docs: sort the top-level directories into five sections by what the reader wants

Every docs directory moves under 1-getting-started, 2-handbook,
4-implementation or 5-project; the options reference (section 3) comes from
the website and has no directory here. trust-boundary stays whole under the
handbook for now. web-ui, swarm and tools split between handbook and
implementation, and the command-line references move to
2-handbook/reference. Links, path references in code and nix, and the docs
index follow the moves; no page content changes.

hive-c0re/src/agent_set.rs

@@ -46,7 +46,7 @@ pub async fn refresh(agents: &[hive_meta_flake::AgentSpec]) -> Result<()> {
     // Every agent binds a unix socket (`HIVE_WEB_SOCKET`); the gateway routes
     // via this map, falling back to a computed TCP loopback port
     // (`lifecycle::agent_web_port`) only while an agent's socket marker is
-    // absent. See `docs/networking/gateway.md::Per-agent unix-socket upstream`.
+    // absent. See `docs/4-implementation/networking/gateway.md::Per-agent unix-socket upstream`.
     if let Err(e) = crate::agent_sockets::write(&agent_names) {
         tracing::warn!(error = ?e, "agent_sockets::write failed (non-fatal)");
     }

hive-c0re/src/dashboard/mod.rs

@@ -138,7 +138,7 @@ fn app(coord: Arc<Coordinator>) -> axum::Router {
 
 pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
     // Binds loopback-only; external access via gateway.
-    // Rationale: docs/networking/gateway.md::Firewall posture.
+    // Rationale: docs/4-implementation/networking/gateway.md::Firewall posture.
     let addr = SocketAddr::from(([127, 0, 0, 1], port));
     let listener = bind_with_retry(addr).await?;
     tracing::info!(%addr, "dashboard listening");
@@ -146,10 +146,10 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
     Ok(())
 }
 
-// SPA shape + SSE channels: docs/web-ui/shape.md.
+// SPA shape + SSE channels: docs/4-implementation/web-ui/shape.md.
 
 /// `SO_REUSEADDR` bind with retry. Retry mechanics, attempt-cap
-/// rationale, and log-level cadence: `docs/web-ui/shape.md::Listener bind`.
+/// rationale, and log-level cadence: `docs/4-implementation/web-ui/shape.md::Listener bind`.
 async fn bind_with_retry(addr: SocketAddr) -> Result<tokio::net::TcpListener> {
     let mut retries = 0u32;
     let listener = (|| async { try_bind(addr) })

hive-c0re/src/dashboard/state_snapshot.rs

@@ -1,7 +1,7 @@
 //! `/api/state` cold-load snapshot plus the dashboard's live read side:
 //! the `StateSnapshot` shape and its view builders, the
 //! `/api/dashboard/stream` SSE channel. SPA shape + SSE channels:
-//! docs/web-ui/shape.md.
+//! docs/4-implementation/web-ui/shape.md.
 
 use std::convert::Infallible;
 
@@ -64,7 +64,7 @@ pub(super) struct StateSnapshot {
     /// runtime-generated `agents.conf` include file — see
     /// `gateway_nginx.rs`). The `false` branch (direct
     /// `http://<hostname>:<port>/` TCP links) is retained as a defensive
-    /// fallback for the env being unset. See `docs/networking/gateway.md::Vhost map`.
+    /// fallback for the env being unset. See `docs/4-implementation/networking/gateway.md::Vhost map`.
     gateway_enabled: bool,
     /// Public URL of the forge (e.g.
     /// `"https://forge.pr1ma.darkest.space"`). Sourced from the

hive-c0re/src/dashboard_events.rs

@@ -2,7 +2,7 @@
 //! flow through `Coordinator.dashboard_events`. Each event carries a
 //! monotonic `seq` for client-side dedupe against `/api/state` snapshots.
 //! Design rationale (single channel, broker forwarder isolation):
-//! `docs/web-ui/shape.md::One unified channel`.
+//! `docs/4-implementation/web-ui/shape.md::One unified channel`.
 
