M3b plan: follow-up tasks 14 to 17 for the review's lower findings

14 moves the pipe handling out of container.rs (a pure move, replayed on its
own); 15 starts threads with Builder and bounds output collection with a 2 s
grace period; 16 escapes container errors in the log and fixes two texts; 17
fixes toolkit's thread start, casts and the egress-proxy form. Each checked
against a reference, which is not kept. Tips T24 to T26 from this run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/plans/M3b/14-brokerd-pipes-module.md

@@ -0,0 +1,63 @@
+# M3b task 14: move the pipe handling into its own module
+
+**Branch:** `m3b` (run `git switch m3b`; `git status --short` must be empty, otherwise stop)
+**Commit subject:** `brokerd: move the container's pipe handling into pipes.rs`
+
+## Goal
+
+`container.rs` is 432 lines, and the next two tasks add to the pipe handling. Before they do, move
+that code into its own file, **without changing what it does**. This is a pure move: every test
+passes before and after, unchanged.
+
+## Files
+
+- Create: `crates/brokerd/src/pipes.rs`
+- Modify: `crates/brokerd/src/container.rs`, `crates/brokerd/src/lib.rs`, `docs/implementer-log.md`
+- No test files change.
+
+## What moves
+
+From `container.rs`, cut these three items, **bodies unchanged**, and paste them into `pipes.rs`:
+
+1. `struct Io { … }` (the three `JoinHandle` fields) → `pub(crate) struct Io`.
+2. `impl Io { fn start(…) … fn finish(…) … }` → the same, with `pub(crate) fn start` and
+   `pub(crate) fn finish`.
+3. `fn read_capped(…)` → `pub(crate) fn read_capped`.
+
+Their doc comments move with them. `pipes.rs` starts with a module doc comment:
+
+```rust
+//! The three pipes of one container: its arguments go in on standard input, its output and errors
+//! come back, each on its own thread so no pipe can block another.
+```
+
+and the `use` lines those items need (`std::io::{Read, Write}`, `std::process::Child`,
+`std::thread::JoinHandle`). `Io::start` uses `STDERR_KEPT`: leave that constant in `container.rs`
+(the tests import it from there) and write `crate::container::STDERR_KEPT` in `pipes.rs`.
+
+In `lib.rs`: `pub mod pipes;`, between `pub mod ledger;` and `pub mod podman;`.
+
+In `container.rs`: add `use crate::pipes::Io;`, and remove the `use` lines the compiler then says
+are unused. Nothing else in `container.rs` changes.
+
+## Steps
+
+- [ ] **1. Branch.** `git switch m3b`.
+- [ ] **2. Move the three items** as above. Run `cargo fmt --all`.
+- [ ] **3. Check it builds.** `cargo check -p brokerd`, then
+  `cargo clippy -p brokerd --all-targets -- -D warnings`. Fix only imports.
+- [ ] **4. See every test pass, unchanged.**
+  `cargo test -p brokerd --test container --test container_egress --test serve_runner`. Expected:
+  11, 6 and 2 passed.
+- [ ] **5. Check it moved.** `grep -n "struct Io\|fn read_capped" crates/brokerd/src/container.rs`
+  prints nothing; `wc -l crates/brokerd/src/container.rs` is under 380.
+- [ ] **6. Run the gate.** `make gate`. Expected last line: `gate: ok`.
+- [ ] **7. Log and commit.** `git add crates/brokerd docs/implementer-log.md Cargo.lock && git commit`
+
+## Done when
+
+- `container.rs` no longer holds `Io` or `read_capped`; `make gate` prints `gate: ok`.
+
+## Stop and report if
+
+- Any test fails after the move: a pure move cannot break one, so report instead of changing code.