docs: state current behaviour without change-log wording

docs/agent-lifecycle/persistence.md

@@ -215,7 +215,7 @@ Three indices:
 - `(node_id)` — added by a later migration so a build log row can be
   looked up by the job-queue node it belongs to (a `hive_jobq` node is
   immutable after insert, so hive-c0re records the link on the log row
-  instead); rows predating the column have `node_id IS NULL`.
+  instead); `node_id` is nullable.
 
 Writes are best-effort: `append_stdout` / `append_stderr` / `finish`
 log a warning on sqlite error and let the build continue. A failed
@@ -298,11 +298,9 @@ Under `/var/lib/hyperhive/agents/<name>/`:
     `hive-forge-notify` — upsert keyed todos here over the harness's
     in-agent socket, `HIVE_AGENT_SOCKET`; the harness merges them into
     `get_loose_ends` output and clears a row on `mark_todo_done`).
-    Consolidates todos and reminders into one file. A one-time boot
-    migration (`db_migrate::run`) folds any pre-existing files
-    (`hyperhive-todos.sqlite`, `hyperhive-reminders.sqlite`, the older
-    file-based `mcp-loose-ends/` scanner) into this path the first time
-    a harness boots. Also backs the `mcp__hyperhive__remind` queue.
+    At boot, `db_migrate::run` creates this file from
+    `hyperhive-todos.sqlite` and `hyperhive-reminders.sqlite` when those
+    are present. Also backs the `mcp__hyperhive__remind` queue.
 
     The harness itself is also a producer, not just the socket server:
     boot wiring's `spawn_todo_socket` starts `todo_server::run` (the
@@ -507,9 +505,8 @@ reinstall.
 
 The harness runs as a per-agent unix user inside the container
 (`services.hyperhive.agent.user.name`, defaults to the agent's logical label so each
-container has a uniquely named user). Operators with root-owned
-state dirs need a one-time data shuffle so they don't lose their claude
-session.
+container has a uniquely named user). The activation script below
+moves root-owned state to the agent user so the claude session survives.
 
 `system.activationScripts.hive-agent-user-migrate` (in
 `nix/agent-modules/user.nix`) runs on every activation,
@@ -543,8 +540,6 @@ container lifetime:
    there as the agent user. Why the mode matters:
    [`boundary.md`](../trust-boundary/boundary.md#the-per-agent-socket-dir).
 
-The activation script migrates any root-owned state dir still present.
-
 ## Matrix per-agent daemon + token-arrival trigger
 
 `hive-matrix-daemon` is a long-running matrix-sdk Client + sync

docs/tools/forge.md

@@ -281,7 +281,7 @@ to discover valid label names before triaging or to audit the label set.
   falling back. `--job` selects the job (0-based, default 0);
   `--attempt` picks the run attempt for the durable path (default 1;
   re-runs increment it). `--json` wraps the output.
-- `ci-rerun` re-runs CI without pushing an empty commit: it dispatches a
+- `ci-rerun` re-runs CI: it dispatches a
   **fresh** run of the workflow via the workflow-dispatch API
   (`POST …/actions/workflows/<workflow>/dispatches {"ref":"<branch>"}`).
   Resolve the branch with `--run <n>` (the same run number `ci-log` /

docs/tools/matrix.md

@@ -98,9 +98,7 @@ route refuses to create an account by that name.
 mechanism behind "accounts are the enable signal": an agent with no
 homeserver and no account of its own has an empty set, so it gets no
 daemon, no path watcher and no injected MCP entry. That's how you give
-an agent no matrix tools. Setting
-`services.hyperhive.agent.matrix.enable` fails evaluation with a
-message saying so. Declaring an external account with
+an agent no matrix tools. Declaring an external account with
 its own `homeserver` is enough on its own; a hive homeserver isn't
 required.
 

docs/trust-boundary/boundary.md

@@ -122,8 +122,7 @@ container's own activation (`hive-agent-user-migrate`) then chowns it to
 the agent user and sets `0751`. The container has no user namespace, so
 that uid is the host inode's owner. Don't add a host-side chown or chmod:
 two owners of one path revert each other. Until the container activates,
-the dir is `0751 root`: nothing but root can plant a socket in it, and a
-root-run harness can still bind.
+the dir is `0751 root`: nothing but root can plant a socket in it.
 
 <!-- vale write-good.Passive = YES -->
 

docs/web-ui/agent.md

@@ -161,8 +161,6 @@ the checked ids to `POST /api/todos/mark-done`, which dismisses them
 from the harness-local store (same effect as `cancel_loose_end(kind:
 "todo")`, just from the web UI instead of the agent's own tool calls).
 
-The todos flyout is the only per-agent flyout.
-
 ## Live view
 
 Each agent runs an `events::Bus`: a `tokio::sync::broadcast<LiveEvent>`