 use serde::Serialize;
 

hive-c0re/src/forge/mod.rs

@@ -2,7 +2,7 @@
 //! every hive. The
 //! swarm-wide orgs, teams and repos, and each agent's read grant on
 //! `internal/docs`, are swarm-controller's. Full design:
-//! `docs/integrations/forge.md`.
+//! `docs/2-handbook/integrations/forge.md`.
 
 mod reader;
 

hive-c0re/src/gateway_nginx.rs

@@ -2,7 +2,7 @@
 //! `/agent/<name>/` location blocks. Writes
 //! `/var/lib/hive-gateway/conf/agents.conf` on every topology change.
 //! UDS upstream selection, the reload trigger, and idempotency:
-//! `docs/networking/gateway.md::Per-agent unix-socket upstream`.
+//! `docs/4-implementation/networking/gateway.md::Per-agent unix-socket upstream`.
 
 use anyhow::{Context, Result};
 use std::fmt::Write as _;
@@ -175,7 +175,7 @@ fn render(names: &[String], frontend_dir: Option<&str>) -> String {
 /// It stays an explicit trigger rather than a systemd path
 /// unit watching the file: the write already knows it changed something,
 /// and a watcher would turn one causal edge into a race with the writer's
-/// own rename (see `docs/networking/gateway.md`).
+/// own rename (see `docs/4-implementation/networking/gateway.md`).
 ///
 /// The priv call is best-effort — a failed sync is logged but not fatal.
 /// `reload_if_pending` retries on the next `spawn_poll` tick so a

hive-c0re/src/job_queue/mod.rs

@@ -23,7 +23,7 @@
 //! The queue is runtime-only (no persistence): an empty graph on boot; desired
 //! state is re-derived by the reconcile sweep. A single scheduler task
 //! ([`scheduler::run_worker`]) drives it; concurrency comes from the build-slot
-//! capacity, not multiple workers. Design: `docs/scheduler/coordinator.md::Job queue`.
+//! capacity, not multiple workers. Design: `docs/4-implementation/scheduler/coordinator.md::Job queue`.
 
 pub mod exec;
 pub mod model;

hive-c0re/src/job_queue/model.rs

@@ -9,7 +9,7 @@
 //! execution, build-log, cancel, and the dashboard group (a group root's
 //! subtree *is* the group). A DAG used to be a second level above it, with
 //! its own store and its own id; there is no container node any more, so a
-//! job is exactly the nodes it declared. See `docs/scheduler/coordinator.md::Job queue`
+//! job is exactly the nodes it declared. See `docs/4-implementation/scheduler/coordinator.md::Job queue`
 //! for the full design.
 
 pub use hive_host_sock::jobs::State;
@@ -23,7 +23,7 @@ use serde::Serialize;
 ///
 /// What each kind does, the resource/lease rules, and the DAG shapes they
 /// compose into live in the node-inventory table and surrounding sections
-/// of `docs/scheduler/coordinator.md` — this enum is deliberately not a
+/// of `docs/4-implementation/scheduler/coordinator.md` — this enum is deliberately not a
 /// second copy of that; each variant below gets a one-line pointer.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, strum::IntoStaticStr)]
 #[serde(tag = "kind", rename_all = "snake_case")]

hive-c0re/src/job_queue/resource.rs

@@ -16,7 +16,7 @@
 
 /// The resource classes the queue gates concurrency on, as the crate's
 /// generic resource type `R`. What each holds, who declares it, and the
-/// exemptions: see `docs/scheduler/coordinator.md`'s _Scheduler semantics_
+/// exemptions: see `docs/4-implementation/scheduler/coordinator.md`'s _Scheduler semantics_
 /// section — this enum stays the one-line summary, not a second copy.
 #[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum Resource {

