docs: name the thing instead of calling it a door

One word stood for several: the MCP server, one address that accepts requests,
the single way in, and the boundary a credential is validated at. Doc comments
here are lifted into OpenAPI descriptions and republished on docs.hanzo.ai, so
the ambiguity was reaching customers.

Each site now names its own sense — endpoint, entry point, the MCP server, the
edge, address — or takes the word the surrounding code already uses.

Comments and prose strings only. Identifiers keep their names, including the doc
comments that must open with the identifier they document. go build ./... passes.

access_test.go

@@ -199,7 +199,7 @@ func TestAccessFailsClosedWithoutARuntime(t *testing.T) {
 
 // THE ROUTES, exactly as they were. Twenty paths across the three files; the
 // router's own spelling of a parameter differs from the mux tree's, the wire
-// path does not, and no door was added or dropped.
+// path does not, and no route was added or dropped.
 func TestAccessRoutesAreTheSameTwenty(t *testing.T) {
 	app := mounted(t)
 	want := map[string]bool{
@@ -243,12 +243,12 @@ func TestAccessRoutesAreTheSameTwenty(t *testing.T) {
 	for route := range got {
 		if !want[route] {
 			// identity.go owns the role<->user join (roles/:id/users); this census
-			// counts the ACCESS face only. A door another slice converted is not
+			// counts the ACCESS face only. A route another slice converted is not
 			// this face growing one.
 			if route == "GET /v1/o11y/roles/:id/users" {
 				continue
 			}
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }

address.go

@@ -20,7 +20,7 @@ package o11y
 // So the address travels WITH the call. The declaration verbs (claim.go) wrap
 // every op in [addressed], which puts the address the op was registered at into
 // the context, and relay reads it there. The op's body states no method and no
-// path at all, which is the honest end state: which door was knocked on is not
+// path at all, which is the honest end state: which endpoint was called is not
 // something the body decides.
 //
 // The concrete path comes from [zip.Address], the inverse of the binding zip
@@ -61,7 +61,7 @@ type addrKey struct{}
 //
 // The full address is the target's own prefix plus the declared path, the same
 // composition [claims] reads and the same one zip's registry records, so the
-// three cannot name different doors.
+// three cannot name different addresses.
 func addressed[In, Out any](on zip.OpTarget, method, path string, fn zip.TypedHandler[In, Out]) zip.TypedHandler[In, Out] {
 	pattern := on.OpScope().Prefix + path
 	template := zip.Template(pattern)

anonymous.go

@@ -12,7 +12,7 @@ package o11y
 // existing and the paths that exist were never named, so the host's exemption
 // matched nothing at all and every public op — /version, /health, the three
 // probes, sign-in, the shared-dashboard reads — was refused 403 at the unified
-// door while the standalone door served them 200. A copy of a route fact, kept
+// binary while the standalone one served them 200. A copy of a route fact, kept
 // one repo away from the routes, drifted the moment the routes moved. There is
 // one copy now and it is this one.
 //
@@ -48,7 +48,7 @@ import (
 // argument are the same spelling.
 //
 // anonymous_test.go proves every static entry below is a route Mount actually
-// registers, which is the drift that broke the unified door: a path in an
+// registers, which is the drift that broke the unified binary: a path in an
 // exemption list that no route serves.
 func Anonymous(method, path string) bool {
 	if openOps[method+" "+path] {
@@ -137,13 +137,13 @@ func publicDashboardRead(method, path string) bool {
 // project segment. Refusing it for lacking a principal it can never carry would
 // take every SDK in the field off the air.
 //
-//	POST /v1/event/{project}/envelope|store     (the ingest door a minted DSN names)
+//	POST /v1/event/{project}/envelope|store     (the ingest endpoint a minted DSN names)
 //	POST /v1/o11y/api/{project}/envelope|store  (the suffix a stock SDK appends)
 //
 // It matches by METHOD + PREFIX + SUFFIX and never by a bare prefix, so nothing
 // else on either root is reachable through it: the faces stay gated — issues,
 // discover, logs, traces, stats — and so does /v1/event itself, the product
-// event door beside this one. The trailing slash is the protocol's form; the
+// event endpoint beside this one. The trailing slash is the protocol's form; the
 // slash-less variant is tolerated defensively. Exported because the EDGE needs
 // the identical answer: the gateway waives its JWT check on exactly these, and a
 // request the gateway lets through tokenless must not then be refused here for

anonymous_test.go

@@ -38,7 +38,7 @@ var fixedExemptions = []string{
 	"PUT /v1/o11y/service_accounts/me",
 }
 
