Date: 2026-10-01. Normal review: two reviewers (AI agents in their own
clones), one on sc watch (signals, exit codes, logging; run as their user
with --root on temp dirs), one on the systemd unit, the acceptance script
and the docs (statically: the acceptance script was never run; its steps
6-16 were copied into a harness against a scratch watcher). Claude
reproduced each finding before fixing it.
Held up: SIGTERM/SIGINT stop with exit 0, a batch waiting on the lock finishes, refusals are one line, no NSS access (strace), journald parses the priority prefix, the M1 signal tests pass 10 times, the unit matches plan 9 and verifies, and the script’s awk fields and expected intents are right.
| Area | Finding | Severity | Fixed in |
|---|---|---|---|
| acceptance | Under nested sudo (sudo make accept-m2, as WORKLOG said) SUDO_USER is root, so step 5 would really restore /root/.ssh/authorized_keys (new inode) and step 1 would run go test as root. |
high | e865164; WORKLOG now says make accept-m2 |
| acceptance | A MainPID of 0 (unit restarting) made kill -STOP 0 stop the script itself; its cleanup never ran, leaving test files and a store with a copy of /etc/shadow. |
medium | e865164 |
| docs | README and the recovery guide told the owner to run the M2 bin/sc on the real store, which upgrades it on first use (gate G1). |
medium | 0bdf909 |
| sc watch | A broken stderr killed scd with SIGPIPE; systemd counts that as clean and does not restart. | medium | d56237f |
| sc watch | Fatal lines were logged at info, hidden from journalctl -p warning. |
low-medium | d56237f |
| sc watch | A signal during startup died by the signal; --root / never refused SC_HOME; --root "" watched the cwd; a doubled path in an error; no “stopped” line. |
low | d56237f |
| design | SIGHUP stopped scd (exit 0, not restarted). Now a rescan, and the unit’s reload. | decision | d56237f, e865164 (C14) |
| acceptance | A grep read error could pass step 18; one-line checks passed on empty output; restore rounds 2-5 unchecked; umask; whole-store row counts; silent exits; dangling symlinks at the test names. | low | e865164 |
| unit | No After=remote-fs.target for NFS homes. |
low | e865164 |
| docs | Stale status lines; sudo make smoke doubles sudo. |
low | 0bdf909 |
| tests | SIGTERM-only signal test; logWriter wiring untested; an env-dependent test; no tests for the fixes above. | gaps | d56237f |