fix Microsoft.Quotes vale findings - move punctuation inside quotes

Moved 27 instances of periods and commas from outside closing quote marks
to inside, following American-style punctuation placement. Changes span
across ~15 documentation files including integration, process, scheduler,
trust-boundary, and web-ui docs.

docs/integrations/matrix.md

@@ -278,7 +278,7 @@ Two subtle details worth knowing before touching either derivation:
   needs to hit `buildFlutterApplication`'s pub-get output
   (`.dart_tool/` in the build CWD). Walking up from a read-only
   `$src/` store path finds no `.dart_tool/` and errors with
-  "Couldn't resolve the package 'matrix'".
+  "Couldn't resolve the package 'matrix'."
 
 Drop both derivations when nixpkgs's flutter builder grows worker
 + emcc support upstream.

docs/process/conventions.md

@@ -331,7 +331,7 @@ clear them.
 `/var/lib/hyperhive/meta/tool-groups.json` (hive-c0re-owned, committed to the
 meta repo alongside `topology.json`). Format: `{ "alice": ["messaging", "meta",
 "inbox", "lifecycle"], "bob": ["messaging", "meta", "inbox"] }`. An absent entry
-means "use role default". Tool permissions are intentionally NOT configurable
+means "use role default." Tool permissions are intentionally NOT configurable
 from `agent.nix` — that file goes through the manager's approval flow, so
 letting it declare its own groups would let the manager grant itself any tool by
 submitting a config commit, bypassing the operator gate.
@@ -369,7 +369,7 @@ that allows the underlying resource access.
 **Config storage** — per-agent capabilities live in
 `/var/lib/hyperhive/meta/capabilities.json` alongside `tool-groups.json`.
 Format: `{ "atlas": ["read_host_journal"], "ruth": ["manage_root_agent"] }`.
-An absent entry means "no extra capabilities". `render_flake` in `meta.rs`
+An absent entry means "no extra capabilities." `render_flake` in `meta.rs`
 reads this file and injects `HIVE_CAPABILITIES` (comma-separated
 `snake_case` names) into each agent's systemd service env; absent entries emit
 no env var so agents without capabilities don't trigger a spurious rebuild.

docs/process/gotchas.md

@@ -439,7 +439,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   desktop-shell shows its click-to-unlock screen — useless for an
   agent desktop viewed over `/screen`. `idle-time=0` updates the
   idle timer with a 0ms delay, which
-  `wl_event_source_timer_update` treats as "disarm", so the
+  `wl_event_source_timer_update` treats as "disarm," so the
   compositor never goes idle and never locks.
 
 ## Nix docs pipeline

docs/process/pr-review-gate.md

@@ -6,7 +6,7 @@ human review that already happened.
 
 ## The gate has (up to) three parts, and they're per-repo settings
 
-Whether a PR can merge, and what counts toward "can", is configured
+Whether a PR can merge, and what counts toward "can," is configured
 per repo in its branch-protection settings — not a fact true of every
 hive or every repo. The pieces a repo _can_ require:
 
@@ -59,7 +59,7 @@ comment before approving; a stray style nit isn't the same category.
 
 Where a repo dismisses stale approvals on a new commit, a review you
 already gave stops counting the moment a follow-up commit lands — even
-one whose message reads as trivial ("just a wording fix", "just
+one whose message reads as trivial ("just a wording fix," "just
 trimming comments"). Re-diff and re-verify before submitting a fresh
 verdict; don't take a small-sounding commit message as an accurate
 description of the diff.

docs/scheduler/coordinator.md

@@ -192,7 +192,7 @@ rides the queue through that power layer, so intent, lease serialization,
 and crash-watch suppression can't drift per surface; the only direct starts
 left are the root-agent bootstrap and infra containers (no lease, no
 harness). Cancelling a still-queued power DAG reverts `wanted` to the
-observed state — a cancel means "don't do it", not "do it later". Agents
+observed state — a cancel means "don't do it," not "do it later." Agents
 without a row are seeded from observed state on first touch (running ⇒
 `Up`); destroy removes the row.
 

docs/scheduler/observability.md

@@ -274,7 +274,7 @@ recorded (every turn, always).
 Everything above is measured **per agent**, tagged with the hive it runs in.
 These three are measured per **hive**, and carry no `agent` label — so a hive
 that hosts no agents still reports, and "this hive is quiet" is
-distinguishable from "this hive is gone". Select them with
+distinguishable from "this hive is gone." Select them with
 `{hive!="",agent=""}`.
 
 | Metric                    | Unit | Kind  | Meaning                                                                                                              |

docs/swarm/ca.md

@@ -25,7 +25,7 @@ something a host assumes. Turn it on for an all-on-one-host deployment
 and the hierarchy costs no configuration.
 
