Automatic reviews

[phil-opp]

Summary issues for automatic reviews.

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Reviewed all 66 open PRs against their current diffs (diff = source of truth). A prior review round had run earlier today (~08:35–09:34), and several PRs then received new commits (~09:41–09:51) responding to it. Per the noise-minimization rules I only commented where something changed or was genuinely new; a <!-- claude-review:<pr>:<head-sha> --> marker is embedded in each new comment so future runs can detect diff changes reliably.

Result: 26 comments posted, 40 PRs left untouched (prior review already covers the unchanged diff — nothing new to add).

New finding (1):

• fix(daemon): keep the timer-tick tracing span entered for the tick body #3464 — the change binds the tick span guard as let _guard = span.enter();, which now holds the !Send tracing::span::Entered across events_tx.send(event).await inside a future given to tokio::spawn (requires Send). Verified against main (where it was let _ = …, dropped immediately): this should fail to compile. Suggested span.in_scope(…)/.instrument(…).

Correction of an earlier review (1):

• fix(cli): validate dora new name against CMake/TOML-breaking characters #3441 — a prior review called this a new 1.0 break for non-ASCII names. Verified against main: every dora new template already rejects non-ASCII (if !name.is_ascii() { bail!("… must be ASCII") }), so it is not a new break; the PR only newly rejects certain ASCII-punctuation names (mostly already-broken scaffolding). Also re-flagged the pre-existing Python-dataflow space-normalization gap.

Re-review notes on PRs that got new commits today (23): #3435, #3430, #3371, #3336, #3417, #3458, #3410, #3420, #3381, #3366, #3395, #3438, #3380, #3434, #3432, #3444, #3355, #3367, #3431, #3294, #2930, #2895, #2288 — in each case the latest commit(s) resolved the earlier findings (e.g. the shared stale-Cargo.lock downgrade hunk dropped by rebase; #2288's Box-consuming ownership that risked a segfault replaced by a borrowing Arc<Mutex<…>> handle) with no new important issues.

Untouched (40): #3345, #3442, #3447, #3419, #3418, #3379, #3461, #3459, #3446, #3399, #3363, #3314, #3443, #3424, #3396, #3463, #3349, #3340, #3318, #3337, #3457, #3416, #3358, #3456, #3422, #3278, #3285, #3310, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850, #3360, #3350, #3343 — prior review covers the current (unchanged) diff and I found no clearly-important missed issue. Several of these still carry earlier unresolved findings (e.g. #3414's build-graph blockers, #3360's schema-freshness/wire-gate concerns, #3350's in-tree-symlink over-rejection, #3072's non_exhaustive compile break) — those stand from the prior round and were not re-posted since nothing changed.

One redundant post to note honestly: on #3414 the latest prior review's marker (dea19e3c) did not match head (77d7d550), but that PR has had no new commit (single Sep-4 commit) — the marker was a stale content-hash, not a head SHA. A re-flag of the (still-valid, still-unaddressed) build-blockers was posted before that was caught; the content is accurate but duplicates the 09:34 review. No new comment tool can retract it. Future runs should prefer commit-date evidence over a marker that matches no commit.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Reviewed all 37 open PRs against their current diffs (diff = source of truth, PR descriptions/prior comments not trusted). The prior run (~10:49Z today) already covered every PR and embedded a <!-- claude-review:<pr>:<sha> --> marker in each comment. This run only looked for new work since that review (genuine non-merge commits / force-pushes / new merge-conflict resolutions) and brand-new PRs opened after 10:49Z. Per the noise rules, I stayed silent where the diff was unchanged and nothing new was found.

Result: 7 comments posted, 30 PRs left untouched.

New first-time reviews (2 PRs opened after the last run):

• fix: fail full-speed replay when receiver delivery is incomplete #3466 — fail full-speed replay when receiver delivery is incomplete. Large (~3.5k-line) but fully opt-in feature; verified existing behavior is preserved (receipts/byte-budget gated on DORA_REPLAY_* env vars, verified_replay guards, fail_on_stop default-false), no 1.0-frozen surface touched (no dora-message wire types, additive --delivery-timeout flag, no YAML schema change). No blocking issues; disclosed that verification.rs and the 1.2k-line integration test were not read line-by-line.
• fix(cli,daemon): unify project root resolution for symlinked entrypoints (#3247) #3465 — unify project root resolution for symlinked entrypoints. The canonicalize(path).parent() → canonicalize(path.parent()) fix is correct for Allow dataflows in subdirectories to reference shared modules (project root is fixed to the entry file's directory) #3247; non-symlink case unchanged; regression test exercises the real helper and would fail on main. No issues found.

Short "reviewed, safe" notes on PRs with new commits/force-push/merge since the last review (5):

• fix(daemon): keep the timer-tick tracing span entered for the tick body #3464 — new commit scopes the span.enter() guard to a synchronous block so it no longer crosses .await; resolves the earlier !Send-across-await compile-break finding.
• fix(core): bound zenoh connect and scouting timeouts to prevent teardown hang (#2776) #3340 — new commit drops the inert/risky zenoh keys (incl. routing/interests/timeout), keeps only transport/unicast/open_timeout behind a named const + DORA_ZENOH_OPEN_TIMEOUT_MS override + deterministic config test; resolves prior findings.
• chore(deps): format cxx-bridge messages with prettyplease 0.2 directly (#2452) #3420 — rebased onto main; source diff identical to the already-cleared migration, only Cargo.lock regenerated.
• fix(daemon): answer unsupported requests on the local listener #3285 — new commit removes the {other:?} payload-amplification (static request_kind() label) and fixes the version-skew wording; resolves both prior findings.
• feat(c++): thread-safe send_output from worker threads (#1915) #2288 — merge commit hand-resolves conflicts against the arrow_v59/DoraArray and output_channel upstream changes; mechanical API adaptations, shared-handle design unchanged.

Untouched (30): #3463, #3444, #3441, #3435, #3434, #3432, #3417, #3414, #3410, #3381, #3371, #3367, #3360, #3355, #3350, #3343, #3310, #3294, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2895, #2878, #2850 (draft) — plus the two only-base-merge cases folded above. In each, the prior review already covers the current (unchanged) source diff and I found no new important issue. Several still carry unresolved findings from earlier rounds (e.g. #3414's cp310-wheel build-graph blockers, #3360's hand-edited schema / config breaking-gate exemption, #3350's over-broad symlink pre-scan rejection, #3118's stale 13-arg build_daemon call that won't compile on main, #3215's 1 s timeout misapplied to regular Output) — these stand from the prior round and were not re-posted because there was no new commit to re-flag against.

Note on markers: the prior run's marker SHAs are an internal content hash, not always the git head SHA, so this run used "new non-merge commit after the last Claude comment" as the reliable diff-changed signal rather than SHA equality.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 20 open PRs, diff = source of truth. The two prior runs today (10:49Z, 12:43Z) already reviewed every currently-open PR with embedded markers, so this run only looked for genuine diff changes since each PR's last review comment (new non-merge commit / force-push / new merge-conflict resolution) and any brand-new PR.

