diff --git a/CLAUDE.md b/CLAUDE.md
index 28e4272e..3171a4d5 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -51,6 +51,20 @@ hive-c0re/         host daemon + sibling operator CLI (lib + 2 bins)
                          (`spawn_poll`) re-fires the writer so the map
                          reconverges if a marker appears between
                          meta-sync ticks.
+  src/gateway_nginx.rs  runtime nginx include-file generator. Writes
+                         `/var/lib/hyperhive/gateway/agents.conf` (one
+                         `location /agent/<n>/` block per agent, UDS or
+                         TCP upstream) on every topology change; calls
+                         `systemd-run --machine=hive-gateway` to reload
+                         nginx. Idempotent — skips write + reload when
+                         the file content would not change.
+  src/priv_client.rs    async client for the `hive-priv` privileged-
+                         helper socket at `/run/hive/priv.sock`.
+                         One-shot connection-per-call: open socket,
+                         send one JSON line, read response, close.
+                         Exposes one async fn per operation; called by
+                         `lifecycle` for bind-mount manipulation during
+                         spawn / rebuild.
   src/agent_server.rs   per-sub-agent socket listener (long-poll Recv)
   src/broker.rs         sqlite Message store + intra-process broadcast
                          channel (`MessageEvent`) for `recv_blocking_batch` +
@@ -88,6 +102,13 @@ hive-c0re/         host daemon + sibling operator CLI (lib + 2 bins)
   src/bash_tasks_vacuum.rs  host-side hourly sweep of every agent's
                          harness/bash-tasks/ — deletes terminal task
                          trios (.json/.out/.err) older than 48h
+  src/build_logs.rs     sqlite-backed full build-log capture (stdout +
+                         stderr per `nixos-container` / `nix build`
+                         invocation). Process singleton opened by
+                         `Coordinator`; `lifecycle` appends lines live.
+                         Dashboard surfaces the log on expand. Backed by
+                         `/var/lib/hyperhive/build_logs.sqlite`; hourly
+                         retention sweep via the existing vacuum.
   src/crash_watch.rs    poll every 10s; fire HelperEvent::ContainerCrash
                          when a previously-running container disappears
                          without an operator-initiated transient (or a
@@ -141,6 +162,12 @@ hive-c0re/         host daemon + sibling operator CLI (lib + 2 bins)
                          `set_groups` + `groups_for` + `remove_agent`.
                          Wired into `render_flake` for `HIVE_TOOL_GROUPS`
                          injection; operator write via dashboard action.
+  src/capabilities.rs   per-agent capability grants — reads/writes
+                         `/var/lib/hyperhive/meta/capabilities.json`;
+                         `set_caps` + `caps_for` + `has_cap` +
+                         `remove_agent`. Wired into `render_flake` for
+                         `HIVE_CAPABILITIES` injection; operator write
+                         via dashboard P3RM1SS10NS tab.
   src/limits.rs         wire-protocol size limits (inline body cap,
                          reminder spill threshold) shared across agent
                          + manager sockets. Single source of truth.