milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

src/cache/dns_cache.zig

@@ -7,7 +7,8 @@
 //! buffer and allocates nothing.
 //!
 //! **Not thread-safe.** No lock guards the slots, the index or the counters.
-//! Phase 7 decides the locking when it wires the cache into the query path.
+//! The query path owns the lock: `handler.Handler.cache_mutex` is held across
+//! every `get`, `put` and `sweep`.
 //!
 //! The store is a fixed array of slots plus a hash index from key bytes to slot
 //! number, both sized at `init` and never resized: a household resolver must
@@ -39,8 +40,8 @@ pub const max_key_len = types.max_name_len + 1 + 2 + 2 + 1 + 1 + max_ecs_len;
 
 /// Writes the cache key into `buf` and returns the written prefix.
 ///
-/// ECS participates only when the caller passes it. Phase 7 passes the
-/// forwarded subnet under `ecs_mode=forward` and nothing otherwise (PLAN §8),
+/// ECS participates only when the caller passes it. `handler.Context.cacheKey`
+/// passes the forwarded subnet under `ecs_mode=forward` and nothing else (PLAN §8),
 /// so a deployment that does not forward ECS pays no key-space split for it.
 ///
 /// The length bounds are assertions, not errors: both values reach here from
@@ -436,7 +437,8 @@ pub const DnsCache = struct {
         return copy;
     }
 
-    /// Removes every expired entry and returns how many. Phase 7 schedules it;
+    /// Removes every expired entry and returns how many. `app.maintenanceOnce`
+    /// schedules it;
     /// expiry is also enforced on access, so this only reclaims memory held by
     /// names nobody asks for any more.
     pub fn sweep(self: *DnsCache, now_s: i64) u32 {