hive-c0re/src/job_queue/templates.rs

@@ -8,12 +8,12 @@
 //! **The one sanctioned exception is a brace** — a pure-resource-holder root
 //! ([`NodeKind::AgentWindow`]) declaring for a
 //! coordinated subtree whose members then declare nothing. See
-//! `docs/scheduler/coordinator.md`, _Braces_ — which also carries the per-operation DAG
+//! `docs/4-implementation/scheduler/coordinator.md`, _Braces_ — which also carries the per-operation DAG
 //! shapes, so they are not restated here.
 //!
 //! Nodes are **named, not counted** — a template holds the handle
 //! [`JobBuilder::node`] hands back, so an edge says which node it waits on. Why that
-//! removes submit-time cycle validation: `docs/scheduler/coordinator.md`.
+//! removes submit-time cycle validation: `docs/4-implementation/scheduler/coordinator.md`.
 //!
 //! The hive-wide **power ops** (`stop` / `start` / `restart`) are NOT here:
 //! their per-agent shape depends on live running state (an async
@@ -156,7 +156,7 @@ impl<'a> RebuildRoots<'a> {
 
 /// The rebuild node subtree — three group roots (`MetaSync`, the `AgentWindow`
 /// brace, `Reconcile`). `after`, when given, is the node it chains behind. The
-/// shape itself is in `docs/scheduler/coordinator.md`; the code below is the source of
+/// shape itself is in `docs/4-implementation/scheduler/coordinator.md`; the code below is the source of
 /// truth for it, so only the two choices a reader would otherwise undo are
 /// called out here:
 ///

hive-c0re/src/job_queue/tests.rs

@@ -554,7 +554,7 @@ fn rebuild_chain_declares_its_resources_on_the_brace() {
     // ⚠️ **The rename is a reversal, not tidying.** The old name asserted "the
     // slot follows the nix work and the lease follows the container" — each node
     // declaring what it personally needed. The brace inverts that for a
-    // coordinated subtree; see `docs/scheduler/coordinator.md`, _Braces_.
+    // coordinated subtree; see `docs/4-implementation/scheduler/coordinator.md`, _Braces_.
     //
     // (`hive_jobq` owns slot *fairness*, pinned there by
     // `a_contended_resource_goes_to_the_oldest_waiter`. What is c0re's is

hive-c0re/src/lifecycle/host_config.rs

@@ -289,7 +289,7 @@ async fn systemd_daemon_reload() -> Result<()> {
 }
 
 /// Append the bind flag for `child`'s `state` dir into `binds`. See
-/// docs/agent-lifecycle/persistence.md ("Cross-agent access to state") for what
+/// docs/2-handbook/agent-lifecycle/persistence.md ("Cross-agent access to state") for what
 /// the holder may touch and why. Creates the missing host-side directory so
 /// nspawn doesn't refuse to start; a missing dir is non-fatal.
 ///
@@ -362,7 +362,7 @@ fn holds_manage_root_agent(agent_name: &str, path: &Path) -> bool {
 /// that hive-c0re owns: `PRIVATE_NETWORK` (always 1), `HOST_ADDRESS` (the
 /// bridge gateway IP) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind). What
 /// those network vars mean and why isolation is unconditional:
-/// `docs/networking/network.md` § *What the Rust side does*.
+/// `docs/4-implementation/networking/network.md` § *What the Rust side does*.
 ///
 /// ⚠️ The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
 /// `systemd-nspawn` command.

hive-c0re/src/lifecycle/mod.rs

@@ -47,7 +47,7 @@ pub use hive_meta_flake::agent_web_port;
 ///
 /// `HIVE_NETWORK_SUBNET` carries the host-side bridge address verbatim
 /// (e.g. `10.42.0.1/24`), **not** the canonical network address — see
-/// the note in `set_nspawn_flags` + `docs/networking/network.md`. The IP part is
+/// the note in `set_nspawn_flags` + `docs/4-implementation/networking/network.md`. The IP part is
 /// therefore the bridge IP itself: the host end of the bridge, the
 /// default-route target for isolated containers, and the address the
 /// hive dnsmasq resolver binds. Returns the dotted-decimal IP with the
@@ -436,7 +436,7 @@ pub async fn converge_start_preamble(
 /// activation-error shape), retry once via stop + kill + start before
 /// giving up. Used by the queue's fast-lane `Start` handler and the
 /// inline start-after-rebuild path.
-/// See `docs/scheduler/coordinator.md::Cold-start fallback`.
+/// See `docs/4-implementation/scheduler/coordinator.md::Cold-start fallback`.
 ///
 /// Requires a [`StartableAgent`] token from [`converge_start_preamble`]
 /// to prove the preamble ran. For internal use within this module (where

