docs(readmes): fix stale facts in remaining crate READMEs + gotchas

- frontend/README.md: list the missing packages/swarm-ui package, fix
  the vanilla-JS claim (all packages depend on preact), and the
  deprecated hyperhive.frontend.extraFiles spelling
- hive-c0re/README.md: hive-c0re no longer provisions per-agent
  forge/matrix accounts (swarm-controller does); it wires gateway
  vhosts and reconciles forge/matrix config
- hive-metric/README.md: OTEL_EXPORTER_OTLP_HEADERS is never set by
  the harness and has no way to be set
- hive-agent-sock/README.md: fix the deprecated
  hyperhive.extraMcpServers spelling
- docs/process/gotchas.md: fix a dangling hive-ag3nt/ path, the real
  directory is hive-agent/

Also fixes pre-existing vale error-level alerts (passive voice,
Microsoft.Auto, Microsoft.Contractions) in the same files so
prose-lint-errors passes clean.

docs/process/gotchas.md

@@ -333,7 +333,7 @@ CI on drift).
 system-prompt template + claude-settings JSON as its own derivation,
 separate from the hive-ag3nt / hive-c0re crates. Reason: when the
 rust build's `src` was the whole repo tree, any tweak to
-`branding/agent-configs.svg` or `hive-ag3nt/prompts/system.md`
+`branding/agent-configs.svg` or `hive-agent/prompts/system.md`
 invalidated the cargo cache and forced a full rebuild. crane (and
 naersk before it) couldn't see "these inputs are unused by rust" on
 its own — the split breaks the coupling at the derivation boundary.

frontend/README.md

@@ -2,11 +2,13 @@
 
 npm workspaces project for the hyperhive browser-facing assets:
 
-- `packages/shared/` — shared modules used by both surfaces (terminal
+- `packages/shared/` — shared modules used by every surface (terminal
   pane, Catppuccin palette + body typography).
 - `packages/dashboard/` — the hive-c0re dashboard SPA.
 - `packages/agent/` — the per-container web UI (default agent page,
   stats, screen).
+- `packages/swarm-ui/` — the swarm-level operator UI shell (project-
+  bootstrap scope, no functionality yet).
 
