Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@samba/Dockerfile`:
- Around line 9-12: The Dockerfile currently installs mdnsd@testing unpinned,
which risks nondeterministic builds; update the apk add invocation to install
mdnsd with an explicit package version (e.g., mdnsd=<pkgver>-r<release> or
mdnsd=<version>@testing) instead of mdnsd@testing. Determine the exact version
to pin by querying the apk repository (apk search/info or apk policy for mdnsd)
in your build environment, then replace the mdnsd@testing token in the apk add
line with the pinned package string (keeping the repository tag if required) so
the Dockerfile’s apk add installs a specific mdnsd release for reproducible
builds.

In `@samba/rootfs/etc/s6-overlay/s6-rc.d/mdnsd/finish`:
- Line 5: The finish script currently runs the command "killall mdnsd" which
returns a non-zero exit when no mdnsd process exists; update the finish script
to make teardown tolerant by invoking killall in a way that ignores "no process"
failures (e.g., use the killall quiet flag or otherwise swallow the exit code)
so the script does not error when mdnsd is already stopped; locate the "killall
mdnsd" invocation in the finish script and change it to a tolerant form (e.g.,
quiet/silent option or append a no-fail fallback) so the overall finish step
succeeds even if mdnsd is absent.

In `@samba/rootfs/etc/s6-overlay/s6-rc.d/mdnsd/run`:
- Around line 22-25: In the s6 run script's jq block that builds the JSON
(.ports and .sambaversion), fix the invalid cut flag by replacing the `cut -F 2`
usage with the correct `cut -f 2` when extracting the second field from
`smbstatus --version`; update the command referenced in the jq string (the
`$(smbstatus --version | cut -f 2)` fragment) so the version extraction succeeds
and the JSON payload written to "${_TMP}" is valid.
- Line 7: Replace the insecure dry-run mktemp call that assigns declare -r
_TMP="$(mktemp -u -t XXXXXX).json" with an atomic creation: call mktemp (without
-u) to create the temp file and assign its path to _TMP (preserving the .json
suffix if desired), and add a trap 'EXIT' handler to remove "$_TMP" on script
exit; update any subsequent uses that write to or read from _TMP to rely on the
created file.

In `@samba/rootfs/usr/share/tempio/smb.service.gtpl`:
- Line 4: The template always falls back to 445 because the default is
hard-coded; change the port expression so it prefers .ports["445/tcp"] then
.ports["139/tcp"] before defaulting to 445. Locate the line using the index
.ports "445/tcp" | default 445 and replace its default with a nested lookup
(e.g. use index .ports "445/tcp" | default (index .ports "139/tcp" | default
445)) so configured 139/tcp is honored when 445/tcp is empty.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@samba/rootfs/usr/share/tempio/smb.conf.gtpl`:
- Around line 1-12: Replace the service-discovery style name used in the
"additional dns hostnames" template with a proper FQDN; specifically update the
line that currently reads additional dns hostnames = {{ env "HOSTNAME"
}}._smb._tcp.local to use a hostname FQDN such as {{ env "HOSTNAME" }}.local (or
another valid domain), i.e. adjust the template expression for the "additional
dns hostnames" key to emit a standard DNS hostname rather than the DNS‑SD
service name; keep mdns/._smb._tcp service announcements handled by the
mdnsd/.service templates instead.

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@samba/DOCS.md`:
- Line 134: The heading "## Network Ports" should use sentence-style
capitalization; update the heading text in DOCS.md from "## Network Ports" to
"## Network ports" so it matches the project's heading capitalization
guidelines.
- Line 137: Replace the quoted UI string "Connect to server..." with a bolded UI
string **Connect to server...** in the DOCS.md text so it follows the project
guideline of using bold for UI strings; ensure you remove the double quotes and
wrap the phrase with double asterisks exactly as used elsewhere in docs.
- Around line 119-121: Replace the phrase "very old legacy" with "legacy" in the
NetBIOS paragraph and rewrite the NOTE sentence to a direct, concise statement
(e.g., "This setting is enabled by default for compatibility; disable it on
modern installations.") so the NetBIOS section reads authoritatively and follows
Microsoft Style Guide guidance.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@samba/DOCS.md`:
- Around line 130-133: The docs incorrectly mark the `allow_hosts` option as
"required" while the example shows a default value; update the heading and
description for `allow_hosts` (the "### Option: `allow_hosts`" section) to
indicate it is optional and document the default (e.g., "optional (default:
...)"/"optional — default: ...") and adjust the text to say "List of
hosts/networks allowed to access the shared folders. If omitted, defaults to
<default_value>." Ensure the label and description consistently reflect it is
not required.

---

Nitpick comments:
In `@samba/DOCS.md`:
- Around line 136-140: Rewrite the paragraph as a task-first, imperative
instruction: start with the goal "To connect after changing ports," then give
the action and location — e.g., "To connect after changing ports, in Finder open
Connect to server... (⌘ + K) and enter smb://<hostname>:<port>/<sharename>."
Ensure the note about Finder's Network browser limitation is included as a brief
follow-up sentence (e.g., "Note: Finder's Network location browser cannot access
shares on non-default ports"), and keep the protocol example string exactly as
shown: smb://<hostname>:<port>/<sharename>.