diff --git a/nix/modules/hive-c0re.nix b/nix/modules/hive-c0re.nix
index dd9a047d..e260e3ec 100644
--- a/nix/modules/hive-c0re.nix
+++ b/nix/modules/hive-c0re.nix
@@ -32,12 +32,13 @@ in
   # hive-c0re and the on-by-default hyperhive subsystems.
   options.services.hyperhive.enable = lib.mkEnableOption "hyperhive — the agent swarm coordinator";
 
-  # Top-level option shared by any hyperhive subsystem that needs a
-  # stable hostname (matrix server_name today, forge ROOT_URL likely
-  # next). Type is nullable + default null so existing operator
-  # configs that don't set it still evaluate; subsystems that
-  # actually need it (matrix) assert non-null in their own config
-  # block with a helpful message.
+  # Canonical hive DNS domain shared by every subsystem that needs a
+  # stable hostname. Nullable + default null so existing configs
+  # evaluate unchanged; subsystems that need it (matrix) assert
+  # non-null in their own config block. Full identity-surface
+  # context (HYPERHIVE_HIVE_DOMAIN / HIVE_NAME / SWARM_NAME env-var
+  # chain → identity.rs → claude prompt): docs/conventions.md::
+  # Hive identity (label + domain + display names).
   options.services.hyperhive.domain = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -56,13 +57,11 @@ in
     '';
   };
 
-  # Display-name identities for the swarm + hive — distinct from the
-  # DNS domain above, which is the machine-readable address. The
-  # display names are how humans address the constellation in
-  # conversation (`pr1ma`, `constellat1on`); the DNS subdomain may
-  # carry the hive name as its leftmost label by convention but the
-  # convention isn't machine-readable. Both nullable + default null
-  # so existing deploys evaluate unchanged (#701).
+  # Human display names for hive + swarm. Distinct from the DNS
+  # domain above (machine-readable) — see
+  # docs/conventions.md::Hive identity for the
+  # domain-vs-name-vs-swarm distinction + the env-var
+  # propagation chain.
   options.services.hyperhive.hiveName = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
@@ -270,22 +269,15 @@ in
         HIVE_ASSETS_DIR = "${cfg.assets}/share/hyperhive";
       }
       // lib.optionalAttrs (config.services.hyperhive.domain != null) {
-        # Canonical hive DNS domain — surfaced to identity.rs as
-        # HYPERHIVE_HIVE_DOMAIN. meta.rs forwards the same env var
-        # into every sub-agent's harness service env so they all see
-        # a consistent qualified label (#589 + #701).
+        # Identity env vars threaded into c0re's own service env and
+        # forwarded by meta.rs into every sub-agent's harness env —
+        # full chain in docs/conventions.md::Hive identity.
         HYPERHIVE_HIVE_DOMAIN = config.services.hyperhive.domain;
       }
       // lib.optionalAttrs (config.services.hyperhive.hiveName != null) {
-        # Display name of this hive instance (#701). meta.rs
-        # forwards into sub-agent harness env so identity.rs can
-        # expose hive_name() to claude.
         HYPERHIVE_HIVE_NAME = config.services.hyperhive.hiveName;
       }
       // lib.optionalAttrs (config.services.hyperhive.swarmName != null) {
-        # Display name of the wider swarm this hive belongs to (#701).
-        # meta.rs forwards into sub-agent harness env so identity.rs
-        # can expose swarm_name() to claude.
         HYPERHIVE_SWARM_NAME = config.services.hyperhive.swarmName;
       }
       // lib.optionalAttrs config.services.hyperhive.forge.enable {
@@ -297,28 +289,17 @@ in
         HIVE_FORGE_URL = "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
       }
       // lib.optionalAttrs config.services.hyperhive.matrix.gui.enable {
-        # Availability flag for `/api/state.matrix_gui_enabled`. The
-        # gateway (hive-gateway.nix) does the actual static serving of
-        # fluffychat-web at `/matrix/`; c0re doesn't host the dist
-        # itself (#634, mara on PR #620). This env var just tells the
-        # dashboard chrome whether the GUI is reachable so iris's
-        # `M4TR1X →` tab doesn't show when the GUI is off.
+        # Availability flags read by the dashboard's `/api/state`.
+        # Matrix GUI lives entirely on the gateway nginx (matrix tab
+        # only shows when both flags are on). Gateway routing detail:
+        # docs/gateway.md::Vhost map.
         HIVE_MATRIX_GUI_ENABLED = "1";
       }
       // lib.optionalAttrs config.services.hyperhive.gateway.enable {
-        # Availability flag for `/api/state.gateway_enabled`. When
-        # true the dashboard builds same-origin `/agent/<name>/` links
-        # to the per-agent web UI (gateway proxies them); when false
-        # it falls back to direct `http://<hostname>:<port>/` TCP
-        # links (legacy / gateway-disabled ops). See
-        # `docs/gateway.md::Vhost map` for the routing shape.
+        # When true the dashboard builds same-origin `/agent/<name>/`
+        # links; when false it falls back to direct `<host>:<port>` TCP.
         HIVE_GATEWAY_ENABLED = "1";
       };
-      # Matrix GUI static serving lives entirely on the hive-gateway
-      # nginx since #609 — when gateway is off the operator opts out
-      # of matrix-GUI serving entirely (mara on PR #620: "if you
-      # disable gateway you have to static host that yourself
-      # somewhere"). c0re no longer touches /matrix/.
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --hyperhive-flake ${cfg.hyperhiveFlake} --dashboard-port ${toString cfg.dashboardPort} --operator-pronouns ${lib.escapeShellArg cfg.operatorPronouns} --context-window-tokens ${lib.escapeShellArg (builtins.toJSON cfg.contextWindowTokens)}";
         Restart = "on-failure";