describe core/meta as the legacy permission repo; drop stale meta-flake prose

Comments, docs and the hive-c0re README no longer say the hive renders, locks or pushes a meta flake. core/meta is the legacy permission-seed repo that meta::remove_permission_files still commits to; builds come from internal/meta (meta_rev.rs). Docs note that a start of a stale stopped agent can fail until the swarm's update pins the config.

hive-c0re/src/forge/mod.rs

@@ -1,5 +1,6 @@
-//! Optional Forgejo wiring — the `core/meta` repo and meta read-access
-//! grants. Those writes, as `core`, run only beside a local `hive-forge`
+//! Optional Forgejo wiring — the legacy `core/meta` repo (the hive's old
+//! permission-seed repo, which `meta::remove_permission_files` still commits
+//! to) and its read-access grants. Those writes, as `core`, run only beside a local `hive-forge`
 //! container; reads of the forge go through [`reader_token`] on every hive.
 //! The swarm-wide orgs, teams and repos, and each agent's read grant on
 //! `internal/docs`, are swarm-controller's. Full design:
@@ -215,8 +216,8 @@ where
         .map_err(|_| anyhow::anyhow!("{op}: no answer from the forge within {API_TIMEOUT:?}"))
 }
 
-/// Per-agent forge sync: grant read access to `core/meta`, and wire the
-/// `meta` remote in its proposed repo. All operations are idempotent;
+/// Per-agent forge sync: grant read access to the legacy `core/meta`, and wire
+/// the `meta` remote in its proposed repo. All operations are idempotent;
 /// failures are logged as warnings but don't abort the caller.
 ///
 /// `core_token` is `core_token()` — passed in so callers that already
@@ -234,8 +235,9 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
     // swarm-controller's; this hive creates none of them and pushes nothing
     // to the repo.
     let mut ok = true;
-    // Grant read-only access to core/meta and wire the `meta` remote
-    // into the proposed repo so agents can fetch their deployment context.
+    // Grant read-only access to the legacy core/meta and wire the `meta`
+    // remote into the proposed repo. Agents build from `internal/meta`, not
+    // from this repo.
     if let Some(token) = core_token
         && let Err(e) = meta_read_access(name, token).await
     {
@@ -249,7 +251,7 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
     ok
 }
 
-/// The `core_token.is_some()` half of [`ensure_all`]: the meta repo, the
+/// The `core_token.is_some()` half of [`ensure_all`]: the legacy meta repo, the
 /// core avatar, and removing this hive's own config-PR hook —
 /// every step that needs an authenticated forge client. The swarm-wide
 /// objects (orgs, the `operators` team, mirrors, `internal/docs`,
@@ -258,9 +260,9 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
 /// `ensure_all` under clippy's function-length limit; not meant to be called
 /// from anywhere else.
 async fn ensure_all_orgs_and_repos(token: &str) {
-    // Meta repo lives at core/meta — pushed from git_commit in
-    // meta.rs on every deploy/lock-update. Make sure it exists
-    // before the first push hits a 404.
+    // The legacy meta repo lives at core/meta. The only push to it is
+    // `meta::remove_permission_files`' commit; make sure the repo exists
+    // before that push hits a 404.
     if let Err(e) = ensure_repo("meta", token).await {
         tracing::warn!(error = ?e, "forge: ensure_repo core/meta failed");
         crate::warnings::set_boot_warning(
@@ -380,7 +382,7 @@ async fn wait_until_ready() -> bool {
 }
 
 /// Sweep the forge at startup: seed the `core` admin user (hive-c0re's own
-/// identity for pushing the meta repo + driving the API) and its token, the
+/// identity for pushing the legacy meta repo + driving the API) and its token, the
 /// `core/meta` repo and the local knowledge clone, then run [`sync_agent`]
 /// over every existing container (manager + sub-agents). Agent accounts,
 /// tokens and `agent-configs/<name>` repos are the swarm-controller's, as is

hive-c0re/src/forge/reconcile.rs

@@ -6,7 +6,7 @@
 //!
 //! `Status` is read-only (fetches forge `main` into a scratch ref, reports
 //! the divergence). `Apply(Forge)` resets the local applied checkout to
-//! forge `main`; the meta flake pins forge `main` itself, not this tree. It
+//! forge `main`; `internal/meta` pins forge `main` itself, not this tree. It
 //! does NOT auto-deploy. `Apply(Local)` is not supported: forge `main` is
 //! branch-protected, so it only advances through a config-PR merge.
 

hive-c0re/src/forge/repos.rs

@@ -89,11 +89,12 @@ pub async fn ensure_repo(name: &str, token: &str) -> Result<()> {
 }
 
 /// Dashboard-warning guard for the meta non-fast-forward condition.
-/// Held while `core/meta` remote is ahead of our local mirror; cleared
+/// Held while the `core/meta` remote is ahead of our local mirror; cleared
 /// automatically when the next push succeeds.
 static META_NON_FF_GUARD: Mutex<Option<crate::warnings::WarningGuard>> = Mutex::new(None);
 
-/// Push `dir` (the meta repo) to `core/meta` on the local forge.
+/// Push `dir` (the legacy hive meta repo) to `core/meta` on the local forge.
+/// Its one caller is `meta::remove_permission_files`' commit.
 /// Best-effort: returns Err which callers log + ignore. No-op when
 /// the core token isn't present yet (forge container not provisioned).
 pub async fn push_meta(dir: &Path) -> Result<()> {
@@ -150,7 +151,7 @@ pub async fn push_meta(dir: &Path) -> Result<()> {
 }
 
 /// Grant agent `name` read-only collaborator access to `core/meta` on
-/// the forge so the agent can clone/fetch the meta flake. Idempotent:
+/// the forge so the agent can clone/fetch that legacy repo. Idempotent:
 /// re-adding an existing collaborator succeeds (Forgejo answers 204
 /// either way).
 pub async fn meta_read_access(name: &str, core_token: &str) -> Result<()> {
@@ -168,7 +169,7 @@ pub async fn meta_read_access(name: &str, core_token: &str) -> Result<()> {
 
 /// Add the forge `core/meta.git` URL as the `meta` remote in the
 /// agent's proposed config repo so the agent (and the manager) can
-/// fetch the meta flake from the forge. Idempotent: no-op when the
+/// fetch that legacy repo from the forge. Idempotent: no-op when the
 /// remote already points at the right URL, or when the proposed repo
 /// does not exist yet. No-op when the forge is not running.
 pub async fn ensure_meta_remote(name: &str) -> Result<()> {

hive-c0re/src/matrix.rs

@@ -65,7 +65,7 @@ fn matrix_base() -> Result<&'static str> {
 ///
 /// # Errors
 /// When `HYPERHIVE_HIVE_NAME` is unset or empty. That is the same variable
-/// [`stored_sender_token`] logs in with and `hive-c0re`'s meta flake asserts
+/// [`stored_sender_token`] logs in with and the swarm meta flake asserts
 /// for every hive, so its absence is a broken deployment rather than a
 /// supported one — and there is no safe default to fall back to: the only one
 /// available is the shared account this replaced.

hive-c0re/src/stores/power.rs

@@ -11,7 +11,7 @@
 //! queued node: operator/intent actions update the row synchronously
 //! at request time, then submit the DAG whose terminal `Reconcile`
 //! reads the fresh value — rapid toggles are last-writer-wins and the
-//! reconciles converge. Power toggles never commit to the meta repo.
+//! reconciles converge.
 
 use std::path::Path;
 use std::sync::Mutex;