Follow-up from the adversarial review of #1317 (tencent/hy3:free, round 1).
--emit-canary-boot-log makes TryExitAfterBootGate() return from Main with exit code 0 after the witness gate and NO host started (worker: no job engine; web api: no socket). No accidental path exists today, but a misconfigured Dokploy command: could trigger a clean-looking outage.
Expected: hard-reject the argument unless an explicit test-only env flag (e.g. PUBLYAPP_TEST_BOOT_PROBE=1) is also set, refusing to start with a plain-words cause otherwise; document it in the deployment runbook; spec: argument without the flag → boot refuses (red/green paired proof).
Part of #1309 (merged via #1317).
Follow-up from the adversarial review of #1317 (tencent/hy3:free, round 1).
--emit-canary-boot-logmakesTryExitAfterBootGate()return from Main with exit code 0 after the witness gate and NO host started (worker: no job engine; web api: no socket). No accidental path exists today, but a misconfigured Dokploycommand:could trigger a clean-looking outage.Expected: hard-reject the argument unless an explicit test-only env flag (e.g.
PUBLYAPP_TEST_BOOT_PROBE=1) is also set, refusing to start with a plain-words cause otherwise; document it in the deployment runbook; spec: argument without the flag → boot refuses (red/green paired proof).Part of #1309 (merged via #1317).