audit: 12 bug fixes, three decided behaviour changes, cleanups across every module

.github/workflows/sandboxd.yml

@@ -104,10 +104,12 @@ jobs:
 
       - name: Test TLS edge with Caddy
         working-directory: e2e
+        shell: bash
         env:
           CADDY_BIN: ${{ runner.temp }}/caddy
         run: |
           curl -fsSL --retry 3 https://github.com/caddyserver/caddy/releases/download/v2.11.4/caddy_2.11.4_linux_amd64.tar.gz -o "$RUNNER_TEMP/caddy.tar.gz"
           printf '%s  %s\n' '8220d1f013b6f27510247b2360c9e0ca9f018feebd82515f07635318b34ff9777ccc8fd0b6e6f2486ce3a33fe389fbb7db12d05baa474f4587509fb4f5ebf1c9' "$RUNNER_TEMP/caddy.tar.gz" | sha512sum -c -
           tar -xzf "$RUNNER_TEMP/caddy.tar.gz" -C "$RUNNER_TEMP" caddy
-          GOWORK=off go test -race -count=1 -run TestCaddyTLSCluster -timeout 60s -v .
+          GOWORK=off go test -race -count=1 -run TestCaddyTLSCluster -timeout 60s -v . | tee "$RUNNER_TEMP/caddy-test.log"
+          ! grep -- '--- SKIP' "$RUNNER_TEMP/caddy-test.log"

README.md

@@ -7,20 +7,8 @@ for Go and Python. Warm claims are sub-millisecond; a pool miss clones from a
 golden snapshot in tens of milliseconds; cold boot is ~0.2–0.4 s on bare metal.
 
 **Documentation: [cocoonstack.github.io/sandbox](https://cocoonstack.github.io/sandbox/)**
-(source in [`docs/`](docs/)).
-
-## Architecture
-
-```
-SDK (Go/Python)         sandboxd (per node)              guest microVM
-client.New/new ─ HTTP ─► claim: warm pool / golden clone   Cloud Hypervisor
-exec/files/… ─ HTTP upgrade (kept) ─► byte relay ─ vsock ─► silkd :2048
-                        memberlist mesh: warm-count gossip,
-                        MOVED-style redirect to the owning node
-```
-
-Cloud Hypervisor serves both network lanes. `net=none` has no NIC and uses
-vsock-only I/O (hardened default); `net=egress` attaches a bridge/CNI NIC.
+(source in [`docs/`](docs/)); the architecture overview is in
+[`docs/index.md`](docs/index.md).
 
 ## Quick start
 
@@ -140,7 +128,7 @@ The cmdline keys `sandbox-init` consumes are in the
 make help          # every target; the ones below are the daily set
 make lint test     # Rust: boot/init + silkd (fmt --check, clippy -D warnings, tests)
 make go-lint       # Go: protocol/wire + sandboxd + sdk/go + e2e + mcp, GOOS linux AND darwin
-make go-test       # Go: go test -race across the Go modules
+make go-test       # Go: go test -race plus one pass of every benchmark, across the Go modules
 make sh-lint       # shellcheck every tracked shell script
 make sandboxd      # build dist/sandboxd
 make bench         # claim-tier + data-plane benchmarks; removes every sbx-* VM

boot/init/src/boot.rs

@@ -248,9 +248,9 @@ fn record_devices(ids: &[&str], found: &mut [Option<String>]) {
 }
 
 fn record_serial(ids: &[&str], found: &mut [Option<String>], serial: &str, device: &str) {
-    for (i, id) in ids.iter().enumerate() {
-        if found[i].is_none() && *id == serial && Path::new(device).exists() {
-            found[i] = Some(device.into());
+    for (slot, id) in found.iter_mut().zip(ids) {
+        if slot.is_none() && *id == serial && Path::new(device).exists() {
+            *slot = Some(device.into());
         }
     }
 }

boot/init/src/cfg.rs

@@ -61,8 +61,8 @@ pub fn parse(cmdline: &str) -> Result<BootCfg<'_>, String> {
                 }
             }
             "cocoon.hostname" if !val.is_empty() => cfg.hostname = Some(val),
-            "sandbox.debug" => cfg.debug = debug_token(val),
-            "sandbox.trace" => cfg.trace = debug_token(val),
+            "sandbox.debug" => cfg.debug = flag_token(val),
+            "sandbox.trace" => cfg.trace = flag_token(val),
             "ip" => {
                 if let Some(param) = parse_ip_param(val) {
                     cfg.ips.push(param);
@@ -85,7 +85,7 @@ pub fn parse(cmdline: &str) -> Result<BootCfg<'_>, String> {
 pub fn debug_requested(cmdline: &str) -> bool {
     params(cmdline)
         .rfind(|&(key, _)| key == "sandbox.debug")
-        .is_some_and(|(_, val)| debug_token(val))
+        .is_some_and(|(_, val)| flag_token(val))
 }
 
