docs: name the matrix host options by their new path

Every prose and error-message reference to the moved options, including
two in hive-c0re/src/matrix.rs that omitted the services. prefix and so
read as the per-agent option. An error that names an option the operator
cannot find is worse than no hint.

docs/matrix.md

@@ -3,7 +3,7 @@
 Private Matrix homeserver (matrix-tuwunel — the conduwuit
 successor) wrapped in a nixos-container, plus optional fluffychat-web
 client at `matrix.<hive>/`. Configured via
-`services.hyperhive.matrix.*`; vhost routing lives in
+`services.hyperhive.swarm.matrix.*`; vhost routing lives in
 [`gateway.md`](gateway.md).
 
 ## Container shape
@@ -60,7 +60,7 @@ client needs to reach the client-server API directly.
 
 **Breaking change**: used to default to `true`. Operators relying on
 external reach must add
-`services.hyperhive.matrix.openFirewall = true;` before rebuilding.
+`services.hyperhive.swarm.matrix.openFirewall = true;` before rebuilding.
 
 Federation port 8448 is intentionally not opened here — tuwunel
 serves the federation API on the same `httpPort` as client-server
@@ -119,7 +119,7 @@ Initial rollout settings:
   `yes_i_am_very_very_sure_…_open_registration_…` flag keeps the
   server closed to anyone without the token.
 - `allow_encryption` — server-side E2EE switch, sourced from
-  `services.hyperhive.matrix.allowEncryption` (**default `false`**, opt-in).
+  `services.hyperhive.swarm.matrix.allowEncryption` (**default `false`**, opt-in).
   Off by default because on the hive-internal homeserver the operator
   already controls the transport; turn it on for encrypted rooms on
   external / federated homeservers or to keep contents opaque to the
@@ -168,7 +168,7 @@ re-creation (e.g. after a homeserver wipe).
 ## Configuration tuning
 
 ```nix
-services.hyperhive.matrix = {
+services.hyperhive.swarm.matrix = {
   trustedServers  = [ "matrix.org" "example.com" ];   # default: []
   maxRequestSize  = 20000000;                          # default: 20 MB
 };

docs/tools/hivectl.md

@@ -58,7 +58,7 @@ hivectl forge reconcile-config iris --verbose      # include the full diff, not
 
 Manual entry to the same idempotent matrix provisioning flow
 `hive-c0re` runs at boot. Requires the `hive-matrix` container to be
-running (`services.hyperhive.matrix.enable = true`).
+running (`services.hyperhive.swarm.matrix.enable = true`).
 
 ```bash
 hivectl matrix create-user iris         # provision (or re-provision) matrix account for agent `iris`
@@ -315,5 +315,5 @@ an error.
 A surface has no URL when it isn't browser-reachable: `home` needs
 `services.hyperhive.domain`; `forge` needs
 `services.hyperhive.forge.behindGateway = true`; `matrix` needs
-`services.hyperhive.matrix.gui.enable = true`. In those cases the command
+`services.hyperhive.swarm.matrix.gui.enable = true`. In those cases the command
 exits with a hint naming the option to set.

docs/web-ui/dashboard.md

@@ -679,9 +679,9 @@ existing in the page DOM.
 
 A static matrix web client (default `pkgs.fluffychat-web` rebuilt
 with `--base-href /matrix/`, swappable via
-`services.hyperhive.matrix.gui.package`) served by the hive-gateway
+`services.hyperhive.swarm.matrix.gui.package`) served by the hive-gateway
 nginx container at `/matrix/` when
-`services.hyperhive.matrix.gui.enable` is on (defaults to
+`services.hyperhive.swarm.matrix.gui.enable` is on (defaults to
 `matrix.enable`). c0re signals availability via the
 `HIVE_MATRIX_GUI_ENABLED` env var → `state.matrix_gui_enabled` in
 `/api/state`; the gateway does the actual static serving.

hive-c0re/src/dashboard/state_snapshot.rs

@@ -84,7 +84,7 @@ pub(super) struct StateSnapshot {
     forge_present: bool,
     /// Whether the matrix GUI is reachable at `/matrix/`. Sourced from
     /// `HIVE_MATRIX_GUI_ENABLED` env var (set by the c0re NixOS module
-    /// when `services.hyperhive.matrix.gui.enable` is on). The gateway
+    /// when `services.hyperhive.swarm.matrix.gui.enable` is on). The gateway
     /// (hive-gateway.nix) does the actual `/matrix/` static serving;
     /// this flag is just an availability signal for iris's dashboard
     /// chrome so the `M4TR1X →` tab doesn't flash when the GUI is off.

hive-c0re/src/matrix.rs

@@ -1,7 +1,8 @@
 //! Optional matrix-tuwunel wiring: shared registration token (host) +
 //! per-agent UIAA registration → `<agent-state>/matrix-token`. No-op
 //! when the `hive-matrix` container isn't running, so operators who
-//! haven't flipped `hyperhive.matrix.enable = true` pay nothing.
+//! haven't flipped `services.hyperhive.swarm.matrix.enable = true` pay
+//! nothing.
 //!
 //! See `docs/matrix.md::Provisioning flow (registration token)` for
 //! the full UIAA round-trip, token-file shape, and host/container
@@ -16,7 +17,7 @@ use crate::coordinator::Coordinator;
 
 /// Client-server API base this daemon provisions against, from
 /// `HIVE_MATRIX_API_URL` (set by `hive-c0re.nix` from
-/// `hyperhive.matrix.apiUrl`).
+/// `services.hyperhive.swarm.matrix.apiUrl`).
 ///
 /// `None` means **this hive has no homeserver to provision against** and
 /// every matrix path no-ops — see [`is_present`]. There is deliberately no
@@ -43,7 +44,8 @@ fn matrix_http() -> Option<&'static str> {
 /// rather than the missing variable.
 fn matrix_base() -> Result<&'static str> {
     matrix_http().context(
-        "matrix: no homeserver configured (hyperhive.matrix.apiUrl / HIVE_MATRIX_API_URL) — \
+        "matrix: no homeserver configured \
+         (services.hyperhive.swarm.matrix.apiUrl / HIVE_MATRIX_API_URL) — \
          this path should have been gated on matrix::is_present()",
     )
 }

hive-c0re/src/server.rs

@@ -472,8 +472,8 @@ fn require_matrix_present() -> Result<()> {
         return Ok(());
     }
     anyhow::bail!(
-        "no matrix homeserver configured — set services.hyperhive.matrix.enable = true to run one \
+        "no matrix homeserver configured — set services.hyperhive.swarm.matrix.enable = true to run one \
-         here, or services.hyperhive.matrix.apiUrl to point at an existing one, before \
+         here, or services.hyperhive.swarm.matrix.apiUrl to point at an existing one, before \
          provisioning matrix users"
     )
 }

hivectl/src/open.rs

@@ -30,7 +30,7 @@ pub(crate) async fn open_url(socket: &Path, target: OpenTarget) -> Result<()> {
         ),
         OpenTarget::Matrix => (
             urls.matrix,
-            "the matrix GUI URL needs `services.hyperhive.matrix.gui.enable = true`",
+            "the matrix GUI URL needs `services.hyperhive.swarm.matrix.gui.enable = true`",
         ),
     };
     let url = url.with_context(|| format!("no URL available for this surface — {hint}"))?;