-// THE DRIFT GUARD. The unified door refused every public o11y op — /version,
+// THE DRIFT GUARD. The unified binary refused every public o11y op — /version,
 // /health, the three probes, sign-in — because the embedding host's exemption
 // list named /v1/o11y/api/v2/livez and three siblings under an internal /api/
 // namespace this module had stopped rewriting onto. Four names, zero routes,
@@ -58,7 +58,7 @@ func TestAnonymousNamesOnlyRealRoutes(t *testing.T) {
 			t.Errorf("%q is listed here but Anonymous says false — this table and anonymous.go disagree", route)
 		}
 		if !have[route] {
-			t.Errorf("Anonymous exempts %q, which Mount does not register — an exemption matching no route is how the unified door lost its public ops", route)
+			t.Errorf("Anonymous exempts %q, which Mount does not register — an exemption matching no route is how the unified binary lost its public ops", route)
 		}
 	}
 }
@@ -109,7 +109,7 @@ func TestPublicOpsAreExempt(t *testing.T) {
 }
 
 // The gate is still a gate. Telemetry is a tenant's own data; if these ever
-// answer true the door is open, which is worse than the 403 it replaced.
+// answer true the route is open, which is worse than the 403 it replaced.
 func TestTenantOpsStayGated(t *testing.T) {
 	for _, route := range []string{
 		"GET /v1/o11y/logs",
@@ -123,12 +123,12 @@ func TestTenantOpsStayGated(t *testing.T) {
 		"GET /v1/event/proj/envelope/", // ingest is a WRITE; a GET is not it
 		"POST /v1/o11y/api/v3/issues",  // a read API under the DSN prefix
 		"POST /v1/o11y/sentinel/issues",     // the face is a face, whatever the suffix
-		// The door moved off the face. The old spelling must buy nothing, or
+		// Ingest moved off the face. The old spelling must buy nothing, or
 		// the move left an unauthenticated hole where the route used to be.
 		"POST /v1/o11y/sentinel/proj/envelope/",
 		"POST /v1/o11y/sentinel/proj/store",
 		"POST /v1/o11y/api/proj/envelopes",
-		"POST /v1/event",        // the product event door is not the Sentry wire
+		"POST /v1/event",        // the product event endpoint is not the Sentry wire
 		"GET /v1/o11y/version/", // a route that does not exist is not public
 		"GET /V1/O11Y/VERSION",  // and the match is exact, never folded
 	} {

apm_test.go

@@ -266,7 +266,7 @@ func TestDomainAnswerIsTheRuntimeAnswer(t *testing.T) {
 
 // THE ROUTES, exactly the twenty-one that were behind the wildcard: five for
 // the service catalog, fourteen for the messaging queues, two for the
-// third-party overview. No more (the face grew no door) and no fewer (every
+// third-party overview. No more (the face grew no route) and no fewer (every
 // route reached the document).
 func TestAPMRoutesAreTheSameTwentyOne(t *testing.T) {
 	app := mounted(t)
@@ -309,7 +309,7 @@ func TestAPMRoutesAreTheSameTwentyOne(t *testing.T) {
 		}
 		// "/service" alone also matches /service_accounts, which is the ACCESS
 		// face (access.go), not APM's. Each slice census must count only its own
-		// doors or every slice fails the moment another one converts — the
+		// routes or every slice fails the moment another one converts — the
 		// substring was safe only while APM was the sole owner of that prefix.
 		// cloud_integrations owns /…/services too (integrations.go). Same lesson as
 		// /service_accounts: a substring is only unambiguous while one face owns it.
@@ -329,7 +329,7 @@ func TestAPMRoutesAreTheSameTwentyOne(t *testing.T) {
 	}
 	for route := range got {
 		if !want[route] {
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }

cloudintegrations_test.go

@@ -391,7 +391,7 @@ func TestBothAgentCheckInsKeepTheirOwnPath(t *testing.T) {
 // THE ROUTES, exactly the thirteen the mux registers in
 // pkg/apiserver/o11yapiserver/cloudintegration.go: eleven on the underscored
 // root, the accounts/check_in twelfth, and the hyphenated agent-check-in that
-// is its own real path. No more (the face grew no door) and no fewer (every
+// is its own real path. No more (the face grew no route) and no fewer (every
 // route reached the document).
 func TestCloudIntegrationsRoutesAreTheSameThirteen(t *testing.T) {
 	app := mounted(t)
@@ -436,7 +436,7 @@ func TestCloudIntegrationsRoutesAreTheSameThirteen(t *testing.T) {
 	}
 	for route := range got {
 		if !want[route] {
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }
@@ -546,7 +546,7 @@ func TestCloudIntegrationsRefusalKeepsTheRuntimeStatus(t *testing.T) {
 	}
 }
 
-// No runtime, no answer: ALL THIRTEEN doors of this face fail closed with the
+// No runtime, no answer: ALL THIRTEEN routes of this face fail closed with the
 // same 503 the delegation wildcard gives before a handler is registered. An op
 // that answered anything else would be answering without the gate having run.
 //

identity_test.go

@@ -132,7 +132,7 @@ func TestIdentityRoutesAreTheSameFortyFive(t *testing.T) {
 // This test used to install a host wildcard and assert the callbacks fell into
 // it. That assertion could not distinguish a deliberate hatch from a route
 // nobody had converted, which is how three unmounted slices shipped; it now
-// asserts the named door instead.
+// asserts the named route instead.
 func TestCompleteCallbacksAreNamedHatches(t *testing.T) {
 	app := mounted(t)
 
@@ -165,7 +165,7 @@ func TestCompleteCallbacksAreNamedHatches(t *testing.T) {
 		}
 	}
 
-	// ...and a typed identity op next door still dispatches as an op.
+	// ...and a typed identity op beside it still dispatches as an op.
 	runtime(t, []any{})
 	if status, body := call(t, app, member(http.MethodGet, "/v1/o11y/users", nil)); status != http.StatusOK {
 		t.Fatalf("the typed users op did not answer: status=%d %s", status, body)

infra_test.go

@@ -258,7 +258,7 @@ func TestInfraFailsClosedWithoutARuntime(t *testing.T) {
 
 // THE ROUTES, exactly the forty-four that were behind the wildcard: three per
 // resource face, ten rollups, one checks read. No more (the face grew no
-// door) and no fewer (every route reached the document).
+// route) and no fewer (every route reached the document).
 func TestInfraRoutesAreTheSameFortyFour(t *testing.T) {
 	app := mounted(t)
 	want := map[string]bool{}
@@ -284,7 +284,7 @@ func TestInfraRoutesAreTheSameFortyFour(t *testing.T) {
 	// The /list heuristic must stay inside infra's OWN resources: other faces
 	// carry /list routes too (the service catalog's /services/list, the
 	// third-party overview's .../overview/list), and a bare "/list" suffix
-	// would miscount those as infra doors. Scope it to the eleven resources the
+	// would miscount those as infra routes. Scope it to the eleven resources the
 	// want-set is built from, so any other face's /list route is ignored here.
 	infraList := map[string]bool{}
 	for _, r := range []string{
@@ -300,12 +300,12 @@ func TestInfraRoutesAreTheSameFortyFour(t *testing.T) {
 		}
 		if strings.HasPrefix(r.Path, "/v1/o11y/") && !strings.HasSuffix(r.Path, "*") &&
 			// query-core's autocomplete/auto_complete routes carry attribute_* in
-			// their paths too, and they are NOT infra doors — without this exclusion
+			// their paths too, and they are NOT infra routes — without this exclusion
 			// the census counts them and the 44-route assertion drifts.
 			!strings.Contains(r.Path, "auto") &&
 			// "/list" alone also matches /services/list (apm face) and
 			// /third-party-apis/overview/list (apm face). Each slice census counts
-			// only its OWN doors — a bare suffix was safe only while infra was the
+			// only its OWN routes — a bare suffix was safe only while infra was the
 			// sole owner of it. The explicit infraList literal is the real anchor.
 			!strings.HasPrefix(r.Path, "/v1/o11y/services") &&
 			!strings.Contains(r.Path, "third-party-apis") &&
@@ -325,7 +325,7 @@ func TestInfraRoutesAreTheSameFortyFour(t *testing.T) {
 	}
 	for route := range got {
 		if !want[route] {
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }

logs_test.go

@@ -464,7 +464,7 @@ func TestLogsRoutesAreTheSameNine(t *testing.T) {
 		"POST /v1/o11y/logs/promote_paths":     true,
 		"GET /v1/o11y/logs/promote_paths":      true,
 
-		// The tenth door: a NAMED hatch, not a typed op and not a fall-through.
+		// The tenth route: a NAMED hatch, not a typed op and not a fall-through.
 		// It is in this census precisely because it is registered — a hatch that
 		// stops being registered is a 404 now, and this is what catches that.
 		"GET /v1/o11y/logs/livetail": true,
@@ -482,7 +482,7 @@ func TestLogsRoutesAreTheSameNine(t *testing.T) {
 	}
 	for route := range got {
 		if !want[route] {
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }
@@ -491,7 +491,7 @@ func TestLogsRoutesAreTheSameNine(t *testing.T) {
 // stream that never completes cannot be a buffered typed op. It reaches the
 // runtime through its OWN named route now, bytes untouched — a typed relay would
 // have choked on a non-JSON stream frame, so verbatim arrival IS the proof of
-// the door it went through.
+// the route it went through.
 func TestLivetailIsANamedHatch(t *testing.T) {
 	app := mounted(t)
 	frame := "event: log\ndata: {\"body\":\"boom\"}\n\n"

metrics/mount.go

@@ -6,7 +6,7 @@
 // This code was github.com/hanzoai/metrics, whose NOTICE names this module its
 // successor. It arrived here whole — store, WAL, ZAP receiver, routes, tests —
 // because a retired module cannot hold running code: the succession was declared
-// while cloud still imported the archive, so the door and its store moved to the
+// while cloud still imported the archive, so the routes and their store moved to the
 // live module rather than leaving a read-only repository load-bearing.
 //
 // One store serves all three signals — metrics, logs, traces — and every route

