nix: finish the "moved to" comment sweep

State where `enable` and the matrix name pins are now rather than where
they moved from: swarm-grafana-service, swarm-nats-service,
hive-matrix-service (and the bao-controller fixture comment quoting it),
plus the same-shaped history in agent-modules/otel, checks and
docs/default. Comments and option-description text only; no script
string changes. Refs #3902

nix/agent-modules/otel.nix

@@ -56,11 +56,9 @@ let
   # There is no auth header among them, and no mechanism to add one. An
   # agent exports to the hive's own collector, which is the only thing
   # holding a credential for anything upstream; nothing an agent can read
-  # is a secret to the swarm. An earlier revision forwarded the
+  # is a secret to the swarm. Forwarding the operator's upstream token into
-  # operator's upstream token into this container and merged it into the
+  # this container and merging it into the agent's own
-  # agent's own `~/.claude/settings.json` — which handed every agent the
+  # `~/.claude/settings.json` would hand every agent the hive's credential.
-  # hive's credential, and was removed with the direct-export path it
-  # served.
   producerEnv = {
     OTEL_EXPORTER_OTLP_ENDPOINT = cfg.endpoint;
     OTEL_EXPORTER_OTLP_PROTOCOL = cfg.protocol;

nix/checks.nix

@@ -208,8 +208,8 @@ in
     version = "0.1.0";
     cargoTestExtraArgs = "--workspace";
     HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive";
-    # The reserved-name blacklist moved out of the Rust tree and into
+    # The reserved-name blacklist lives in `reserved-names.nix`, not in the
-    # `reserved-names.nix`, so the test that pins the message layer's
+    # Rust tree, so the test that pins the message layer's
     # sentinels against it can only run if nix hands it the same list the
     # daemons get. Exported here and in `devshell.nix`, and the test PANICS
     # rather than skipping when the variable is missing: a drift test that

nix/docs/default.nix

@@ -12,14 +12,11 @@
 # subtree-pick / output-tree rationale: docs/process/gotchas.md::Nix options
 # reference.
 #
-# `swarm.md`/`deploy.md` split off `host.md` (mara: "move swarm options
+# `swarm.md`/`deploy.md` are separate pages from `host.md`:
-# to new docs page... deploy.* is also one of the things that should be
+# `services.hyperhive.swarm.*` holds swarm-wide facts (name, domain,
-# a sub page"): `services.hyperhive.swarm.*` was mixed — swarm-wide
+# hives, ca) only, and the "does THIS host run it" toggles live in the
-# facts (name, domain, hives, ca) alongside "does THIS host run it"
+# flat `services.hyperhive.deploy.*` namespace (see deploy.nix's file-top
-# toggles — until `deploy.nix` moved every such toggle to its own flat
+# comment), so each namespace gets its own page.
-# `services.hyperhive.deploy.*` namespace. That reorg landed first
-# (see deploy.nix's file-top comment); this is the docs-side follow-up
-# now that `swarm.*` genuinely is swarm-wide-only.
 let
   # Content-addressed narrow source covering only the nix/ directory.
   # `builtins.unsafeDiscardStringContext` strips `self`'s store-path

nix/host-modules/hive-forge/default.nix

@@ -938,8 +938,8 @@ in
                 # its token file deleted to force a re-mint with the new
                 # scope.
                 #
-                # Token name carries a timestamp suffix rather than the
+                # Token name carries a timestamp suffix rather than a fixed
-                # fixed `swarm-controller-boot` this used to be — a real
+                # `swarm-controller-boot` — a real
                 # incident, not a hypothetical: deleting the token *file*
                 # (the remediation above) doesn't delete the token Forgejo
                 # already has under that name, so re-running this unit hit

nix/host-modules/hive-matrix-service.nix

@@ -33,11 +33,10 @@ in
         here only if you need a different server_name shape (e.g.
         `chat.example.org` for a bespoke hostname).
 
-        **Breaking change, and the one on this page that cannot be
+        **Changing this cannot be undone by rebuilding.** The default
-        undone by rebuilding.** This default has now moved twice — from
+        is the swarm domain, so a homeserver that minted ids under
-        `matrix.''${services.hyperhive.domain}`, then to the bare hive
+        another value (`matrix.''${services.hyperhive.domain}` or the
-        domain, and now to the swarm domain. Every existing homeserver
+        bare hive domain) must pin that value, e.g.
-        must pin whichever value it already minted ids under, e.g.
 
         ```nix
         services.hyperhive.swarm.matrix.serverName =
@@ -121,13 +120,11 @@ in
         through `.well-known`. `serverName` is the matrix-identifier
         domain embedded **irrevocably** in every user and room id —
         adopting a new one is a different homeserver, not a rename.
-        Both defaults now sit under the swarm domain, but only this
+        Both defaults sit under the swarm domain, but only this
-        one is safe to move on a running deployment.
+        one is safe to change on a running deployment.
 
-        A deployment that was running before this moved keeps its
+        To use the per-hive name `matrix.''${services.hyperhive.domain}`
-        current name by pinning
+        instead, pin it here.
-        `matrix.''${services.hyperhive.domain}` here — exactly what the
-        old default rendered.
       '';
     };
 

nix/host-modules/hive-tls.nix

@@ -131,7 +131,7 @@ let
     # than a stale one — its own vhosts are covered by the hive leaf
     # above. Anywhere else it is expected: the leaf comes from the
     # secret store's `pki` mount now, not from a sub-CA that exists on
-    # one host in the swarm, so "this host cannot issue it" is no longer
+    # one host in the swarm, so "this host cannot issue it" is not
     # one of the answers.
     want_svc=${if localServiceDomains == [ ] then "0" else "1"}
 

nix/host-modules/swarm-grafana-service.nix

@@ -17,7 +17,7 @@ let
   domainBase = if swarmDomain == null then "invalid" else swarmDomain;
 in
 {
-  # `enable` moved to `services.hyperhive.deploy.grafana.enable` — see
+  # `enable` is `services.hyperhive.deploy.grafana.enable` — see
   # ./deploy.nix. Whether this host runs the swarm's Grafana is a
   # deployment decision, and `swarm.*` has to be identical on every host.
   # Here is what the service IS to every hive: the name it is served under,

nix/host-modules/swarm-nats-service.nix

@@ -13,13 +13,13 @@ let
 in
 {
   options.services.hyperhive.swarm.nats = {
-    # `enable` moved to `services.hyperhive.deploy.nats.enable` — see
+    # `enable` is `services.hyperhive.deploy.nats.enable` — see
     # ./deploy.nix. What the queue IS to every hive: its domain, ports
     # and client id.
 
     # ⚠️ Deliberately NO `package` option for the NATS server, anywhere —
     # not here and not under `deploy.nats` either, where every other
-    # service's build now lives. `services.nats` upstream does not expose
+    # service's build lives. `services.nats` upstream does not expose
     # one; it resolves `pkgs.nats-server` itself, so an option would be
     # ignored or need an overlay to mean anything, and an option that does
     # not control what it names is worse than its absence. Pin the build

nix/module-eval/bao-controller.nix

@@ -46,8 +46,8 @@ let
   controllerNoStore = hive { deploy.swarm-controller.enable = true; };
 
   # A deployment that pinned `gatewayHost` away from its own swarm-domain
-  # default (`hive-matrix-service.nix`'s own doc: "a deployment that was
+  # default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name
-  # running before this moved keeps its current name by pinning ... here").
+  # ... instead, pin it here").
   # Only this fixture can tell "the controller reads gatewayHost" apart from
   # "the controller re-derives gatewayHost's default itself" — both render
   # the same URL on every other fixture in this file.