 It defaults from `services.hyperhive.deploy.singleHostSwarm`, the single
-switch that says "this box is the whole deployment".
+switch that says "this box is the whole deployment."
 
 **A hive given neither artifact keeps the self-signed CA it has always
 had.** It serves TLS exactly as before and isn't part of a

docs/swarm/sso.md

@@ -124,7 +124,7 @@ nixos-container refuses to start a container whose bind source is
 missing, and this secret doesn't exist until authelia's first boot has
 run. Binding it would make the service wait on a file that waits on a
 container that starts after it — on a fresh hive, a permanent stall
-presenting as "the forge is broken", several layers from its cause.
+presenting as "the forge is broken," several layers from its cause.
 
 ### 2. Swarm-managed services
 

docs/swarm/ui.md

@@ -28,7 +28,7 @@ reader and to a certificate — so there is no separate option to pin.
 
 ## 🔑 You must be in the `admins` group
 
-**This is the step that separates "protected" from "locked out".** The
+**This is the step that separates "protected" from "locked out."** The
 vhost's `auth_request` asks authelia _"is there a session"_; the rule
 that makes it mean _"is this an operator"_ is an `access_control` entry
 requiring `group:admins`. An account without that group authenticates
@@ -46,13 +46,13 @@ would have meant those accounts silently failing a check they were
 supposed to pass.
 
 An account created without any group needs re-adding with the flag —
-`swarmctl` reads the existing entry out of `users.yml`, so the group is
+`swarmctl` reads the existing entry out of `users.yml,` so the group is
 what changes.
 
 Why a group and not a list of usernames: agents are getting authelia
 accounts of their own (matrix SSO), and _authenticated_ would then
 include every agent in the hive. The group is the only thing standing
-between "an operator's page" and "anyone with a session".
+between "an operator's page" and "anyone with a session."
 
 ## What it costs to be reachable
 

docs/tools/forge.md

@@ -151,7 +151,7 @@ distinct output shape — pick by what you need:
 Rule of thumb: **`view` first** when you're about to act on a thread (it
 shows everything and clears the unread guard so your follow-up `comment`
 isn't rejected); the JSON verbs (`issue`/`pr`) when a script needs one
-field; `pr-status` when the only question is "can I merge it".
+field; `pr-status` when the only question is "can I merge it."
 
 ### Contributing to a read-only repo (`clone` + `pr-create --agit`)
 

docs/trust-boundary/boundary.md

@@ -105,7 +105,7 @@ group**, which is why its mode is what it's:
 | `hive-c0re`         | dials `agent.sock` (todo wakes)          | traverse     |
 | the gateway's nginx | dials `web.sock`                         | traverse     |
 
-The last two land in "other", so the dir is **`0751`, owned by the
+The last two land in "other," so the dir is **`0751`, owned by the
 agent's container uid/gid** — `o=--x` is traverse without listing, and
 both sockets are `0666`, which is all a dialer needs.
 

docs/trust-boundary/security.md

@@ -6,7 +6,7 @@ The sections below document specific mechanisms (the state-file endpoint,
 nixbld isolation, privilege separation). This section frames the model they
 serve: **what hyperhive defends, what it deliberately doesn't, and where the
 operator is accepting risk.** It's the reference for "is it safe to give an
-agent capability X?".
+agent capability X?."
 
 ### The trust boundary is the container, not credential storage
 
@@ -23,8 +23,8 @@ state-file endpoint stops one agent proxying another's files. Those harden the
 boundary; they don't sandbox the agent from itself.)
 
 The corollary: **don't reason about security as "can the agent be stopped from
-touching its credentials". Reason about it as "what's the blast radius if this
-agent does the worst possible thing with everything it can reach".**
+touching its credentials." Reason about it as "what's the blast radius if this
+agent does the worst possible thing with everything it can reach."**
 
 ### Scoped tokens bound the blast radius
 
@@ -36,7 +36,7 @@ Each agent gets its own scoped credentials, never shared:
 
 So a compromised/confused agent's reach on the forge or matrix is bounded by
 _its own_ account's scope, not the swarm's. This is the main thing standing
-between "one agent does something dumb" and "the whole hive is affected".
+between "one agent does something dumb" and "the whole hive is affected."
 
