Review M3b tasks 14 to 17: accept; M3b done

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -10,9 +10,9 @@ time (M0 to M7, table in `docs/milestones.md`). M0 (measurements), M1 (workspace
 startup self-test) and M2b (sessions, the turn loop, `loopd serve`, `bxctl chat`) are done. M3 is split:
 M3a (`brokerd`'s decision path, spec `docs/specs/2026-09-18-m3a-decision-path.md`) is done and
 merged, reviewed in `docs/implementer-log.md`; its open findings (17, 18, 20, and 14, which M3b's
-first task must take) are listed there. M3b (the container runner and tools) is specified in
+first task must take) are listed there. M3b (the container runner and the four tools, `docs/specs/2026-09-22-m3b-runner.md`) is done and
-`docs/specs/2026-09-22-m3b-runner.md` (a draft for review) and planned in `docs/plans/M3b/`
+merged: tool containers run from the image `deploy/tools-image.nix` builds, checked on straylight.
-(13 tasks, all testable offline); the image and the checks on straylight are the design model's.
+M4 (`gatewayd` and Mattermost) is next to design.
 Straylight now serves Ornith as four slots over one 262,144-token pool; see
 `docs/inference-contract.md`, "Deployment change, 2026-09-20", before relying on cache behaviour.
 `docs/runbook.md` has an entry for every

docs/implementer-log.md

@@ -485,3 +485,22 @@ nothing read, and `#[allow]` forbidden), then two sessions ran out of room plann
 in one turn; a skeleton, and then a finer one with `run` as glue over small helpers, got it done.
 Every stop was a task-writing problem or a turn-size problem, not a wrong implementation.
 
+### M3b, tasks 14 to 17 — reviewed 2026-09-23 by the design model (Claude)
+
+Accepted; M3b is done. All four by Ornith, each committed on its first attempt: task 14 a pure
+move, tasks 15 and 16 with the glue given exactly, task 17 small. The given tests are unchanged;
+`make gate` prints `gate: ok` with 649 tests, the reference's count; `thread::spawn` and `as u64`
+are gone from `brokerd` and `toolkit`; `container.rs` is 374 lines and `pipes.rs` 128.
+
+On straylight with the final code (image `sha256:08dfabf0…`), every row of the first review's
+table held again, and the glob URL made one request. One behaviour to know: a shell command that
+leaves a background process (`sleep 30 &`) runs to the time limit and is then killed and removed,
+because `toolkit shell` reads its output to the end (task 05) and the container has not ended; the
+grace period of task 15 covers only a container that has.
+
+Open, low: finding 6 (`is_public` does not refuse local-use NAT64 `64:ff9b:1::/48` or 6to4
+`2002::/16` with a private IPv4 inside; neither is in use on straylight, and it has no public
+address of its own), and M3a findings 17, 18 and 20. Owner foot-guns noted by the independent review
+and not fixed: a grant path that overlaps a container path (`/bin`, `/tmp`, `/run/egress`), and a
+`home` containing `:`.
+