 /// Overlay mount data; index-based layer mountpoints keep a serial string out of lowerdir parsing.
@@ -118,7 +118,7 @@ fn params(cmdline: &str) -> impl DoubleEndedIterator<Item = (&str, &str)> {
         .map(|tok| tok.split_once('=').unwrap_or((tok, "")))
 }
 
-fn debug_token(val: &str) -> bool {
+fn flag_token(val: &str) -> bool {
     val.is_empty() || val == "1"
 }
 

docs/cluster.md

@@ -31,8 +31,9 @@ Give every node a `mesh` block:
   join mesh: … connection refused`), so two nodes that name only each other
   cannot cold-start together: list the node's own `bind` alongside its peers
   and every node comes up in any order, joining whoever is already there
-- `cluster_key` — optional base64 key (16/24/32 bytes) enabling gossip
-  encryption; all members must share it
+- `cluster_key` — base64 key (16/24/32 bytes) enabling gossip encryption;
+  all members must share it. Required by `archive_failover`,
+  `checkpoint_peer_heal` and live moves
 
 Two constraints, fine for a homogeneous cluster: all nodes share the same
 `api_token` and tenant set (the SDK replays whichever token authorized a
@@ -167,7 +168,7 @@ cap; to take no claims, cordon the node.
 
 | State | New claim, fork, branch | Existing claims | Root live move in | Adoption of archived claims | Refill and pool gossip | Survives restart and reboot |
 |---|---|---|---|---|---|---|
-| serving | yes, under `max_claims`, `max_running`, the tenant's `max_claims`, `disk_reserve` and `memory_limit`; a 429 for a claim without volumes redirects to a peer | yes; a wake is bound by `max_running` and `disk_reserve`, and an archived claim's refused wake moves to a peer with room | yes, under the same caps and `move_concurrency` | yes; no claim cap binds, `max_running` binds at the wake | yes | — |
+| serving | yes, unless an [admission refusal](sandboxd-api.md#admission-refusals) applies; a 429 for a claim without volumes redirects to a peer | yes; a wake is bound by `max_running` and `disk_reserve`, and an archived claim's refused wake moves to a peer with room | yes, under the same caps and `move_concurrency` | yes; no claim cap binds, `max_running` binds at the wake | yes | — |
 | cordoned | no: 429 `node cordoned`; peers stop redirecting here | yes | yes, under the same caps and `move_concurrency` | no; its own claims stay | no; warm VMs are destroyed | yes, as `<data_dir>/cordoned` |
 | draining | no: 429 `node draining`; peers stop redirecting here | yes | no: admission and commit refuse | no | no; warm VMs are destroyed | no |
 | draining with `evacuate=1` | no, as draining | yes until the claim's turn, then 503 until a peer holds it and 404 after; a claim that cannot move stays and serves | no | no | no | no: a restart stops the evacuation |
@@ -695,8 +696,8 @@ that broadcast keeps its copy until the checkpoint TTL ages it out. A healed
 replica carries the source checkpoint's original `CreatedAt`, so it becomes
 eligible for expiry at the same instant everywhere; each node then removes
 it on its own hourly sweep, which is independently phased and retries on
-failure. The window in which a deleted checkpoint stays branchable by an
-id-holder is therefore normally `checkpoint_ttl_hours` plus the wait for the
+failure. The window in which a deleted checkpoint stays branchable by its
+tenant is therefore normally `checkpoint_ttl_hours` plus the wait for the
 next hourly sweep; a sweep that fails retries on a later one, so persistent
 sweep failure extends retention until one succeeds — the TTL is the eligibility
 point, not a hard ceiling. This is why heal *requires* a nonzero, fleet-matching