hive-priv, hive-c0re: link docs/network.md instead of restating it

The network-isolation doc comments carried prose docs/network.md
already owns, and three of them named `harness-base.nix` — a file
that does not exist. The `hyperhive-isolated-dns` oneshot lives in
nix/agent-modules/network.nix, which the doc gets right.

That is #3749's argument reproducing itself: the same fact written
in two places goes stale in the copy nobody reads. Linking removes
the class, not just the instance — a link cannot name a nonexistent
file without the doc noticing first.

Trap and measurement comments stay put, per the issue's scope: the
load-bearing HOST_ADDRESS default-route note, the unquoted
$EXTRA_NSPAWN_FLAGS expansion, and the "isolation is the only mode"
invariants are facts about this code, not about the subsystem.

hive-c0re/src/lifecycle/host_config.rs

@@ -131,12 +131,12 @@ fn bind_child_agent_dirs(child: &str, binds: &mut Vec<BindMount>) {
 }
 
 /// Idempotently rewrite the lines in `/etc/nixos-containers/<container>.conf`
-/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1 — every container runs in
+/// that hive-c0re owns: `PRIVATE_NETWORK` (always 1), `HOST_ADDRESS` (the
-/// its own network namespace with a veth on the host bridge, and the agent's
+/// bridge gateway IP) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir bind). What
-/// web UI is reached over that bridge rather than a host-shared netns),
+/// those network vars mean and why isolation is unconditional:
-/// `HOST_ADDRESS` (the bridge gateway IP, so the container installs a default
+/// `docs/network.md` § *What the Rust side does*.
-/// route before DHCP completes) and `EXTRA_NSPAWN_FLAGS` (the runtime-dir
+///
-/// bind). The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
+/// ⚠️ The start script expands `$EXTRA_NSPAWN_FLAGS` unquoted into the
 /// `systemd-nspawn` command.
 #[allow(
     clippy::too_many_lines,

hive-priv-sock/src/lib.rs

@@ -294,9 +294,8 @@ pub struct CredentialMount {
 /// Network isolation parameters for `WriteNspawnFlags`. hive-priv writes
 /// `PRIVATE_NETWORK=1` + veth bridge wiring from these; every container
 /// is isolated, so they are required rather than a mode selector.
-/// Containers receive their IP
+/// No static address is pre-assigned here — see `docs/network.md`
-/// dynamically via DHCP from the bridge dnsmasq pool (`networking.useDHCP`
+/// § *Container isolation* for how a container gets its address.
-/// in `harness-base.nix`); no static address is pre-assigned here.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct NetworkIsolation {
     /// Host bridge interface name (e.g. `hive0`).
@@ -306,9 +305,8 @@ pub struct NetworkIsolation {
     /// container-side setup installs a default route (`default via <gw>`)
     /// before DHCP completes: without it the container has no route off
     /// the bridge subnet until the DHCP lease arrives. The same IP runs the
-    /// hive dnsmasq resolver, so it's also written into the container's
+    /// hive dnsmasq resolver — see `docs/network.md` § *How the isolated
-    /// `/etc/resolv.conf` (see the isolated-DNS oneshot in `harness-base.nix`,
+    /// container gets its resolver*.
-    /// gated on the marker hive-priv drops).
     pub gateway_ip: String,
 }
 

hive-priv/src/main.rs

@@ -2759,10 +2759,9 @@ fn write_nspawn_flags(
         // setup is skipped, so this only affects the container's route —
         // exactly what we want.
         let _ = writeln!(out, "HOST_ADDRESS={}", iso.gateway_ip);
-        // LOCAL_ADDRESS is intentionally empty: agent containers receive their
+        // LOCAL_ADDRESS is intentionally empty: containers take their IP by
-        // IP dynamically via DHCP from the bridge dnsmasq pool.  HOST_ADDRESS
+        // DHCP from the bridge dnsmasq pool. (Why HOST_ADDRESS is still
-        // (the gateway IP) is still written so nixos-container's container-side
+        // written: the comment directly above.)
-        // init installs a default route before the DHCP lease arrives.
         out.push_str("LOCAL_ADDRESS=\n");
         out.push_str("HOST_ADDRESS6=\n");
         out.push_str("LOCAL_ADDRESS6=\n");
@@ -2790,15 +2789,13 @@ fn write_nspawn_flags(
     let _ = writeln!(out, "EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"");
     std::fs::write(&path, out).with_context(|| format!("write {path}"))?;
 
-    // DNS marker for the in-container resolver oneshot. nixos-container
+    // DNS marker for the in-container resolver oneshot: the oneshot only
-    // copies the *host's* /etc/resolv.conf into the container at every
+    // rewrites the container's resolv.conf when this marker exists, and the
-    // start (its host resolver — e.g. 127.0.0.53 — is unreachable from a
+    // marker carries the gateway IP so the container need not re-derive it.
-    // private netns, and isn't authoritative for the hive's own zones
+    // Always written — every container is isolated, so there is no mode in
-    // anyway). The `hyperhive-isolated-dns` oneshot in harness-base.nix
+    // which the marker should be absent. Why the rewrite is needed at all,
-    // rewrites resolv.conf to point at the bridge resolver, but only when
+    // and which unit does it: `docs/network.md` § *How the isolated
-    // this marker exists; it carries the gateway IP so the container
+    // container gets its resolver*.
-    // doesn't have to re-derive it. Always written — every container is
-    // isolated, so there is no mode in which the marker should be absent.
     write_bridge_dns_marker(container, isolation)?;
     Ok(())
 }