[nick-potts]

Why

Part of untangling the core/ workspace so that pieces that change together live together, with behavior unchanged. Later agent changes then read less, break less silently and debug faster.

This batch gives each name, path and route one owner. Each fact below was spelled in two or more places, so a change to one copy could miss the others.

What changed

• T6-F3c: RestartPreventExitStatus in the daemon unit and the Internal DNS unit renders from NETWORK_CONFLICT_EXIT_STATUS and ABDICATED. The two stay separate contracts that share the value 78.
• T6-F3e: ployz-core exports the Ingress Proxy mounts, the loopback port and the bind addresses. ployzd and the Tunnel origin use them. TUNNEL_ORIGIN becomes tunnel_origin().
• T6-F4: ployz_build::capture names the captured Build directory once. The CLI writer and every Build Machine reader use it. A new test writes a capture and reads it back through the layout.
• T6-F8: ConfigDir names the files kept beside the CLI config. Its six call sites use it.
• T4-F7: installer/zfs_route.rs owns ZfsRoute. storage.rs, assess.rs and prepare.rs import it, so storage.rs no longer imports back from its own users.

Scope

• Covers five of the six fixes in chunk B. Each is its own commit.
• T6-F2 (DatasetLayout) is left out. It reaches about 14 files, merges two dataset parsers with different edge rules, and needs the ployz-verify citations updated and both volume models re-run. It is a PR of its own.
• T6-F3e covers only the facts that were spelled twice. The Tailscale and host-directory constants already have one owner, or belong to T6-F3a.

Design bets

• Stable promise. Every name here is on disk, on the wire or on a running container. The capture layout is a client-to-daemon contract. The unit text is on installed Machines. The ingress paths are on running containers. The sidecar names sit beside the user's config. The change moves where each name is spelled and keeps every string value. Table tests pin the values.
• Client-first, daemon when forced. The CLI writes and the Build Machine reads the capture layout. Both now take it from ployz_build, so they cannot drift apart. No behavior moves into the daemon.
• Machine-local authority. The ZFS route and the unit exit statuses stay decisions a Machine makes from its own facts. The change only moves the table.

No red flag is crossed.

Fix ids and decision-log text

• T6-F3c. Exit status 78 is rendered from one named const per contract, not aliased. host.rs:285 and dns/service.rs:194 write RestartPreventExitStatus=78 as a literal while core owns NETWORK_CONFLICT_EXIT_STATUS.
• T6-F3e. Ingress, tunnel and tailscale path/port constants are spelled once. ployz-core/domain/ingress.rs:17-22, domain/tunnel.rs:18,25, domain/tailscale.rs:27,34 and ployzd/ingress/caddy/trace.rs:61 spell the Ingress Proxy's container and host paths, the tunnel origin and the loopback port apart.
• T6-F4. ployz_build::capture owns the captured Build directory layout (names are a frozen wire contract). ployz/src/build/inputs.rs writes, and ployz-build/src/{received_recipe,sealed,upload,railpack,index}.rs plus ployz/src/build/local.rs read and re-spell, the capture names. ployzd/src/build/sealed.rs (RECORD) and build.rs name sealed.json a third time.
• T6-F8. ConfigDir<'a> owns the files kept beside the CLI config. config.with_file_name("<name>") is spelled in handlers/mcp/login.rs (mcp.json), cloud_login.rs (cloud.json), handlers/device.rs (device.key), handlers/store.rs (store.key), handlers/link.rs (links.json) and published/mod.rs (published/). Nothing lists them.
• T4-F7. Put the ZFS route table in a leaf module its users import. installer/storage.rs ZfsRoute, a stable distro decision table, lives in the module that consumes it, and assess.rs and prepare.rs import it from there while storage.rs imports back.

Tradeoffs

• ConfigDir call sites use an inline path-qualified call and add no use line. The ployz-verify mcp_login model cites login.rs and cloud_login.rs by line, and this keeps those lines in place.
• The Internal DNS and daemon unit statuses are not aliased to one const. They are independent contracts.

Blast Radius

No Machine behavior changes. No runtime path changes. The installer, DNS unit and Caddy config render the same text and take the same paths, and the tests below pin that. Boat is skipped per docs/agents/landing.md.

Residual. None under the Cloud security bar. Nothing here touches what Cloud can reach.

Verification

• cargo test with filters, all green. ployz-core ingress and tunnel. ployz-build lib (82 passed). ployzd installer, dns::service, ingress and build (293 passed). ployz config_dir, mcp, device, link, store, build::inputs and published (147 passed).
• cargo clippy --all-targets on ployz-core, ployz-build, ployz and ployzd is clean, and cargo fmt --check is clean.
• cargo test -p ployz-verify --lib passes (221). The login.rs and cloud_login.rs edits replace one line each, so the mcp_login citations still hold.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3df7206e-188c-4ed6-a603-50108f0ac20c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn