test: replace real client identifiers with generic placeholders

.ai/README.md

@@ -14,7 +14,7 @@ agent transcripts, generated queues, local reviews, or runtime state.
 | Commands and evidence selection | [verification skill](skills/hack-repo-verify/SKILL.md) |
 | Work units and experiment design | [work-unit skill](skills/hack-repo-work-unit/SKILL.md) |
 | Developer toolchain | [.hack/README.md](../.hack/README.md), root mise/package pins |
-| v5 status and acceptance | [Linear program and issue index](https://linear.app/hackdance/document/hack-v5-program-measurable-acceptance-and-source-of-truth-26d5fb362f3e); local mapping `_docs/docs/plans/v5/linear-sync.md`, preserved ledger `_docs/docs/plans/v5/work-units.md` |
+| v5 status and acceptance | Linear program and issue index (the "Hack v5 program: measurable acceptance and source of truth" document in the private workspace); local mapping `_docs/docs/plans/v5/linear-sync.md`, preserved ledger `_docs/docs/plans/v5/work-units.md` |
 | Consumer instructions installed by Hack | [agent-guidance.md](../docs/agent-guidance.md) |
 
 Contributor skills are authored in `.ai/skills/<name>/SKILL.md`. Relative symlinks

.ai/skills/hack-repo-work-unit/SKILL.md

@@ -19,9 +19,9 @@ Artifact: patch/docs/report and location of durable results
 Exit: completion criteria, experiment budget and any external evidence still required
 ```
 
-For v5, [Linear's Hack project](https://linear.app/hackdance/project/hack-8806a1b201f7/overview)
+For v5, Linear's Hack project (private workspace)
 is the planning/status source of truth. Start with the
-[program and issue index](https://linear.app/hackdance/document/hack-v5-program-measurable-acceptance-and-source-of-truth-26d5fb362f3e),
+program and issue index (the "Hack v5 program: measurable acceptance and source of truth" document),
 which is available even in a fresh checkout without local planning artifacts. Use the local
 `_docs/docs/plans/v5/linear-sync.md` mapping to find the existing issue and milestone;
 preserve `_docs/docs/plans/v5/work-units.md` and linked source/evidence documents.

.gitignore

@@ -78,6 +78,10 @@ zig-out/
 .hack/.internal/
 .hack/supervisor/
 
+# Hack-generated, machine-local runtime state in any project, including examples
+**/.hack/.internal/
+**/.hack/.branch/
+
 
 SPECS/
 _DOCS

CHANGELOG.md

@@ -112,7 +112,7 @@
 
 ## <small>3.3.3 (2026-07-09)</small>
 
-* Merge pull request #61 from hack-dance/codex/event-agent-runtime-repair ([f1de71e](https://github.com/hack-dance/hack/commit/f1de71e)), closes [#61](https://github.com/hack-dance/hack/issues/61)
+* Merge pull request #61 from hack-dance/codex/app-runtime-repair ([f1de71e](https://github.com/hack-dance/hack/commit/f1de71e)), closes [#61](https://github.com/hack-dance/hack/issues/61)
 * fix(cli): preserve usage code for lifecycle json ([f50f408](https://github.com/hack-dance/hack/commit/f50f408))
 * fix(runtime): clean descendant lifecycle groups ([57f2358](https://github.com/hack-dance/hack/commit/57f2358))
 * fix(runtime): isolate detached worktrees and recover orphan groups ([80a8dd2](https://github.com/hack-dance/hack/commit/80a8dd2))
@@ -827,7 +827,7 @@
 
 ## <small>1.10.1 (2026-02-19)</small>
 
-* Fix gateway 502 for livenation ([a1bb858](https://github.com/hack-dance/hack/commit/a1bb858))
+* Fix gateway 502 for a project host ([a1bb858](https://github.com/hack-dance/hack/commit/a1bb858))
 * Improve dashboard header and groups ([1e58826](https://github.com/hack-dance/hack/commit/1e58826))
 * Merge branch 'main' into squircle ([f06f84c](https://github.com/hack-dance/hack/commit/f06f84c))
 * Merge pull request #10 from hack-dance/squircle ([4539e92](https://github.com/hack-dance/hack/commit/4539e92)), closes [#10](https://github.com/hack-dance/hack/issues/10)

docs/guides/native-candidate.md

@@ -1478,7 +1478,7 @@ line and drops nothing. Existing
 require successful initializer completion before dependent services start. Cache
 initializers receive immutable source mounts and writable named cache volumes;
 workspace installs that write elsewhere still require explicit volume mappings.
