fix(#3245): resolve broken intra-doc links in hive-c0re

Remove or fix broken documentation links that accumulate silently:
- container_view.rs: HiveEnv reference
- forge/mod.rs: READY_TIMEOUT and webhook handler links
- workers/knowledge.rs: webhook handler link
- job_queue/model.rs: Claim::deps and WireNode::data references
- stats/hive_stats.rs: read_skill_breakdown reference
- stores/audit_log.rs: global() reference
- workers/agent_sockets.rs: ambiguous agent_sockets::write reference
- coordinator.rs: systemd.services.<harness> formatting
- resource_limits.rs: ambiguous write/read references

Some broken links were to deleted functions/types; these are replaced
with prose descriptions. Others referenced items outside this crate or
were private; these are replaced with plain text references or qualified
paths as appropriate.

Fixes: #3245

hive-c0re/src/agent_config/resource_limits.rs

@@ -225,8 +225,8 @@ pub fn write(map: &BTreeMap<String, AgentLimits>) -> std::io::Result<()> {
 ///
 /// # Errors
 ///
-/// Propagates whatever [`write`] fails with. An unreadable or malformed
-/// existing file is *not* an error — [`read`] degrades to an empty map,
+/// Propagates whatever the `write` function fails with. An unreadable or malformed
+/// existing file is *not* an error — the `read` function degrades to an empty map,
 /// so this call rewrites the file from scratch.
 pub fn set_limits(name: &str, limits: &AgentLimits) -> std::io::Result<()> {
     let mut current = read();

hive-c0re/src/container_view.rs

@@ -89,7 +89,7 @@ pub struct ContainerView {
 ///
 /// Takes `hive` because the effective resource limits are a per-field
 /// fallback onto the hive-wide `agent_cpu_quota` / `agent_memory_max`,
-/// and those live on [`HiveEnv`], not on disk. Both callers already
+/// and those live on [`crate::coordinator::HiveEnv`], not on disk. Both callers already
 /// hold a `Coordinator`, so this is a parameter rather than a global.
 pub async fn build_all(hive: &crate::coordinator::HiveEnv) -> Vec<ContainerView> {
     let raw = lifecycle::list().await.unwrap_or_default();

hive-c0re/src/coordinator.rs

@@ -81,7 +81,7 @@ pub struct Coordinator {
     /// Operator pronouns (free text) — `she/her` by default, set via
     /// the NixOS module option `services.hive-c0re.operatorPronouns`.
     /// Reaches each container as the `HIVE_OPERATOR_PRONOUNS` env var
-    /// (injected into systemd.services.<harness>.environment by the
+    /// (injected into `systemd.services.<harness>.environment` by the
     /// meta flake); the harness substitutes it into the agent /
     /// manager system prompt at boot.
     pub operator_pronouns: String,

hive-c0re/src/forge/mod.rs

@@ -373,7 +373,7 @@ async fn ensure_all_orgs_and_repos(token: &str) {
     ci_runner::ensure_ci_runner_registered(token).await;
 }
 
-/// Poll the local Forgejo API until it answers, bounded by [`READY_TIMEOUT`].
+/// Poll the local Forgejo API until it answers, with a timeout of 1 minute.
 /// The whole boot provisioning below hits the API, and [`is_present`] only
 /// confirms the container exists — not that Forgejo is *listening*. A
 /// `nixos-rebuild` that restarts hive-forge and hive-c0re together races:
@@ -489,7 +489,7 @@ pub async fn ensure_all() {
 ///
 /// `webhook_secret` is the HMAC secret Forgejo will attach as
 /// `X-Hub-Signature-256` on each delivery; hive-c0re verifies this header
-/// in [`crate::dashboard::webhook::post_webhook_config_pr`].
+/// in the dashboard webhook handler (`post_webhook_config_pr`).
 ///
 /// An org-level hook covers every repo in `agent-configs` automatically,
 /// so no per-repo setup is needed as new agents are provisioned.

hive-c0re/src/job_queue/model.rs

@@ -274,7 +274,7 @@ pub enum NodeKind {
     ///
     /// Weak-edged (`DepWhen::AFTER_ANY`) like [`NodeKind::DeployTail`], so it runs on
     /// success, failure **and cancel** alike and decides internally. It reads its
-    /// dependencies' terminal states off its own [`Claim::deps`] rather than
+    /// dependencies' terminal states from the node's dependency list rather than
     /// re-deriving them from the world the way `DeployTail` reads git: a node is
     /// *told* how the work it follows ended, it does not go back out and ask.
     ///
@@ -324,7 +324,7 @@ pub enum NodeKind {
 
 /// How a hive-c0re node describes itself to a generic graph viewer.
 ///
-/// Every field in [`WireNode::data`] here used to be a named column on
+/// Every field in the wire node's `data` representation here used to be a named column on
 /// `NodeView`, meaningful for one node kind and `null` on all the others. As
 /// free-form data it costs the wire type nothing, and a generic consumer
 /// renders it without knowing what any of it means.

hive-c0re/src/stats/hive_stats.rs

@@ -212,8 +212,8 @@ pub struct HiveStats {
     pub bash_mix: Vec<KeyCount>,
     /// Most-triggered skills (fully-qualified `plugin:skill-name`) across
     /// the whole swarm, busiest first, capped to 10. Sourced from each
-    /// agent's `tool_call_breakdown_json` — see [`read_skill_breakdown`].
-    /// Empty until at least one agent has actually invoked a skill.
+    /// agent's `tool_call_breakdown_json`. Empty until at least one agent has
+    /// actually invoked a skill.
     pub skill_mix: Vec<KeyCount>,
 }
 

hive-c0re/src/stores/audit_log.rs

@@ -14,8 +14,8 @@
 //! signal the operator actually wants.
 //!
 //! Same process-singleton handle pattern as `build_logs`: installed once
-//! at `Coordinator::open`, fetched via [`global`] so the recording sites
-//! (e.g. `socket_server::handle_restart_infra`) don't have to thread an
+//! at `Coordinator::open`, and fetched by recording sites (e.g.
+//! `socket_server::handle_restart_infra`) so they don't have to thread an
 //! `Arc<AuditLog>` through every call path. Recording is best-effort: a
 //! sqlite blip must never fail the underlying privileged action.
 

hive-c0re/src/workers/agent_sockets.rs

@@ -56,7 +56,7 @@ pub fn agent_dir_for(name: &str) -> PathBuf {
 
 /// Compute the deterministic socket path for an agent. Pure function
 /// of the agent name so the value matches whatever
-/// [`agent_sockets::write`] writes for that agent, and whatever the
+/// [`write`] writes for that agent, and whatever the
 /// harness binds via `HIVE_WEB_SOCKET`.
 #[must_use]
 pub fn socket_path_for(name: &str) -> PathBuf {

hive-c0re/src/workers/knowledge.rs

@@ -153,7 +153,7 @@ async fn seed_readme(core_token: &str) -> Result<()> {
 ///
 /// `webhook_secret` is the HMAC secret Forgejo will attach as
 /// `X-Hub-Signature-256` on each delivery; hive-c0re verifies this header
-/// in [`crate::dashboard::webhook::post_webhook_knowledge`].
+/// in the dashboard webhook handler (`post_webhook_knowledge`).
 ///
 /// Called at startup alongside [`ensure_local_clone`]. No-op when the
 /// core token is absent (forge not yet provisioned).