review E: follow-up review docs/30 (R1-R9) - #66

…rtable run names, cancel lifetime, conversion ownership, numeric domains, rewrite coverage, audit acceptance, nested reservations, main-thread stack

Code review E (docs/30_code_review_2026-09-08.md, findings R1 to R9) plus the
cleanup notes on model identity and the MBR worker's empty outputs.

R1. Enabling DeepLC fine-tuning with its own defaults was rejected at load,
because finetune_batch = 0 is the documented automatic batch size and review A's
validation demanded a positive batch. Only the epoch count is bounded now.

R2. run-experiment --run-names accepted `a` and `a.`, one directory on Windows,
and the second run overwrote the first with exit 0. Names ending in a dot or a
space, containing <>:"|?* or a control character, or naming a Windows reserved
device are rejected on every platform before anything is written.

R3. A desktop stop could sweep temporary files that belonged to the next run in
the same folder: the sweep ran after the reservation was released, and a stop on
a finished run swept too. Cancellation is intent and kill only, inert once the
run is terminal, and holds the pid lock across the kill; the waiter retires the
pid under that lock, sweeps, then releases, so a stop still killing finishes
before the folder changes hands. The progress thread writes only while active.

R4. Two searches converting the same vendor file concurrently shared one
temporary output and one could publish the other's bytes. Each conversion writes
a unique partial file under a lock beside the destination; a concurrent
converter waits and reuses the result; a lock whose holder stopped writing for
fifteen minutes is broken.

R5. Domain checks for the numeric settings review A left unchecked, with the
boundaries tested as accepted.

R6. The fine-tune and re-prediction worker zipped predictions with peptidoforms
without checking the count and silently kept the imported iRT for anything it
did not predict. A count mismatch is an error; rows keeping their imported value
are counted in <lib_out>.summary.json and the engine warns when there are any.
Rows are not dropped: candidate_id is the contiguous index the fragment table
references, and renumbering both tables for a rare event is a worse risk.

R7. The audit's reported flag repeated the precursor gate; it follows the
rejection reason now, a decoy past both gates is REMOVED_DURING_REPORTING, and a
present precursor_q column of the wrong type is an error rather than a fallback.

R8. The desktop reservation compared exact folders only; ancestors and
descendants of an active folder are refused, siblings are not.

R9. The Windows debug binary overflowed its 1 MiB main-thread stack on
--version. The CLI runs on a thread with a 256 MiB reservation, and
tests/cli_version.rs runs the built binary.

Model identities carry the installed DeepLC and MS2PIP versions. With nothing to
transfer the MBR worker writes a full-schema empty transfer table and the
requested augmented scored table unflagged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>