batch09-token.sh drives the request shapes against a running stack, which is
where the interesting part of b25aee3 lives: handler_test.go proves each shape
in-process, but it cannot show which form a real client picks, and that is the
whole reason the commit exists.
What driving real clients turned up, now encoded in the script's comments so a
re-run re-checks it:
* Docker 29.7.2 and skopeo 1.22.2 use the GET form even holding a credential
helper secret, and take two token requests for a pull with no 401 retry —
so neither exercises the POST path at all.
* containerd 2.3.3 does POST, and gets 200. That is the client b25aee3 was
written for, and the only one here that would have eaten the old 405.
* There is no anonymous branch in the handler at this branch; anonymous GET
is a 401. The anonymous path arrives with val/10-anonpull, so the plan's
"anonymous pull is GET-only" note describes a later batch.
seed-legacy-devices.go reproduces the day-one production devices table for the
08121f3 check: every row legacy, the real device inserted last so it sits at
the end of the rowid-order scan. Measured here at 200 rows: 7.83s first auth,
backfilled, 0.006s second. It is build-tagged `ignore` so it stays out of
go build ./... while remaining go run-able.
The 9d4ad84 comment claimed the reference PDS and tranquil both answer 403
InsufficientScope for a read-only app password. Only the tranquil half is
supported: the observation is issue #26 on pds.sqrl.systems, and the reference
PDS has no read-only app passwords at all, so the branch cannot be reproduced
against one. The comment now records that provenance and the reason a wrong
guess is harmless — the classification only adds a branch, and an unrecognised
error name falls through to the 503 that shipped before it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SeaUS5AFPX9gqCahoLRMRh
