build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

docs/web-ui/README.md

@@ -16,13 +16,13 @@ surfaces — Stats, the API docs and the swarm UI — and each of
 those pages links back to the dashboard.
 
 The dashboard is where you'll spend most of your time. It's a single
-page with five tabs:
+page with four tabs:
 
 - **4G3NTS** — every agent, live. This is the default tab and the one
   you'll check most.
-- **R3BU1LD QU3U3**, **M3T4 1NPUTS** and **BUILD L0GS** — the build
+- **R3BU1LD QU3U3** and **BUILD L0GS** — the build
   lifecycle: the rebuild queue with a live log of whatever is building,
-  the meta flake inputs you can bump, and the build log history.
+  and the build log history.
 - **K3PT ST4T3** — kept state from agents with no container
   (tombstones), with a purge button per entry.
 

docs/web-ui/dashboard.md

@@ -33,7 +33,7 @@ dashboard tab strip.
   `HIVE_AUTHELIA_PUBLIC_URL` (set from `services.hyperhive.swarm.authelia.url`).
   If the name doesn't load the avatar shows a question mark, and without the URL the
   popover has no links.
-- **Tab strip**: `◆ 4G3NTS ◆`, `◆ R3BU1LD QU3U3 ◆`, `◆ M3T4 1NPUTS ◆`,
+- **Tab strip**: `◆ 4G3NTS ◆`, `◆ R3BU1LD QU3U3 ◆`,
   `◆ BUILD L0GS ◆`, `◆ K3PT ST4T3 ◆`. In-page tabs only — ST4TS
   lives on its own page, reached from the pages menu. Count pills on
   4G3NTS (stale containers), R3BU1LD QU3U3 (rebuilds in flight) and
@@ -73,7 +73,7 @@ agent is stale.
 
 Passive / rare-interaction state. `kept.js` renders it from the
 `/api/state` snapshot and keeps it live from the `tombstones_changed`
-stream event. (Rebuild queue and meta inputs are dashboard tabs too —
+stream event. (The rebuild queue and build logs are dashboard tabs too —
 see below.)
 
 Per-container CPU, memory and disk load isn't shown in the hive UI. The
@@ -96,16 +96,16 @@ container is all hive-c0re can actually prove. Fixing it properly
 needs a recorded destroy — **deferred** to the swarm-controller /
 snapshot-storage rework where the problem changes shape.
 
-## Build tabs (`#rebuild`, `#meta`, `#buildlogs`)
+## Build tabs (`#rebuild`, `#buildlogs`)
 
-The build lifecycle — rebuild queue, live build log, meta inputs, and
-build log history — is three tabs of the dashboard: **R3BU1LD QU3U3**
-(`#rebuild`), **M3T4 1NPUTS** (`#meta`) and **BUILD L0GS**
+The build lifecycle — rebuild queue, live build log, and
+build log history — is two tabs of the dashboard: **R3BU1LD QU3U3**
+(`#rebuild`) and **BUILD L0GS**
 (`#buildlogs`). They live in `builds.js`, which `tabs.js` imports: the
 dashboard's one tab strip, `/api/state` snapshot and
 `/api/dashboard/stream` subscription serve them, with
-`rebuild_queue_changed`, `meta_inputs_changed` and `meta_update_running`
-on the stream alongside the dashboard's other kinds. The count pill on
+`rebuild_queue_changed` on the stream alongside the dashboard's other
+kinds. The count pill on
 R3BU1LD QU3U3 is the number of rebuilds in flight.
 The 4G3NTS tab does **not** read the graph endpoint, by design — the swarm
 view stays independent of job-queue internals. Its per-agent pending
@@ -115,7 +115,7 @@ handful of pre-tallied counts, not the graph. The banner's "view queue →"
 link goes to the `#rebuild` tab.
 