-An isolated Event Agent trial reached 14-service native readiness, completed Google
+An isolated trial of a real 14-service application reached native readiness, completed Google
 sign-in, and rendered authenticated search results and images over browser-trusted
 HTTPS. A normal `restart` kept its run and Redis data after a source edit. This does
 not establish every application workflow, crash recovery or comparative performance.
@@ -1640,7 +1640,7 @@ without blocking owned cleanup. Missing or malformed delivery refuses, as do
 values for another service; ordinary graph startup environment delivery retains
 its nonempty requirement.
 
-The running-project noninteractive path has a live Event Agent smoke check:
+The running-project noninteractive path has a live smoke check against a real multi-service application:
 `hack run www -- bun --version` completed after a same-run restart, and a command
 exiting 7 returned its stdout and exit status. Both left no job resource and
 preserved the healthy parent graph and its volume identities. An

docs/guides/v5-release-readiness.md

@@ -39,12 +39,12 @@ into the stable default or switch active projects to create a readiness claim.
 | Qualify rollback and dogfood | Retained working software selection, explicit project/data compatibility, staged reversible project opt-in and measured acceptance | Software rollback is not data rollback. Refusal by an older candidate is not a successful rollback. |
 | Publish or promote | Exact version/channel/SHA/artifact plus remaining checks and explicit approval | No blanket waiver, active-project switch or DNS/deployment authority. |
 
-Track canonical acceptance under the [v5 program](https://linear.app/hackdance/issue/HACK-1112),
-[distribution](https://linear.app/hackdance/issue/HACK-1124),
-[agent integration](https://linear.app/hackdance/issue/HACK-1130),
-[plugin guidance](https://linear.app/hackdance/issue/HACK-1132),
-[MCP workflows](https://linear.app/hackdance/issue/HACK-1133) and
-[agent cost](https://linear.app/hackdance/issue/HACK-1141).
+Track canonical acceptance under the v5 program (HACK-1112),
+distribution (HACK-1124),
+agent integration (HACK-1130),
+plugin guidance (HACK-1132),
+MCP workflows (HACK-1133) and
+agent cost (HACK-1141).
 Linear is canonical; this document supplies the reproducible gate structure.
 
 ## Staged, reversible primary-driver plan

docs/performance.md

@@ -696,7 +696,7 @@ linked-worktree roots through the runtime interface, one pool per root. They do
 the `hack up` frontend, routing, application-specific images or cold host caches, and each
 fresh home still acquires the image, which is timed separately.
 
-Prepared bases carry no application images. On an M3 (September 2026, one prepared pool, three
+Prepared bases carry no application images. On an Apple silicon host (September 2026, one prepared pool, three
 repeats), `ensure-image` for `postgres:16-alpine` (114 MB archive) took 10.6 s cold. The engine
 load itself took 3.1 s and host digest and layer validation about 1.8 s; the rest was registry
 acquisition into the home's image cache. `node:22-alpine` (61 MB) took 6.3 s cold, with a 1.7 s
@@ -712,7 +712,7 @@ image-free. The larger remaining costs are image acquisition and per-incarnation
 Revision 1 of the v5 matched application benchmark is frozen in the
 [application benchmark protocol](reference/application-benchmark-protocol.md)
 (HACK-1169). It fixes the exact candidate and stable artifacts, the host and engine
-versions, the Event Agent and small-fixture workloads, capacities, cache classes, a
+versions, the large-application and small-fixture workloads, capacities, cache classes, a
 10-round rotated order, sample counts, observer accounting and the program budgets.
