is the bundle's node dist/cli.js managed-runtime-worker. The worker and contract sources are byte-identical to this head (git diff --quiet 04a146c9a7 8157a218 -- managed-runtime-attestation-{worker,contract}.ts).
• A Java harness drives the PR's own LocalProcessRuntimeProvisioner + RuntimeBrokerService + HttpRuntimeTransport with in-memory repositories. Session verbs use an accepting RuntimeTransport, because the worker still exposes only attest.
• macOS, JDK 26, Node 24. Module suite 84/84, 0 skipped, and checkstyle:check is clean. CI is green at this head on Java 11/17/21, macOS, Windows, MariaDB and Lint.

N1: a retired worker is never released

invalidateBinding removes the lease from liveBindings and fails the record. It never calls provisioner.release. The process stays in owned and keeps its port and token until provisioner.close().

• C1: a worker that attests at adoption and then answers 409 managed_runtime_identity_conflict on re-attest. Across 8 warms the binding alternates OK gen=N / 409. Live workers go 1,1,2,2,3,3,4,4, and all 4 retired endpoints are still LISTEN. This is the case R1-3 called security-relevant: the thing answering on the lease is not the adopted identity, yet the process stays up.
• D2: the real worker is SIGSTOPped. The re-attest times out and a new generation comes up. After SIGCONT the old pid is alive and still listening on 127.0.0.1. It only dies at service.close().
• Minor: a 409 on re-attest is returned as retryable=false, yet the very next warm succeeds, because the binding was already retired.

Fix: invalidateBinding calls releaseQuietly(record.getRequest(), record.getLease()). release is keyed by runtimeInstanceId, so it cannot touch the new generation. With the patch, C1 goes 1,0,1,0,… with every retired endpoint closed, and D2 has the old pid gone.

N2: a session on a dead worker cannot be released

releaseSession starts with requireUsableLease. The session context keeps the old lease forever, so once its worker dies:

• release(rt-1) returns 503 runtime_provision_failed retryable=true on every call (B4). The binding has already recovered at gen 2, and the session still never releases.
• acquire(rt-1) returns READY, because the existing context is reused, and the next control gets 503 again.
• Only a new runtimeSessionId works (B5).

So the session record and the sessions entry stay until the Broker restarts, and the caller is told to retry something that cannot succeed. That is the same shape as round-1 F1, one level down. Fix: when the lease is not usable, release completes locally. It retires the binding, keeps the runtime_session_busy guard, moves the record to RELEASED and removes the context. With the patch, 3× release → OK true. Re-acquiring the released id is a 409 runtime_session_conflict, as for any released id.

A session holding the UNKNOWN execution from B2 then answers 409 runtime_session_busy. That is the existing "UNKNOWN is not settled" rule and waits for reconciliation; I left it alone.

F3 / F4 / E2 (round 1, still open)

• F3: a double whose ready url is http://<en0 LAN ip>:<port> still received Authorization: Bearer … plus tenant, workspace, cwd and capability digest (F1 in the figure). It was not in a review thread, so it may simply have been missed. The patch adds a 4-line http + 127.0.0.1 pin, the only address the worker binds.
• F4: I kill -9ed a Broker JVM that had provisioned a real worker. 5 s later the worker had PPID 1 and was still listening. The new drain keeps the stdout pipe open, but the real worker writes nothing after ready, so it never sees the pipe close. It still needs a parent watch on the worker side.

• E2: an adopted worker that ignores SIGTERM is still alive 6.5 s after service.close(). This confirms deferred R1-23 and is not a new ask.

Candidate patch (+27/−3): 84/84 and checkstyle clean

The same harness on head + patch gives 12 pass / 1 fail. The one failure is E2, deferred as R1-23.

