Take the product's name out of the cryptography

[Randolin]

The KDF salts read moxy.hatch.view.v2 — the old product name, spelled into a value that can never change. Nothing was wrong with it as a salt. What was wrong was that it looked editable: it sat in the same namespace as package aliases, storage keys and CSS selectors, all of which are ordinary mutable things a rebrand or a tidy-up would rightly update. Sooner or later somebody renames the lot in one pass, the frozen vectors go red, and the only thing between that and locking every user out of their own profile is whether the person reading the failure understands why it's there. That isn't a safeguard; it's a trap with a note on it.

The fix is categorical, not cosmetic

The meaning now lives in the constant's name, which is ordinary TypeScript and may be renamed freely. The value carries none at all — there is nothing in rzhy65722j6xubt5 that any future rename could plausibly want to touch.

All eight domain strings now live in one file, crypto/domains.ts: four KDF salts, the boop seal's HKDF info label, the match-token prefix, the persona-colour digest, and the metrics token. Three of those were ones I'd missed when first answering the question — moxy.persona.v3 feeds every creature's colour.

domains.spec.ts is the tripwire. The vector specs would also go red, but they go red the way any regression does, and a person under time pressure fixes red tests — this one says in its own failure message what the red actually means. It also rejects any value that reads as a word, so the next person to make these "meaningful" is stopped by a test rather than by luck.

Cost: 26 vectors regenerated plus the KDF fixture. Every phrase minted against the old salts now opens nothing. This is a one-time reset that is only safe because there is no production data yet — after launch it would have been impossible.

The invariant list is genuinely shorter

With the crypto decoupled, the moxy invariant stopped protecting anything, so the rest of the rename is just work: browser-storage keys, wire headers, server env vars, the runtime config filename, the build output path, the server entrypoint, systemd units, service paths, the default DB filename.

What's left is @moxy/* and the moxy- selector prefix — 260 references, zero derivations, pure cosmetics. The win isn't that they're renamed; it's that they're now safe to rename.

CLAUDE.md and the README's historical note are rewritten accordingly — the old note claimed renaming would "churn frozen crypto vectors," which is exactly what is no longer true.

The updater had to survive its own rename

The rename broke the property the unattended deploy exists for: the installed unit passes MOXY_REPO_DIR, the new update.sh read MENAGERIE_REPO_DIR with a default matching no existing box, and the first run after the pull would have cd'd into a directory that doesn't exist and stopped updating — silently, unfixable without shell access.

Three fixes, each closing a way it can wedge:

• The clone is located from the script's own path. No variable to get wrong.
• The update test compares against a commit label on the running container, not the git ref. Keying off the ref has one unrecoverable state: a run that resets the clone then dies leaves HEAD at origin/main with the old container up, so every later run reports "already up to date" while serving pre-failure code. Comparing against what is actually serving makes the updater converge on a desired state, so a half-finished run is just retried.
• git reset --hard rewrites the script underneath the shell reading it — it now hands off to the new copy exactly once, guarded against looping.

Plus the script retires the pre-rename container itself, since it holds port 8787 and would otherwise wedge the deploy behind a server nobody can update.

A box installed before the rename converges on its own within two ticks. The old moxy-sync-data volume is left untouched rather than migrated — nothing is deleted, and it can be re-mounted if its contents turn out to matter.

Also here

A guard for the copy no text-node pass can see. Three i18n misses of the same shape turned up while shipping the adoption plan — a string literal inside an interpolated ternary, invisible to Angular's marker and visible in the pseudo-locale only to someone reading a screenshot. i18n-copy.spec.ts rejects that shape and unmarked static attributes outright, and found sixteen more on its first run — in the dashboard, groups, group and menagerie pages, which the sweep, the pseudo-locale and two rounds of review had all walked past.

Verification

Full ladder green — format, both typechecks, all four unit suites, production build, and the e2e, which exercises the renamed config file, headers, env vars and dist path end to end.

Operator note: the MENAGERIE_SERVER_URL repo variable is already updated. Nothing else needs hands — see deploy/README.md → Migrating off the moxy names for what the automatic path is fixing, and what a hand-rolled install would need instead.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UaDanzXTm6kVSgbNh1eNrs

---

Generated by Claude Code