docs: migrate reminder/gateway/crash-watch/migrate prose to docs (#715)

docs/approvals.md

@@ -162,6 +162,31 @@ Transient broker errors (sqlite lock contention, etc.) get the same
   fan-out pass; a broker error on a one-shot is not retried (the
   operator advisory and `last_result` are the only audit trail).
 
+### Reminder delivery: file-path semantics
+
+A reminder may carry a `file_path` (the agent-visible path inside its
+container, e.g. `/agents/<name>/state/foo.md`). On delivery hive-c0re:
+
+1. **Translates** the container path to the host path
+   (`/var/lib/hyperhive/agents/<name>/state/foo.md`) so c0re can write
+   from outside the container.
+2. **Validates** the path: rejects anything outside the agent's own state
+   subtree, containing `..` (path traversal), or with an empty relative
+   tail. On rejection the write is skipped and the original message is
+   delivered inline with a warning — the reminder still fires.
+3. **Defends against symlink escape**: after `create_dir_all`, the parent
+   dir is canonicalized and re-verified to live under the agent's host
+   state root. The final file is opened with
+   `O_NOFOLLOW | O_CREAT | O_TRUNC` so an existing symlink at the
+   basename cannot redirect the write to an arbitrary host path.
+4. **Writes the body to disk** and delivers a short pointer message in its
+   place, keeping the agent's inbox / wake-prompt small while the bulky
+   payload is read out of band.
+
+Atomicity of the inbox INSERT + `reminders.sent_at` UPDATE is handled
+inside `Broker::deliver_reminders_batch`; the scheduler only computes the
+body strings before calling it.
+
 ### Destroy semantics
 
 `HostRequest::Destroy { name, purge }` is the lifecycle tear-down,