Name the thing instead of calling it a door

One word stood for several: the MCP server, one address that accepts requests,
the single way in, and the boundary a credential is validated at. Each site now
names its own sense — endpoint, entry point, the MCP server, the edge, address,
relay — or, where none of those fit, takes the word the surrounding code already
uses.

Prose and comments only, 1:1 line for line. Identifiers keep their names: CSS
classes, DOM ids, struct fields, enum variants, config values and the doc
comments that must open with the identifier they document.

LLM.md

@@ -47,7 +47,7 @@ Cluster{Name, Org, Provider, Endpoint, Nodes, NvidiaGPU, AmdGPU, Namespaces, Reg
 - **`Namespaces`** bounds a registration made with a scoped credential on a shared cluster.
   Empty means the whole cluster, which is what an org registering its own cluster gets.
 
-`registry.Reach(ctx, name) (*Bound, error)` is the only door:
+`registry.Reach(ctx, name) (*Bound, error)` is the only entry point:
 
 1. `Tenant(ctx)` — zip's full rule (validated user claim, non-empty org, under
    `MaxOrgLen`) plus one thing zip cannot know: the org becomes a KMS ref segment, so a

openapi.json

@@ -1815,7 +1815,7 @@
     },
     "/v1/k8s/pods": {
       "get": {
-        "description": "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration door wearing the name of a health check.",
+        "description": "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration endpoint wearing the name of a health check.",
         "operationId": "k8s_pods_list",
         "parameters": [
           {

ops/ops.go

@@ -1,7 +1,7 @@
 // Package ops is the /v1/k8s surface: one named, typed operation per thing this
 // deployment may do to a Kubernetes cluster, and nothing else.
 //
-// # Every op names its cluster, and Reach is the only door
+// # Every op names its cluster, and Reach is the only entry point
 //
 // Not one handler here constructs a Kubernetes client. Each one calls
 // registry.Registry.Reach with the cluster the caller named, and Reach is the

ops/pods.go

@@ -24,7 +24,7 @@ const maxLogBytes = 1 << 20
 //
 // Container ENV is deliberately absent from the projection. A pod spec carries the
 // secret material injected into it, so a read surface that returned the spec would be
-// an exfiltration door wearing the name of a health check.
+// an exfiltration endpoint wearing the name of a health check.
 //
 // Example: {"cluster":"hanzo-k8s","namespace":"acme-prod","labelSelector":"app=api"}
 // Response: {"pods":[{"namespace":"acme-prod","name":"api-7d9f-2xk","phase":"Running","node":"pool-a1","controller":"ReplicaSet/api-7d9f","images":["oci.hanzo.ai/acme/api:1.4.2"],"restarts":0}]}

ops/zipdoc_gen.go

@@ -123,7 +123,7 @@ func init() {
 		Response: json.RawMessage(`{"volumes":[{"namespace":"acme","name":"data","usedBytes":48318382080}],"nodesRead":6,"nodesTotal":6}`),
 	})
 	zip.Describe("GET /v1/k8s/pods", zip.Doc{
-		Description: "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration door wearing the name of a health check.",
+		Description: "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration endpoint wearing the name of a health check.",
 		Fields: map[string]string{
 			"PodsIn.cluster":       "Cluster is the registered cluster to read.",
 			"PodsIn.labelSelector": "LabelSelector is a Kubernetes label selector, verbatim.",
@@ -445,7 +445,7 @@ func init() {
 		Response: json.RawMessage(`{"volumes":[{"namespace":"acme","name":"data","usedBytes":48318382080}],"nodesRead":6,"nodesTotal":6}`),
 	})
 	zip.Describe("POST /k8s/pods/list", zip.Doc{
-		Description: "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration door wearing the name of a health check.",
+		Description: "Returns pods, narrowed by namespace, labels or node.\n\nOne op covers every way the fleet asks for pods: the whole-cluster sweep an\ninfrastructure board takes, the label-selected set that answers \"is this app's\nworkload up\", and the single-node set a drain needs. They were three call sites\nwith three shapes; the difference between them is which argument is set.\n\nContainer ENV is deliberately absent from the projection. A pod spec carries the\nsecret material injected into it, so a read surface that returned the spec would be\nan exfiltration endpoint wearing the name of a health check.",
 		Fields: map[string]string{
 			"PodsIn.cluster":       "Cluster is the registered cluster to read.",
 			"PodsIn.labelSelector": "LabelSelector is a Kubernetes label selector, verbatim.",

plane/plane.go

@@ -346,7 +346,7 @@ type PodsIn struct {
 
 // Pod is one pod, projected to placement, health, what it mounts and what it
 // runs. Container ENV is deliberately absent: a pod spec carries injected
-// secret material, and a read surface that returns it is an exfiltration door.
+// secret material, and a read surface that returns it is an exfiltration endpoint.
 type Pod struct {
 	Namespace  string   `json:"namespace"`
 	Name       string   `json:"name"`

registry/authz_test.go

@@ -250,7 +250,7 @@ func TestOrgHeaderWithoutPrincipalIsRefused(t *testing.T) {
 func TestClusterNameCannotEscapeItsRef(t *testing.T) {
 	// A cluster name becomes a KMS ref segment, so a name containing a separator or a
 	// parent reference would address material outside the org's own prefix. This is the
-	// one place a name is checked, and Register is the only door it comes through.
+	// one place a name is checked, and Register is the only function it arrives through.
 	for _, bad := range []string{
 		"../alpha/prod", "a/b", "prod/../../alpha", ".", "..", "-prod", "prod-",
 		"Prod", "pro d", "", strings.Repeat("p", MaxNameLen+1),

registry/registry.go

@@ -1,5 +1,5 @@
 // Package registry is the cluster registry — the core model of this app and the
-// only door to a Kubernetes apiserver in this program.
+// only way to reach a Kubernetes apiserver in this program.
 //
 // A cluster is a REGISTERED ENTITY: a name, a provider, an endpoint, a credential
 // ref in KMS, and the org that owns it. Every operation NAMES its cluster, and