refs: repoint seven comments that name files which have moved

Comments cite nix modules, scripts and crate source files constantly,
and nothing evaluates a comment — so when a file moves, the reference
rots silently and `nix flake check` stays green. A reader following one
finds nothing and cannot tell whether the file was renamed, deleted, or
never existed.

Seven such references, each repointed at the file that actually holds
the thing the sentence is about rather than at the directory the old
name became:

  hive-c0re/src/agent_config/limits.rs   hive-agent/src/mcp.rs
                                       -> hive-agent-mcp/src/mcp/mod.rs
  hive-agent-mcp/src/mcp/mod.rs          hive-c0re/src/limits.rs
                                       -> hive-c0re/src/agent_config/limits.rs
                                         (and the module path in the doc
                                          comment above it, which was stale
                                          in the same way)
  hive-c0re/src/forge/mod.rs             hive-c0re/src/knowledge.rs
                                       -> hive-c0re/src/workers/knowledge.rs
  nix/host-modules/hive-c0re/options.nix hive-c0re/src/hive_stats.rs
                                       -> hive-c0re/src/stats/hive_stats.rs
  nix/packages/default.nix               nix/host-modules/hive-c0re.nix
                                       -> .../hive-c0re/options.nix
  nix/agent-modules/network.nix          nix/host-modules/hive-gateway.nix
                                       -> .../hive-gateway/dnsmasq.nix
  frontend/README.md                     nix/modules/frontend.nix
                                       -> nix/packages/frontend.nix

The two `limits.rs` comments are a matched pair: each names the other's
old path, so the "keep in sync" instruction they exist to carry pointed
both ways at nothing.

Where a flat module became a directory the target is the file that
declares the named thing, not `default.nix` by reflex — the
`preBuildAgentTemplates` option is declared in `options.nix`, and the
DHCP pool that sentence is about lives in `dnsmasq.nix`.

Comments only; no behaviour change. Refs #3923, which is about whether a
gate should cover this class at all — that question is unanswered and
this does not close it.

frontend/README.md

@@ -17,7 +17,7 @@ npm run build          # builds every workspace into packages/*/dist/
 
 The Rust binaries serve `packages/dashboard/dist/` and
 `packages/agent/dist/` via `tower_http::ServeDir` at runtime; the
-build derivation is wired up in `nix/modules/frontend.nix`. Per-agent
+build derivation is wired up in `nix/packages/frontend.nix`. Per-agent
 additions are layered on top of the default agent dist via the
 `hyperhive.frontend.extraFiles` option in `agent.nix`.
 

hive-agent-mcp/src/mcp/mod.rs

@@ -45,11 +45,11 @@ use render::{
 /// harness runs as the agent user and has write access to `state/`, whereas
 /// hive-c0re's `hive-core` user does not after the privsep migration).
 ///
-/// Mirrors the validation in `hive-c0re::limits::check_status_text` so
+/// Mirrors the validation in `hive-c0re::agent_config::limits::check_status_text` so
 /// the file is never written with text the server would later reject (which
 /// would leave a stale invalid entry on disk).
 fn write_status_file(text: &str) -> Result<(), String> {
-    // 200 chars mirrors STATUS_MAX_CHARS in hive-c0re/src/limits.rs.
+    // 200 chars mirrors STATUS_MAX_CHARS in hive-c0re/src/agent_config/limits.rs.
     // Keep in sync if that constant changes.
     const STATUS_MAX_CHARS: usize = 200;
     let trimmed = text.trim();

hive-c0re/src/agent_config/limits.rs

@@ -48,7 +48,7 @@ pub fn check_size(label: &str, body: &str) -> Result<(), String> {
 /// payload. Cap at 200 chars to fit the chip plus a little
 /// descriptive padding without forcing the operator to read a
 /// scrolling chunk.
-/// NOTE: `hive-agent/src/mcp.rs::write_status_file` mirrors this constant
+/// NOTE: `hive-agent-mcp/src/mcp/mod.rs::write_status_file` mirrors this constant
 /// client-side so invalid text is caught before the file is written.
 /// Keep in sync if this value changes.
 pub const STATUS_MAX_CHARS: usize = 200;

hive-c0re/src/forge/mod.rs

@@ -115,7 +115,7 @@ const SHARED_DOCS_REPO: &str = "docs";
 /// The hive-wide knowledge repo inside `SHARED_ORG`. Public — agents
 /// can fork it and open PRs without explicit collaborator grants.
 /// Bind-mounted read-only into every container at `/knowledge`.
-/// See `hive-c0re/src/knowledge.rs`.
+/// See `hive-c0re/src/workers/knowledge.rs`.
 const KNOWLEDGE_REPO: &str = crate::knowledge::REPO;
 /// Forgejo org that owns agent-created repos. Agents can't create
 /// repos with their own token (`max_repo_creation = 0`); instead hive-c0re

nix/agent-modules/network.nix

@@ -19,7 +19,7 @@
   # the hyperhive-isolated-dns oneshot owns resolv.conf. (Same "take
   # resolvconf out of the loop" approach the matrix container uses.)
   # All agent containers receive their bridge IP via DHCP from the hive
-  # dnsmasq pool (see nix/host-modules/hive-gateway.nix). useDHCP runs dhcpcd
+  # dnsmasq pool (see nix/host-modules/hive-gateway/dnsmasq.nix). useDHCP runs dhcpcd
   # on every interface (just eth0 in practice — the nspawn bridge veth).
   config = {
     networking.useDHCP = true;

nix/host-modules/hive-c0re/options.nix

@@ -279,7 +279,7 @@
       # 4.x, Sonnet 4.x, Haiku 4.5); cache_write is the 1-hour cache-TTL
       # price (the default through the Claude subscription the agents run
       # on). Keep in sync with `builtin_prices` in
-      # hive-c0re/src/hive_stats.rs.
+      # hive-c0re/src/stats/hive_stats.rs.
       default = {
         opus = {
           input = 5.0;

nix/packages/default.nix

@@ -247,7 +247,7 @@ in
   # so operators can `nix build .#agent-base-toplevel` (or wire
   # them into their host system closure via the
   # `preBuildAgentTemplates` option on the hive-c0re module —
-  # see nix/host-modules/hive-c0re.nix). Speeds up the first agent
+  # see nix/host-modules/hive-c0re/options.nix). Speeds up the first agent
   # spawn dramatically because the heavy lifting (nixpkgs +
   # claude-code + hive-agent binary) is already in the store
   # when the meta evaluator goes to build the container.