Housekeeping cluster: stop exit code, dead branch, stale line refs, missing docstrings, unbounded dev deps, mutable dep pin

[AlexMKX]

Minor items surfaced by the same review, grouped to avoid issue spam. Split out individually if any is picked up.

a) stop reports failure with exit code 0. stop_command catches every identity-read failure and calls sys.exit(0) (cli.py:974-975); _emit_stop_outcome also returns normally for unresolved outcomes such as identity mismatch and still alive. tunstrap stop --session-dir "$d" && echo done prints "done" for a daemon that is provably still running. Contradicts code.md:29-32 ("Default to fail fast"). Fix: exit non-zero when not _stop_resolved(outcome); the JSON body can stay byte-identical.

b) Unreachable branch in _kube_channel_keys. envrender.py:40-41 handles count == 0 and documents it, but the only caller returns early at envrender.py:60-61 (if not kube_paths: return {}). coverage report -m confirms line 41 uncovered despite 98% file coverage. Contradicts code.md:98 (leftover/unreachable code).

c) file.py:LINE cross-references have already drifted. 5 of 6 checked are wrong at PR head:

Citation site	Claimed target	Actual
cli.py:470 → "cli.py:241-254"	start's top-level guard	cli.py:287-300
cli.py:432 → "session.py:53-56"	worker generates session dir	session.py:91-94
cli.py:438 → "session.py:57-63"	mkdir(parents=True, exist_ok=True)	session.py:95-100
cli.py:790 → "cli.py:578"	run_command grace_seconds default	cli.py:590
session.py:270 → "daemon.py:41"	subprocess.Popen	daemon.py:79

Also dangling: envrender.py:127-128 refers to an "Anti-drift guard" section that does not exist in that file. testing.md:164-173 mandates the stable path/to/file.ext::SymbolName form instead. Fix: switch to module.py::symbol and add a unit test resolving every ::symbol citation via ast.

d) 23 production callables lack docstrings, against code.md:78. Includes _worker.py:31,67,89; cli.py:128,520; schemas.py:192,235,248,262,280,320; session.py:156,166.

e) Unbounded dev-dependency ranges. Production deps are properly bounded (pydantic>=2.13,<3, click>=8.3,<9, cryptography>=44,<46) but mypy>=1.13 and pytest-cov>=5.0 (pyproject.toml:21-22) are not. A review environment resolved mypy 2.3.0 — a major version the project has never been validated against. Fix: bound them consistently.

f) asyncssh pinned to a personal fork at a mutable git tag. pyproject.toml:10: asyncssh @ git+https://github.com/AlexMKX/asyncssh.git@v2.23.0+forward-tracker.3. A git tag is mutable, so there is no integrity guarantee on a fork of the SSH security boundary; it also forces allow-direct-references = true (pyproject.toml:57), which blocks PyPI publication. Fix: pin to a 40-hex commit SHA and record the divergence + upstream PR link in a comment.

g) run_command carries an undeclared back-channel parameter. run_command(..., suppress_kubeconfig: bool = False) (cli.py:607) is not a Click option; it exists only so tofu_proxy can reach it via run_command.callback (cli.py:768). The verb has a hidden second signature no --help shows. Fix: extract the shared body into a plain function both callers use.

h) Dead # renovate: annotations. .github/workflows/test.yml:127,135,147,154 (and release.yml) carry # renovate: datasource=… annotations, while tests/unit/test_ci_version_coupling.py:9-11 states they are inert because the repo is outside the org's Renovate autodiscovery scope. Fix: enrol the repo or delete the annotations.

---

Found by a cross-model red-team review of #13 @ 75e3d68 (panel: claude-opus-5, gpt-5.6-sol, glm-5.2). Scope was the whole project at PR head, judged against coding-agent-public-rules incl. code-health-check.md.
Verification: single-source — raised by one panel model with concrete evidence; NOT independently reproduced. Treat as unverified until checked.