diff --git a/docs/conventions.md b/docs/conventions.md
index fe2ef6e7..839d6eaa 100644
--- a/docs/conventions.md
+++ b/docs/conventions.md
@@ -408,7 +408,8 @@ bypass the operator approval gate.
 **Adding a new capability** — add a variant to `Capability` in
 `hive-sh4re/src/lib.rs` + an arm to `as_str`. Add it to `Capability::ALL` (the
 source of truth for the permissions UI columns). Implement the access check in
-the relevant handler (`agent_server.rs`, `mcp.rs`, or `dashboard.rs`).
+the relevant handler (`agent_server.rs`, `mcp.rs`, or a handler under
+`hive-c0re/src/dashboard/`).
 
 ## Async forms
 
@@ -441,7 +442,7 @@ sufficient to recover.
 ## Actions are factored
 
 `approve` / `deny` / `destroy` (and the lifecycle helper) live in
-`actions.rs` / `dashboard.rs`. The admin socket and the dashboard
+`actions.rs` / `hive-c0re/src/dashboard/`. The admin socket and the dashboard
 POST handlers both call into them so the two surfaces never drift.
 
 ## Commit messages
diff --git a/docs/web-ui/shape.md b/docs/web-ui/shape.md
index 718010d1..97d0b410 100644
--- a/docs/web-ui/shape.md
+++ b/docs/web-ui/shape.md
@@ -198,7 +198,8 @@ listener: read `data-confirm`, swap the button to a spinner, POST
 `application/x-www-form-urlencoded`, re-enable the button on success
 (refreshState may keep the form mounted, so we don't rely on a
 re-render), call `refreshState()`. State shapes live in
-`dashboard.rs::StateSnapshot` and `web_ui/state.rs::StateSnapshot` — when
+`hive-c0re/src/dashboard/state_snapshot.rs::StateSnapshot` and
+`web_ui/state.rs::StateSnapshot` — when
 adding state fields, plumb through the snapshot struct and the
 relevant domain module (`assets/swarm.js`, `assets/call.js`, etc.) render function.