Result: 0 comments posted, 20 PRs left untouched. No PR has a diff change since its last review comment, and no new findings.

PRs that had activity after the 12:43Z run, and why no new comment:

• fix(core): validate ros2 port mappings and bind single-topic bridges to the declared port #3310 — new non-merge commit 8eb67759 (single-topic topic: now resolves to the node's declared port) was already reviewed by the 14:21Z comment ("single-topic gap is closed … good to go from my side"). The only later commit is merge aede59a (conflict resolution), already documented in the 14:30Z comment. Nothing unreviewed remains.
• fix: fail full-speed replay when receiver delivery is incomplete #3466 — latest commit 40dd4d95 ("reconcile replay cleanup with upstream log flushing") is at 13:42Z; the detailed scope review at 13:57Z was posted after it and covers the current head. That review's outstanding request (rebase onto main and re-test at --speed 0 given fix(daemon): preserve backpressure inputs under timer pressure #3429; split the ~3.6k-line change) still stands, unchanged — nothing new to add.

Base/label churn, not diff changes (verified via commit history — no new commit): #3118, #3072, #3047, #2915, #2878, #2850 all show updated_at around 13:20Z from base-branch/label syncing, not a push. Their earlier unresolved findings stand from the prior rounds and were not re-posted since nothing changed.

Untouched, prior review covers unchanged diff: #3465, #3441, #3414, #3360, #3350, #3343, #3290, #3283, #3215 — no new commit; earlier findings (e.g. #3414's cp310 build-graph blockers, #3360's schema-freshness/wire-gate concerns, #3350's over-broad symlink pre-scan, #3215's 1 s timeout on regular Output) still stand from earlier rounds.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 19 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The three prior runs today (10:49Z, 12:43Z, 14:34Z) already reviewed every previously-open PR against its current head, so this run only looked for PRs opened since the last run and genuine diff changes since each PR's last review comment (new non-merge commit / force-push — not label churn or base-branch sync).

Result: 2 comments posted (both on brand-new PRs), 17 PRs left untouched.

New first-time reviews (2 PRs opened after the last run, both by the maintainer):

• chore(deps): update zenoh and zenoh-ext to 1.10 #3471 — chore(deps): update zenoh and zenoh-ext to 1.10. No issues found. Verified the diff is a pure version bump (~1.9→~1.10 in Cargo.toml, Cargo.lock churn + 4 new transitive crates, one docs line) with zero code adaptations — correct because dora only consumes zenoh-ext builder-extension traits (never implements them, so the async-trait removal is irrelevant) and touches none of the 1.10.0 breaking surfaces (SHM handoff still via default_backend, SourceInfo unused). zenoh 1.x wire interop + matching zenohd docs mean no dora 1.0-frozen surface is affected.
• ci(docker): fix the multi-platform build and smoke the dora-slim image #3470 — ci(docker): fix the multi-platform build and smoke the dora-slim image. No issues found. The publish-hole fix (packages: write isolated to a push-gated job), the buildx multi-platform setup, and the smoke step are all sound — the smoke meaningfully exercises the image (reads the Arrow payload back, greps a marker only printed on real receipt, correct exit-code handling). One non-blocking visibility note: arm64 is built/pushed but never actually smoked (documented trade-off).

Untouched (17) — no diff change since last review, so nothing re-posted: #3466, #3465, #3441, #3414, #3360, #3350, #3343, #3340, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850 (draft). For each, the latest non-merge commit predates that PR's last automated review comment (all reviewed earlier today); the ~15:00Z updated_at bumps on several were waiting-for-author / needs-rebase label churn and base-sync, not pushes.

Several of these still carry unresolved findings from earlier rounds — restated here for the record, not re-posted since no new commit landed to re-flag against:

• feat(python): ship CPython 3.10 wheels alongside the abi3 ones #3414 — cp310-wheel build-graph blockers (dropped pyo3/extension-module on cp310 legs, missing -i on linux-family legs, deleted pypi: dora-rs-cli entry, stale docs/api-python.md).
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — hand-edited dora-schema.json, config wrongly listed in NON_POSTCARD_MODULES (breaking-gate exemption), startup-timeout marker mislabeling early crashes, deleted finish_grace_secs doc.
• fix(core): resolve module inner node paths relative to lexical project root (#3341) #3350 — over-broad ..-over-symlink pre-scan rejecting legitimate in-tree symlinks, tautological symlinked_project_root test, stale docs/modules.md:280.
• ci(qa): guard the nightly reporting wiring against silent rot #3343 — missing trunk.yaml required-status entry, hub-smoke repro/log-pattern gaps, a continue-on-error : true space-before-colon that silently bypasses the setting.
• fix(daemon): report required event delivery failures #3215 — ZENOH_PUBLISH_TIMEOUT (1 s) applied to every publish on the per-output drain incl. regular InterDaemonEvent::Output, a new data-loss mode; scoping it to the control Block publish keeps the fix without it.
• fix(daemon): retry finished dataflow reports after reconnect #3118 — stale 13-arg build_daemon call that won't compile on main; ? on report_pending_finished_dataflows.
• Fix reliable inter-daemon close handling #3072 — non_exhaustive compile break.
• fix: fail full-speed replay when receiver delivery is incomplete #3466 — standing request to rebase onto main and re-test at --speed 0 (given fix(daemon): preserve backpressure inputs under timer pressure #3429) and to split the ~3.6k-line change.
• fix(cli): validate dora new name against CMake/TOML-breaking characters #3441 — the earlier "new 1.0 break" claim was already corrected (main already rejects non-ASCII names); only a non-blocking pre-existing Python-dataflow space-normalization gap remains.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 18 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The four prior runs today (10:49Z, 12:43Z, 14:34Z, 16:37Z) already reviewed every previously-open PR against its current head, so this run only looked for genuine diff changes since each PR's last review comment (new non-merge commit / force-push — not label churn, base sync, or empty CI-retrigger commits) and any brand-new PR. No new PRs since the last run.

Result: 1 comment posted, 17 PRs left untouched.

Diff changed → reviewed (1):

• fix(core): resolve module inner node paths relative to lexical project root (#3341) #3350 — new commit 5a49a1f3 resolves all three outstanding findings: the over-broad ..-over-symlink pre-scan now allows in-tree symlinks (gated by a lexical/physical-identity check — the narrower rule that was requested), the tautological expand_modules_accepts_symlinked_project_root test was removed and real positive/negative cases added, and both module docs were corrected. No new issues. Only the non-code fix: allow symlinked module directories and fix project root on symlinked entrypoints (#3247) #3318 overlap remains a maintainer choice.

Activity but no diff change, so nothing posted (2):

• fix(core): bound zenoh connect and scouting timeouts to prevent teardown hang (#2776) #3340 — latest commit 6aa2177b is an empty ci: re-trigger checks (0 files changed); the real fix commit cabe4e88 was already cleared in the 12:43Z run.
• ci(qa): guard the nightly reporting wiring against silent rot #3343 — the ~17:21Z bump is label/base churn; the latest non-merge commit is 16f50d5c (Sep 4), already reviewed. Prior unresolved findings still stand (missing trunk.yaml required-status entry, hub-smoke repro/log-pattern gaps, the continue-on-error : space-before-colon).

