[CMGS]

Whole-repo review round: dependency bump, one bug fix, comment and modern-Go review, two cuts, and docs that the code contradicted.

Commits

• build: cocoon 22b7392 → 1951f35 (master: #262 TAP redirect verify, #261 image/doctor), flock v0.13.1, projecteru2/core v0.1.5, oras-go v2.6.2.
  • With #262, recoverNet's Verify also requires the TAP's ingress redirect filter. A TAP left without its filter by an interrupted add used to pass Verify, so QEMU launched onto a dead data path. Now vm start rebuilds it in one pass (CNI DEL+ADD with the recorded MAC; the qdisc and filter steps tolerate existing state).
  • A normally stopped VM keeps its filter, so it is not rebuilt.
  • Launch-path cost: one netlink filter listing per owned CNI NIC.
  • core, flock and oras change no call site here (no Sentry DSN; oras fetches a KB-sized manifest).
• fix: reject a double quote in the VNC password.
  • QEMU's HMP parses an argument that starts with " as a quoted string (monitor/hmp.c get_str; set_password takes password:s). So --vnc-password '"abcdef"' passed validation and was stored as abcdef: silently the wrong password.
  • The new test row fails on master and passes here.
• review: log the missed power-down at warn, as cocoon's stop escalation does.
  • Comment tightening: the nonexistent export op; the three gc godocs cut to one fact each; three dead //nolint:gosec (G204/G304 are excluded in .golangci.yml) and five dead test //nolint:errcheck; restated DataDisks and VNC proxy comments.
• review: stdlib uuid.NewV4() for the SMBIOS UUID (Go 1.27) replaces the hand-rolled v4. The partition-wait predicate is folded.
• cut:
  • gc's vmInUse predicate never matched:
    • cocoon's cni and bridge collectors only ask about IDs that Resolve left after dropping every recorded VMID.
    • sweep holds the gc lock exclusively plus every VM lock, so no record appears between ReadDB and Collect.
    • The bridge collector passes an 8-char prefix, and a 26-char VMID never equals it.
  • provisionNet's empty-Add guard never fired: both backends return one config per spec on success, and AddRange(0, 1) is one spec.
• docs:
  • cli.md names disk.qcow2 and the per-VM OpenCore overlay (both were wrong when written).
  • networking.md gains the vm: rebuild owned networking before launch when the host lost it #51 start-time rebuild of lost networking.
  • The scripts/e2e.sh header names the script it is.
• scripts/qmp-input.py (three commits): cmd now fails on a QMP error reply or a closed monitor instead of returning it unchecked, so an OCR step no longer clicks on a stale /tmp/_ocr.ppm from a failed screendump; the dead ocrdclick op goes (its callers left in 5ef9948); the usage text lists the ten live ops, the agree_button docstring is one line, % formatting becomes f-strings. Verified against a fake QMP server: click/dclick/key/chord/type/screendump exit 0; an error reply or EOF exits 1 (the old script exited 0 silently). Not run: ocrclick/ocrtext/agreebtn need tesseract + PIL.

Numbers

• Production Go +27/−74 (net −47); tests +6/−5; go.mod/go.sum/docs/scripts +104/−102 (qmp-input.py +21/−37).
• Go comment lines: +4/−5. The four are in-place rewrites; lines carrying a comment drop by 11.

Evidence (final HEAD)

golangci-lint v2.13.2 GOOS=linux   0 issues.
golangci-lint v2.13.2 GOOS=darwin  0 issues.
make fmt-check rc=0; golangci-lint fmt --diff rc=0
asl ./... linux/darwin: no findings (incl. -forwarder)
go vet linux/darwin: ok
go test -race -count=1 ./... (darwin): no FAIL lines, rc=0
go test -race -count=1 ./... (golang:1.27 linux/arm64 container):
ok  github.com/cocoonstack/cocoon-macos/cmd        1.031s
ok  github.com/cocoonstack/cocoon-macos/cmd/image  1.027s
ok  github.com/cocoonstack/cocoon-macos/cmd/vm     6.574s
ok  github.com/cocoonstack/cocoon-macos/home       1.017s
ok  github.com/cocoonstack/cocoon-macos/qemu       1.165s

The branch also builds, vets and passes the darwin race tests against the cocoon round branch through a scratch-only replace.

After cocoon #264

• build: cocoon is pinned to the #264 squash commit dcec1fa (v0.6.9-0.20260924025202-dcec1fa3f056), and both command groups take cliutil.GroupCommand, which #264 made the one owner of the group contract (NoArgs + help). On the built binary: vm and image print help with rc 0; vm bogus and image bogus fail with unknown command "bogus" for "cocoon-macos vm" / "... image", rc 1.
• Gates re-run on the final head: lint 0 issues on linux and darwin, fmt-check and golangci-lint fmt --diff rc 0, asl clean on both, build+vet both, race tests on darwin and in the linux container all ok.

Not in this PR

• vk-cocoon's COCOON_MACOS_VNC_PASSWORD check accepts whitespace and double quotes that this repo rejects, so a bad value fails every macOS launch loudly instead of at vk-cocoon startup. That is a vk-cocoon change; its validator is being aligned in the vk-cocoon round.