Follow-ups from #460 (celeris fe9264f pin): merged before review, PR-body scripts and counts, the container commit stamp, what the local suites cannot check #462

These are the follow-ups from the round-1 review of #460, which pinned celeris main fe9264f. #460 had already been squash-merged as e190383 when the two reviews (correctness, and API/perf/security) ran. Both reviews approved it and found no defect in the change itself. e190383 has the same tree as the head 1517b55 (69c9343). Below are the 2 minor and 7 nit findings they left; both reviewers raised item 1. Line numbers are at 1517b55 / e190383 unless a celeris sha is given.

Evidence root (on the maintainer's machine; the paths below are relative to it): ~/.claude/projects/-Users-fuming-Documents-github-celeris-probatorium/evidence/lanes-20261002/LREPIN/

1. minor (process): deps: pin celeris main fe9264f (no new EngineMetrics field) #460 merged before any independent review ran. The lane's gate was "merges its PR once the reviews are clean". deps: pin celeris main fe9264f (no new EngineMetrics field) #460 was marked ready at 11:42:14Z and merged with the admin bypass at 11:53:07Z, with no reviews (reviewDecision=REVIEW_REQUIRED). The lens reviews started at about 12:02Z. BUILD.json says under pr.reviews that no lens review ran, but its deviations list names only the ready-marking and two short docker runs.
   No revert is needed, because both post-merge reviews approved.
   Fix: add the early merge to the lane's deviations. For a lane that merges, gate the merge on the review stage's verdicts, not on the build stage's result.

2. minor (evidence): some numbers in the PR body come from no script the body names. The body's script list (its last paragraph) names s06_linux_root.sh. That script's default shape (bare golang:1.27, run as root) produced root 1357/9/13 and mage 1470/9/14 (out/s06_linux_root-1517b55.out), not the table's numbers.

   • The table's 1366/0/13, 1479/0/14, 31/0/0, 4/0/0 and 30/0/0 come from s06_linux_suites.sh in runner mode with image/Dockerfile, driven by s11_chain.sh (out/s06_linux_ci_shape-1517b55.out). The body names none of the three.
   • No script produces these outputs:
     • out/s07_submodule_pin.out
     • out/s10_mod_verify.out ("go mod verify passes in all 10 modules")
     • out/s12_binary_buildinfo.out ("every linux/arm64 binary ... embeds")
     • out/pr460_checks_premerge.out ("30 checks pass, and 4 are skipped")
   • s11_chain.sh:9 runs the RULE 26 base control in $L/wt-main, which no longer exists, so that control cannot be rerun as written.

   Fix:

   • Add the four missing scripts.
   • Have s11_chain.sh create its own base worktree at 38779a4.
   • Name s06_linux_suites.sh, image/Dockerfile and s11_chain.sh in the body. The Review section of deps: pin celeris main fe9264f (no new EngineMetrics field) #460 now names them.

3. nit: the Coverage rerun on fe9264f is not recorded. The body says Coverage passed on fe9264f, and out/s08_celeris_ci_fe9264f.out lists Coverage run 36572760158 as success. In fact attempt 1 failed on the known flake TestAdaptiveImmediatePromote_Epoll fails when one /ping run takes over 2 ms, which -race plus coverage on a hosted runner can cause celeris#752 (TestAdaptiveImmediatePromote_Epoll: "/ping (fast) must not be promoted"), and only attempt 2 passed. The required CI run 36572759986 was green on attempt 1, so fe9264f is still the right pin.
   Evidence: review-correctness-r1/rv/out/coverage_attempt1_job109420556842.log.
   Fix: have s08_celeris_ci.sh print run_attempt and the conclusion of each earlier attempt (gh api repos/goceleris/celeris/actions/runs/<id>/attempts/<n>).

4. nit: the Linux container logs do not show which commit they tested. Line 4 of every CI-shape log (out/linux-ci-shape-1517b55/{root,root_mage,debugvars,server_celeris,fieldguard}.log) should hold the sha from git log -1 --format=%H. It holds fatal: detected dubious ownership in repository instead, because the container's git rejects the bind-mounted worktree.

   • For the root suites this does not matter, because they do not depend on the pin (item 5).
   • For debugvars and servers/celeris, the only evidence of which tree ran is the host-side worktree.
   • The v1-shape run, which ran as root in the same worktree, did log 1517b55, and PR CI is green on 1517b55.

   Fix: add git config --system --add safe.directory '*' to image/Dockerfile, or pass GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0='*'. Also print go list -m github.com/goceleris/celeris in each pinned module, as the reviewer's review-correctness-r1/rv/r03_linux.sh does: its logs show v1.5.12-0.20260929130646-fe9264f5773c inside the container.

