From 4d64f253c808f33da94ac8903a2dbfa9d5293a7a Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Sat, 30 May 2026 21:43:55 +0200
Subject: [PATCH] 664: address argus nits (must_use + DEFAULT_DAEMON_SOCKET
 path)

---
 hive-c0re/src/lifecycle.rs   |  1 +
 hive-matrix-mcp/src/paths.rs | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/hive-c0re/src/lifecycle.rs b/hive-c0re/src/lifecycle.rs
index 7c3084ae..c81217a5 100644
--- a/hive-c0re/src/lifecycle.rs
+++ b/hive-c0re/src/lifecycle.rs
@@ -33,6 +33,7 @@ pub const CONTAINER_RUNTIME_MOUNT: &str = "/run/hive";
 /// service environment sets `HOME` to the same path, so the OAuth
 /// session survives container restarts the same way the constant
 /// did.
+#[must_use]
 pub fn container_claude_mount(name: &str) -> String {
     format!("/home/{name}/.claude")
 }
diff --git a/hive-matrix-mcp/src/paths.rs b/hive-matrix-mcp/src/paths.rs
index 7d497108..3b020646 100644
--- a/hive-matrix-mcp/src/paths.rs
+++ b/hive-matrix-mcp/src/paths.rs
@@ -15,10 +15,11 @@ pub const DEFAULT_HOMESERVER: &str = "http://localhost:8008";
 
 /// Default unix socket path the daemon listens on inside the agent
 /// container. The stdio MCP bridge `connect()`s here on every tool call.
-/// `/run/hive-matrix.sock` is a tmpfs path that disappears on container
-/// restart — fine, because the daemon recreates the socket on its own
-/// boot.
-pub const DEFAULT_DAEMON_SOCKET: &str = "/run/hive-matrix.sock";
+/// Lives under systemd's `RuntimeDirectory=hive-matrix` (a tmpfs path
+/// that disappears on container restart — fine, because the daemon
+/// recreates the socket on its own boot) so the agent unix user
+/// (post-#658) can bind a socket inside it without root in `/run`.
+pub const DEFAULT_DAEMON_SOCKET: &str = "/run/hive-matrix/socket";
 
 /// Resolve the matrix access-token file path. Override via
 /// `HIVE_MATRIX_TOKEN_FILE`; default is `<HYPERHIVE_STATE_DIR>/matrix-token`,
@@ -41,7 +42,7 @@ pub fn homeserver_url() -> String {
 }
 
 /// Resolve the daemon's unix socket path. Override via
-/// `HIVE_MATRIX_SOCKET`; default is `/run/hive-matrix.sock`.
+/// `HIVE_MATRIX_SOCKET`; default is `/run/hive-matrix/socket`.
 #[must_use]
 pub fn daemon_socket() -> PathBuf {
     std::env::var_os("HIVE_MATRIX_SOCKET").map_or_else(|| PathBuf::from(DEFAULT_DAEMON_SOCKET), PathBuf::from)