Untouched (15) — no diff change since last review: #3466, #3465, #3441, #3414, #3360, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850 (draft). For each, the latest non-merge commit predates that PR's last automated review comment. Earlier unresolved findings still stand from prior rounds and were not re-posted because no new commit landed to re-flag against — e.g. #3414's cp310-wheel build-graph blockers, #3360's hand-edited dora-schema.json / config breaking-gate exemption, #3215's 1 s ZENOH_PUBLISH_TIMEOUT applied to regular Output, #3118's stale 13-arg build_daemon call, #3072's non_exhaustive compile break, and #3466's rebase-onto-main + split request.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 15 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The five prior runs today (10:49Z, 12:43Z, 14:34Z, 16:37Z, 18:35Z) already reviewed every previously-open PR against its current head, so this run only looked for genuine diff changes since each PR's last review comment (new non-merge commit / force-push — not label churn or base sync) and any brand-new PR. No new PRs since the last run.

Result: 1 comment posted, 14 PRs left untouched.

Diff changed → reviewed (1):

• fix(cli,daemon): unify project root resolution for symlinked entrypoints (#3247) #3465 — new commit 3b8ef04 ("preserve physical resolution for cargo build workspace walk-up") resolves the 14:21Z review's outstanding request. The local build's cargo cwd now goes through a dedicated canonicalize_build_working_dir that keeps physical (symlink-resolved) resolution, so the workspace walk-up still finds the real Cargo.toml even when the entrypoint symlink lives outside the Cargo workspace — while module expansion / relative node-path resolution keep the lexical-parent behavior Allow dataflows in subdirectories to reference shared modules (project root is fixed to the entry file's directory) #3247 needs. A regression test covers the cargo path and the canonicalize_working_dir doc now states the new contract explicitly. No new issues; the intentional build-cwd vs module-path divergence for symlinked entrypoints is the split the reviewer already blessed.

Untouched (14) — no diff change since last review: #3466, #3441, #3414, #3360, #3343, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850 (draft). For each, the latest non-merge commit predates that PR's last automated review comment (all reviewed earlier today); the recent updated_at bumps are waiting-for-author / needs-rebase label churn and base-sync, not pushes.

Several still carry unresolved findings from earlier rounds — restated for the record, not re-posted since no new commit landed to re-flag against: #3414's cp310-wheel build-graph blockers (dropped pyo3/extension-module, missing -i on linux legs, deleted pypi: dora-rs-cli entry, stale docs/api-python.md); #3360's hand-edited dora-schema.json and config breaking-gate exemption; #3215's 1 s ZENOH_PUBLISH_TIMEOUT applied to regular Output; #3118's stale 13-arg build_daemon call; #3072's non_exhaustive compile break; #3466's rebase-onto-main + split request; #3047's unbounded pending_passthrough.

---

Generated by Claude Code

[phil-opp]

🤖 Scheduled automated review — merged commits (last 2 days) — this is a scheduled automated Claude Code check; no human vetted these findings.

Unlike the earlier runs in this issue (which reviewed open PRs pre-merge), this pass reviewed the merged result on main: all 49 non-merge commits dated 2026-09-09 (the 50th, 5390f68, is the squashed base snapshot of the shallow checkout, not a recent change). Diff = source of truth; commit messages/PR descriptions were not trusted. I read each diff in context, traced the load-bearing invariants, and specifically looked at how the changes interact.

Result: no bugs or regressions found. 0 issues filed.

Red-flag scan (disabled/skipped/#[ignore]d tests without a fix, todo!/unimplemented!, broad error swallowing, #[allow(dead_code/unused)] masking): nothing new in the 49-commit window. The only new #[allow]s are cxx-bridge-mandated (borrowed_box/boxed_local), and the only new catch_unwind is the intended C++ worker-panic fail-stop in #2288.

Reviewed in five clusters (each deep-read, plus independent spot-checks):