metrics_test.go

@@ -298,11 +298,11 @@ func TestMetricsRoutesAreTheSameNineteen(t *testing.T) {
 		if !want[route] {
 			// platform.go owns the OLDER /metric/metric_metadata route (legacy
 			// path, service-scoped input) — a different op from this face's
-			// /metrics/metadata. Another slice's door is not this face growing one.
+			// /metrics/metadata. Another slice's route is not this face growing one.
 			if route == "GET /v1/o11y/metric/metric_metadata" {
 				continue
 			}
-			t.Errorf("%s is registered and was not declared — the face grew a door", route)
+			t.Errorf("%s is registered and was not declared — the face grew a route", route)
 		}
 	}
 }

mount.go

@@ -217,7 +217,7 @@ func mountHatches(app *zip.App) {
 	// the caller is a Sentry SDK authenticating with a DSN public key rather
 	// than a Hanzo session.
 	//
-	// SO IT ANSWERS ON THE INGEST DOOR, NOT UNDER A PRODUCT'S ROOT (relay.go).
+	// SO IT ANSWERS AT THE INGEST ENDPOINT, NOT UNDER A PRODUCT'S ROOT (relay.go).
 	// eventRoot is what a minted DSN spells, so a beacon has exactly one address
 	// to knock on and the face beside it keeps its own gate.
 	//
@@ -225,8 +225,8 @@ func mountHatches(app *zip.App) {
 	// /api/<project>/envelope/ suffix to whatever DSN path it is given, so
 	// renaming it would break every SDK in the field. We RECEIVE this shape; we
 	// do not publish it.
-	route(app, http.MethodPost, eventRoot+"/:project/envelope/")       // the door a minted DSN names
-	route(app, http.MethodPost, eventRoot+"/:project/store/")          // the same door, single-event form
+	route(app, http.MethodPost, eventRoot+"/:project/envelope/")       // the endpoint a minted DSN names
+	route(app, http.MethodPost, eventRoot+"/:project/store/")          // the same endpoint, single-event form
 	route(app, http.MethodPost, o11yRoot+"/api/:project_id/envelope/") // the suffix a stock SDK appends
 	route(app, http.MethodPost, o11yRoot+"/api/:project_id/store/")    // the same suffix, single-event form
 }

pkg/apiserver/o11yapiserver/provider.go

@@ -275,7 +275,7 @@ func (provider *provider) AddToRouter(router routing.Router) {
 	provider.addLLMPricingRuleRoutes(router)
 	provider.addLLMObsRoutes(router)
 	provider.addErrorTrackingRoutes(router)
-	// Hanzo Sentry: the /v1/o11y/sentinel product face and the /v1/event ingest door.
+	// Hanzo Sentry: the /v1/o11y/sentinel product face and the /v1/event ingest endpoint.
 	provider.addSentryRoutes(router)
 	provider.addTraceDetailRoutes(router)
 	provider.addRulerRoutes(router)

pkg/apiserver/o11yapiserver/routes_test.go

@@ -57,8 +57,8 @@ const wantAPIServerRoutes = 233
 
 // every handler field satisfied by an embedded nil interface: the route table is
 // a fact about REGISTRATION, and registration only takes method values off these
-// — it never calls one. Standing up 33 real modules to count doors would test
-// the modules, not the doors.
+// — it never calls one. Standing up 33 real modules to count routes would test
+// the modules, not the routes.
 func censusProvider() *provider {
 	return &provider{
 		authzMiddleware:            middleware.NewAuthZ(slog.Default(), nil, nil),
@@ -122,7 +122,7 @@ func TestEveryAPIServerRouteIsRegistered(t *testing.T) {
 	}
 
 	// Every route answers on one of the three public roots — the two faces and
-	// the ingest door — and carries no leftover spelling from the tree this
+	// the ingest endpoint — and carries no leftover spelling from the tree this
 	// replaced.
 	for _, route := range table {
 		switch {

pkg/apiserver/o11yapiserver/sentry.go

@@ -22,13 +22,13 @@ import (
 //   - The FACE, /v1/o11y/sentinel — Hanzo Sentry, the Sentry-parity product read by a
 //     signed-in person: projects, issues, discover, events, logs, traces, stats. Hanzo
 //     IAM authz, every one scoped to the caller's org from the validated claims.
-//   - The DOOR, POST /v1/event/{project}/envelope/ and /store/ — a keyed beacon. It is
+//   - INGEST, POST /v1/event/{project}/envelope/ and /store/ — a keyed beacon. It is
 //     the address a minted DSN spells (implsentry's mintDSN), so the address a client
 //     is told and the address this router opens are one string. OpenAccess (no IAM):
 //     a Sentry SDK presents a DSN key, not a Hanzo session; the handler verifies that
 //     key against the project's rotation watermark.
 //
-// ONE WIRE, ONE PUBLIC ADDRESS. The door used to sit under the face's root as well,
+// ONE WIRE, ONE PUBLIC ADDRESS. Ingest used to sit under the face's root as well,
 // which put one wire at two addresses and put an unauthenticated write inside a
 // principal-gated subtree — so the face's gate had to carry an exemption shaped like
 // the ingest paths, and the exemption is what anything under that root had to be
@@ -155,7 +155,7 @@ func (provider *provider) addSentryRoutes(router routing.Router) {
 		router.Handle(rt.method, rt.path, handler.New(rt.fn, rt.def))
 	}
 