 **Identity vs. secret (matrix).** The scoping is on the _secret_, not the
 _identity_: an agent's matrix **token** is private to its own account, but its
@@ -83,7 +83,7 @@ accepting**. The rule of thumb:
 If an agent can deploy to prod, you are accepting the risk of a dropped
 production database (via injection or plain error). If that's unacceptable,
 the answer is _don't grant the capability_ — not "grant it and hope the
-sandbox holds", because there is no sandbox between an agent and the tools you
+sandbox holds," because there is no sandbox between an agent and the tools you
 handed it.
 
 ### No autosandboxing of external tokens

docs/turn-loop/claude-invocation.md

@@ -213,7 +213,7 @@ the embedded MCP server.
 Whenever hive-c0re starts / restarts / rebuilds a container, it
 also drops a `system` message into the agent's inbox via
 `Coordinator::kick_agent` — a one-line "you were just (re)started,
-check /state/ for your notes, your session is intact". The
+check /state/ for your notes, your session is intact." The
 next turn picks it up like any other inbox message.
 
 ## On-boot files

docs/turn-loop/config.md

@@ -258,7 +258,7 @@ is a no-op without the other:
   checking `~/.claude/` (`hive_agent::login::using_api_key`, reads
   `HIVE_USE_API_KEY`), and the fact is stamped into the consolidated
   harness state file so the operator dashboard also stops reading this
-  agent's empty `~/.claude/` as "needs login". An api-key agent that hits
+  agent's empty `~/.claude/` as "needs login." An api-key agent that hits
   a real 401 (the key itself is bad) still surfaces `needs_login` — only
   the boot-time "have I ever logged in" check is bypassed, not the
   auth-failure path.

docs/web-ui/dashboard.md

@@ -323,7 +323,7 @@ and `user_id` are backfilled from the matrix daemon's
 `matrix-accounts.json` snapshot — a host-visible file the daemon
 **force-rewrites every ~30s** (a heartbeat), so `as_of_unix` (the
 snapshot mtime) advances while the daemon is alive and a *stalled* value
-genuinely means "stopped publishing", not just "old snapshot". An account
+genuinely means "stopped publishing," not just "old snapshot." An account
 with a token but absent from the snapshot reports `live: false`.
 
 The status dot renders these states:
@@ -332,7 +332,7 @@ The status dot renders these states:
 - **dim green** — `live` but `as_of_unix` hasn't advanced in > ~90s (3
   missed heartbeats) while the container is *not* down: the daemon stopped
   publishing, so the snapshot's `live` is no longer trustworthy (likely
-  dead/wedged). Labelled "online · no heartbeat".
+  dead/wedged). Labelled "online · no heartbeat."
 - **amber** — `live` but the container is **down** (a stopped container
   ⟹ a dead daemon, so the snapshot is stale); also the `token_present &&
   !live` "provisioned but offline" case.
@@ -741,7 +741,7 @@ A full-height **square agent icon** (5em, capped) on the left. The
 icon is the **selection toggle**: click (or Enter/Space) adds/removes
 the agent from the selection set; `aria-pressed` reflects the state;
 the tooltip says "select … for bulk actions" or "deselect … (or press
-Esc to clear all)". The `<img>` points at `<url>/icon`; load failure
+Esc to clear all)." The `<img>` points at `<url>/icon`; load failure
 falls back to the dimmed hyperhive mark (`/favicon.svg`). The card
 body sits to the right with three stacked lines
 (`assets/swarm.js::renderContainers`).

docs/web-ui/shape.md

@@ -128,7 +128,7 @@ regardless, for example message-bearing tool_use, are unaffected either way).
 
 **Sticky-bottom + snap animation.** `stickToBottom` is the
 operator's intent: true means "keep snapping to bottom on every
-mutation", false means "I scrolled up, leave me alone". The flag
+mutation," false means "I scrolled up, leave me alone." The flag
 flips when a scroll event lands further than `NEAR_BOTTOM_PX = 48`
 from the bottom. New rows then either snap to bottom (when sticky)
 or bump the unseen-count and surface the "↓ N new" pill. The snap
@@ -146,7 +146,7 @@ rather than land short.
 **Mid-animation scroll-event guard.** The scroll handler's
 `isNearBottom` check would flip `stickToBottom` false mid-snap as
 the smooth animation eases through positions that are technically
-"not near bottom yet", which would strand the operator partway. A
+"not near bottom yet," which would strand the operator partway. A
 `smoothScrollingUntil` timestamp gates the scroll handler — set to
 the animation end + ~80ms headroom, re-armed on each fresh snap.
 Programmatic `scrollTop` writes (the animation's per-frame update)