• node-api — fix(node-api): keep the input type check armed on a Null first message #3430, fix(node-api): skip the send-side output type check for Null payloads #3380, fix(node-api): replay recorded zero-length arrays in integration testing #3438, perf(node-api): skip redundant metadata encode on schema-once send path #3294, fix(node-api): tolerate Python log levels above 255 in host_log #3367, fix(node-api): honor timeout on merged (ROS2) event streams #3366. The fix(node-api): keep the input type check armed on a Null first message #3430↔fix(node-api): skip the send-side output type check for Null payloads #3380 pair tells a consistent Null-exempt story on both the receive (one-shot, re-armed on a Null first message) and send sides; they touch different files/directions and neither re-introduces what the other guards. perf(node-api): skip redundant metadata encode on schema-once send path #3294's metadata-encode closure re-reads the immutable &metadata per arm, so no stale/wrong metadata; the schema-once fast path matches prior behavior.
• core (descriptor/path/mermaid/zenoh) — fix(core): resolve module inner node paths relative to lexical project root (#3341) #3350, fix(core): escape Mermaid-significant chars in node description #3371, fix(core): sanitize runtime-node subgraph IDs in Mermaid output #3456, fix(core): reject sub-nanosecond interval fields in descriptor validation #3345, fix(core): validate ros2 port mappings and bind single-topic bridges to the declared port #3310, refactor(core): move the operator subtree out in resolve_aliases_and_set_defaults instead of cloning #3431, fix(core): bound zenoh connect and scouting timeouts to prevent teardown hang (#2776) #3340. refactor(core): move the operator subtree out in resolve_aliases_and_set_defaults instead of cloning #3431's take()-instead-of-clone() is sound: ResolvedNode::from_node never reads operators/operator, all input-mapping mutation precedes the take, and each loop iteration gets a fresh owned node — pinned by a new regression test. fix(core): escape Mermaid-significant chars in node description #3371/fix(core): sanitize runtime-node subgraph IDs in Mermaid output #3456 Mermaid escaping closes the quoted-label injection vector with correct ordering. fix(core): reject sub-nanosecond interval fields in descriptor validation #3345 rejects sub-nanosecond intervals that round to Duration::ZERO while still accepting genuine 1 ns.
• cli (record/replay/logs) — fix(record-node): bound recorder crash-loss by record count and wall-clock time #2895, fix(cli): reject record topics that collide under the ___ input-id encoding #3444, fix(cli): validate dora replay --speed instead of silently replaying at full speed #3381, fix(cli): honor --until for newly appended lines in local log follow #3336, fix(cli): flush buffered logs before dora run returns #2930, fix(cli): don't let a stray dora-config.yml brick dora up/down #3419, fix(cli): don't discard a located node binary when canonicalization fails #3379, refactor(recording): drop the inert footer re-validation in next_entry #3358. fix(record-node): bound recorder crash-loss by record count and wall-clock time #2895's flush bound is min(100 records, 1 s) on the write path (no off-by-one, binds on sub-1 Hz streams); buffered records flush on RecordingWriter::finish. fix(cli): reject record topics that collide under the ___ input-id encoding #3444's collision guard has no false pos/neg and the YAML mapping is now derived from the validated map. refactor(recording): drop the inert footer re-validation in next_entry #3358 removed genuinely-inert footer re-validation (FOOTER_MAGIC[..4] = "DORA" implies a ~1.09 GB length prefix, far above MAX_RECORD_BYTES).
• daemon/tracing/runtime — fix(daemon): keep the timer-tick tracing span entered for the tick body #3464, fix(daemon): answer unsupported requests on the local listener #3285, fix(daemon): forward Trace-level logs through the Tracing destination (#3348) #3349, fix(tracing): match RUST_LOG targets on a name boundary, not a bare substring #3337, perf(tracing): skip context serialization when no span is active #3395, fix(runtime): bound the queue of an operator input that has no configured size #3422, fix(hub-client): don't abort version resolution on one unreadable index entry #3355. fix(daemon): keep the timer-tick tracing span entered for the tick body #3464's tick-span guard is scoped to the synchronous build block and dropped before .await (the earlier !Send-across-await concern from the pre-merge review is resolved in the merged form). fix(tracing): match RUST_LOG targets on a name boundary, not a bare substring #3337's RUST_LOG name-boundary matcher is correct (:: submodules match, zenoh_transport/azenoh don't). fix(daemon): answer unsupported requests on the local listener #3285 answers unsupported local-listener requests with a Postcard-encoded error only for expects_tcp_binary_reply() requests, silent for no-reply ones, with an exhaustive #[non_exhaustive] wildcard arm. fix(runtime): bound the queue of an operator input that has no configured size #3422 bounds an undeclared operator input to DEFAULT_QUEUE_SIZE (cap ≥ 1, cannot block/drop-all), tested.
• ros2/mavlink/c++ FFI — fix(ros2-bridge): don't misclassify a member with = in its string default #3457, refactor(ros2-bridge): drop two unreachable int64 tags in the basic-type parser #3416, fix(mavlink2-bridge-node): don't skip graceful reader shutdown on a send_output error #3432, feat(c++): thread-safe send_output from worker threads (#1915) #2288, refactor(operator-api-cxx): dedupe the C++ event-dispatch arms #3417, #85e14de. The riskiest change, feat(c++): thread-safe send_output from worker threads (#1915) #2288 (thread-safe C++ send_output), is correct: every node access — main thread and workers — funnels through lock_node on Arc<Mutex<DoraNode>>; clone_output_sender borrows via Arc::clone (never nulls the original box), so the 1.0-frozen segfault path is genuinely avoided. fix(ros2-bridge): don't misclassify a member with = in its string default #3457 classifies a string default containing = as a member, not a constant, across all edge cases. fix(mavlink2-bridge-node): don't skip graceful reader shutdown on a send_output error #3432's mavlink shutdown consumes reader_handle exactly once per branch (no double-free).

Cross-commit interactions checked: #3471 (zenoh→1.10 bump) vs. #3340 (zenoh open_timeout config) — the timeout keys are stable across 1.9→1.10 and the bump touches no surface dora uses, so no conflict; #3430/#3380 Null handling as above; #3294 metadata skip against the schema-once send path.

Minor non-blocking notes (not filed as issues — no code defect):

• fix(core): bound zenoh connect and scouting timeouts to prevent teardown hang (#2776) #3340 — commit title says "scouting timeouts" but the diff only sets transport/unicast/open_timeout; wording imprecision, not a code bug. The 1000 ms default applies to every unicast open (incl. the coordinator dial), so a lossy high-RTT WAN could exceed it on one attempt — but there are two escape hatches (DORA_ZENOH_OPEN_TIMEOUT_MS, JSON5 overlay applied last) and zenoh retries opens, so it degrades to a slower connect rather than a failure. Deliberate, documented tradeoff.
• A couple of debug-log lines (fix(node-api): skip the send-side output type check for Null payloads #3380 Null-vs-pattern-correlation attribution) are imprecise in wording only.

---

Generated by Claude Code

[phil-opp]

🤖 Scheduled automated component review — no bugs found — this is a scheduled automated Claude Code check; no human vetted these findings. No separate GitHub issue was filed because nothing actionable was found.

Unlike the PR/merged-commit passes above, this run randomly sampled existing components on main (not tied to any open PR) and read each for logic errors, edge cases, off-by-one / type-mismatch / bounds bugs, and unsafe assumptions. Diff/source = source of truth.

Result: 0 bugs found across the ~14 modules reviewed. 0 issues filed.

Components deep-read this run:

• ros2-bridge Arrow codec — serialize/array.rs, serialize/sequence.rs, deserialize/array.rs, deserialize/sequence.rs, deserialize/string.rs, deserialize/primitive.rs. The fixed-array vs. variable-sequence paths are consistent: both enforce the element/max_size bound before dispatching on item type, both reject nulls for primitive/bool/string elements (ros2-bridge: null element in a primitive/bool array or sequence field is silently encoded as 0/false (silent data corruption) #3271), both accept the Binary/List<UInt8> byte-field duality identically (ros2-bridge: sequence<u8>/char/byte field given as Arrow Binary is double-nested on the CDR wire (extra length prefix corrupts the message) #2507/ros2-bridge: BoundedSequence<uint8> max_size is not enforced when the byte field is supplied as an Arrow Binary/LargeBinary column #2816/ros2-bridge: fixed-size array field (type[N]) rejects Arrow Binary/LargeBinary columns, unlike the sequence path #3065), and both cap element counts at MAX_SEQUENCE_ELEMENTS. The WString path bounds UTF-16 code units and surfaces from_utf16 errors. No CDR length-prefix/alignment divergence between representations.
• MAVLink bridge — arrow_convert.rs (schema/to/from symmetry for all 15 message types, enum-vs-bitfield widths, SERVO_OUTPUT_RAW.time_usec = uint32 per spec), transport.rs (scheme/proto/baud parsing — invalid values are hard errors, not silent fallbacks), and the node main.rs (recv-error Silent/Transient/Fatal classification mavlink2-bridge: reader thread never exits/reconnects on fatal disconnect (logging zombie) #2034, three-layer TCP/UDP/serial shutdown, per-frame sequence wrap, nullable-StructArray rejection mavlink2-bridge: nullable StructArray on a *_cmd input panics the bridge node (bypasses the "reject, don't panic" decode contract) #2298). Consistent and well-covered.
• .drec recording format (libraries/recording) — length-prefix framing, torn-record graceful EOF, footer-magic detection, MAX_RECORD_BYTES caps, and checked_add bounds in read_slice/read_array all hold; write-side u16/u32 length overflow is rejected before truncation.
• daemon logger (binaries/daemon/src/log.rs) — rotation pruning down to a lowered limit and to zero, shared-Arc<Mutex> coordinator-target reconnect (daemon: coordinator-reconnect path kills all running nodes (contradicts #1996 "running dataflows continue") #2029), exhaustive tracing-level forwarding (Bug: Trace-level node/build logs are silently dropped by the daemon's Tracing log destination #3348).
• hub index catalog (libraries/hub-client/src/index.rs) — symlink confine() (existing + not-yet-created leaves), key-charset traversal guards, git_pin full-object-id validation, resolve fallback across yanked/unreadable entries with correct error precedence.
• config parsing (libraries/message/src/config.rs) — timer <unit>/<count> ↔ FormattedDuration round-trip (coarsest exact unit, zero-interval rejection config: sub-millisecond (>1kHz) timer interval corrupts to a 0ms busy-loop on wire round-trip #2031), ByteSize integer/float/overflow handling, dora/logs/<level>/<node> slash handling.
• Plus cli inspect top, cli hub update, cli expand, cli node restart, daemon pool_extension, libraries/log-utils, and descriptor/visualize.rs (Mermaid label escaping ordering).

