diff --git a/hive-c0re/README.md b/hive-c0re/README.md
index cf0c9dd6..4b6e6e7d 100644
--- a/hive-c0re/README.md
+++ b/hive-c0re/README.md
@@ -1,89 +1,49 @@
 # hive-c0re
 
-The unprivileged host daemon (runs as `hive-core`). This is the biggest
-crate in the workspace — it owns the sqlite broker, the approval /
-question / reminder / schedule queues, the generic job-DAG queue,
-lifecycle (`nixos-container` shellouts + per-agent flake generation),
-gateway/forge/matrix provisioning, per-container stats, and the axum
-operator dashboard.
-
-`hive-c0re` is **bin-only**: this binary owns the whole module tree
-directly (no separate lib crate). The operator CLI used to live here
-too, but moved out to the standalone `hivectl` crate, which talks to
-this daemon over the host admin socket instead of linking it.
+The unprivileged host daemon (runs as `hive-core`). Owns the sqlite
+broker, the approval/question/schedule queues, the generic job-DAG
+queue, container lifecycle, gateway/forge/matrix provisioning,
+per-container stats, and the axum operator dashboard. Largest crate in
+the workspace — bin-only, no separate lib.
 
 ## When to use it
 
-This is where host-level, cross-container orchestration logic lives:
-spawning/rebuilding/destroying agent containers, approving config
-changes, reconciling desired vs. actual container state, provisioning
-per-agent forge/matrix/gateway accounts, and serving the dashboard.
-If you're changing what the operator sees on the dashboard, how a
-container gets spawned or torn down, or anything in the approval flow,
-it's here. Agent-side behavior (the turn loop, MCP tools) lives in
-`hive-agent`/`hive-agent-mcp` instead — this daemon only talks to
-agents over the unix socket wire types in `hive-sh4re`.
+Host-level, cross-container orchestration: spawning/rebuilding/
+destroying agent containers, the approval flow, dashboard-visible
+state, provisioning per-agent forge/matrix/gateway accounts. Agent-side
+behavior (turn loop, MCP tools) lives in `hive-agent`/`hive-agent-mcp`
+instead — this daemon only talks to agents over the socket wire types
+in `hive-sh4re`.
 
 ## Shape
 
-Cohesive clusters live in directory submodules; each child is
-re-exported at the crate root so `crate::broker::…`-style paths keep
-resolving unchanged regardless of which subdirectory a module actually
-lives in.
+Cohesive clusters live in directory submodules, each re-exported at
+the crate root (`crate::broker::…` keeps resolving regardless of which
+subdirectory a module actually lives in). One line each — read the
+module's own `//!` doc-comment for real detail, don't expect this file
+to track it:
 