-	// INGEST — the door, on its own root, UUID-constrained project segment.
+	// INGEST — on its own root, UUID-constrained project segment.
 	ingestRoutes := []struct {
 		path string
 		fn   http.HandlerFunc

pkg/http/routing/routing.go

@@ -58,8 +58,8 @@ type Chain func(defs []handler.ResourceDef) func(http.Handler) http.Handler
 // and the handler that answers it.
 //
 // Handler is the WHOLE answer — the chain composed around the leaf, not the bare
-// body underneath it. A route's handler is what happens when you knock on that
-// door, and the audit record, the timeout and the resource resolution are part of
+// body underneath it. A route's handler is what happens when a request arrives
+// at it, and the audit record, the timeout and the resource resolution are part of
 // what happens. Recording the bare one would make the census describe a route
 // nobody can reach.
 type Route struct {
@@ -162,7 +162,7 @@ func (r Router) Group(prefix string) Router {
 // brace spelling; the Router respells it for the router and records it verbatim.
 //
 // A duplicate registration PANICS. Registration runs once, at boot, from a fixed
-// list of literals — a second route at the same door is a mistake in the source,
+// list of literals — a second route at the same address is a mistake in the source,
 // not a condition a running server can encounter, and the router that used to
 // hold these silently let the first one win.
 func (r Router) Handle(method, path string, h http.Handler) Router {

pkg/http/routing/routing_test.go

@@ -85,7 +85,7 @@ func TestTableAndRouterAgree(t *testing.T) {
 func TestDuplicateRegistrationPanics(t *testing.T) {
 	defer func() {
 		if recover() == nil {
-			t.Fatal("a second registration at the same door did not panic")
+			t.Fatal("a second registration at the same address did not panic")
 		}
 	}()
 	app := zip.New(zip.Config{DisableStartupMessage: true})
@@ -127,7 +127,7 @@ func TestRouteValuesReachTheHandler(t *testing.T) {
 // would do it SILENTLY: an audit record keyed on "" is still a record, and
 // Param("id") returning "" is still a string. Nothing would go red.
 //
-// So both doors are driven here, against one registration, and compared to each
+// So both paths are driven here, against one registration, and compared to each
 // other. Comparing them to a written-down expectation would pin what someone
 // believed; comparing them to each other pins what the seam promises.
 func TestByNameCarriesTheSameRouteAsMatching(t *testing.T) {

pkg/modules/sentry/implsentry/dsn.go

@@ -11,7 +11,7 @@ import (
 //
 //	https://<version>:<hmac>@<host>/v1/event/<projectID>
 //
-// THE INGEST DOOR IS /v1/event, and it is the same door the product event stream
+// THE INGEST ADDRESS IS /v1/event, the same one the product event stream
 // uses. @hanzo/event derives its ingest URL from the DSN's OWN path — base plus
 // /envelope/ — so this line decides where every reporting client posts, and it is
 // the one place the server states it.

pkg/modules/sentry/implsentry/dsn_test.go

@@ -25,8 +25,8 @@ func TestMintDSN_ShapeAndVerify(t *testing.T) {
 	dsn := mintDSN(secret, "api.hanzo.ai", proj, 1)
 	// CLEAN path — no /api/ segment.
 	assert.True(t, strings.HasPrefix(dsn, "https://"))
-	// THE INGEST DOOR, not the product face. A DSN addresses /v1/event — the one
-	// door every beacon lands on — while /v1/o11y/sentinel is where a signed-in person
+	// THE INGEST ADDRESS, not the product face. A DSN addresses /v1/event — the one
+	// address every beacon lands on — while /v1/o11y/sentinel is where a signed-in person
 	// reads issues back. A DSN minted on the face would send the error plane to a
 	// second public spelling of one wire, which is the whole reason they converged.
 	assert.Contains(t, dsn, "@api.hanzo.ai/v1/event/"+proj.String())

pkg/modules/sentry/implsentry/module.go

@@ -131,7 +131,7 @@ func (m *module) ResolveIngest(ctx context.Context, projectID valuer.UUID, prese
 	// A project that already exists and has been disabled stops accepting ingest,
 	// which is what disabling one is for and what ProjectStatus documents. Only an
 	// existing row can say this: a project unseen until now is provisioned active
-	// just below, and a store that cannot answer must not silently open the door.
+	// just below, and a store that cannot answer must not silently admit ingest.
 	if _, _, status, found, err := m.projects.Resolve(ctx, projectID); err == nil && found &&
 		status != sentrytypes.ProjectActive {
 		return valuer.UUID{}, false