Everything reviewed is defensively written with regression tests tied to specific issue numbers, so this run adds no new findings. Note: several of these areas (.drec footer #3358, Mermaid escaping #3371/#3456, timer rounding #3345, MAVLink shutdown #3432) were also cleared in the 02:09Z merged-commit pass above — this run reached the same conclusion from the component side.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over the open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-09 20:36Z, so this run reviewed PRs opened since then and PRs with a genuine new non-merge commit since their last review comment.

Result: 5 comments posted, rest untouched.

New first-time reviews — the #3047 split (4 stacked PRs by @caothu2k1, decomposing the large #3047 as its review requested):

• feat(node-cxx)!: let a C++ node see that a node restarted #3478 (1/4, feat(node-cxx)!) — adds the DoraEventType::NodeRestarted cxx variant + event_as_node_restarted, reusing the existing Rust Event::NodeRestarted. Correct; tests meaningful. Flagged that it's a source-only break of the 1.0-frozen cxx bridge (-Werror=switch without a default; ABI unaffected, variant appended) for a conscious maintainer call. No code issues.

• feat(node-api): send a service request under a caller-supplied request_id #3479 (2/4) — send_service_request_with_id, purely additive; send_service_request now delegates to it (one path, not two). No issues.

• feat(node-api): correlate a fan-out request against a set of servers #3480 (3/4) — ExpectedServers (One/AnyOf/Any). Existing recv_service_response/recv_action_result behavior preserved; restart id now correctly sourced from the event (needed for AnyOf); single-server→One mapping and empty-entry rejection reasoned and tested. No issues.

• feat(node-api): non-blocking correlated receives for service and action clients #3481 (4/4, the substantive one) — non-blocking try_recv_* with a framework-owned per-correlation deadline. Traced the full logic (deadline lifecycle, reply-wins-before-expiry drain, One/AnyOf restart handling, cancel_correlation, C++ clamp_pattern_timeout) — no correctness bug. Raised two test-quality gaps: the "open-but-empty stream + lapsed deadline → Timeout" case is not actually exercised through the poll path (its test short-circuits on StreamEnded), and ..._reports_timeout_exactly_once never issues a second poll to prove exactly-once. Same frozen-surface note as feat(node-cxx)!: let a C++ node see that a node restarted #3478 (adds a 7th DoraPatternStatus variant + 5 cxx fns — WARN-level additive, passes qa-breaking).

  Note: feat(node-api): non-blocking correlated receives for service and action clients #3047 is superseded by this series and can likely be closed.

Diff changed → re-reviewed (1):

• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 (startup_timeout watchdog) — new commit 51e39938 resolves all four prior blocking points: schema regenerated (both copies, full description), config removed from NON_POSTCARD_MODULES (re-verified the remaining descriptor/WS-module exemptions are sound — those transports are serde_json-framed), early-crash mislabel now gated on is_sigkill_like_exit + stderr appended, and the finish_grace_secs doc restored. Re-flagged the two still-outstanding test gaps from the prior review (no test exercising the connected_nodes wiring for the slow-but-healthy connect-just-in-time case; no restarted-incarnation coverage).

Untouched: the maintainer's own WIP drafts #3475, #3476, #3477, #3482; and the remaining open PRs (#3466, #3465, #3441, #3414, #3343, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850) — no new non-merge commit since their last review (the recent updated_at bumps are waiting-for-*/needs-rebase label churn and base sync). Earlier unresolved findings on those still stand and were not re-posted since nothing changed.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 26 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 06:46Z, so this run looked for PRs opened since then and PRs with a genuine new non-merge commit since their last review comment.

Result: 0 comments posted on PRs. Nothing new to report since the last run.

No diff changes since 06:46Z:

• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — the ~07:15Z updated_at bump is waiting-for-* / needs-rebase label churn and base sync; the latest non-merge commit is still 51e39938 (05:11Z), already reviewed at 06:46Z. Its two outstanding test-quality gaps (no test exercising the connected_nodes wiring for the slow-but-healthy connect-just-in-time case; no restarted-incarnation coverage) still stand from that review — not re-posted since no new commit landed.
• All other open PRs (feat(node-api): non-blocking correlated receives for service and action clients #3481, feat(node-api): correlate a fan-out request against a set of servers #3480, feat(node-api): send a service request under a caller-supplied request_id #3479, feat(node-cxx)!: let a C++ node see that a node restarted #3478, fix: fail full-speed replay when receiver delivery is incomplete #3466, fix(cli,daemon): unify project root resolution for symlinked entrypoints (#3247) #3465, fix(cli): validate dora new name against CMake/TOML-breaking characters #3441, feat(python): ship CPython 3.10 wheels alongside the abi3 ones #3414, ci(qa): guard the nightly reporting wiring against silent rot #3343, feat: Add SerialEventLoop examples for C++ and Python #3290, fix(record): stop dora record silently dropping messages #3283, fix(daemon): report required event delivery failures #3215, fix(daemon): retry finished dataflow reports after reconnect #3118, Fix reliable inter-daemon close handling #3072, feat(node-api): non-blocking correlated receives for service and action clients #3047, docs(ros2-bridge): document service readiness behavior #2915, fix(ros2-bridge): restore DDS service and action discovery #2878, fix(core): fall back to non-multicast zenoh discovery when scouting bind fails #2850) — latest non-merge commit predates each PR's last review comment; earlier unresolved findings still stand from prior rounds and were not re-flagged (no new commit to flag against).

