Merge chore/scrub-deployment-names — no deployment nicknames in the published tree

Author: tbiyss

FEATURES.md

@@ -2149,7 +2149,7 @@ are retired, bullet by bullet; everything else stands.
 - **Gateway-to-gateway sources** (`src/gateway/skills/peer-sync.js`): a source of kind `gateway`
   (a peer's URL + a token with the `sync` scope, stored write-only) pulls the peer's organization
   skills through that endpoint — staged in review mode, active in auto mode, tombstoned when the
-  peer drops them, last-good kept on failure — so a second gateway (Atlas following Xavier) shares
+  peer drops them, last-good kept on failure — so a second gateway (a follower gateway tracking a primary one) shares
   one library with nothing but a URL and a token. All source kinds (git / folder / gateway) sync
   through one dispatcher on the interval, from the UI and from chat.
   → TEST-PLAN: Skills platform (round two).

TEST-PLAN.md

@@ -2546,7 +2546,7 @@ are the v0.8 production deployment gate and are executed in the QA loop that fol
       mask create args work; the `agent` user sees every channel folder and memory, every repo and the
       gateway logs, can write, and `~/.local/share/containers` is an empty tmpfs while the host store
       is untouched.
-- [ ] Manual (Xavier, both engines): switch on → an admin author in a Full-access channel lists
+- [ ] Manual (production gateway, both engines): switch on → an admin author in a Full-access channel lists
       another channel's `MEMORY.md` under `~/ChannelGate/slack/<slug>/` and a repo under `~/Code/`
       with Read/Bash (Claude) and the shell (Codex); `podman inspect` shows the home bind + the
       tmpfs mask; a Worker channel's container shows neither; switch off → the admin container is
@@ -2574,7 +2574,7 @@ are the v0.8 production deployment gate and are executed in the QA loop that fol
 - [x] Unit: `parseInspectLine` reads the tenth `cg.mounts` field, maps `<no value>` to empty, and
       still parses a nine-field line from a container created before the label existed — an unknown
       mount fingerprint counts as CHANGED, not as matching (automated).
-- [ ] Manual (Xavier): point a channel's `workDir` at a subfolder, send a turn (the container is
+- [ ] Manual (production gateway): point a channel's `workDir` at a subfolder, send a turn (the container is
       created with that folder bind-mounted), restore `workDir` to the default and delete the
       subfolder, then send another turn. Pass when the container is rebuilt before the turn runs
       and the answer arrives normally; fail on `Append system prompt file not found` or any reply
@@ -3137,8 +3137,8 @@ are the v0.8 production deployment gate and are executed in the QA loop that fol
       create a skill from chat, confirm the commit lands and the skill shows as owned by that source
       after the next sync; push a change to a source repository with the webhook configured and
       confirm the sync runs within seconds.
-- [ ] Live (two gateways): mint a `sync` token on Xavier, add Xavier as a gateway source on Atlas in
-      review mode, approve a staged skill there, and use it in an Atlas channel.
+- [ ] Live (two gateways): mint a `sync` token on the primary gateway, add it as a gateway source on the
+      second gateway in review mode, approve a staged skill there, and use it in one of that gateway's channels.
 
 ## Security checks
 - [ ] **Retired 2026-09-03 (Linux + containers only):** the sandbox wording — inside the container `~/.ssh` and sibling channel folders do not exist at

src/gateway/skills/peer-sync.js

@@ -2,7 +2,7 @@
 // that gateway's MCP endpoint (/mcp/skills) with an access token carrying the `sync` scope. The
 // peer's organization skills arrive as synced (owner git, this source) revisions — staged in
 // review mode, active in auto mode — with the same tombstone/conflict rules as a git source. A
-// second gateway on the same host (Atlas following Xavier) needs nothing more than the URL and a
+// second gateway on the same host (a follower tracking a primary) needs nothing more than the URL and a
 // token minted on the peer.
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";

src/runtimes/container/names.js

@@ -1,7 +1,7 @@
 // Container, volume and label naming — the one home for "what is this channel's container called".
 //
-// Two gateways can share one host under different users (this box runs @xavier under `management`
-// and @atlas under `tby`) and, with a rootful daemon, they would share ONE container namespace. So
+// Two gateways can share one host under different users (one bot per Linux account, each
+// with its own user systemd unit) and, with a rootful daemon, they would share ONE container namespace. So
 // every name carries the install id: sha256 of the runtime root's real path, not the per-boot
 // instanceId, so a restart finds its own containers again. Discovery is by NAME and then VERIFIED
 // by the `cg.install` label — a container that happens to answer to our name but carries a foreign

src/slack/progress.js

@@ -12,7 +12,7 @@ import { describeSilence } from "../engines/watchdog.js";
 // Live feedback: while Claude runs, edit the placeholder every ~1.5s (Slack's chat.update rate
 // limit) with the streamed text + a cursor, falling back to an activity line before any text.
 // Slack Assistant working UI in an AI-app / assistant thread
-// (assistant.threads.setStatus). `status` drives the compact "atlas is using…" activity line;
+// (assistant.threads.setStatus). `status` drives the compact "<bot> is using…" activity line;
 // `loading_messages` drives the separate, prominent loading copy above the composer. It no-ops
 // gracefully outside an assistant thread or without the required scope. Pass "" to clear.
 // Threads where setStatus has already been refused (not an assistant thread, missing

test/health-liveness.test.js

@@ -49,7 +49,7 @@ function getHealth(headers = {}) {
 }
 
 test("a connected daemon says so to a caller with no session", async () => {
-  snapshot = { status: "connected", connected: true, user: "atlas", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null };
+  snapshot = { status: "connected", connected: true, user: "gatewaybot", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null };
   const body = await getHealth();
   assert.deepEqual(body.slack, { status: "connected", connected: true }, "the connection state, exactly — nothing that names the workspace");
   assert.equal(body.ok, true);
@@ -78,7 +78,7 @@ test("a manager with no state yet answers disconnected instead of omitting the f
 
 test("a caller who cannot identify itself still gets no engine or filesystem detail", async () => {
   // The liveness widening is exactly one field wide: everything the narrowing was for stays shut.
-  snapshot = { status: "connected", connected: true, user: "atlas", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null };
+  snapshot = { status: "connected", connected: true, user: "gatewaybot", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null };
   const body = await getHealth({ "x-cg-secret": "not-the-secret" });
   assert.deepEqual(Object.keys(body).sort(), ["instanceId", "ok", "slack"]);
 });

test/run-api.test.js

@@ -16,7 +16,7 @@ const KEY = process.env.CG_API_KEY;
 
 const { createWebApp } = await import("../src/web/app.js");
 
-const slackStub = { snapshot: () => ({ status: "disconnected", connected: false, user: "atlas", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null }), getClient: () => null };
+const slackStub = { snapshot: () => ({ status: "disconnected", connected: false, user: "gatewaybot", team: "Make it Future", teamId: "T0BB", botUserId: "U0BB", error: null }), getClient: () => null };
 let updateSmokeCalls = 0;
 let updateStartResult = {
   ok: true,