review: whole-repo round — relaxed snapshot touch, pidfd wait, dead Scan path, cloud-image sniff, FindVM reuse, comment budget

[CMGS]

Whole-repo quality round (2026-09-03): every production file read against the /code Style Self-Check (8 readers) and the judgment lenses (engine, storage, host); five commits, net −197 lines, comment lines +22/−205.

1. perf — DataDir bumped LastAccessedAt on every clone-from-snapshot through a durable transaction (an fsync on sqlite, serialized on the single durable writer); the value only steers GC's LRU, so the touch commits relaxed. terminateWithPidfd held a pidfd but waited for exit by polling kill(pid, 0) every millisecond; it polls the fd, so the kernel wakes it on exit (the VM stop path in every vm rm/release).
2. cut — Log.Scan and metalog.Recorder.Scan had no caller anywhere in the workspace (the metering log was write-only); the OCI sizer's stat fallback served index entries older than v0.1.0; the Firecracker clone renamed cow.raw onto itself (runDir and COWRawPath derive from the same id and config); runningVMClientWithRecord's record was discarded at all three call sites.
3. fix — the cloud-image Range probe fetched one byte, below the four-byte sniff floor, so a URL serving an HTML error page was downloaded in full (up to 20 GiB) before nonImageSignatures rejected it (perf(cloudimg): sniff before full download and reuse the non-Range probe response #137's Range half); a snapshot delete resumed from a tombstone emitted its storage-stop metering with an empty hypervisor; Prepare and the Add rollback bypassed three of the seven CNI test seams and the helper left statNetnsFn real, so Remove's TAP deletion had no coverage on any platform; gcTick ignores a nil GC hook; the bridge GC skips its LinkList when it has no prefixes to match.
4. docs — docs/gc.md described a lock-all-modules cycle the code never had and a nics=2/2 log field it never emits; docs/vm.md named a REMOVED event verb (the code emits DELETED) and the json engine's watch mechanism; docs/images.md and the flag help scoped --force to URL pulls (OCI tags are re-resolved every pull); docs/cli.md's tree shows the --from-dir positional.
5. review — eight verbs resolved a ref through FindHypervisor and immediately Inspected the same ref (the resolver's probe is that Inspect); FindVM returns the record. LogPath opened two views where ResolveAndLoad does one. vm list/vm status --watch reconciled every VM's state twice per render and the watch path never assigned it, so THROTTLED could contradict STATE. CNI interface names come from one helper and ifIndex rejects trailing garbage. Named scan-callback types replace three spelled-out func types. Comments shrink to the one-line budget; test files carry no comments (284 lines); six godocs on interface-implementing methods go. core.ImageJSONNamespace is exported for cocoon-macos, which lost BaseConfig.JSONNamespace in cut: network Inspect/List and batch Delete, Reserver hard-require; images stop importing meta/json #207.

Held with measurement or reason: the CNI Add's four networks.json parses per run/clone (measured 0.1–1.0 % of a 230 ms copy-mode clone; both durable commits are required); deleteOneLocked re-walking /proc per stopped VM (reusing the pre-stop scan contradicts the re-observe-under-lock rule at supervisor.go:83); the oci/cloudimg GC method pairs (a shared base costs more lines than it saves); unexporting ten package-private hypervisor helpers (surface only; the layout churn is not worth it); the vmlock 2 ms retry (the same cadence as gofrs/flock, no cancellable primitive).

Gates: GOWORK=off make lint 0 issues on linux and darwin; make fmt-check clean; asl ./... clean on both GOOS; GOWORK=off go test -race -count=1 ./... green (the Linux-gated CNI/bridge/pidfd paths run in CI). Round diff: 106 files, +269/−466.