hive-c0re/src/main.rs

@@ -351,7 +351,7 @@ async fn cmd_serve(
     // Also retries any pending gateway nginx reload that failed on
     // the previous tick. write() is idempotent so steady-state cost
     // is one stat per agent per tick.
-    // See `docs/networking/gateway.md::Per-agent unix-socket upstream`.
+    // See `docs/4-implementation/networking/gateway.md::Per-agent unix-socket upstream`.
     agent_sockets::spawn_poll();
     // MCP socket listener startup sync: one-shot sweep that re-registers any
     // running agent container whose MCP listener was lost when hive-c0re

hive-c0re/src/migrate.rs

@@ -17,7 +17,7 @@
 //!   `agent-permissions` bucket when the swarm UI creates her.
 //!
 //! Kill-switch: `HIVE_SKIP_META_MIGRATION=1`. Full sequence and phase
-//! details: `docs/agent-lifecycle/config-changes.md::Startup migrations (older hosts)`.
+//! details: `docs/2-handbook/agent-lifecycle/config-changes.md::Startup migrations (older hosts)`.
 
 use std::path::Path;
 use std::time::Duration;

hive-c0re/src/stats/container_stats.rs

@@ -13,7 +13,7 @@
 //! No network: agents share the host network namespace
 //! (`privateNetwork = false`), so there is no per-container net
 //! counter to read. Per-agent network only becomes meaningful with the
-//! netns-isolation roadmap (`docs/networking/network.md`).
+//! netns-isolation roadmap (`docs/4-implementation/networking/network.md`).
 //!
 //! CPU is cumulative (`usage_usec` is monotonic), so a single read is
 //! meaningless — we sample every machine's counter, sleep one short

hive-c0re/src/stats/host_stats.rs

@@ -12,7 +12,7 @@
 //!
 //! The registry has no dashboard banner any more. A raised warning reaches
 //! the operator as the `hyperhive.hive.warning` gauge and a Grafana alert
-//! on it (see `docs/scheduler/observability.md`).
+//! on it (see `docs/4-implementation/scheduler/observability.md`).
 
 use serde::Serialize;
 use utoipa::ToSchema;

hive-c0re/src/stores/build_logs.rs

@@ -1,7 +1,7 @@
 //! Sqlite-backed full build-log capture — stdout + stderr per
 //! `nixos-container` / `nix build` invocation, accumulated live.
 //! Schema, indices, retention, and the rationale for replacing
-//! the old ring buffer: `docs/agent-lifecycle/persistence.md::/var/lib/hyperhive/db/build_logs.sqlite`.
+//! the old ring buffer: `docs/2-handbook/agent-lifecycle/persistence.md::/var/lib/hyperhive/db/build_logs.sqlite`.
 
 use std::path::Path;
 use std::sync::{Arc, Mutex, OnceLock};

hive-c0re/src/workers/agent_sockets.rs

@@ -6,7 +6,7 @@
 //!
 //! Full mechanism — per-agent subdir bind-mount, `hyperhive-socket-bound`
 //! marker gate, gateway UDS upstream, 10s poll loop:
-//! `docs/networking/gateway.md::Per-agent unix-socket upstream`.
+//! `docs/4-implementation/networking/gateway.md::Per-agent unix-socket upstream`.
 
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};

hive-c0re/src/workers/auto_update.rs

@@ -21,7 +21,7 @@
 //!    never while a rebuild of the agent is queued or running, so a closure
 //!    that fails to deploy does not restart its agent every interval.
 //!
-//! See `docs/scheduler/coordinator.md::Boot reconcile`.
+//! See `docs/4-implementation/scheduler/coordinator.md::Boot reconcile`.
 
 use std::collections::HashMap;
 use std::path::Path;