 It records no results.
 

docs/reference/application-benchmark-protocol.md

@@ -19,7 +19,7 @@ cannot meet this protocol is reported as inconclusive, not adjusted after the fa
 ## Artifacts
 
 Every lane runs an exact released artifact, installed into its own isolated home and
-state paths. A lane never uses whatever `hack` is on `PATH`; the M3 host currently has
+state paths. A lane never uses whatever `hack` is on `PATH`; the benchmark host currently has
 4.2.0 installed, and that installation is not a lane. Before each cohort, the harness
 must verify the SHA-256 digest of each downloaded asset and record the executable's
 reported version. A mismatch refuses the cohort.
@@ -50,7 +50,7 @@ read from the host on 2026-10-19:
 
 Before each cohort, the harness records these values again. If any of them differs,
 the cohort is refused and a new revision is needed. Results from another host,
-including the M5 Max development host, are not revision-1 results.
+including other development hosts, are not revision-1 results.
 
 Only one stateful benchmark owner may use the host and its runtimes at a time. Other
 agents' runtime tests, builds and Docker work must not overlap a cohort. Independent
@@ -96,7 +96,7 @@ Two workloads run in every lane, and each workload is compared against every req
 baseline. A cohort records each workload's pin, and every lane in that cohort uses the
 same pin.
 
-**Event Agent.** The actual application configuration, not a reduced copy. The cohort
+**Large application.** The actual application configuration, not a reduced copy. The cohort
 records the application commit and a digest of its configuration. Its expected shape is
 14 services, 9 HTTP health checks and 2 initializers. A different shape refuses the
 cohort until the protocol is revised. Credentials come only through authorized managed

docs/reference/native-compose-commands.md

@@ -122,7 +122,7 @@ The maintained `native-config-routing` Docker fixture additionally observes a
 running one-off with no routing keys, exact exit 17 and removal, unchanged main
 and sibling container IDs and HTTPS markers, completed claims, retained data and
 recovery from a deliberately blocked one-off removal. This fixture passed on an
-M3 macOS host with the current compiled CLI and its matching compiler. That
+Apple silicon macOS host with the current compiled CLI and its matching compiler. That
 qualification is separate from unit tests and does not establish cold routed-run
 support or whole-product parity.
 

docs/versions/v5/guides/native-candidate.md

@@ -762,7 +762,7 @@ line and drops nothing. Existing
 require successful initializer completion before dependent services start. Cache
 initializers receive immutable source mounts and writable named cache volumes;
 workspace installs that write elsewhere still require explicit volume mappings.
-An isolated Event Agent trial reached 14-service native readiness, completed Google
+An isolated trial of a real 14-service application reached native readiness, completed Google
 sign-in, and rendered authenticated search results and images over browser-trusted
 HTTPS. A normal `restart` kept its run and Redis data after a source edit. This does
 not establish every application workflow, crash recovery or comparative performance.
@@ -896,7 +896,7 @@ without blocking owned cleanup. Missing or malformed delivery refuses, as do
 values for another service; ordinary graph startup environment delivery retains
 its nonempty requirement.
 
-The running-project noninteractive path has a live Event Agent smoke check:
+The running-project noninteractive path has a live smoke check against a real multi-service application:
 `hack run www -- bun --version` completed after a same-run restart, and a command
 exiting 7 returned its stdout and exit status. Both left no job resource and
 preserved the healthy parent graph and its volume identities. An

docs/versions/v5/originals/docs/guides/native-candidate.md

@@ -641,7 +641,7 @@ explicit native selections described below. Existing
 require successful initializer completion before dependent services start. Cache
 initializers receive immutable source mounts and writable named cache volumes;
 workspace installs that write elsewhere still require explicit volume mappings.
-An isolated Event Agent trial reached 14-service native readiness, completed Google
+An isolated trial of a real 14-service application reached native readiness, completed Google
 sign-in, and rendered authenticated search results and images over browser-trusted
 HTTPS. A normal `restart` kept its run and Redis data after a source edit. This does
 not establish every application workflow, crash recovery or comparative performance.
