OCTOBER-REVIEW-REVISIONS subunits 8-8b: docs follow the code, and lint repairs #74

Documentation and lint repairs. SANDBOX.md and docs/SECURITY.md are brought in line with the code (the front server's single render child, one kind of request socket, no child-routes socket, iroh on the admin thread, the wake-up and direct calls through on_main, the principal assigned once). Lint findings from the closing standard are fixed: narrow allow attributes with reasons on test-support code and on the .git/.lichen/tmp file operations in git/hub.rs, a dead fn packed, a needless return, an explicit auto-deref and an unused re-export removed.

---

OCTOBER-REVIEW-REVISIONS, unit 8 (subunits 8, 8b combined, replacing their per-subunit PRs). Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/OCTOBER-REVIEW-REVISIONS-2026-10-28.md

This is a reading copy: only this PR's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3423 s/792-orr-u8-docs — ORR 8: SANDBOX.md and docs/SECURITY.md follow the code; ORR's stale comments

  OCTOBER-REVIEW-REVISIONS unit 8, the docs (section E), and the stale comments ORR left. One PR: no test or pin changed, so there is no tests PR.

  • SANDBOX.md's diagram:
    • the front server's one child, the render child (front_render_spec), with the operator's note that its sandbox "is not strictly necessary": defence in depth, kept because it costs little;
    • one kind of request socket;
    • no child-routes socket;
    • iroh on the admin thread;
    • the wake-up (git::hub::Wake) and every direct call through on_main.
  • SANDBOX.md's table of what crosses: each frame kind gains "reaches" and "its principal, assigned by". Only ToSite::Connection and ToSite::Admin carry a principal. The front server sets it once, and the site believes it only on a connection passed on its control channel. ToSite::Admin's row was stale: it also carries clients' git, the editor's git panel and a publish.
  • SANDBOX.md prose follows the code: the admin thread's pushes, the git-remote-pds folder, no admin-thread git reading the site's .git, the backup's children. A bullet citing a deleted test is rewritten.
  • docs/SECURITY.md:
    • the internal group is gone (2c);
    • A4's one principal, assigned once;
    • publish build and end are direct calls;
    • PDS remotes go by DID (C3/R6);
    • two older errors fixed (the allowance file's location, a "front check before a push" that does not exist).
    • The generated principal tables already followed B3 and A3: regenerated, they are byte-identical.
  • docs/SITE-CONCURRENCY-MODEL.md C083 and C053 describe the one runtime slot (C4). AGENTS.md's test-layout rule matches D5 and its structure test.
  • Stale comments (1d31954a, comments only but one assert message and one reason string; a script shows no code line changed):
    • ipc/identity.rs's Origin doc;
    • admin_router's doc and forward_admin's doc and dead_code reason;
    • workspace_structure's acts::asks docs and :1749's message;
    • spawns.rs:84's reaper path;
    • lichen-cli site_process_tests.rs:2836 (5b's note). (…cut here; the full text is on the PR page.)

• #3424 s/793-orr-u8b-standard-fixups — ORR 8b: the closing standard's clippy reds (a test-support stand-in, hub.rs's .git paths) and ORR's leftovers

  ORR unit 8b, product: the closing standard's reds (notify-95805416 at ccb40e42 --base 65a6666b). Per TESTING-STRATEGY these are the phase-end standard's to find; the per-unit runs carry no clippy.

  • clippy, atproto/tests/stand_in.rs (5c):
    • The file is compiled under test-support as well as cfg(test). lichen-server's dev-dependency turns test-support on in clippy's --all-targets build, so it was linted as product code.
    • Each start gets a narrow #[allow(..., reason = "test-support: …")], as runtime.rs and inject.rs do: expect_used on all three, and disallowed_methods on the two that call Router::route.
    • clippy.toml and the lint levels are unchanged.
  • clippy, git/hub.rs (1c):
    • The two remove_file calls and the create_dir_all touch the site's own .git and .lichen/tmp, which are outside its file tree.
    • They carry the allow-with-reason that clippy.toml prescribes for those paths, as the same file already does at its reset mark.
    • The sabotage-write-gate lane's three extra errors were these; it counts its six plants again.
  • ORR's leftovers:
    • the dead fn packed (2b), deleted;
    • a needless return in outbound.rs (5c);
    • an explicit auto-deref in host.rs (2a);
    • api.rs's pub use with_git::*, which exported nothing public, is now pub(crate) use (6c).
  • Not touched: the base-era clippy warnings; blame puts each one before 65a6666b.
  • Merged in: unit 8 docs round 1 (7225c4bc).

  On lichen-ci:

  • notify-bc051da1 at 56091fd4:
    • fmt 0;
    • clippy, all 7 crates, rc 0 with 0 errors;
    • the sabotage gate rc 0, every plant refused;
    • test_c2_offline.py 94 passed;
    • custom 56/56.
  • notify-baea502a at 0d5c12d5: clippy rc 0, custom 58/58.
  • The merge of 7225c4bc changes one comment and nothing else.

Commits #

• 87b836f86 OCTOBER-REVIEW-REVISIONS unit 8-8b: subunit 8
• 64db7800c OCTOBER-REVIEW-REVISIONS unit 8-8b: subunit 8b

Count and shas #

count-product-code-lines 4a1a47150275..64db7800cbed: NET -5 · counted +13 -18 · moved out of the counted set +0 · comment-only deletions flagged 12 · macros flagged 0 · tests-folder code flagged 0

Base 4a1a471502755cfe56ea8a329fd05e6d41ac8a2d (tip of s/791-orr-u7-renames-tests). Head 64db7800cbed66f476db5b7555f380f22a0d2027. 16 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/793-orr-u8b-standard-fixups.

Files that a tests PR of this unit also changed (so a test-only edit could in principle sit in them): crates/lichen-cli/tests/site_process_tests.rs, crates/lichen-server/tests/workspace_structure.rs.