pkg/modules/sentry/sentry.go

@@ -64,7 +64,7 @@ type Module interface {
 
 // Handler is the HTTP surface of Hanzo Sentry: the product face under /v1/o11y/sentinel,
 // behind Hanzo IAM authz and org-scoped from the validated claims, plus the ingest
-// door under /v1/event, which is PUBLIC and DSN-authenticated in-handler.
+// endpoint under /v1/event, which is PUBLIC and DSN-authenticated in-handler.
 type Handler interface {
 	// Ingest (public, DSN-auth): POST /v1/event/{project}/envelope|store/.
 	EnvelopeIngest(http.ResponseWriter, *http.Request)

pkg/query-service/app/publish_test.go

@@ -73,7 +73,7 @@ func operations(t *testing.T, doc map[string]any) int {
 }
 
 // mcpTools counts the tools the router offers, read the way an MCP client reads
-// them: a tools/list over the served door.
+// them: a tools/list over the served MCP endpoint.
 //
 // It used to be len(app.MCPTools()) — an in-process accessor on the app the test
 // had just built, which is the shape of proof this file exists to reject. The
@@ -127,7 +127,7 @@ func TestPublishServesTheDocument(t *testing.T) {
 }
 
 // The three public roots this service answers on — two faces and the ingest
-// door. Named here so the assertion and the message cannot disagree about what
+// endpoint. Named here so the assertion and the message cannot disagree about what
 // "o11y's surface" means.
 const (
 	o11yRootPath     = "/v1/o11y"
@@ -137,7 +137,7 @@ const (
 
 // Every operation the document publishes is o11y's own surface. A host that
 // mounts this table is publishing these paths under its own name, so a path that
-// is not ours would be this service claiming someone else's door.
+// is not ours would be this service claiming someone else's address.
 func TestPublishedDocumentIsO11ysSurface(t *testing.T) {
 	app := zip.New(zip.Config{DisableStartupMessage: true})
 	if err := publish(app); err != nil {

pkg/query-service/app/server.go

@@ -323,13 +323,13 @@ func (s *Server) createPublicServer(api *APIHandler, web web.Web) (*zip.App, err
 // AN APP OF ITS OWN IS THE POINT, and it is what zip v1.23 forced. The
 // declaration and the implementation describe THE SAME 367 ADDRESSES, and one
 // address may now have exactly one definition: Build refuses a program where two
-// claim the same door, naming both claimants. That rule is right — for a
+// claim the same address, naming both claimants. That rule is right — for a
 // composition, where two claimants means one of them is silently dead. Here
 // neither is dead and neither is a mistake: the implementation SERVES the
 // address and the declaration DESCRIBES it, which is a distinction zip has no
 // way to spell (typed.go: "the route and the op are the same fact recorded
-// once"). So the two facts go on two apps. The service's app holds the doors;
-// this app holds the description of them, and never claims a door on the
+// once"). So the two facts go on two apps. The service's app holds the routes;
+// this app holds the description of them, and never claims an address on the
 // listener.
 //
 // That also makes the old ORDER IS THE CONTRACT structural rather than
@@ -341,7 +341,7 @@ func (s *Server) createPublicServer(api *APIHandler, web web.Web) (*zip.App, err
 // pinned by one test. Now the declaration is not on the listener at all, so
 // there is no order to get wrong.
 //
-// Build is what turns the in-memory registry into doors, and it RETURNS THE
+// Build is what turns the in-memory registry into routes, and it RETURNS THE
 // VERDICT — which is why it replaced zip's Prepare at v1.23. Prepare's silence
 // meant an invalid program started anyway and its routes were simply missing.
 func declaration() (*zip.App, error) {
@@ -362,7 +362,7 @@ func declaration() (*zip.App, error) {
 // Only the projections. The declaration's 353 ops answer on ITS app, and the
 // five paths below are the only ones that cross over — zip calls them CONTROL
 // routes, keeps them off the walk and excludes them from a Declaration, because
-// they are projections of the app rather than doors its owner wrote. None of
+// they are projections of the app rather than routes its owner wrote. None of
 // them is one of this service's 367, so nothing here can shadow a handler and
 // nothing here can be shadowed by one.
 //

pkg/zapreceiver/uds_test.go

@@ -47,7 +47,7 @@ func TestListenOnAPathBindsASocket(t *testing.T) {
 
 // A host:port still binds TCP, so the off-pod senders that must keep reaching
 // this receiver — the otel agent on every node, the gateway, another cluster
-// through the otlz door — are unaffected. The socket is ADDITIVE.
+// through the otlz endpoint — are unaffected. The socket is ADDITIVE.
 func TestListenOnAPortStillBindsTCP(t *testing.T) {
 	r, err := zapreceiver.New(zapreceiver.Config{
 		Listen:  "127.0.0.1:0",

reach_test.go

@@ -22,7 +22,7 @@ package o11y_test
 // shape — adaptor.FiberApp over a runtime that routes, which is exactly what
 // Server.PublicHandler() returns and what the host installs — against a runtime
 // that serves every one of those paths. Any 404 is a request that never reached
-// the runtime, i.e. a lost door. There is no way to add a sixth relay body with
+// the runtime, i.e. a lost route. There is no way to add a sixth relay body with
 // this defect and keep this test green.
 