--- a/.../LocalProcessRuntimeProvisioner.java
+++ b/.../LocalProcessRuntimeProvisioner.java
@@ start()
+            URI endpoint = URI.create(String.valueOf(ready.get("url")));
+            if (!"http".equals(endpoint.getScheme())
+                    || !"127.0.0.1".equals(endpoint.getHost())) {
+                throw failed("Managed Runtime ready record is invalid.");
+            }
             RuntimeLease lease = new RuntimeLease(runtimeInstanceId,
-                    URI.create(String.valueOf(ready.get("url"))), token,
-                    leaseId, 1);
+                    endpoint, token, leaseId, 1);
--- a/.../RuntimeBrokerService.java
+++ b/.../RuntimeBrokerService.java
@@ releaseSession
-        requireUsableLease(context);
+        if (!provisioner.isUsable(context.lease())) {
+            invalidateBinding(context.binding());
+            synchronized (context) {
+                if (context.hasActiveControl()
+                        || executionRepository.hasActiveByRuntimeSession(
+                                context.session().getRuntimeSessionId())) {
+                    throw conflict("runtime_session_busy",
+                            "Runtime Session has an active operation");
+                }
+                RuntimeSessionRecord gone =
+                        transitionSessionToReleasing(context);
+                if (gone.getState() != RuntimeSessionRecord.State.RELEASED) {
+                    finishSessionRelease(gone);
+                }
+                sessions.remove(context.session().getRuntimeSessionId());
+                return CompletableFuture.completedFuture(true);
+            }
+        }
@@ invalidateBinding
         liveBindings.remove(record.getBindingId());
+        if (record.getLease() != null) {
+            releaseQuietly(record.getRequest(), record.getLease());
+        }

Test strength (mutation of the fix)

The reply says "each fix is pinned by a test that goes red when the fix is reverted". The full 84-test suite kills 8/16. The survivors:

• N03/N04/N05, the control/cancel/release liveness checks, which are the R2-1 fix. Only the dispatch check (N06) is pinned.
• N15, isUsable ignoring isAlive.
• N08, the second fenced exit.
• N10, the R1-25 finally (a regression to "never kill" stays green).
• N14, the R1-3 "don't flatten 409 into 503" half.
• N12, the drain. This one is near-equivalent: keeping the pipe open without draining only bites after 64 KiB of chatter.

N03's first-run kill came from HttpRuntimeTransportTest under parallel load. In isolation N03 survives, so that class may be timing-sensitive.

Housekeeping

qqqys's CHANGES_REQUESTED (the 9 no-undef errors) was fixed at f57765b and Lint is green here. The review decision is still CHANGES_REQUESTED, so it needs a re-review or a dismissal before merge.

Evidence (harness, worker doubles, raw logs, mutant driver, patch): wenshao/qwen-code@assets-pr12552/pr-12552-r2

Round 2

采纳 N1、N2、F3，在 9d08c65aa（fix(sdk-java): Release retired workers and pin the ready origin）。RuntimeBrokerServiceTest + LocalProcessRuntimeProvisionerTest + HttpRuntimeTransportTest 为 57/57，checkstyle:check 通过。

• N1： invalidateBinding 在退役 binding 时调用 releaseQuietly。release 按 runtimeInstanceId 定位，不会动到新一代。重新证明失败后退役的 worker 会被停掉，而不是一直占着端口和 token。
• N2： lease 已经不可用时，release 在本地完成：退役 binding，未结算执行仍然返回 runtime_session_busy，否则把 session 置为 RELEASED 并移出 context，不再调 transport。已经在进行中的 release 会被 join，避免和正在走的 transport release 抢写。重新 acquire 已释放的 id 仍然是 409 runtime_session_conflict。
• F3： ready url 必须是 http 且 host 为 127.0.0.1，否则在发出 bearer token 之前按无效 ready 记录失败。进程测试用 --foreign-url 报告 172.16.1.234，断言没有 attest 请求落到替身上。

这一次证明失败返回的 409 仍然是 retryable=false。那是这一次调用的结果；binding 已经退役，下一次 warm 是新的 provision，不是同一次失败调用的重试。