 ## Build
 
@@ -16,18 +18,19 @@ npm run build          # builds every workspace into packages/*/dist/
 ```
 
 The Rust binaries serve `packages/dashboard/dist/` and
-`packages/agent/dist/` via `tower_http::ServeDir` at runtime; the
+`packages/agent/dist/` via `tower_http::ServeDir` at runtime;
-build derivation is wired up in `nix/packages/frontend.nix`. Per-agent
+`nix/packages/frontend.nix` wires up the build derivation. The
-additions are layered on top of the default agent dist via the
+`services.hyperhive.agent.frontend.extraFiles` option in `agent.nix`
-`hyperhive.frontend.extraFiles` option in `agent.nix`.
+layers per-agent additions on top of the default agent dist.
 
 ## Why npm + esbuild
 
 - **Hermetic**: dependencies vendored via the checked-in lockfile;
   `buildNpmPackage` in nix uses it as the source-of-truth so the
   output is reproducible without network access at build time.
-- **esbuild**: vanilla-JS bundler, no framework runtime overhead.
+- **esbuild**: each package is a small Preact app, bundled with no
-  Each workspace's `build.mjs` is ~30 lines.
+  framework beyond Preact itself. Each workspace's `build.mjs` is ~30
+  lines.
 - **Single-PR migration**: see the tracked design proposal and
   the four-commit shape (npm scaffold → nix derivations → container
   plumbing → Rust cutover).

hive-agent-sock/README.md

@@ -14,24 +14,25 @@ Unlike the host-served sockets, this one **never leaves the container**.
 - the loose-ends-v2 **todo** op family
 - the harness-local **reminder** op family
 
-More in-agent request families may be added over time — the socket is
+More in-agent request families may show up over time — the socket is
 deliberately named for the agent, not for the todos.
 
 **Why in-container**: the harness owns the todo + reminder stores locally and
-signals its own turn loop directly, so `hive-c0re` is not in either path: no
+signals its own turn loop directly, so `hive-c0re` isn't in either path: no
 broker round-trip, no long-poll, no marker files. That locality is the
 point — it's also what lets these stores travel with the agent for hive
 portability.
 
-**Not to be confused with `hive-core-agent-sock`**: that crate is the
+**Don't confuse this with `hive-core-agent-sock`**: that crate is the
 _host_-served core↔agent protocol on `/run/hive/mcp.sock` (the harness
 talking out to `hive-c0re`). This socket is purely intra-container.
 
-## `extra_mcp`: the `hyperhive.extraMcpServers` spec
+## `extra_mcp`: the `services.hyperhive.agent.extraMcpServers` spec
 
 Not a socket protocol — a shared config type. Parses
-`/etc/hyperhive/extra-mcp.json` (the nix-rendered `hyperhive.extraMcpServers`
+`/etc/hyperhive/extra-mcp.json` (the nix-rendered
-option) and renders each entry into the shape claude expects in a
+`services.hyperhive.agent.extraMcpServers` option) and renders each
+entry into the shape claude expects in a
 `--mcp-config` blob. Shared by `hive-agent` (the main session's servers) and
 `hive-subagent-mcp` (the subagent-eligible subset, gated on
 `availableToSubagents`) — both already depend on this crate for the socket

hive-c0re/README.md

@@ -2,15 +2,17 @@
 
 The unprivileged host daemon (runs as `hive-core`). Owns the sqlite
 broker, the approval/reminder/schedule queues, the generic job-DAG
-queue, container lifecycle, gateway/forge/matrix provisioning,
+queue, container lifecycle, gateway vhost wiring, forge/matrix config
-per-container stats, and the axum operator dashboard. Largest crate in
+reconciliation, per-container stats, and the axum operator dashboard.
-the workspace — bin-only, no separate lib.
+Largest crate in the workspace — bin-only, no separate lib.
 
 ## When to use it
 
 Host-level, cross-container orchestration: spawning/rebuilding/
 destroying agent containers, the approval flow, dashboard-visible
-state, provisioning per-agent forge/matrix/gateway accounts. Agent-side
+state, wiring each agent's gateway vhost and reconciling its forge
+config-repo access and matrix room membership. The accounts themselves
+are swarm-controller's (`docs/integrations/forge.md`). Agent-side
 behavior (turn loop, MCP tools) lives in `hive-agent`/`hive-agent-mcp`
 instead — this daemon only talks to agents over the socket wire types
 in `hive-sh4re`.
@@ -31,7 +33,7 @@ to track it:
   flake generation.
 - **`stores/`** — sqlite-backed stores (broker, queues, audit, power).
 - **`workers/`** — background sweeps (crash watch, scheduled prompts,
-  auto-update, knowledge sync).
+  autoupdate, knowledge sync).
 - **`agent_config/`** — per-agent registries (tool groups,
   capabilities, resource limits, topology).
 - **`stats/`** — dashboard metrics aggregation + OTEL export.

hive-metric/README.md

@@ -15,12 +15,15 @@ scripts use it to record per-agent metrics.
 hive-metric <name> <value> [--type counter|gauge] [--labels key=value ...]
 ```
 
-Standard OTEL environment variables are read automatically by the SDK:
+The SDK reads standard OTEL environment variables automatically:
 
 - `OTEL_EXPORTER_OTLP_ENDPOINT` — collector URL (**required**)
-- `OTEL_EXPORTER_OTLP_HEADERS` — auth headers (`Key=Value,...`)
 - `OTEL_RESOURCE_ATTRIBUTES` — resource labels (`k=v,...`)
 
-The harness populates all of these per-agent when
+The harness populates both per-agent when
-`services.hyperhive.otel.enable = true`. See `docs/scheduler/observability.md` for the
+`services.hyperhive.otel.enable = true`. There's no
-collector setup and the metrics hyperhive exports.
+`OTEL_EXPORTER_OTLP_HEADERS` and no way to add one: an agent exports
+straight to its hive's own collector and holds no upstream credential
+to put there (`nix/agent-modules/otel.nix`). See
+`docs/scheduler/observability.md` for the collector setup and the
+metrics hyperhive exports.