docs/integrations: correct what runs at hive vs swarm level

knowledge.md: swarm-controller's site-admin account also pushes; the
clone no longer carries a token, the .git overlay hides history.
forge.md: the dashboard link follows swarm.forge.publicUrl; the poller's
HIVE_FORGE_URL gate is only unmet outside a nix-built hive.
matrix.md: the homeserver is the swarm's, not the hive's.

docs/integrations/forge.md

@@ -122,8 +122,9 @@ Two things live in the `agent-configs` Forgejo organization:
   see [config-changes.md § Meta flake](../agent-lifecycle/config-changes.md#meta-flake)), fetching it as the `core`
   user via a git credential helper that reads the live forge-core token —
   so the config lives on the forge, not a hand-synced local checkout.
-- The dashboard links each container's "config" anchor to this
-  config repo, so operators can go straight from the SW4RM tab into
+- The dashboard links each container's deployed config commit to this
+  config repo on the swarm's forge (`swarm.forge.publicUrl`; `null` means no
+  link), so operators can go straight from the SW4RM tab into
   the rendered repo without an extra `git` step.
 
 The `hive-forge` CLI (separate workspace crate, see
@@ -205,8 +206,8 @@ read directly without a delivery — same `mark_read` call, no wake.
 
 The poller starts disabled and stays that way for any of:
 
-- `HIVE_FORGE_URL` not set (no forge configured for this hive), or
-  not parseable as a URL.
+- `HIVE_FORGE_URL` not set or not parseable as a URL (a hand-run
+  harness; hive-c0re sets it from `swarm.forge.domain` on every hive).
 - no token in `$HIVE_FORGE_TOKEN_FILE` or `<state>/forge-token` (agent has no forge
   account — pre-provisioning or destroy-without-purge race).
 - Initial client construction fails (the typed `forgejo-api` client
@@ -325,7 +326,7 @@ to `closed_at` that `state_change_is_current` returns `true` — so it takes
 the state-change path, dropping its body. Best of both worlds:
 on the merge/close path `forge_notify` fetches the `latest_comment_url` comment and, when
 its `created_at` is strictly **after** the subject's `closed_at`
-(`comment_is_after_close`) — that is, it raced the merge rather than being the
+(`comment_is_after_close`) — in other words, it raced the merge rather than being the
 pre-merge last comment the subject keeps — append it as a
 `comment by <author>: <excerpt>` block before the meta suffix
 (`fresh_post_close_comment_tail`). The wake carries **both** `[PR merged]`

docs/integrations/knowledge.md

@@ -30,7 +30,8 @@ the local clone updates automatically (see
 Canonical forge location: `internal/knowledge` (org `internal`,
 repo `knowledge`). The repo is public, so every agent's forge account
 has read access without an explicit per-agent collaborator grant;
-only the `core` account has push access.
+only site admins can push: `core`, and swarm-controller's own account,
+which seeds the README.
 
 The swarm controller creates the repo if it doesn't exist, at startup
 and every few minutes after, and seeds an empty one with a `README.md`
@@ -106,10 +107,10 @@ from the host clone on every container start. Gone when container
 is stopped; reappears on next start with the current clone state.
 <!-- vale write-good.Passive = YES -->
 
-The mount deliberately **excludes `.git`**: the host clone embeds the `core`
-token in `.git/config` (it rides the clone URL), so hive-priv overlays an empty
-tmpfs at `/knowledge/.git` — agents see the documents, not the repo metadata or
-token.
+The mount deliberately **excludes `.git`**: hive-priv overlays an empty
+tmpfs at `/knowledge/.git`, so agents see the documents, not the branches or
+history. An older clone also kept a token in `.git/config`; `knowledge::pull()`
+rewrites that remote to the plain URL.
 
 ## Contributing
 

docs/integrations/matrix.md

@@ -298,7 +298,7 @@ Initial rollout settings:
   `yes_i_am_very_very_sure_…_open_registration_…` is also set.
 - `allow_encryption` — server-side E2EE switch, sourced from
   `services.hyperhive.swarm.matrix.allowEncryption` (**default `false`**, opt-in).
-  Off by default because on the hive-internal homeserver the operator
+  Off by default because on the swarm's own homeserver the operator
   already controls the transport; turn it on for encrypted rooms on
   external / federated homeservers or to keep contents opaque to the
   homeserver admin. **The agent matrix client always supports decryption