[CMGS]

The last step of the audit that #420, #422, #424, #425, #426, #427, #428, #429, #430 and #431 came from. It fixes no bug and changes one error message. It makes the tree they leave consistent.

This branch is built by path from the tree that was verified, not by replaying its 96 commits, because #427's later commits overlap most of them. The final tree is byte-identical to the verified one (git rev-parse HEAD^{tree} matches 95500f19).

Commit	Files	Lines	Net
Production code	22	+110 -133	-23
Docs	7	+124 -132	-8
Go tests and test packages	96	+3566 -4871	-1305
silkd and Python tests	15	+198 -270	-72

Production code

No change in behaviour, apart from the message below.

• Layout: utilities sit below methods, and method-less types above the methods they serve. Log tags name their call, for example pool.trip, and two messages say inspect where they said list.
• Names: leaseWindow replaces three copies of leaseTTL - leaseMargin. dropPool becomes dropPoolLocked. VolumeCallTimeout becomes an unexported syncTimeout, because no other package reads it.
• Simplified: TakeOwned shares collect. The peer fan-out uses http.DefaultClient, since every call already has a context deadline. writableMounts becomes slices.ContainsFunc. The env row rewrite calls putRow directly.
• Message: ErrArchived said "an exec or file call wakes it first", which is wrong for a pool with a reader. It now says "a wake or an exec wakes it first".

Hot path: none. Nothing here runs on the claim path except moved declarations.

Docs

• Corrected against the code: which writes reach the failover row, reload and tenant errors, golden retirement and build time, and a warm claim landing on a dead VM.
• New: kernel.pty.max caps a node at about 4057 VMs, because each VM holds a console pty.
• Reference: the API error lists are filled in, and pages that repeated each other collapse into one link.

Tests

• Weak checks: checks that passed vacuously now fail when the code breaks. CloseRelays must end a conn with EOF rather than at the conn's own deadline, and a hole-only scan checks every chunk.
• Shared helpers: these replace repeated setup, for example hibernateClaim, mustAdopt, waitWarm, newTestEngine, statusOf and storetest.StageRecord.
• Readability: vague tests are named after what they check, locals no longer shadow helpers or packages, and a fatal error names its failed step.
• Removed: an env-gated 10 GiB digest timing harness.

Evidence

Run on the same tree as this branch, on macOS and in Linux containers, with the PostgreSQL suites against a real server:

76 Go packages ok
0 issues. x 10 (5 modules, 2 GOOS)
All checks passed! / Success: no issues found in 11 source files / 272 passed
--- FAIL: TestCloneFileRemovesFailedDestination  clone_test.go:34: CloneFile copied a directory
--- SKIP: TestStatsReadsResidentSetFromPID

TestCloneFileRemovesFailedDestination fails only on the container's overlay filesystem. It failed the same way in earlier runs of this audit, and it was not rerun on main for comparison.

41 mutants ran on darwin: 40 killed, and the 1 survivor was expected to pass. They did not run on Linux.

Hardware results are in the PR bodies of the fixes they cover. The two-node failover and high-density round ran before the last test cleanups. The last hardware run, a warm pool of 0 recovering after a rollback, was one docs commit before this tree. sdk/openai and sdk/langchain tests did not run.