不采纳

• F4（Broker 崩溃后 worker 成为孤儿）： Java 进程被 kill -9 之后没法再收割子进程。stdout drain 只是保持管道打开；真实 worker 在 ready 之后不再写 stdout，看不到管道关闭。这需要 worker 侧监视父进程，不在这一笔 Java broker 里改。
• E2 / R1-23（stop/close 只发 SIGTERM）： 与上一轮已经推迟的项相同，不是新问题。已合入的 worker 会在 SIGTERM 时退出；对无视 SIGTERM 的进程做 SIGKILL 升级会改变 teardown 时序，仍留在生命周期加固。
• 变异测试里其余存活项： 这一轮用测试钉住的是退役时 release、死 lease 的本地 release，以及非 loopback ready URL。control/cancel 的存活检查、isUsable 忽略 isAlive、第二个 fenced 出口、finally、409 不压成 503、以及 drain，不作为这一轮的合入条件。drain 保持管道打开但不读，只有输出超过 64 KiB 才会分岔，接近等价变异。

Round 3 local verification against the real worker — head 9d08c65a

Verdict: the three fixes adopted from round 2 (N1, N2, F3) hold against the real qwen managed-runtime-worker. I found no new correctness problem. Before merging, two CI items need fixing, and neither is in the production code:

1. macOS / Java 21 is red because fencedProvisioningReapsTheWorker depends on timing. The fence fires only if the first 33 ms renewal tick beats the Node double's boot. A 6-line change to the test double makes the result deterministic (verified below).
2. Lint & Static is red only at Check lint gate freshness. .github/workflows/ci.yml changed on main in a5a5eb55 (ci(web-shell): give E2E Smoke 30 minutes #12593). Merging origin/main into the branch clears it. ESLint --max-warnings 0 and Prettier both pass on the changed .mjs at this head.

Environment

• The real worker is node dist/cli.js managed-runtime-worker from an existing bundle. Its managed-runtime-attestation-{worker,contract}.ts are byte-identical to this head and to current origin/main.
• The round-2 Java harness is extended with a new scenario G. It drives the PR's LocalProcessRuntimeProvisioner, RuntimeBrokerService and HttpRuntimeTransport with in-memory repositories. Both heads ran on the same harness and the same bundle.
• macOS, JDK 21, Node 24. The module suite is 87/87, 0 skipped on JDK 21, 25 and 26. checkstyle:check is clean.

The round-2 fixes: previous head vs this head

I added G1 to check whether the retirement that release now triggers can hit the recovered binding. It can't: every re-provision mints a new bindingId, so invalidateBinding(context.binding()) only ever touches the dead generation.

Head totals are 13 pass / 1 fail. The one failure is E2: an adopted worker that ignores SIGTERM outlives close(). That is the deferred R1-23, as agreed. F4 (worker-side parent watch) also stays a follow-up.

macOS CI: fencedProvisioningReapsTheWorker depends on timing

Run 35959440392 failed with Expected ExecutionException ... nothing was thrown in 0.082 s. The same test passed on macOS at 8157a218 and passes on ubuntu, Windows and MariaDB at this head.

FencingBindingRepository fences only renewOperation. The first renewal runs operationLease / 3 = 33 ms after the claim. If the worker boots and attests before that tick, stopAndGet() still returns the claim, the READY CAS succeeds and nothing is fenced. The whole local class took 60–90 ms to provision, so the margin is small. Changing only the lease value makes this deterministic:

Failing runs take about 0.09 s, which matches the CI failure: the tick lost the race. Fix in the test only: the double also fences the READY compareAndSet. The outcome then no longer depends on scheduling. With this patch the test passes at every lease value (16/16). It still fails 3/3 against a mutant that drops both fenced-exit releaseQuietly calls. The suite stays 87/87 and checkstyle stays clean.