 import (
@@ -99,7 +99,7 @@ func routingRuntime(t *testing.T, patterns map[string]bool) (seen *[]string) {
 // The assertion is on 404 alone. Every other status proves the request ARRIVED
 // — a 400 from input validation, a 500 from decoding a stand-in body into a
 // typed Out, a 401 from the gate — and this file is only ever about whether the
-// door opens onto anything.
+// route resolves to anything.
 func TestEveryRouteReachesTheRuntime(t *testing.T) {
 	app := mounted(t)
 	patterns := registered(t, app)

relay.go

@@ -30,7 +30,7 @@ package o11y
 //
 // So the address is stated once, at the registration, and travels with the call
 // (see claim.go's addressed). relay takes no method and no path: it reads the
-// address of the door that was knocked on, which is a fact about the call and
+// address the request arrived at, which is a fact about the call and
 // not a decision this function makes. The 119 hand-built paths are gone with it —
 // zip.Address renders the concrete one from the same input zip bound the segments
 // into, so the round trip is exact by construction.
@@ -80,9 +80,9 @@ import (
 
 // The three public roots this package answers on, each spelled ONCE.
 //
-// Two of them are FACES and one is a DOOR, and that is the whole reason there
+// Two of them are FACES and one is INGEST, and that is the whole reason there
 // are three. A face is read by a signed-in person and answers about what is
-// already stored; a door is knocked on by a keyed beacon that holds no session
+// already stored; ingest is called by a keyed beacon that holds no session
 // and carries something in. Different nouns, different callers, different
 // credentials — so the same wire does not get to answer at both.
 //
@@ -91,9 +91,9 @@ import (
 //     console calls.
 //   - sentinelRoot is the error-tracking face: projects, issues, occurrences,
 //     discover and the event-rate stats.
-//   - eventRoot is the ingest door. It is the address a minted DSN spells
-//     (implsentry's mintDSN), so the door a client is TOLD about and the door
-//     this service OPENS are one string.
+//   - eventRoot is the ingest endpoint. It is the address a minted DSN spells
+//     (implsentry's mintDSN), so the address a client is TOLD about and the one
+//     this service SERVES are one string.
 const (
 	o11yRoot     = "/v1/o11y"
 	sentinelRoot = "/v1/o11y/sentinel"
@@ -146,7 +146,7 @@ func relay(ctx context.Context, params url.Values, body, out any) error {
 	// The in-process case no longer depends on it — nothing matches this path any
 	// more, because the handler was chosen by name. It stays for the case that
 	// still does: a runtime in ANOTHER process is reached through [Whole], and
-	// behind that one door is a proxy that has to forward a request-target. It is
+	// behind that one address is a proxy that has to forward a request-target. It is
 	// also the field a middleware logs, and a blank one there reads as a lost
 	// request.
 	//
@@ -156,7 +156,7 @@ func relay(ctx context.Context, params url.Values, body, out any) error {
 	// r.RequestURI into the fasthttp request verbatim — so an empty one erased the
 	// path, fasthttp normalized it to "/", no API route matched, and the request
 	// fell through to the console web provider, which answers http.NotFound. That
-	// is why the unified door answered every relayed op
+	// is why the unified binary answered every relayed op
 	//   404 {"status":404,"error":"404 page not found"}
 	// — /version, /health, /global/config, /users/me, all 353 typed ops — while
 	// the standalone runtime served the identical paths 200.

relay_test.go

@@ -13,7 +13,7 @@ package o11y_test
 // r.RequestURI into fasthttp verbatim. With RequestURI empty the path was
 // erased, fasthttp normalized it to "/", no API route matched, and the request
 // fell through to the console web provider's http.NotFound. Every relayed op
-// answered 404 {"status":404,"error":"404 page not found"} at the unified door
+// answered 404 {"status":404,"error":"404 page not found"} at the unified binary
 // while the standalone served the same paths 200.
 //
 // So this test installs the REAL wrapper rather than a stand-in. A fake that is

routes_test.go

@@ -33,7 +33,7 @@ func registered(t *testing.T, app *zip.App) map[string]bool {
 }
 