-- **`dashboard/`** — the axum operator dashboard: managed containers
-  (with deep-links to each container's own web UI), pending approvals
-  (unified diff vs. the applied repo + approve/deny), schedules,
-  questions, journal/build-log viewers, topology, webhook ingest.
-- **`job_queue/`** — generic job-DAG queue + desired-state
-  reconciliation, the host-side wrapper over the domain-agnostic
-  `hive_jobq` scheduler. Jobs are nodes in per-request DAGs
-  (`templates.rs`); special cases (graceful-stop watcher, deferred-start
-  follow-up, meta-update cascade, topology reparents) collapse into DAG
-  *shapes* over the shared node primitives (`model::NodeKind`). See
-  `docs/coordinator.md`.
-- **`lifecycle/`** — `nixos-container` lifecycle (spawn/kill/destroy/
-  rebuild/restart) + per-agent config flake generation.
-- **`stores/`** — sqlite-backed host-side stores: the broker
-  (`broker.rs`), approval / question / schedule queues, build logs,
-  audit trail, power intent, plus the shared connection open/migration
-  helper (`db.rs`).
-- **`workers/`** — background tasks and periodic sweeps: crash/login
-  watcher, scheduled-prompt delivery loop, boot-time auto-update
-  reconcile, the agent-sockets.json writer loop, the MCP socket
-  listener reconcile loop, knowledge-repo sync.
-- **`agent_config/`** — per-agent configuration registries (tool
-  groups, capabilities, resource limits, topology — all JSON under
-  `/var/lib/hyperhive/meta/`) plus the shared wire-protocol size
-  limits. Note the two similarly-named modules: `limits` caps inline
-  message-body sizes on the sockets, while `resource_limits` holds
-  per-agent CPU/memory caps for the container drop-in (`agentMemoryMax`
-  etc.).
-- **`stats/`** — metrics aggregation for the dashboard: hive-wide
-  turn-stats rollups, host-system probes/server warnings, live
-  per-container cgroup load, OTEL metric export.
-- **`socket_server/`** — the unix-socket request server, shared by the
-  per-agent sockets and the (pure-transport) manager socket. The socket
-  file's existence on disk authenticates the caller — connecting to
-  `<.../agents/foo/mcp.sock>` means you are `foo`. No privilege flag:
-  authority derives from the caller's identity (topology, capabilities,
-  tool-group membership), not a hardcoded name match.
-- **`forge/`** — optional Forgejo wiring: per-agent user + token
-  provisioning, config-repo mirroring, meta read-access grants, the CI
-  runner registration, PR auto-merge. No-op when `hive-forge` (the
-  container) isn't running. Full design: `docs/forge.md`.
-- **`coordinator.rs`** — top-level `Coordinator`/`HiveEnv`/`ServeConfig`
-  wiring that ties the above together for `serve`.
-- **`meta.rs`**, **`migrate.rs`** — the meta flake (agent config repos)
-  and schema/state migrations.
-- **`matrix.rs`**, **`gateway_nginx.rs`**, **`webhook_secret.rs`** —
-  matrix provisioning, gateway nginx vhost rendering, webhook secret
-  management.
-- **`priv_client.rs`** — client for the `hive-priv` privileged-helper
-  socket (the few root operations this unprivileged daemon delegates
-  out — see `docs/boundary.md`).
+- **`dashboard/`** — the operator dashboard (containers, approvals,
+  schedules, questions, logs, topology).
+- **`job_queue/`** — the job-DAG queue + desired-state reconciliation
+  (`docs/coordinator.md`).
+- **`lifecycle/`** — `nixos-container` lifecycle + per-agent config
+  flake generation.
+- **`stores/`** — sqlite-backed stores (broker, queues, audit, power).
+- **`workers/`** — background sweeps (crash watch, scheduled prompts,
+  auto-update, knowledge sync).
+- **`agent_config/`** — per-agent registries (tool groups,
+  capabilities, resource limits, topology).
+- **`stats/`** — dashboard metrics aggregation + OTEL export.
+- **`socket_server/`** — the unix-socket request server shared by
+  per-agent + manager sockets.
+- **`forge/`** — optional Forgejo wiring (`docs/forge.md`).
+- **`coordinator.rs`** — top-level wiring for `serve`.
+- **`meta.rs`**, **`migrate.rs`** — the meta flake + schema/state
+  migrations.
+- **`matrix.rs`**, **`gateway_nginx.rs`**, **`webhook_secret.rs`**,
+  **`priv_client.rs`** — matrix provisioning, gateway vhosts, webhook
+  secrets, and the `hive-priv` client respectively.
 
-`src/main.rs` is the `hive-c0re` binary entry point: `serve` (the
-daemon) plus the periodic vacuum/sweep loops. See the top-level
-`CLAUDE.md`/`docs/` index for the full reading-path map — this README
-is just the module tour.
+See the top-level `CLAUDE.md`/`docs/` index for the full reading-path
+map.
diff --git a/hive-forge/README.md b/hive-forge/README.md
index 029d6797..fbcb32ce 100644
--- a/hive-forge/README.md
+++ b/hive-forge/README.md
@@ -1,58 +1,30 @@
 # hive-forge
 
-Typed CLI wrapper around the in-cluster Forgejo's REST API. Replaces
-the prior bash script (`hive-forge-tools.nix`) so that agents and
-operators get the same error handling, exit codes, and JSON shapes
-regardless of how the bash mood was that day — this is the **only
-supported path** to the forge from inside an agent container; never
-`curl` it directly.
+Typed CLI wrapper around the in-cluster Forgejo's REST API — issues,
+PRs, comments, labels, reviews, CI status, attachments, triage.
+Replaces the old bash-script wrapper so agents and operators get
+consistent error handling, exit codes, and JSON shapes. This is the
+**only supported path** to the forge from inside an agent container;
+never `curl` it directly.
 
