Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
3.3 KiB
Filbert review, row 87 round 5: approve.
Candidate: commit 232e05449 (232e054499), diff from e5dbcf626 on the design docs/plans/2026-10-18_containerized-install-design.md and the rows docs/plans/2026-10-18_containerized-install-rows.md. Line numbers are at 232e05449.
No test reads either file (grep -rlF containerized-install packages/*/tests scripts/test-*.sh finds nothing), so under decision 137 the items below are doc-only and don't block.
My round 4 follow-up: answered
The stop timeout now covers both close waits. The host passes MOSAIC_CLOSE_TIMEOUT_MS from the constant I6 exports, the entry refuses to start without it, and the core stop timeout is 2 x 20 s + 5 s = 45 s (design.md:165-173). The leftover rule passes it to docker stop -t (design.md:233-235). I6 tests a notifier slower than one close timeout and checks writer.lock is gone (rows.md:469-471). That is what I asked for. Checked: CLOSE_TIMEOUT_MS = 20000 at packages/cli/src/host.mjs:30, the two waits at :343 and :347.
The rest of the round
- Name keyed on the store (design.md:153-164). Two data roots with the same business get two names, and I6 tests that stopping one leaves the other running (rows.md:472-474).
{from, pid}line andconnected(design.md:178-197). The rule is one-way and covers the exit line, the client ending and a failed stdin write, andsend/killreturn false after. Theconnectedchecks it relies on are at host.mjs:256, :342 and :346. I6 tests the exit-line and client-exit cases (rows.md:476-477).host.pids(design.md:198-207). Null in containerized mode, with the reason (a container pid passed toprocess.killhits a host process), and the pid tests stay in local mode.firstReply:129,ended:148 andwatchChildren:159-165 match.
Doc-only, follow-up
- design.md:161-162 says the engine refuses a second core container for the store, but not what bus start reports when it does. After the leftover rule that should only happen if a container survives
rm -for another host races pasthost.lock. Name the refusal (a code or message) so I6's builder doesn't pick one. - The name hashes the real path of
<dataRoot>/bus(design.md:156-157), but the label and the leftover filter use<dataRoot>/busas written (design.md:155, 232, 249-250). With a symlinked data root, two spellings of one store get the same name and different labels, so the leftover rule misses the old container and the run hits item 1. Use the real path in the label too, or say the data root is resolved first. - A real path needs
<dataRoot>/busto exist. The host creates onlybus-host/(host.mjs:80, :120); today the broker creates the store (packages/bus/src/store.mjs:126). Say the host creates<dataRoot>/busbefore it hashes and mounts it. - design.md:201-202 says the listed tests "signal a fork by pid". host.test.mjs:612 finds the child by pid and sends it IPC (
children.find((c) => c.pid === host.pids.broker).send(...)), and :201-204 read/proc/<pid>for everyhost.pidsentry. Both still need local mode, so the conclusion holds; list :201-204 and say "reach" rather than "signal".
Not run by me
Nothing executed. This is a read of the diff and the cited lines in host.mjs and host.test.mjs.
Verdict: approve, with follow-ups 1 to 4.