--- a/packages/sdk-java/runtime-broker/src/test/java/com/alibaba/qwen/code/runtimebroker/LocalProcessRuntimeProvisionerTest.java
+++ b/packages/sdk-java/runtime-broker/src/test/java/com/alibaba/qwen/code/runtimebroker/LocalProcessRuntimeProvisionerTest.java
-    /** Fences every renewal so provisioning loses its claim mid-boot. */
+    /** Fences renewal and the READY write, so provisioning always loses. */
@@ FencingBindingRepository
         public RuntimeBindingRecord compareAndSet(
                 RuntimeBindingRecord expected,
                 RuntimeBindingRecord replacement) {
+            // Also fence the READY write, so the outcome does not depend on
+            // whether the first renewal tick beats the worker's boot.
+            if (replacement.getState() == RuntimeBindingRecord.State.READY) {
+                return null;
+            }
             return delegate.compareAndSet(expected, replacement);
         }

Mutation on this round's fixes: 7/9 killed

The new tests pin the release-on-retire, local-release and loopback-host changes. Two mutants survive. Neither blocks the merge:

• M5: dropping the "join an in-flight release" branch in releaseUnusableSession. No test drives a release whose transport call is still pending when the worker dies.
• M9: dropping the http scheme half of the ready-URL check, so https://127.0.0.1:… is accepted. A one-line --https-url variant of the existing test would pin it.

Before merge

• Take the test patch above, or an equivalent (the macOS red).
• Merge origin/main into the branch (the lint freshness red). Please don't rebase: the inline threads would lose their anchors.
• Earlier CHANGES_REQUESTED reviews still block the PR. Their items are addressed at this head, so they need a re-review or a dismissal.

Harness, logs and mutation driver: pr-12552-r3/

Round 4 local verification against the real worker — head d1689c16

Verdict: mergeable. Both CI items from round 3 are fixed, and CI is fully green at this head. The merge of main (#12583's cancel changes) composes correctly with the liveness check, verified on the real worker. The real-worker results match round 3. What's left is one optional test gap: the fence-test change made the test deterministic, but the first fenced exit is now covered by no test at all. A 56-line companion test covers it (verified). It's fine as a follow-up.

What changed since 9d08c65a

• 74f62d94 merges main. For this module that brings in fix(java): Deliver broker cancellation after a dispatch lease lapses #12583 (invocations set, cancel of an UNKNOWN call that is still in flight). The only textual crossing with this PR is in cancelExecution: the new UNKNOWN-still-running branch now reaches requireUsableLease.
• d1689c16 makes the fencing double refuse the READY compareAndSet and lets renewal delegate, with a 1-minute lease. That is the round-3 suggestion, and the renewal half goes one step further.

Results

• CI: macOS / Java 21 and Lint & Static, both red last round, now pass. So do MariaDB, Windows, ubuntu Java 11/17/21, Real daemon E2E and the Node lanes.

• Module suite: 94/94, 0 skipped on JDK 21, 25 and 26. checkstyle:check is clean.

• Fence test: 20/20 pass with the lease swept over 100 ms, 300 ms, 600 ms and 1 min. At 9d08c65a it failed 4/4 at 300 ms and 600 ms.

• Real worker: the bundle's qwen managed-runtime-worker; its worker and contract sources are identical to this head and to origin/main. Scenarios A–G give the same results as round 3. N1, N2 and F3 stay fixed. The only failure is E2, the deferred R1-23.

• New I1, for the merge crossing: start a call whose execute stays pending, then cancel it.

  • Worker alive: transport.cancel is called once.
  • After kill -9 of the worker, cancel returns 503 runtime_provision_failed and transport is never reached. When execute then fails, the call becomes UNKNOWN. A later cancel returns UNKNOWN. release returns 409 runtime_session_busy, the existing "UNKNOWN is not settled" rule. The next warm provisions gen 2.

  So fix(java): Deliver broker cancellation after a dispatch lease lapses #12583's physical cancel works on a live worker and fails closed on a dead one. Total: 14 pass / 1 fail (E2).

