put the socket-dir test above the records-flag comment, and say the activation logs on the new link

docs/agent-lifecycle/persistence.md

@@ -748,7 +748,9 @@ container lifetime:
    A namespaced agent has the dir bound at `/agents/<name>/sockets` and
    linked from `/run/hive-agent/<name>`; the activation chowns nothing, because
    a mount point under `/run` would belong to root and the id mapping would
-   give the agent user no ids there.
+   give the agent user no ids there. A later in-container activation sees the
+   link and logs `is a symlink or not a directory; not handing it`. The log
+   is harmless.
 
 ## Matrix per-agent daemon + token-arrival trigger
 

hive-c0re/src/lifecycle/host_config.rs

@@ -571,9 +571,6 @@ mod tests {
         }
     }
 
-    /// The flag in the record is what hive-priv is told, both ways. No record
-    /// and an unreadable one say nothing, so a swarm outage changes no agent's
-    /// namespace; a record from before the field reads false.
     /// Only a namespaced agent's socket dir moves off `/run`.
     #[test]
     fn the_socket_dir_leaves_run_only_for_a_namespaced_agent() {
@@ -589,6 +586,9 @@ mod tests {
         assert!(!b.read_only);
     }
 
+    /// The flag in the record is what hive-priv is told, both ways. No record
+    /// and an unreadable one say nothing, so a swarm outage changes no agent's
+    /// namespace; a record from before the field reads false.
     #[test]
     fn the_records_flag_is_what_the_start_path_passes() {
         assert_eq!(