-Single binary, one verb subcommand per forge operation (issues, PRs,
-comments, labels, reviews, CI status, attachments, triage). Reads
-credentials from the environment: `HIVE_FORGE_URL` (base URL),
-`HIVE_FORGE_REPO` (default repo), `HYPERHIVE_STATE_DIR` (state dir —
-`forge-token` lives here). The global `-f/--forge <label>` flag
-retargets a dashboard-provisioned *external* forge account instead,
-reading `forge-<label>-token` + `forge-<label>.json` from the state
-dir rather than the internal-forge pair.
+Reads credentials from the environment (`HIVE_FORGE_URL`,
+`HIVE_FORGE_REPO`, `HYPERHIVE_STATE_DIR`); `-f/--forge <label>`
+retargets a dashboard-provisioned external forge account instead.
 
 ## When to use it
 
-Reach for this crate when you're adding a new forge verb or changing
-how an existing one behaves — it's the single place issue/PR/comment/
-CI logic lives for every agent and `hivectl`. If you're instead adding
-a *tool* an agent's claude session calls, that's `hive-agent-mcp`
-wrapping a shellout to this binary, not new logic here.
+Reach for this crate when adding or changing a forge verb — it's the
+single place issue/PR/comment/CI logic lives for every agent and
+`hivectl`. Adding a *tool* an agent's claude session calls is
+`hive-agent-mcp` wrapping a shellout to this binary, not new logic
+here.
 
 ## Shape
 
-- **`verbs/`** — one module per subcommand, each exposing a clap-derived
-  `Args` struct and a `run(&Client, Args) -> Result<()>` fn. Splitting
-  one verb per module keeps each handler small and avoids the bash
-  script's monolithic `case` statement. Notable ones:
-  - **`lint.rs`** — `lint <subcommand>` triage queries (unassigned,
-    no-reviewer, stale-branches, assignments), always JSON-able via the
-    global `--json` flag.
-  - **`pr_status.rs`** — the merge-readiness verdict command
-    (`pr-status --pr <n>` / `--sha <commit>`); its exit code IS the
-    verdict, not just a report.
-  - **`comment.rs`** / **`comments.rs`** — post (refuses on unread
-    thread activity) / read (marks forge's own notification read as a
-    side effect) — see `notify.rs` for why that's safe to rely on.
-- **`client.rs`** — the app-level Forgejo client wrapper. Identity is
-  the per-agent token under `${HYPERHIVE_STATE_DIR}/forge-token`. REST
-  calls go through the typed `forgejo_api::sync::Forgejo` client
-  (`Client::api`); a minimal raw `reqwest` client remains for the few
-  *web-router* routes Forgejo doesn't serve under `/api/v1/`
-  (attachment downloads, Actions artifact/log routes).
+- **`verbs/`** — one module per subcommand (clap `Args` + `run`).
+- **`client.rs`** — the Forgejo client wrapper + token loading.
 - **`notify.rs`** — the read-before-comment guard, backed by forge's
-  own notification read-state rather than a local mirror (which would
-  drift across container restarts). "Is there unread activity here?"
-  is just "does forge still have an unread notification for this
-  thread?" — forge is the single source of truth.
-- **`body.rs`** — body-input resolution shared by every verb that
-  posts a body: exactly one source between `--body`, `--body-file`,
-  and piped stdin (matches the old bash `resolve_body` helper);
-  passing both `--body` and `--body-file` is a clear error.
+  own notification read-state (no local mirror to drift).
+- **`body.rs`** — shared `--body`/`--body-file`/stdin resolution.
 
-Full verb reference (with worked examples): `docs/tools/forge.md`.
+Full verb reference: `docs/tools/forge.md`.
diff --git a/hivectl/README.md b/hivectl/README.md
index 731a51ad..afbbde0e 100644
--- a/hivectl/README.md
+++ b/hivectl/README.md
@@ -1,65 +1,35 @@
 # hivectl
 