 **R3BU1LD QU3U3** — pending, in-flight, and recently settled container
-operations: rebuilds, meta-update cascades, and first-spawns. One
+operations: rebuilds and first-spawns. One
 operation runs at a time; the worker drains FIFO. **Is a mounted
 `JobqGraph`** (the shared generic graph-viewer Preact component,
 `@hive/shared/jobq-graph.js` — the same one swarm-ui uses) —
@@ -184,20 +184,6 @@ own container outside `#rebuild-queue-section` so the mounted
 `JobqGraph`'s own re-renders never disturb the open poll; it hides
 when nothing is building.
 
-**M3T4 1NPUTS** — inputs in `meta/flake.lock` the operator can
-selectively `nix flake update`, rendered as an indented tree:
-every fetched input at every depth (`hyperhive`,
-`hyperhive/nixpkgs`, `agent-<n>`, `agent-<n>/mcp-<x>`, …), each
-shown once at its shallowest path. `read_meta_inputs` walks the
-lock graph with a `visited` set, skipping `follows` aliases and rev-less
-nodes. A `select all / select none`
-control sits above the tree. Checking inputs + submitting bumps
-the lock in `/meta/` and rebuilds the selected agents in
-sequence; each outcome reaches the root agent as a `rebuilt`
-system event. `POST /meta-update`. While a lock-bump ripple runs,
-the panel shows a pulsing "⏳ meta-update running" banner and disables
-the update button (snapshot field `meta_update_running`,
-live event `meta_update_running`).
 
 **BUILD L0GS** — all-agents build log history. Lazy-loaded on first tab
 activation; autorefreshes when
@@ -378,7 +364,7 @@ life). Two consequences for anything rendering it:
   to rebuild-shaped work — `running_transients()` in hive-c0re is
   a status-only test (any `Running` node whose payload names a
   non-empty agent lights a pill), so work the operator never
-  triggered (a meta-update cascade, a crash-recover rebuild, a
+  triggered (a crash-recover rebuild, a boot-sweep rebuild, a
   lease-exempt `prebuild`) lights the same mechanism.
 
 Ops with no queue node behind them (destroy, migration) supply
@@ -575,8 +561,7 @@ below — some endpoints aren't in it yet.
 - `POST /api/cancel-reminder/{id}` — hard-delete a pending reminder.
 - `POST /api/retry-reminder/{id}` — re-arm a reminder whose delivery
   failed (clears the failure state so the scheduler retries).
-- `POST /api/meta-update` — `nix flake update` the selected
-  `meta/flake.lock` inputs, then rebuild the affected agents.
+
 - `GET /api/dashboard/stream` — unified live event channel:
   broker `sent` / `delivered`, plus the mutation events listed
   below. Each frame carries `seq`.
@@ -620,18 +605,12 @@ payload):
 - `tombstones_changed` (seq, tombstones: `Vec<TombstoneView>`) —
   full snapshot of destroyed-but-state-kept agents. Emitted on
   destroy, purge, and revive. The K3PT ST4T3 tab subscribes.
-- `meta_inputs_changed` (seq, inputs: `Vec<MetaInput>`) — full
-  snapshot of `meta/flake.lock` inputs. The M3T4 1NPUTS tab
-  subscribes; same shape as `GET /api/meta-inputs`.
-- `meta_update_running` (running: bool) — emitted when a
-  `nix flake update` ripple starts or completes. The M3T4 1NPUTS
-  tab uses this to show/hide the "⏳ meta-update running" banner.
+
 
 <!-- vale write-good.Passive = NO -->
 `/api/state` is **only fetched on cold-load and on the few
-forms that mutate non-event-derived state** (PURG3 +
-meta-update, since tombstones + meta_inputs aren't event-
-shaped yet). Every other section — transients,
+forms that mutate non-event-derived state** (PURG3, since
+tombstones aren't event-shaped yet). Every other section — transients,
 containers —
 derives from `/api/dashboard/stream` after the initial snapshot,
 maintaining its own client-side store and applying events on