milestone 19: hygiene sweep - dead ecs surface, single-source constants, tls classification, frontend state hazards, docker smoke network fix

src/app.zig

@@ -465,8 +465,6 @@ fn serve(r: cli.Runner, args: cli.RunArgs) !u8 {
     // Everything the web layer borrows lives above; the group below cancels the
     // web task before any of it is released. With the web interface disabled
     // the state stays in its null-defaulted shape and no task reads it.
-    if (args.web_dev) |dir| web_dev_dir = dir;
-
     var web_state: web_server.WebState = .{ .gpa = gpa };
     // The live hash may own a gpa replacement after a settings PUT; this defer
     // runs after `group.cancel` below, so no web task can still read it.
@@ -499,6 +497,7 @@ fn serve(r: cli.Runner, args: cli.RunArgs) !u8 {
         // Ruling 24: `--web-dev` serves from disk with no cache headers;
         // otherwise the embedded assets answer every non-/api miss.
         .fallback = if (args.web_dev != null) serveWebDev else static.fallback,
+        .dev_dir = args.web_dev orelse "",
         .reload_fn = reloadManager,
     };
 
@@ -634,12 +633,6 @@ fn reloadManager(state: *web_server.WebState, io: std.Io) anyerror!void {
     try manager.reload(io);
 }
 
-/// The `--web-dev` directory. `WebState.fallback` is a bare function pointer
-/// with no closure to carry the path, and one process runs one composition
-/// root, so the directory lives here: written once by `serve` before the web
-/// task starts, read only by `serveWebDev`.
-var web_dev_dir: []const u8 = "";
-
 /// Dev-mode asset serving (ruling 24): straight from disk, no cache headers,
 /// so an edit shows up on the next reload.
 fn serveWebDev(
@@ -647,8 +640,7 @@ fn serveWebDev(
     io: std.Io,
     request: *http_util.Request,
 ) http_util.HandlerError!void {
-    _ = state;
-    return static.serveFromDisk(web_dev_dir, io, request);
+    return static.serveFromDisk(state.dev_dir, io, request);
 }
 
 // ---------------------------------------------------------------------------