-The operator-facing host CLI for hyperhive. A thin client for the
-`hive-c0re` daemon: it speaks the host admin socket protocol
-(`hive-host-sock`) and does **not** link the daemon crate.
-
-Container lifecycle + the approval queue (`agents <spawn|kill|rebuild|
-restart|…>`, `approvals <pending|approve|deny>`, `stop`/`start`) and
-provisioning (`forge`/`matrix`/`github`/`gateway`) all forward to the
-daemon, which owns the broker, the credentials, and the provisioning
-logic — a running daemon is required for those verbs. A few verbs work
-off local host state directly instead, so they don't need the socket:
-`wg`/`peer-config` read the mesh key + TLS CA, and `choom` execs into a
-container.
+The operator-facing host CLI. A thin client for the `hive-c0re`
+daemon — speaks the host admin socket protocol (`hive-host-sock`) and
+does not link the daemon crate. Container lifecycle, the approval
+queue, and provisioning verbs all forward to the daemon and need it
+running; a few (`wg`/`peer-config`, `choom`) work off local host state
+instead.
 
 ## When to use it
 
-Reach for this crate when you're adding a new operator-run host
-command, not an agent-run one — agents talk to the daemon over their
-own per-agent MCP tool surface (`hive-agent-mcp`), not this binary.
-`hivectl` is what a human operator (or a script on the host) runs.
+Reach for this crate when adding an operator-run host command — agents
+talk to the daemon over their own MCP tool surface
+(`hive-agent-mcp`), not this binary. `hivectl` is what a human operator
+(or a host-side script) runs.
 
 ## Shape
 
 One module per subcommand family; `main.rs` is just the clap parse +
-top-level dispatch match.
+dispatch:
 
-- **`cli.rs`** — the clap `Cli`/`Cmd` derive tree every other module's
-  `Args` hangs off of.
-- **`client.rs`** — the host admin socket client (`request`), split out
-  so it lives with `hivectl` rather than in the daemon crate.
-- **`agents.rs`** — `agents <spawn|kill|destroy|rebuild|restart|list|
-  set-parent|…>` — container lifecycle.
-- **`approvals.rs`** — `approvals <pending|approve|deny>` — the config/
-  init-config/meta-input approval queue.
-- **`dag_progress.rs`** — rebuild-queue progress rendering: everything
-  that polls the daemon's DAG queue (`HostRequest::QueueDag`) and
-  renders per-DAG / per-node progress (spinner or plain), split out
-  because `agents.rs` was already large.
-- **`power.rs`** — `restart`/`start`/`stop` at the container level.
-- **`choom.rs`** — `hivectl choom <agent>`: drop into an interactive
-  Claude session inside an agent container by exec-ing `machinectl
-  shell` running claude as the agent user, mirroring the harness's own
-  per-turn claude invocation.
+- **`agents.rs`** — container lifecycle (spawn/kill/rebuild/restart/…).
+- **`approvals.rs`** — the config/init-config/meta-input approval queue.
+- **`dag_progress.rs`** — rebuild-queue progress rendering.
+- **`power.rs`** — restart/start/stop at the container level.
+- **`choom.rs`** — drop into an interactive claude session in a
+  container.
 - **`forge.rs`**, **`matrix.rs`**, **`github.rs`**, **`gateway.rs`** —
-  per-agent account/token provisioning for each integration
-  (`forge create-user`, `matrix …`, `github set-token`, `gateway
-  create-user|delete-user|list-users`).
-- **`wg.rs`** — `wg`/`peer-config`: WireGuard mesh helpers — generate
-  this hive's key + the nix snippets to enable the mesh, add a peer,
-  print the block a peer pastes to federate with us, show the live
-  interface.
-- **`subvol.rs`** — `agents subvol`: btrfs state-subvolume ops (migrate
-  a plain-dir agent state root to a subvolume, snapshot create/delete/
-  send).
-- **`quota.rs`** — resource-quota reporting/enforcement helpers shared
-  across the above.
-- **`open.rs`** — `open <url>`: opens a hive URL (dashboard, agent UI)
-  in the operator's browser.
-- **`completions.rs`** — shell-completion generation
-  (`clap_complete`/`clap-markdown`).
-- **`util.rs`** — small shared helpers (formatting, table rendering)
-  used across subcommand modules.
+  per-integration account/token provisioning.
+- **`wg.rs`** — WireGuard mesh helpers.
+- **`subvol.rs`** — btrfs state-subvolume ops.
+- **`quota.rs`**, **`util.rs`**, **`completions.rs`**, **`open.rs`** —
+  shared helpers, shell completions, browser-open.
 
 Full verb reference: `docs/tools/hivectl.md`.