@@ -763,7 +763,7 @@ without blocking owned cleanup. Missing or malformed delivery refuses, as do
 values for another service; ordinary graph startup environment delivery retains
 its nonempty requirement.
 
-The running-project noninteractive path has a live Event Agent smoke check:
+The running-project noninteractive path has a live smoke check against a real multi-service application:
 `hack run www -- bun --version` completed after a same-run restart, and a command
 exiting 7 returned its stdout and exit status. Both left no job resource and
 preserved the healthy parent graph and its volume identities. An

docs/versions/v5/originals/next6/docs/guides/native-candidate.md

@@ -770,7 +770,7 @@ line and drops nothing. Existing
 require successful initializer completion before dependent services start. Cache
 initializers receive immutable source mounts and writable named cache volumes;
 workspace installs that write elsewhere still require explicit volume mappings.
-An isolated Event Agent trial reached 14-service native readiness, completed Google
+An isolated trial of a real 14-service application reached native readiness, completed Google
 sign-in, and rendered authenticated search results and images over browser-trusted
 HTTPS. A normal `restart` kept its run and Redis data after a source edit. This does
 not establish every application workflow, crash recovery or comparative performance.
@@ -904,7 +904,7 @@ without blocking owned cleanup. Missing or malformed delivery refuses, as do
 values for another service; ordinary graph startup environment delivery retains
 its nonempty requirement.
 
-The running-project noninteractive path has a live Event Agent smoke check:
+The running-project noninteractive path has a live smoke check against a real multi-service application:
 `hack run www -- bun --version` completed after a same-run restart, and a command
 exiting 7 returned its stdout and exit status. Both left no job resource and
 preserved the healthy parent graph and its volume identities. An

packages/runtime-core/README.md

@@ -891,7 +891,7 @@ two concurrent routed graphs still require native acceptance. A bounded native
 reference control qualifies one graph with two networks and two declared hostnames:
 both forward real HTTP over Unix publication, followed by authenticated cleanup,
 foreground exit and independently verified resource absence. This does not qualify
-actual Event Agent routing, TLS, two routed graphs, restore, publisher-exit/partial
+real application routing, TLS, two routed graphs, restore, publisher-exit/partial
 startup failure, owner-crash recovery, scale or performance. No global Caddy
 configuration or trust installation is performed by this contract.
 

packages/runtime-core/src/project/compose/routing.rs

@@ -124,32 +124,32 @@ mod tests {
     fn normalizes_search_pair_and_supported_ports() {
         for port in [1, 6980, 65535] {
             let value = labels(
-                "Search.Event-Agent.Hack., search.event-agent.localhost",
+                "Search.Example-App.Hack., search.example-app.localhost",
                 &port.to_string(),
             );
             let route = parse(Some(&value)).unwrap().unwrap();
             assert_eq!(route.port, port);
             assert_eq!(
                 route.hostnames,
-                ["search.event-agent.hack", "search.event-agent.localhost"]
+                ["search.example-app.hack", "search.example-app.localhost"]
             );
         }
     }
 
     #[test]
-    fn accepts_all_actual_event_agent_route_shapes() {
+    fn accepts_multi_subdomain_route_shapes() {
         for (prefix, port) in [
-            ("consumer-sessions.", 3333),
+            ("sessions.", 3333),
             ("chat.", 3001),
             ("", 3000),
             ("chat-2.", 9001),
-            ("data-sync.", 9002),
-            ("crawl.", 9007),
+            ("sync.", 9002),
+            ("worker.", 9007),
             ("core.", 6969),
             ("search.", 6980),
             ("ws.", 6970),
         ] {
-            let hosts = format!("{prefix}livenation.hack, {prefix}livenation.hack.gy");
+            let hosts = format!("{prefix}example-app.hack, {prefix}example-app.hack.gy");
             let route = parse(Some(&labels(&hosts, &port.to_string())))
                 .unwrap()
                 .unwrap();