1022 B
Raw output - own created netns bindspaces
The human reported the attach-only netns lifecycle committed and authorized the next incremental Layer C change.
git diff HEAD~1..HEAD -- tractor/discovery/_bindspace.py tractor/discovery/__init__.py tests/discovery/test_bindspace.py ai/tpt-backends/03_wg_tunnel_bindspace.md
Added async open_netns() as the owned counterpart to attach_netns(). It requires a named spec, creates through pyroute2 in a shielded worker call, attaches the resulting namespace FD and yields an owned process-local BindspaceHandle.
FD closure occurs before shielded namespace removal on normal, exceptional and cancelled exits. The context never calls setns(); namespace entry remains a spawn/bootstrap responsibility.
Privileged operations are faked in tests. Ruff and lock checks passed; discovery plus message coverage passed 137 tests with 2 xpasses.