[CMGS]

Whole-repo audit after today's volume merges (#382, #383, #395, #396, #398, #399, #401, #402, #404), with #403 folded in.

Changes

• utils: one SyncDir owns the directory fsync: pool kept a private syncDir that duplicated the tail of utils.ReplaceFileSync. Both now call utils.SyncDir, which keeps the open dir / sync dir stage errors that volume_catalog_ordering_test pins. Drops one comment that restated volumeQuiesceMax. Go prod −2 lines, comment lines +1/−1.
• docs: match the SDK volume options and the mount retry: since pool: runtime volume catalog follow-ups to #382 #395, WithVolumesAttachOnly and Python mount=False no longer validate locally (sandboxd answers 400). Volume carries attach_only. A mount that reports not a valid block device is retried within the setup budget (engine: retry a volume mount while the device is not yet openable #404), and attach-only callers get the same advice. The README names runtime volume registration (pool: register runtime volume catalog entries #382).
• e2e: cover controller-managed volume hibernation (from docs: document controller-managed volume hibernation #403, by @minatoaquaMK2, cherry-picked unchanged): the controller doc, the Python example with its tests, and the HTTP/Go SDK detach → hibernate → wake → reattach test.
• review: tighten the volume controller example and its doc: the 26-line VolumeHooks docstring repeated the doc. Each hook contract now appears once, as a list in docs/volume-controller.md. That list points mount_and_verify at the attach-only device discovery and mount retry. The example gets a one-line module docstring. The cancellation tests are dropped: the functions hold no cleanup, so a CancelledError takes the same path as the failure cases already tested.
• docs: list attach_only in the sandbox index row.

No daemon behavior change. Hot-path cost: zero. The rw-volume and catalog paths make the same open/fsync/close syscalls, and the warm-claim path does no new work.

Audit scope

• Hygiene ledger: 3 files due (the engine: retry a volume mount while the device is not yet openable #404 files) plus the @live-volumes flow. Every prod file changed since 9974f1b was read against /code, /code-py, /code-rs, use-modern-go, /simplify and /loc-justify.
• Kept, with reasons: the asl forwarder findings (replaceArchive, replaceReplica, skipIdle, refillGated, isZero) were already recorded as kept. time_tick_gc is skipped for the volume poll loops: they are bounded and return, so Stop releases the 10 ms ticker at return instead of at the next GC.
• LOC: Go prod grew from 22174 to 32936 lines since v0.1.15 (2026-09-28). 48 feature commits account for +9840 net; review and cleanup commits are mostly net negative.

Gates

• make go-lint: 10 × 0 issues. (5 modules × linux/darwin), fmt clean. With a warm cache, staticcheck SA4023 panics in e2e after a dependency edit; a cold cache (as in CI) is clean.
• asl -forwarder=false ./...: 0 findings, every module, linux and darwin
• go test -race -count=1 ./...: 25 packages ok; TestRuntimeVolume* pass on the final head
• Rust (boot/init, silkd): fmt, clippy -D warnings and tests green on macOS and in a linux/arm64 rust:1 container (rustc 1.99.1)
• Python: ruff format/check, 269 cocoonsandbox + 10 openai + 15 langchain tests passed, mypy clean (now including examples)

Hardware (bare metal, 384 cores, cocoon v0.7.4 official, CH v54.0.0, rt:24.04 sha256:03e8bed49d4c, isolated cocoon root)

Full e2e suite, interleaved PR / main / main / PR. All 32 legs passed (seconds):

leg	PR #1	main #1	main #2	PR #2
sandboxd (volumes ro + rw + live, egress pool)	24.4	25.3	24.6	24.1
egress, none lane	3.8	3.8	3.9	3.8
egress, egress lane	7.1	7.2	7.1	7.2
socks	15.0	16.3	14.6	14.3
intercept	3.8	3.7	3.8	3.8
archive	41.3	41.3	41.3	41.3
port	4.6	4.6	4.2	4.6
credentials	17.2	19.4	19.2	17.4

bench.sh ran in 8 interleaved runs (PR, main, main, PR, then main, PR, PR, main). Warm hit p50 was 0.4–0.5 ms in both arms. Clone-tier p50: PR 73.4 / 161.1 / 84.5 / 78.2 ms, main 65.9 / 167.1 / 177.0 / 79.0 ms. The slow runs (~160–177 ms) depend on run position, not arm: main #2, PR #2 and main #3 were slow. Cold boot p50 was 650–667 ms in both arms.

The #403 controller cycle ran on this head with a real tenant claim and a runtime-registered writable attach-only volume: attach, mount and write, then detach, hibernate, sandboxd restart while asleep, exec wake, reattach, mount and verify, then a second detach and hibernate. The claim, device, filesystem UUID, serial and payload all matched across the cycle. Timings: attach 78 ms, hibernate 605 ms, wake + reattach 212 ms. Unregister after release returned 204, and the daemon logged no errors.

Closes #403.