# Review brief: scanner host, the code

You are reviewing the implementation of an infrastructure spec you already
reviewed six times as a design. Your output is a findings report, not an edit.
Do not modify any file.

## What to read

1. The spec: `docs/superpowers/specs/2026-10-04-scanner-host-rollout-design.md`
   (draft 6). Decisions D1-D8 in §2 are fixed owner rulings: report a mechanism
   that fails one, do not re-argue one. Your earlier design findings are in
   `CODEX-FINDINGS-SCANNER-HOST*.md` beside it.
2. The plan: `docs/superpowers/plans/2026-10-05-scanner-host-rollout.md`.
   Tasks 1-4 are what was built. Tasks 7 and 9-10 show how the module and its
   outputs are used on real boxes.
3. The code, as the branch's own changes against main. The merge-base is the
   commit the branch started from; review `git diff <merge-base>..HEAD` for:
   - `internal/clamd/clamd.go`, `clamd_test.go`
   - `infra/modules/region-host/{main,variables}.tf`, `tests/store_scanning.tftest.hcl`
   - `infra/modules/scanner-host/` (all of it: `main.tf`, `variables.tf`,
     `outputs.tf`, `scanner-init.sh.tftpl`, `files/*`, `tests/*`, `README.md`)
   - `docs/site/cli.md`, `infra/modules/README.md`, `infra/modules/region-host/README.md`
   Ignore everything that arrived from main through the merge commit.
4. Debian trixie's `clamav` 1.4.3 packaging and ClamAV 1.4.3 sources, as you
   know them or can fetch them. Earlier rounds relied on `libclamav/unzip.c`,
   `others.c`, `debian/usr.sbin.clamd`, `clamav-daemon.config.in`,
   `clamav-daemon.postinst.in`, `clamav-daemon.service.in`.

## What matters most

- **The invariant** (spec §3.2): TCP 3310 is open only while a self-test has
  passed against the clamd process running now. Trace the three units and the
  clamd drop-in through: first boot, reboot, clamd crash and auto-restart,
  explicit restart, a package upgrade (which now runs with
  `clamav-daemon/debconf` false), a freshclam signature reload, a failed
  self-test, and a direct restart of the self-test. Name any state in which the
  port is open without a passed test, or never reopens after one.
- **The first-boot script** (`scanner-init.sh.tftpl`): every failure path must
  print `SCANNER-HOST FAILED: <reason>` and exit non-zero, and READY must never
  print with the invariant unmet. Check `set -euo pipefail` and the ERR trap
  (not inherited by functions), template escaping (`${...}` is templatefile),
  the AppArmor local include and reload, the debconf freeze and its position
  relative to the package's own `clamd.conf` generation, and the copied
  `ExecStartPre` lines.
- **The self-test**: can it pass while the property it guards fails?
- **The Go change**: every consumer of `clamd.Status` after the change.
- **IAM**: least privilege on both roles; the scanner role's Deny.
- **Tests**: does each `tofu test` run and Go test pin what it claims?
- **The docs**: anything an operator following the README or `cli.md` would
  get wrong because the docs and the code disagree.
- **The acceptance checks** in plan Task 7: could any pass on a box that is
  actually wrong?

## Output format

Number findings from 13 (1-12 were the design rounds). For each: severity
(P1 blocks applying this to a live deployment, P2 should fix first, P3 nice to
have), file:line, what goes wrong concretely, and a fix. End with one line:
accept, accept with fixes, or reject.