# The one blacklist: names no agent and no hive may take.
#
# Nix owns this list and hands it to the Rust side as an environment variable
# (`HIVE_RESERVED_NAMES`), so keeping it current is a config change rather than
# a rebuild of a binary. Read by:
#
#   - `host-modules/hive-c0re/environment.nix`  -> the env var, for the
#     `request_init_config` path every hive uses
#   - `host-modules/swarm-controller.nix`       -> the same var, for the
#     swarm-level `create_agent` path
#   - `host-modules/swarm-otel.nix`             -> its `<owner>` assertion, so
#     a hive name and an agent name are checked against ONE list
#   - `nix/checks.nix`                          -> exported into `cargo test`,
#     which is what keeps the message layer's sentinels from drifting away
#     from this file
#
# A plain nix file rather than a module option because two of those readers are
# flake-level (`checks.nix`) and cannot see a NixOS option.
#
# ⚠️ Agent names and hive names are ONE namespace going forward (mara, 2026-08-27:
# "agent and hive names live in the swarm level going forward"). Adding a name
# here forbids it for both. That is the point: two lists is how they drift.
#
# ⚠️ Every entry must be a value some component actually PRODUCES as a message
# `from`/`to`, or a component name the collector builds pipelines from — not a
# word that merely looked risky. A name in here that nothing emits is a refusal
# with no failure behind it.
[
  # ---- message-layer senders -------------------------------------------
  # The human at the dashboard: a broker recipient (the T4LK box sends
  # `{from: "operator", ...}`) and the fallback attribution for an answered
  # question.
  "operator"
  # Helper events (`approval_resolved`, `container_crash`, ...) — the sender an
  # agent is told to treat as hyperhive itself rather than as a peer.
  # `hive_sh4re::manager::SYSTEM_SENDER`.
  "system"
  # A due self-scheduled reminder arrives as its own sender, so a wake I asked
  # for last week is distinguishable from a peer message.
  "reminder"
  # Forge notification wakes, delivered by the notify daemon.
  "forge"
  # A scheduled prompt firing, pushed as a trusted sender.
  "scheduled"
  # Three synthetic wakes the harness itself produces: an in-container todo,
  # the follow-up turn after a self-requested compaction, and the single flush
  # turn before a graceful stop.
  "todo"
  "compact"
  "graceful-stop"

  # ---- swarm-tier component owners -------------------------------------
  # The swarm collector names its components `<kind>/<owner>` and uses the hive
  # name as the owner, so a hive called `swarm` would silently replace the
  # swarm tier's own pipelines and lose its own — it would keep accepting
  # pushes into a pipeline that routes nowhere. Previously enforced only
  # against hive names, in `swarm-otel.nix`'s own `reservedOwners`.
  "swarm"
]
# Deliberately absent, and both are load-bearing omissions:
#
#   `<parent>` / `<children>` — routing recipients the ident charset already
#   rejects, so no name can ever equal them; listing them would imply a guard
#   that never fires.
#
#   `ruth` — a real agent, not a literal. A second agent wanting that name is a
#   name that is TAKEN, which the roster answers, not this list.