Diligence gap closed — first read of the four maintainer WIP drafts (never reviewed in prior runs). Read line-by-line this pass; no important issues found, so nothing posted on them (they are the maintainer's own drafts and marked draft/WIP):

• docs(node-api): add a compile-checked example to SampleAllocator::encode_arrow #3475 — adds a compile-checked doctest to SampleAllocator::encode_arrow (heap-alloc encode → decode_arrow_ipc round-trip via IntoArrow). Doc-only; the example is CI-verified as a doctest.
• docs(message): document public LogMessage / NodeExitStatus API and add an encode/decode doctest #3476 — per-field / per-variant doc comments on LogMessage and NodeExitStatus, plus an encode/decode round-trip doctest on dora_message::encode. Doc-only, no surface change.
• refactor(daemon): collapse stderr marker scans to Iterator::any #3477 — behavior-preserving refactor: the two for … { if starts_with … return } marker scans in extract_err_from_stderr.rs collapse to Iterator::any. Semantics identical.
• fix(daemon): contain pre-init orphans on a hard-killed dora run (#3473) #3482 — closes the pre-init orphan window on Linux: the dora run in-process spawn path arms PR_SET_PDEATHSIG(SIGKILL) in a pre_exec closure (gated on DORA_RUN_PARENT_PID, with a fork/prctl-race getppid() != parent → _exit(0) guard), and the in-node poll guard clears it at init so a healthy long-lived node can't be SIGKILLed early when the spawning tokio thread exits. unsafe/pre_exec use is async-signal-safe and well-scoped; the thread-vs-process fragility of PDEATHSIG is acknowledged and bounded to startup by the clear-at-init handover. New Linux-only e2e test (run_killed_before_node_init_does_not_orphan) sleeps 120s pre-init — well past the 30s teardown deadline — so an unfixed daemon would leave a live, detectable node and fail. Solid; still a WIP draft.

No new PRs since the last run.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 26 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 08:34Z, so this run looked for PRs opened since then and PRs with a genuine new non-merge commit since their last review comment. No new PRs since the last run.

Result: 2 short confirmation comments posted, 24 PRs left untouched.

Diff changed → re-reviewed (2):

• feat(node-api): non-blocking correlated receives for service and action clients #3481 — new commit 4b4aabab. Closes both test-quality gaps from the 06:46Z review (the open-empty-stream deadline path is now exercised via a real open_empty_event_stream helper instead of short-circuiting on StreamEnded; the once-per-deadline test now polls twice). Closing them also surfaced a genuine edge-case bug, fixed here: correlation_expired collapsed an unrepresentable Instant + Duration to now (so a Rust Some(Duration::MAX) poll reported Timeout at once) and the blocking path panicked — both now route through a terminating saturating_deadline. No new issues.
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — new commit d2da2aa4. Adds the two e2e tests the 06:46Z review requested: a connected-within-timeout disarm test (verified stop-delay-node honors DORA_TEST_INIT_DELAY_MS, so it really tests the slow-but-healthy connect-just-in-time case) and a restarted-incarnation re-arm test whose elapsed < 5 s assertion is the real regression signal if re-arm broke. Both meaningful; no new issues.

Untouched (24): #3482, #3480, #3479, #3478, #3477, #3476, #3475 (maintainer WIP drafts), #3466, #3465, #3441, #3414, #3343, #3290, #3283, #3215, #3118, #3072, #3047, #2915, #2878, #2850 (draft) — latest non-merge commit predates each PR's last review comment (recent updated_at bumps are waiting-for-* / needs-rebase label churn and base sync, not pushes). Earlier unresolved findings still stand from prior rounds and were not re-posted since no new commit landed to re-flag against — e.g. #3414's cp310-wheel build-graph blockers, #3215's 1 s ZENOH_PUBLISH_TIMEOUT applied to regular Output, #3118's stale 13-arg build_daemon call, #3072's non_exhaustive compile break, #3466's rebase-onto-main + split request, and the note that #3047 is superseded by the #3478–#3481 split and can likely be closed.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Incremental pass over all 26 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 10:35Z; this run looked for PRs opened since then and PRs with a genuine new non-merge commit / force-push since their last review comment.

Result: 0 comments posted. No new PRs and no diff changes since the last run.

Verified via commit evidence (not just updated_at):

• feat(node-api): non-blocking correlated receives for service and action clients #3481 — head is still 4b4aabab (2026-09-10 10:17Z), the exact commit reviewed at 10:35Z. No change.
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — head is still d2da2aa4, reviewed at 10:35Z. No change.
• Every other open PR (fix(daemon): contain pre-init orphans on a hard-killed dora run (#3473) #3482, feat(node-api): correlate a fan-out request against a set of servers #3480, feat(node-api): send a service request under a caller-supplied request_id #3479, feat(node-cxx)!: let a C++ node see that a node restarted #3478, refactor(daemon): collapse stderr marker scans to Iterator::any #3477, docs(message): document public LogMessage / NodeExitStatus API and add an encode/decode doctest #3476, docs(node-api): add a compile-checked example to SampleAllocator::encode_arrow #3475, fix: fail full-speed replay when receiver delivery is incomplete #3466, fix(cli,daemon): unify project root resolution for symlinked entrypoints (#3247) #3465, fix(cli): validate dora new name against CMake/TOML-breaking characters #3441, feat(python): ship CPython 3.10 wheels alongside the abi3 ones #3414, ci(qa): guard the nightly reporting wiring against silent rot #3343, feat: Add SerialEventLoop examples for C++ and Python #3290, fix(record): stop dora record silently dropping messages #3283, fix(daemon): report required event delivery failures #3215, fix(daemon): retry finished dataflow reports after reconnect #3118, Fix reliable inter-daemon close handling #3072, feat(node-api): non-blocking correlated receives for service and action clients #3047, docs(ros2-bridge): document service readiness behavior #2915, fix(ros2-bridge): restore DDS service and action discovery #2878, fix(core): fall back to non-multicast zenoh discovery when scouting bind fails #2850 draft) has its latest non-merge commit predating its last review comment; all updated_at bumps are ≤ 10:35Z (label churn / base sync, not pushes).

Earlier unresolved findings from prior rounds still stand and were not re-posted, since no new commit landed to re-flag against — e.g. #3414's cp310-wheel build-graph blockers, #3215's 1 s ZENOH_PUBLISH_TIMEOUT applied to regular Output, #3118's stale 13-arg build_daemon call, #3072's non_exhaustive compile break, #3466's rebase-onto-main + split request, and the standing note that #3047 is superseded by the #3478–#3481 split and can likely be closed.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Fresh pass over all 23 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 12:34Z. No PR has a diff change since then — every open PR's head is the exact commit its last review comment covers, and all updated_at bumps are waiting-for-* / needs-rebase label churn or base sync, not pushes. So per the noise rules this run did a genuine re-review looking for missed findings rather than re-flagging on new commits.

Result: 0 comments posted on PRs. No new important findings that warrant a PR comment.

