SPI Fly R8 conformance fixes

[wilx]

This is result of AI agents looping on simple "find and fix R8 conformance issues in spi-fly" and "review changes on the branch" until the reviewing agent no long finds any issues.

SPI Fly works fine for me without this, so I am not expecting to get this merged. I was just curious where this would go. Some of these were a result of the previous changes. But eventually, it converged and the reviewing agent did not find any new issues.

SPI Fly OSGi R8 conformance work: digest

This work reviewed SPI Fly against the OSGi Release 8 Service Loader Mediator
specification and the related Core framework rules. The purpose was to ensure
that standard OSGi Service Loader behavior is driven by resolved wiring,
effective bundle content, lifecycle, and permissions rather than by manifest
text or broad class-loader visibility.

The following general classes of non-conformance were discovered and fixed:

• Provider publication and registrar opt-in were conflated. Publishing
  Service Providers for mediated consumers and requesting their registration as
  OSGi services are separate operations. Providers are now published without
  requiring registrar opt-in, while service registration remains explicitly
  opt-in.

• Consumer and provider selection did not consistently follow resolved
  wiring. Selection could be inferred from declarations or proprietary
  metadata instead of the actual resolver result. Standard mediation now uses
  the processor, registrar, and Service Loader wires established by the
  framework, including optional and attribute-based requirements.

• A selected provider bundle was treated as if only one wired Service Type
  were visible. Release 8 selects provider bundles, not individual provider
  configurations within those bundles. Once selected, a provider bundle now
  contributes all of its published Service Providers, subject to type-space,
  permission, lifecycle, and advertisement checks.

• Multiple capabilities and their registration properties were handled
  incompletely. Each decorating capability must independently select and
  decorate every matching provider. Duplicate capabilities are preserved,
  public attributes retain their declared types, private attributes are
  excluded, and the mediator identity property takes precedence.

• Provider-configuration parsing differed from the Service Loader rules.
  Configuration files are now read as UTF-8, comments and blank lines are
  handled correctly, and duplicate provider names are suppressed while
  preserving discovery order.

• Provider visibility could fail open. Empty selections, optional unwired
  requirements, incompatible type spaces, explicit-loader calls, and mediator
  transition states could expose providers from the original or parent class
  loader. Standard consumers now receive a closed view containing only the
  providers selected by the mediator.

• Not every Service Loader invocation form was mediated. Direct calls,
  explicit-loader calls, installed-provider calls, method handles, and common
  lambda or bootstrap representations are now routed through the same
  caller-aware mediation rules.

• Caller identification was not fully portable. Mediation could depend on
  a particular framework class-loader implementation. Caller bundles are now
  identified through the portable framework API, with compatibility behavior
  kept separate from the standard path.

• Type-space compatibility was not always enforced. An unrestricted
  consumer could see a provider using a different definition of the requested
  Service Type. Candidate providers are now filtered against the consumer's
  actual Service Type before being exposed.

• Security checks occurred at the wrong boundaries or under the wrong bundle
  identity. Consumer GET permission and provider REGISTER permission are now
  associated with the correct bundles and checked close to lazy provider
  provisioning. One provider can no longer lend its permission or origin to
  another provider.

• Service-factory scope could contradict the specified instance model.
  Registered providers now consistently use the required per-consuming-bundle
  factory behavior, regardless of decorating properties that might otherwise
  suggest a different scope.

• Provider lifecycle changes could leave stale or newly invalid providers
  visible. Provider activity, permission, revision, and mediator-session
  state are checked lazily. Registrations are removed when required, existing
  mediated views close when the mediator stops, and affected consumers are
  submitted for refresh when stale provider objects may remain.

• Late mediator startup and fragment attachment were not fully repaired.
  Consumers whose classes were already defined could remain unprocessed, and
  newly attached fragments could add requirements or providers without being
  reconsidered. Relevant active consumers are refreshed and provider discovery
  is recomputed when effective wiring changes.

• Static processing claimed a standard capability it could not satisfy for
  arbitrary resolved consumers. Offline transformation remains available as
  a separate compatibility feature, but it no longer advertises an
  unfulfillable standard processor role.

• Provider advertisements could be discovered through dependency or parent
  visibility. A visible configuration is not necessarily an advertisement
  owned by the publishing bundle. Standard discovery is now restricted to the
  exact host and attached-fragment revisions, and foreign configurations are
  not substituted when a local one is unusable.

• Fragment revision and cache handling could use stale content. Discovery
  is tied to the exact fragment revision attached to the host and is recomputed
  after dynamic attachment. Updating a fragment does not silently replace the
  revision that remains attached until framework refresh.

• The effective bundle class path was not reconstructed exactly. Provider
  discovery now respects host-first entry-path lookup, fragment attachment
  order, fragment-local class-path entries, roots selected only by an effective
  root element, and embedded archives or directories supplied by fragments.

• First-match edge cases were incomplete. Explicit empty directories,
  directory constructs omitted from archives, and ordinary or unusable entries
  now all follow the Release 8 first-match rules. Once an entry is selected, an
  unusable container contributes no providers and does not cause lookup to
  resume in a later fragment.

The fixes preserve proprietary and offline SPI Fly features as separate
compatibility modes without allowing them to weaken the standard OSGi path.

Verification included focused unit and integration regressions, real-framework
checks on two framework implementations, and repeated clean Java 8 builds of
the complete project. The final review found no remaining source-level mismatch
within the reviewed requirements. These results are review and regression
evidence, not formal conformance certification, because the relevant OSGi
conformance test suite was not available.

[alien11689]

Hi, it's an interesting experiment. I don't think it would be mergable in the current form, but when split and properly described (with jira ticket created for each finding) it could be the valuable contribution.