Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
2.5 KiB
Filbert review, row 87 round 7: approve.
Candidate: commit 4c1fee85a (4c1fee85a5), diff from 80ebe2afc on the design docs/plans/2026-10-18_containerized-install-design.md and the rows docs/plans/2026-10-18_containerized-install-rows.md. Line numbers are at 4c1fee85a.
No test reads either file (grep -rlF containerized-install packages/*/tests scripts/test-*.sh finds nothing), so under decision 137 nothing here blocks.
My round 6 follow-up (28883): answered
design.md:156-158 names the order: host.lock, the store path, the rootless check, the leftover rule, then docker run. The rootless check it points to is in section 4 (design.md:361-402, the name=rootless element rule at :372). The store path bullet now says "right after host.lock" (:159).
The rest of the round
- Wait by id (design.md:274-292). After
docker stop -t, the rule waits until each listed id answers "no such container", bounded by the core stop timeout. Then it runsrm -fwith the same wait, then exits 1 with the id. That closes the race where--rmis still removing anddocker runhits the name. Tested at rows.md:489-492. - Exit codes. The unit retries exit 1 and doesn't retry exit 3:
RestartPreventExitStatus=2 3 4at packages/cli/systemd/mosaic-bus.service.in:33, withRestart=on-failureandRestartSec=15at :31-32. So exit 1 for an engine still removing and exit 3 for a hand-made container match what the unit does. Since the name is a hash of the store path andhost.lockexcludes another host, a name holder without the store's labels can only be hand-made (or a 64-bit hash collision), as design.md:183-186 says.
Doc-only, follow-up
- design.md:277-285: the list and
docker stopare separate calls, so a leftover can be removed between them, anddocker stopon that id then fails with "no such container". Say that answer fromstop(orrm -f) counts as gone, so I6's builder doesn't turn it into a refusal. - design.md:280-285: say whether the bound is per container or for the whole list. With N leftovers waited one at a time, the worst case is about 3 x 45 s per container before
docker run. That's fine underType=simplewith no start timeout (service.in:13), but it bears onStartLimitBurst=5inStartLimitIntervalSec=600(:9-10). Normally N is at most 1, so this is wording only.
Not run by me
Nothing executed. This is a read of the diff, the cited design lines and the unit template.
Verdict: approve, with follow-ups 1 and 2.