Deep fresh re-reviews this run (verified independently against main):

• feat(node-api): non-blocking correlated receives for service and action clients #3481 — re-read the full ~2900-line diff and the try_correlation/now_or_never interaction against recv_from_stream on main. No correctness bug: the now_or_never poll cannot lose events (Pending never dequeues), deadline lifecycle is consistent, AnyOf-restart is buffered and reported exactly once, saturating_deadline genuinely fixes the Instant + Duration::MAX panic (confirmed main still panics), and all additions are purely additive to the 1.0 surface. Regression tests fail on main. Nothing new.
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — traced the watchdog against the connect/init race: the kill is gated on the sticky connected_nodes set (only cleared alongside running_nodes removal), startup_kill_sent is a swap-latch, spawned_at resets to 0 during restart backoff (treated as "never kill"), and the field is JSON-framed (not postcard), so the schema change is not a real wire break. e2e tests exercise real behavior. Nothing new.
• fix: fail full-speed replay when receiver delivery is incomplete #3466 — this run read the parts skipped before line-by-line: verification.rs, both receipt recorders, and the ~1.2k-line integration test. The delivery-verification core is correct — the per-stream digest is order/dup/drop-sensitive and transport-agnostic (identity = producer HLC timestamp), every yield path records exactly once, a failed record fails verification rather than passing it, and fail_on_stop only trips on genuine stop sources. Could not construct a false-pass or false-fail. The speed_zero_* #[ignore] cases are wired into PR CI, so they run.

One genuinely-new but secondary observation on #3466 (not posted to the PR): the published 1.0 crate dora-node-api gains unconditional dora-recording → sha2 0.11 + serde_json + tempfile dependencies (apis/rust/node/Cargo.toml) for a feature that is inert unless DORA_REPLAY_* is set — every downstream Rust node now compiles/links these (and a second sha2 major in the tree). A natural cargo feature-flag candidate. Not posted as a PR comment because it reinforces (rather than adds to) the standing 13:57Z scope review — which already recommends rebasing onto main (given #3429), splitting the ~3.6k-line change, and moving per-edge verification behind its own opt-in flag — and there is no new commit to re-engage against. Recorded here for the maintainer.

Sweep of the less-covered PRs (#3283, #2878, #2850 draft, #3290, #3441, #3478): no new issues. Verified #3283's backpressure-mapping fix and its drop-count accounting are real (tests fail on main); #2878's partial_sequence→sequence rename matches the example_interfaces/Fibonacci feedback field and the wait_for_service call compiles; #3441's allow-list validation is CLI hardening, not a 1.0 API break. The #3290 cross-thread send_output flush/liveness gap and the "~680 lines of framework under examples/ belongs in apis/" scope concern are already in that PR's comment history (most recently the 09:34Z Sep-9 review; flush issue on Aug 30) and its head is unchanged since Aug 30 — not re-posted.

Untouched, prior review covers the unchanged diff: #3482, #3480, #3479, #3477, #3476, #3475 (maintainer WIP drafts), #3465, #3414, #3343, #3215, #3118, #3072, #3047, #2915. Earlier unresolved findings still stand from prior rounds and were not re-posted since no new commit landed to re-flag against — e.g. #3414's cp310-wheel build-graph blockers, #3215's 1 s ZENOH_PUBLISH_TIMEOUT reaching regular Output via the shared per-output drain, #3118's stale 13-arg build_daemon call, #3072's non_exhaustive compile break, and the note that #3047 is superseded by the #3478–#3481 split and can likely be closed.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Fresh pass over all 23 open PRs (incl. the 4 maintainer WIP drafts + #2850 draft), diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 14:43Z. This run did a genuine independent re-read of every PR looking for missed findings, and separately checked for diff changes since each PR's last review comment.

Result: 1 comment posted (#3047), 22 PRs left untouched.

Diff changed since last PR-thread review → short confirmation posted (1):

• feat(node-api): non-blocking correlated receives for service and action clients #3047 — commit 2b1d6726 (2026-09-10 01:54Z) landed after the last automated review on the PR (2026-09-09 13:20Z), but had not been acknowledged by a review there. Re-read it: no new findings, safe. It is exactly the content now carried by the split PRs feat(node-cxx)!: let a C++ node see that a node restarted #3478–feat(node-api): non-blocking correlated receives for service and action clients #3481 (all re-reviewed clean this run), and the two API-freeze items are resolved. Posted a one-paragraph "safe / superseded" confirmation. Should be closed in favour of the split.

Deep fresh re-reviews, no new important findings (verified independently against main):

• feat(node-api): non-blocking correlated receives for service and action clients #3481 (the substantive split PR) — re-traced try_correlation ordering (buffer → drain-ready via now_or_never → deadline last), saturating_deadline (terminates; means "no practical deadline", the real bug fixed in 4b4aabab), deadline lifecycle, AnyOf-vs-One restart handling. No correctness bug; regression tests fail on main. feat(node-cxx)!: let a C++ node see that a node restarted #3478/feat(node-api): send a service request under a caller-supplied request_id #3479/feat(node-api): correlate a fan-out request against a set of servers #3480 all clean & additive (feat(node-cxx)!: let a C++ node see that a node restarted #3478's -Werror=switch source-only cxx break is a conscious maintainer call).
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 — watchdog kill gated on the sticky connected_nodes set, startup_kill_sent swap-latch, spawned_at reset-at-loop-top, JSON-framed field (no wire break); both requested e2e tests are meaningful. Reads landable.
• fix: fail full-speed replay when receiver delivery is incomplete #3466 — standing 13:57Z scope review still current (rebase onto main per fix(daemon): preserve backpressure inputs under timer pressure #3429, split the ~3.6k lines, move per-edge verification + the unconditional dora-recording/sha2 0.11/serde_json/tempfile deps behind an opt-in feature flag). Core delivery-verification logic re-confirmed correct.
• fix(cli,daemon): unify project root resolution for symlinked entrypoints (#3247) #3465 — symlinked-entrypoint fix + build-cwd split correct and tested. Landable.

Untouched — no diff change since last review; earlier findings stand and were not re-posted (no new commit to flag against):

