Automated review: no new bugs found in commits merged 2026-07-22 → 07-23 (one real defect already tracked in #2808)

[phil-opp]

Note: This issue was created by an automated, scheduled Claude code-review check. Please verify before acting on it. It exists to record that the review ran and what it covered — no action is required.

Scope

Detailed review of the ~30 substantive commits merged to main between 2026-07-22 and 2026-07-23, with particular attention to how the changes interact with each other. Trivial commits (docs-only, dead-code removal that the compiler already validates, CI-config tweaks) were noted but not deep-reviewed. Each functional change was read against its surrounding code, callers, and concurrency, not just its commit message.

Result: no new isolated bugs

The one genuine correctness/recoverability defect surfaced during this review is already tracked — nothing new was filed.

Already tracked (not re-filed)

• fix(core): don't let a concurrent session's HEAD-check delete a git clone that's still being written #2795 (996741c) — a crashed build's half-written git clone is permanently un-recoverable. The Reuse-arm HEAD check now bail!s without cleanup when HEAD won't resolve, so a SIGKILL/power-loss leftover at the final clone path wedges every subsequent build until a manual rm -rf. This is already reported in core/build: #2795 leaves a crashed build's half-written git clone permanently un-recoverable (Reuse HEAD-check bails without cleanup) #2808 and being fixed by open PR fix(core/build): atomically promote git clones so a crashed build can self-heal #2809 (atomic clone promotion). No duplicate filed.

Clusters reviewed and verified correct

• git-clone cache / core resolution — fix(core): keep a file:// drive letter out of the git clone cache path (#2742) #2811 (drive-letter sanitize), fix(core): don't let a concurrent session's HEAD-check delete a git clone that's still being written #2795 (in-progress claim map), fix(core): trim field-type strings in resolve_field_type to match the admission gate #2760 (field-type trim), fix(core): reject module param keys that collide case-insensitively #2708 (case-insensitive param collision). Claim mechanics (RAII count map, poison recovery) are sound; fix(core): keep a file:// drive letter out of the git clone cache path (#2742) #2811 and fix(core): don't let a concurrent session's HEAD-check delete a git clone that's still being written #2795 compute identical cache keys, no path-collision interaction.
• daemon bookkeeping — fix(daemon): purge removed node's per-node bookkeeping on RemoveNode #2757 (RemoveNode purge), fix(daemon): record force-stopped nodes in grace_duration_kills #2758 (force-kill accounting), fix(daemon): don't poison the shared metrics System on serialization error #2731 (metrics System not poisoned), fix(daemon): gate circuit-breaker recovery on receiver backpressure #2684 (circuit-breaker recovery gating), perf(daemon): build LogBroadcast metadata once instead of per subscriber #2734 (LogBroadcast metadata hoist). grace_duration_kills is a set (no double-count); breaker does not get stuck open; hoisted metadata carries no per-subscriber state.
• node-api Arrow IPC — fix(node-api): stop wait_for_correlation livelocking on buffered events #2747 (wait_for_correlation livelock), fix(node): reset IPC decoder only after an empty batch; reconcile Arrow-59 docs #2611 (IPC decoder reset), fix(node): bound the resulting Arrow IPC stream length in encode guards #2588 + fix(node): cap fallback Arrow IPC encode to fail loudly on oversized output #2594 (encode length bounds — consistent thresholds, exact total, no overflow), fix(message): clamp DropOldest queue capacity to at least 1 #2596 (DropOldest cap ≥1 → latest-only), perf(arrow-convert): drop per-element error-string allocation in into_vec #2749 (deferred error alloc).
• coordinator / cli — fix(coordinator): don't let a disconnected daemon block state-log pruning #2706 (prune ignoring disconnected daemon — full-store replay is authoritative on reconnect, no data loss), fix(coordinator): don't treat a partially-finished multi-daemon dataflow as stopped #2614 (partial multi-daemon stop — reply keyed on daemons.is_empty(), all combinations resolve, guard applied to every dataflow_results reader), fix(coordinator): use node_to_daemon for running-dataflow log retrieval #2597 (node_to_daemon log lookup — clean error on missing key, no panic), fix(cli): reject dora daemon --worker-threads 0 instead of panicking #2748 (--worker-threads 0 reject), fix(cli): report hidden failures in all-cascading DataflowError case #2739 (cascading-error summary), fix(daemon,cli): report true on-wire size in dora topic info #2589 (on-wire size).
• ros2-bridge FFI + misc — fix(ros2-bridge): avoid null-pointer slice UB in Owned/RefFFISeq::as_slice #2677 (null-ptr slice UB guard — audited all from_raw_parts sites), fix(ros2-bridge-arrow): cap element count when deserializing a wstring field #2678 (wstring element cap), fix(c-node): accept the (NULL, 0) empty-payload idiom in dora_send_output #2598 ((NULL,0) empty payload traced downstream to a valid empty Arrow buffer), fix(download): derive URL fallback filename without query string #2729 + fix(download): match Content-Disposition filename case-insensitively #2610 (download filename — no traversal/empty-name hole via shared file_name() sanitize), fix(replay-node): honor each node's initial timestamp offset on replay #2603 (replay offset), fix(python): decode string tuples in operator metadata as ListString #2623 (Python string tuples).

Pre-existing conditions noted (NOT regressions from this batch — no action requested here)

Flagged only for future auditing; none was introduced by the reviewed commits:

• RemoveNode still doesn't clear dynamic_nodes / open_external_mappings / cascading_error_causes for the removed node (outside fix(daemon): purge removed node's per-node bookkeeping on RemoveNode #2757's stated scope; leak only across repeated dynamic add/remove cycles).
• The gate/materializer silent-skip class that fix(core): trim field-type strings in resolve_field_type to match the admission gate #2760 addresses for padded primitives/List still exists for struct-typed fields (a registered struct with empty/unresolvable fields passes field_type_resolves but yields None from resolve_field_type, so check_schema_compat silently skips). Pre-existing; low risk.
• Cross-session write-write race on the same clone target dir, and RenameAndFetch claiming only target_dir (not the from dir), remain uncovered by clones_in_progress. Mild failure mode; largely subsumed by the core/build: #2795 leaves a crashed build's half-written git clone permanently un-recoverable (Reuse HEAD-check bails without cleanup) #2808/fix(core/build): atomically promote git clones so a crashed build can self-heal #2809 atomic-promotion work.