[zach88]

What

host-context-controller rejects CONTEXT_MAPPER_GFS_DRIVE_NAME values outside ^[a-z0-9-]{1,63}$ when the operator starts.

Why

The operator injects this value into every gfs-controller pod as GFS_DRIVE_NAME and seeds it as the drive of every resource row. gfs-controller now validates the same pattern at boot (#1496). Without this check a bad value would only surface as every gfs-controller pod crash-looping on the same error; failing in the operator puts the error where the value is configured.

How

gfsConfig.ts validates the value with the same pattern and error style as the rest of its config. The README documents the constraint.

Testing

• gfsConfig.test.ts: default main when unset or empty, valid names, and the same rejected set as gfs-controller (uppercase, _, ., /, surrounding spaces, trailing newline, non-ASCII, 64 characters).
• At this head (current dev merged in): tsc --noEmit clean, vitest run 129 files / 3127 tests passed.

Risks

Same as #1496: a drive name outside the alphabet now fails at operator start. No deploy manifest in this repo sets the variable, so the default main applies. Merge after #1496.

Stack

Live GFS subscriptions ship as a stack. The server half and the desktop half must reach dev together: the server PRs retire the route the current desktop uses, and the desktop PR needs the new watch route.

#	PR	Base	Scope
1	#1496	dev	gfs-controller: drive name validation, principal_denied reason
2	#1497	dev	host-context-controller: drive name validation (merge after 1)
3	#1498	dev	control-api: shared building blocks, per-resource change trigger
4	#1499	3	control-api: watch registry, listener, process runtime
5	#1500	4	control-api: GET/PUT /external/gfs/watch
6	#1501	5	external-rest-api: GET/PUT /api/v1/me/gfs/watch
7	#1502	6	control-api + ERA: authorization and session push, retire the per-user entity-change stream
8	#1503	7	desktop-app: watch client, live previews and folders

1 and 2 are independent of the chain and safe to merge on their own (1 before 2, since the controller check in 2 mirrors the one in 1).

3 to 8 are one unit and should not be deployed partially:

• 3 and 4 add groundwork; the only new runtime behavior is the gfs_resource_changed NOTIFY trigger, which nothing listens to yet.
• 5 and 6 expose the route, but until 7 lands an authorization or session change does not cut the changed events of a stream that is idle (no op in flight). Do not ship 5/6 without 7.
• 7 removes the per-user entity-change stream (ERA /api/v1/entity-changes/stream and control-api /external/entity-changes/stream), which the current desktop still uses. Do not ship 7 without 8.