• feat(python): ship CPython 3.10 wheels alongside the abi3 ones #3414 — cp310-wheel build-graph blockers (dropped pyo3/extension-module on cp310 legs, missing -i on linux-family legs, deleted pypi: dora-rs-cli entry, bare --features breaking cargo metadata, stale docs/api-python.md). Unbuildable as-is.
• fix(daemon): report required event delivery failures #3215 — 1 s ZENOH_PUBLISH_TIMEOUT still applied to every publish on the per-output drain incl. regular Output; new tests call build_daemon with 13 args vs main's 15 (compile break on rebase).
• fix(daemon): retry finished dataflow reports after reconnect #3118 — 13-arg build_daemon call won't compile on main (15 args); ? on report_pending_finished_dataflows aborts following re-sends (should be warn!).
• Fix reliable inter-daemon close handling #3072 — NodeRunConfig is now #[non_exhaustive] (refactor(message)!: make the descriptor structs non-exhaustive before 1.0 #3387), so the new test_running_node struct-literal is an E0639 compile break on main; outbound-only exemption leaves a remote-fed local sink reachable for erroneous SIGKILL escalation.
• fix(ros2-bridge): restore DDS service and action discovery #2878 — best-effort QoS warning misfires (reliable: bool defaults false), RosContextCreation guards a non-existent invariant, new default rmw-zenoh feature gates no code so --no-default-features won't compile.
• fix(record): stop dora record silently dropping messages #3283 — shutdown Event::Stop(_) => break still discards the buffered backlog uncounted; missing cli-surface.txt entry for --queue-size; still needs-rebase.
• fix(cli): validate dora new name against CMake/TOML-breaking characters #3441 — only newly-rejected ASCII punctuation remains (the "non-ASCII 1.0 break" claim was already corrected — main rejects those already); non-blocking Python space-normalization gap.
• ci(qa): guard the nightly reporting wiring against silent rot #3343 — missing trunk.yaml required-status entry, hub-smoke repro/log-pattern gaps, continue-on-error : true space-before-colon silent-pass hole.
• feat: Add SerialEventLoop examples for C++ and Python #3290 — clean-checkout C++ build broken (DORA_LIB_PATH → unbuilt .a), missing smoke registration, worker data race in the ordering test, post-Stop cross-thread send_output drop; ~680 lines of framework under examples/ that arguably belongs in apis/.
• docs(ros2-bridge): document service readiness behavior #2915 — the edited section documents the YAML ros2: bridge (20 s / 10 retries), so the "30 retries / 60 s" rewrite is wrong for that surface; most of the diff should be reverted.
• docs(node-api): add a compile-checked example to SampleAllocator::encode_arrow #3475, docs(message): document public LogMessage / NodeExitStatus API and add an encode/decode doctest #3476, refactor(daemon): collapse stderr marker scans to Iterator::any #3477, fix(daemon): contain pre-init orphans on a hard-killed dora run (#3473) #3482 (maintainer WIP drafts) — re-read; doc-only / behavior-preserving / sound orphan-containment respectively. No issues.
• fix(core): fall back to non-multicast zenoh discovery when scouting bind fails #2850 (draft) — retry opens a bare Config::default() discarding tuned connect/listen endpoints + fix(core): bound zenoh connect and scouting timeouts to prevent teardown hang (#2776) #3340 timeouts (silent partition risk), catches every zenoh::open failure not just multicast-bind, re-disables even when the operator asked for multicast. Already reviewed at this exact head.

---

Generated by Claude Code

[phil-opp]

🤖 Automated review run — summary (fully automated Claude Code review; no human vetted this).

Fresh pass over all 23 open PRs, diff = source of truth (PR descriptions / prior comments not trusted). The previous open-PR run was 2026-09-10 16:38Z.

Result: 0 comments posted on PRs. No diff changes since the last run, and no new important findings.

No diff change since 16:38Z (verified via head SHA / commit dates, not just updated_at): every open PR's head is the exact commit its last review comment already covers. The most-recently-pushed PRs — #3481 (4b4aabab, 10:17Z), #3360 (d2da2aa4), #3047 (2b1d6726) — were all reviewed at or before 16:38Z; every other PR's latest non-merge commit predates its last review comment, and the recent updated_at bumps are waiting-for-* / needs-rebase label churn and base sync. So per the noise rules this run did a genuine independent re-read looking for missed findings rather than re-flagging on new commits.

Deep fresh independent re-reads this run (each read the full diff line-by-line and cross-checked against main):

• feat(node-api): non-blocking correlated receives for service and action clients #3481 (non-blocking correlated receives, ~2900 lines) — re-traced lost/duplicated-event safety in try_correlation (position+remove extracts only the matched reply; now_or_never(recv_from_stream()) is cancel-safe on both the flume and scheduler paths; no path both returns and re-buffers an event), the deadline lifecycle (saturating_deadline/clamp_pattern_timeout both avoid Instant + Duration overflow), and AnyOf/One restart correlation. No new correctness bug. (Probed the AnyOf "flapping can't hold the correlation open past the timeout" guarantee: only theoretically starvable if a NodeRestarted were ready at the stream head on every poll — not realistically reachable, since the in-process drain catches up to an empty stream within one call. Not an important defect.)
• fix: fail full-speed replay when receiver delivery is incomplete #3466 (fail full-speed replay on incomplete delivery, ~5100 lines) — read verification.rs, both replay_receipt.rs, all three byte-budget layers, fail_on_stop plumbing, and the 1.2k-line integration test. Delivery-verification core re-confirmed correct: every yield path (incl. drain()/try_recv(), both funneling through recv_async) records exactly once; verify() indexing is panic-safe (validated key sets); the 256 MB budgets are sound and the saturation test is deterministic; fail_on_stop trips only on genuine stop sources. No new correctness bug. The one candidate-new observation (that --speed 0 now hard-errors on partial --replace / --loop / deploy / DORA_WRITE_EVENTS_TO, changing a shipped 1.0 flag's semantics) turned out to be already covered by the 13:57Z scope review — which lists exactly those and already recommends a separate --verify-delivery flag over redefining --speed 0. Verified against main (partial---replace-at---speed 0 is only an eprintln! warning there, --loop is permitted), then confirmed it was not new — not re-posted (repetition, no new commit).
• feat(daemon): add startup_timeout watchdog to kill hung nodes before init (#3022) #3360 (startup_timeout watchdog) — traced arm/disarm across spawn/restart/connect/exit: spawned_at resets to 0 before connected_nodes is cleared on restart (no spurious kill of a backing-off incarnation), the sticky connected_nodes set makes a healthy-but-slow node's kill impossible once subscribed, startup_timeout_should_kill is saturating_sub-based with a strictly-greater boundary, and both e2e tests exercise real behavior. The only theoretical stale-handle window (kill submitted to the dead predecessor handle between spawn_inner and ProcessHandleReplaced) requires a sub-tens-of-ms startup_timeout; not realistically reachable. No new correctness bug.
• feat: Add SerialEventLoop examples for C++ and Python #3290 (SerialEventLoop C++/Python examples) — re-verified all five standing findings still hold at the unchanged head 3a9c22f: clean-checkout C++ build broken (DORA_LIB_PATH → unbuilt .a, and the advertised cmake --build command has no rule to produce it), missing smoke-test registration (repo policy gate), the Test-2 worker data race (reads processed with no lock and without joining the worker), the C++-only post-Stop output-drop / no-worker-shutdown in run() (the Python half handles this correctly in its finally drain), and ~680 lines of reusable framework living under examples/. Not landable as-is; not re-posted since the head is unchanged and all findings are already in the PR's comment history.

Untouched — no diff change since last review; earlier findings stand and were not re-posted (no new commit to flag against): #3482, #3480, #3479, #3478, #3477, #3476, #3475 (maintainer WIP drafts), #3465, #3441, #3414, #3343, #3283, #3215, #3118, #3072, #2915, #2878, #2850 (draft). Standing unresolved findings from prior rounds still hold — e.g. #3414's cp310-wheel build-graph blockers, #3215's 1 s ZENOH_PUBLISH_TIMEOUT reaching regular Output, #3118's/#3072's compile breaks on rebase (13-arg build_daemon; #[non_exhaustive] NodeRunConfig), #2878's misfiring best-effort-QoS warning, #2915's wrong retry rewrite, and the note that #3047 is superseded by the #3478–#3481 split and can likely be closed.

---

Generated by Claude Code