 // assertRoutes proves a slice registered EXACTLY its own routes under prefix —
-// no more, no fewer, at the same methods. Each slice counts only its own doors,
+// no more, no fewer, at the same methods. Each slice counts only its own routes,
 // so a slice that stops being mounted fails here rather than being quietly
 // answered by something else.
 func assertRoutes(t *testing.T, want map[string]bool, prefix string) {

runtime.go

@@ -11,7 +11,7 @@ package o11y
 // It used to be ONE HANDLER FOR EVERYTHING. A host installed the runtime's whole
 // public surface as a single http.Handler and every op spoke HTTP to it: build a
 // request at the op's path, hand it over, let the runtime's router MATCH that
-// path and dispatch. Which means the declaration knew exactly which door it
+// path and dispatch. Which means the declaration knew exactly which route it
 // wanted, threw the address away, and paid a router to find it again — inside the
 // same process, through an httptest recorder, across a net/http↔fasthttp bridge,
 // 353 times over.
@@ -36,7 +36,7 @@ package o11y
 // address to handler — read as one. The standalone server hands over its own
 // table; the composed cloud binary hands over the embedded runtime's; a host
 // whose runtime is in another process hands over [Whole], because for a remote
-// every address really does resolve to the same door.
+// every address really does resolve to the same handler.
 
 import (
 	"net/http"
@@ -73,7 +73,7 @@ type Func func(method, path string) http.Handler
 func (f Func) Handler(method, path string) http.Handler { return f(method, path) }
 
 // Whole is a Runtime whose every address is the same handler — the honest shape
-// for a runtime that is somewhere ELSE. A reverse proxy has one door and the
+// for a runtime that is somewhere ELSE. A reverse proxy has one address and the
 // request's own path is what selects the route on the other side, so there is
 // nothing to resolve here and pretending otherwise would be a lie with a map in
 // it.

runtime_test.go

@@ -262,7 +262,7 @@ func TestFuncResolvesAndComposes(t *testing.T) {
 		t.Fatal("a served address did not resolve through the Func")
 	}
 	// An address the inner runtime does not serve stays unserved: a decorator has
-	// no opinion about a door that is not there.
+	// no opinion about an address that is not there.
 	if rt.Handler(http.MethodGet, "/v1/o11y/nothing") != nil {
 		t.Error("an unserved address resolved through the Func")
 	}

sentryerrors.go

@@ -36,7 +36,7 @@ package o11y
 // The FOUR ingest routes — POST /v1/event/{project}/envelope|store/ and POST
 // /v1/o11y/api/{project}/envelope|store/ — are the deliberate escape hatches,
 // NOT typed here and not on this face at all: ingest is a keyed beacon and a
-// face is read by a person, so the door has its own root (relay.go's eventRoot,
+// face is read by a person, so ingest has its own root (relay.go's eventRoot,
 // the address a minted DSN spells). They are OpenAccess (a Sentry SDK presents a DSN key,
 // not a Hanzo session) and carry an OPAQUE Sentry-envelope body — a foreign wire
 // protocol we receive verbatim, like /.well-known. A typed relay JSON-encodes

telemetry_test.go

@@ -321,11 +321,11 @@ func TestProjectIsMandatory(t *testing.T) {
 // THE ROUTES, exactly as they were. Five paths, five methods; the router's own
 // spelling of a parameter differs from the mux tree's, the wire path does not.
 //
-// THE FACE CARRIES NO INGEST. The two ingest doors used to land in this census
+// THE FACE CARRIES NO INGEST. The two ingest routes used to land in this census
 // as well, and that is the shape this asserts against coming back: an
 // unauthenticated write registered inside a principal-gated subtree means the
 // gate has to carry an exemption shaped like it, and everything else under the
-// root has to be checked against that exemption. The doors answer on /v1/event
+// root has to be checked against that exemption. The routes answer on /v1/event
 // now (mount.go mountHatches, counted in routes_test.go), so everything here is
 // a read — and TestTheFaceIsGatedWholesale below states that as a property
 // rather than leaving it to this closed list.
@@ -356,7 +356,7 @@ func TestTelemetryRoutesAreTheSameFive(t *testing.T) {
 	}
 	for route := range got {
 		if !want[route] {
-			t.Errorf("%s is registered and was not before — the face grew a door", route)
+			t.Errorf("%s is registered and was not before — the face grew a route", route)
 		}
 	}
 }
@@ -364,7 +364,7 @@ func TestTelemetryRoutesAreTheSameFive(t *testing.T) {
 // NOTHING ON THE FACE IS EXEMPT FROM THE PRINCIPAL GATE. The set above is a
 // closed list and would catch this instance; this states the PROPERTY, so a
 // route added to both the face and the list still fails. The face is read with
-// a session — an exempt write here is an unauthenticated door inside a gated
+// a session — an exempt write here is an unauthenticated route inside a gated
 // subtree, and the exemption that admits it is what every sibling then has to
 // be checked against.
 func TestTheFaceIsGatedWholesale(t *testing.T) {
@@ -376,7 +376,7 @@ func TestTheFaceIsGatedWholesale(t *testing.T) {
 	}
 }
 
-// The ingest door reaches the runtime through its OWN named route, path
+// Ingest reaches the runtime through its OWN named route, path
 // untouched, while the typed reads on the face dispatch as ops.
 func TestTheIngestDoorIsANamedHatch(t *testing.T) {
 	app := mounted(t)