5. nit: the root suite counts cannot tell this pin from the last one, and no local test runs io_uring or adaptive on it.

   • The root go.mod does not require celeris.
   • The root module is byte-identical to 38779a4. git diff --stat 38779a4 e190383 shows 20 files, all go.mod/go.sum under servers/celeris and validation/refapp/*.
   • No root test builds a refapp. The root e2e tests compile only a temporary source (validation/tier3_test.go:145), validation/testdata/racedemo (validation/race_e2e_test.go:23) and checkptrdemo (validation/checkptr_e2e_test.go:29).
   • Only two sets of local tests depend on the pin. debugvars has 31 tests, all on std (validation/refapp/internal/debugvars/debugvars_test.go:28) except one epoll side-listener test (sidelistener_linux_test.go:29). servers/celeris has 4 tests, on std (servers/celeris/debugvars_test.go:21).

   So the Proof table puts the 1366/1479 rows next to the pin-sensitive ones, but no row checks fix(iouring): an async handler's direct write waits for a ring SEND of the conn's earlier bytes (celeris#751) celeris#800, #801, #799, #805, #807 or #808 on their engines. The nightly on the new pin is the only engine-level check of them. As of 2026-10-02 13:03Z no nightly has run on e190383: the cluster is still busy with Benchmark Tier 36441790519.
   Fix: in pin PRs, mark the root rows "pin-independent (no celeris in the root graph)", and state that the nightly is the engine-level check of the pinned changes.

6. nit: "all 12 go.mod files" should be 27 (PR body line 47). s02_resolve.sh walks every go.mod in the tree, and there are 27 (out/s02_resolve.out). The 12 is the 10 modules that require celeris plus the 2 sub-module requires.

7. nit: the heads-up's drain sentence overstates the 250 ms floor (PR body line 67: "lasts at least 250 ms when there is something to drain"). 250 ms is the least time the drain is allowed, not a time it always takes. At celeris fe9264f:

   • epoll's h2PoolSettled returns as soon as no stream is busy (engine/epoll/loop.go:3740).
   • drainSends returns as soon as nothing is queued (:3801).
   • sendDrainWait uses the floor only as the drain's end bound (:3828).
   • io_uring's drain ends as soon as no send is pending (engine/iouring/worker.go:1195).

   celeris's public Server.Shutdown godoc (server.go:536-542, "never for less than 250 ms", "io_uring for 250 ms") and the docs page (src/content/docs/graceful-shutdown.md:264, :287, :294) use the same wording. That wording is tracked on Follow-ups from #808: std h2c conns get no GOAWAY and outlive the drain, a pool-wait bound test that passes on main, cost wording celeris#820 (item 10, Follow-ups from #808: std h2c conns get no GOAWAY and outlive the drain, a pool-wait bound test that passes on main, cost wording celeris#820 (comment)), next to its items 6 and 9 on the same sentences.
   The heads-up could also have cited the open shutdown follow-ups at this pin: io_uring: a shutdown that finds a SEND stalled on a client that does not read returns ~10 s late: the 250 ms send-drain bound is not enforced while the worker waits in SubmitAndWait celeris#806 (on io_uring, a Start* call returns about 10 s late when the client does not read) and Follow-ups from #808: std h2c conns get no GOAWAY and outlive the drain, a pool-wait bound test that passes on main, cost wording celeris#820 (std h2c conns outlive the drain).
   Fix: correct the wording in the next pin PR's heads-up. Nothing else in probatorium needs to change.

8. nit: the merge commit message contains a local path. The body of e190383 ends with "Evidence: evidence/lanes-20261002/LREPIN/.", taken from the lane's merge-body.txt. The path exists only on the maintainer's machine, so no reader of this public repo can open it. The earlier pin merges (38779a4 for fix(validation): pin celeris main dbbaaee and carry its two celeris#685 close-path counters to the artifacts (schema 5.18) #454, 6ce66eb for deps: pin celeris main 698bed6, and record EngineMetrics.Throughput as deprecated #439) have no such line. History is not rewritten for this.
   Fix: leave local evidence paths out of merge-commit bodies.

9. nit: the head branch was deleted at merge. The merge ran without --delete-branch, but the repo setting delete_branch_on_merge=true deleted chore/repin-celeris-fe9264f anyway. The lane disclosed this. If merged lane branches should be kept, restore the branch from 1517b55 (git push origin 1517b5596d8b5f6cdc27a1370a973051958a280d:refs/heads/chore/repin-celeris-fe9264f) or turn the setting off.

Related: #460, #454, #461, #427; goceleris/celeris#752, #806, #820.