Optional: the first fenced exit has lost its test

provisionBinding has two runtime_provision_fenced exits, each with its own releaseQuietly:

1. The renewal lost the claim (currentClaim == null).
2. The READY CAS was refused (ready == null).

The PR's test now reaches only exit 2. Before, it reached exit 1 whenever the timer won, which was flaky but real coverage.

Deleting exit 1's release survives the PR's tests (3/3 pass). The companion test is deterministic by construction. The double fences renewal and counts down a latch. A gated provisioner starts the boot only after that renewal has already lost the claim.

• It passes 10/10.
• It kills X1 (3/3). X2 and X3 are still caught.
• The suite is 95/95 and checkstyle is clean.

@@ LocalProcessRuntimeProvisionerTest
     @Test
     void fencedProvisioningReapsTheWorker() throws Exception {
+        assertFencedProvisioningReaps(false);
+    }
+
+    @Test
+    void provisioningFencedByRenewalReapsTheWorker() throws Exception {
+        assertFencedProvisioningReaps(true);
+    }
+
+    private void assertFencedProvisioningReaps(boolean atRenewal)
+            throws Exception {
         requireNode();
@@
         Set<Long> before = childPids();
+        FencingBindingRepository bindings =
+                new FencingBindingRepository(atRenewal);
         try (LocalProcessRuntimeProvisioner provisioner = ...) {
+            // In renewal mode, provisioning starts only after the first
+            // renewal has already lost the claim.
+            RuntimeProvisioner gated = request -> {
+                try {
+                    assertTrue(bindings.renewed.await(10, TimeUnit.SECONDS));
+                } catch (InterruptedException exception) {
+                    throw new IllegalStateException(exception);
+                }
+                return provisioner.provision(request);
+            };
             RuntimeBrokerService service = new RuntimeBrokerService(
                     ...,
-                    provisioner, new AcceptingTransport(),
-                    new FencingBindingRepository(),
+                    atRenewal ? delegating(gated, provisioner) : provisioner,
+                    new AcceptingTransport(), bindings,
                     ...,
-                    "broker", Duration.ofMinutes(1), Duration.ofMinutes(1));
+                    "broker",
+                    atRenewal ? Duration.ofMillis(300) : Duration.ofMinutes(1),
+                    Duration.ofMinutes(1));
@@
+    /** Gates provision; forwards release so the service can reap. */
+    private static RuntimeProvisioner delegating(RuntimeProvisioner gate,
+            LocalProcessRuntimeProvisioner target) {
+        return new RuntimeProvisioner() {
+            @Override
+            public java.util.concurrent.CompletionStage<RuntimeLease>
+                    provision(RuntimeProvisionRequest request) {
+                return gate.provision(request);
+            }
+
+            @Override
+            public java.util.concurrent.CompletionStage<Void> release(
+                    RuntimeProvisionRequest request, RuntimeLease lease) {
+                return target.release(request, lease);
+            }
+        };
+    }
@@ FencingBindingRepository
+        private final boolean fenceRenewal;
+        final java.util.concurrent.CountDownLatch renewed =
+                new java.util.concurrent.CountDownLatch(1);
+
+        FencingBindingRepository(boolean fenceRenewal) {
+            this.fenceRenewal = fenceRenewal;
+        }
@@ renewOperation
+            if (fenceRenewal) {
+                renewed.countDown();
+                return null;
+            }
             return delegate.renewOperation(bindingId, owner,
                     operationGeneration, leaseDuration);

Round-3 mutation on this head: the same 7/9 are killed. The survivors are unchanged: M5 (in-flight release join) and M9 (http scheme half of the ready-URL check). Both are small, and neither blocks.

Before merge

• The standing CHANGES_REQUESTED reviews need a re-review or a dismissal. Their items are addressed at this head.
• Optional: the companion test above, now or as a follow-up.
• Follow-ups, as already agreed: E2/R1-23 (SIGKILL escalation) and F4 (worker-side parent watch).

Harness, logs and mutation driver: pr-12552-r4/

@qwen-code /triage