[guijacquemet]

This fixes the findings of the external rc4 review. The owner's decisions are final. Do not merge before the independent review.

B1: mount points below the experiment or masks folder are refused

• Added mounts.MountCheck. LinkGuard.real() now refuses any folder (or file) below the walked root that is a mount point, with the error mounted_folder naming it. A path counts as a mount point when:
  • it is listed in /proc/self/mountinfo (octal escapes undone), or
  • it is a folder whose st_dev differs from the root's.
• mounted_folder is in LINK_CODES, so discovery, OME-Zarr stores (check_store), the masks folder, check, run, convert and RunInputs all refuse it the same way. run writes no table or manifest.
• The selected root itself may be on any mount.
• I tested a real bind mount in this container. os.path.ismount() returns False and st_dev is the same as the parent's (only the inode differs). That is why the mountinfo check is needed.
• Tests in tests/test_mounts.py:
  • a real mount --bind (skipped by name without root or permission). Here it ran and passed;
  • a replaced mount table, so the checks always run: experiment, masks, a link onto a mount, an OME-Zarr store, check/run/RunInputs, and the st_dev rule;
  • parsing of mountinfo.
• Remaining limits (documented in contract §1 and mounts.py):
  • where /proc/self/mountinfo cannot be read (macOS, BSD, Windows), only a mount on another device is seen, so a BSD nullfs mount of the same device is missed;
  • macOS bindfs (FUSE) and Windows mounted folders have another device, and a Windows mounted folder is also a mount-point reparse point, which the junction/link rule already handles;
  • Btrfs subvolumes have their own st_dev and are refused too;
  • mounts are read once per walk, so a mount made after the walk is not seen;
  • each folder of the walk now costs one stat, including the folders inside OME-Zarr stores (their files are not stat'ed).

I1: hard-linked images and masks get a warning

• claim() uses the stat it already takes. A file with st_nlink > 1 is the warning hard_linked_file, naming each file and its count. Reading and fingerprints are unchanged.
• Warnings do not change exit codes: check still exits 0 (tested).
• The files inside OME-Zarr stores are not counted.

I2: the output folder is fsynced after the commit

• _commit() now calls _flush_folder(output) right after the manifest's os.replace. Before, only _finish_committed flushed.
• The flush a recovering lock holder needs moved to finish_publication, so a normal run flushes once.
• A test records the order: staged-folder flush → manifest rename → output-folder flush → moves. It fails without the fix.
• Contract §9.4 now describes the commit flush and the Windows limit (folders cannot be flushed there).

I3: identity rule stated; opt-in --verify-content

• (a) The contract (§9 row reuse, §9.1 RunInputs, §9.4 resume), the user guide, AGENTS.md, CHANGELOG and docstrings now state the identity rule: the metadata fingerprint (size + mtime_ns; for OME-Zarr, the inventory). They also state its blind spot: a rewrite of the same size with the modification time set back. A test shows the blind spot in the default mode.
• (b) How strict mode is turned on:
  • RunMode(name, verify_content=True) passed as run_experiment(mode=...);
  • CLI --verify-content / --no-verify-content;
  • the notebook's "Verify each image's content (SHA-256) before reusing its rows" box, filled from the earlier run and shown in the plan.
• What strict mode does:
  • records files[].content_sha256 (TIFF bytes; OME-Zarr: per-file SHA-256s over the files the inventory covers) and settings.verify_content;
  • adds the content SHA-256 to RowKey and the staging key, so earlier and staged rows are reused only for the same content;
  • checks that an image read still has its SHA-256 after the read (else source_changed_during_run);
  • reports an image that cannot be hashed as unreadable_planes;
  • makes RunInputs.open of such a run check every image's content once (it already checked fingerprints).
• Changing the mode between runs:
  • verify_content is a recorded input: a run that does not give it keeps the recorded choice;
  • turning it on or off recomputes every row, with the reason "content verification (verify_content) was turned on/off";
  • it appears as the input change verify_content;
  • staged rows of the other mode are discarded with that reason.
• The default mode's behaviour and speed are unchanged. In the default mode the staging key is unchanged too.
• Deviation: the flag rides on mode= (RunMode) instead of a new parameter, because run_experiment is at its shrink-only baseline of 15 parameters.
• To keep manifest.py under 600 lines, package_versions moved to versions.py (still re-exported from manifest).
• New modules: source_content.py, versions.py, mounts.py, plus inventory.store_files. All have declared layers.
• Strict-mode limits:
  • masks keep the fingerprint rule;
  • a change with metadata kept between the header read and the hashing, or after a reused image was hashed, is not seen;
  • cost: one extra whole read of each image per run, one more for each image read, and one per RunInputs.open.

Also

Opened #141: "Conversion reopens TIFF headers for pixel reads and memory checks (performance follow-up of #96)".

Gate (Python 3.13, .[dev,notebook,zarr])

• ruff check .: pass. ruff check --ignore-noqa . reports the same diagnostics on main and on this branch: no new suppressed violations.
• ruff format --check .: pass.
• python tools/check.py --rules: pass. The baseline is unchanged; tools/code_rules.py SHA starts with cc04a420.
• pytest: 2090 passed, 4 skipped, 0 failed. The skips are three case-sensitive file-system tests and one permissions-as-root test. The real bind-mount tests ran (not skipped).

🤖 Generated with Claude Code

https://claude.ai/code/session_01G3qp9AxjpGPw9xfWAUJNqc

[guijacquemet]

Independent review, merged as 544fa45 (merge commit). Fixes are in 4d0726c.

Blocking, fixed: MountCheck.is_mount read st_dev from os.DirEntry.stat(). On Windows that call always reports 0, so every folder was refused as mounted_folder (both Windows jobs failed with 637 failures at 14aa0c8). It now uses os.stat(entry.path), and a regression test covers it.

Minor, fixed: settings.verify_content was written as false in every manifest. It is now written only when true, so a default run's manifest keeps the rc4 keys. A run written by rc4 opens with RunInputs and reruns with nothing read and no change listed; I checked this against a run produced by e24f334. I also added tests for a bind-mounted file inside an OME-Zarr store and for a strict-run image that cannot be hashed. Mutation runs showed neither case was tested.

I checked these and found no defect:

• The B1 rule covers discovery, the masks walk, check_store, convert and RunInputs. The root is exempt.
• Real bind mounts behave correctly: the root under a bind mount, the root as a mount point, \040 spaces in paths, and a file bind mount.
• I3 strict reuse holds: reuse, resume, the after-read check, the recorded mode and RunInputs gating.
• I2 ordering is correct. Neither rc4 nor this PR flushes after the final moves, so there is no regression.

Gate:

• ruff check and ruff format --check are clean. ruff --ignore-noqa shows the same 66 findings as base.
• tools/check.py --rules passes, and code_rules.py is unchanged (cc04a420).
• Local pytest: 2093 passed, 4 skipped. The real bind-mount tests ran as root.
• CI: all 7 jobs are green.

---

Generated by Claude Code