chore(nix): replace tracker tags with prose in nix comments

Part of the tracker-tag cleanup: the hive convention is prose, not
issue-tracker tags, in code. Reword the 21 tags in the nix tree
(flake.nix + the hive-c0re/ci/gateway/network modules) to describe
the thing they pointed at, preserving the context without the tag.

Comment-only — no eval or logic change. Validated with nix fmt
(no reformatting) and nix flake check --no-build (all checks
evaluate clean); the full build check was skipped locally because
the shared remote builder is degraded, so CI will exercise the
build derivations once the runner recovers.

flake.nix

@@ -4,7 +4,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    # Crane (replaces naersk #538). Stateless — no nixpkgs input to
+    # Crane (replaces the former naersk-based build). Stateless — no nixpkgs input to
     # follow; `crane.mkLib pkgs` returns the lib at whatever pkgs we
     # pass it (we use the project's pinned nixpkgs).
     crane.url = "github:ipetkov/crane";
@@ -51,7 +51,7 @@
             # cares about" filter (Cargo.toml/Cargo.lock + *.rs). All
             # non-rust runtime assets — branding + the claude system
             # prompt template + claude-settings.json — live in the
-            # separate `hyperhive-assets` derivation (#555) and are
+            # separate `hyperhive-assets` derivation and are
             # loaded by the binaries at runtime from `$HIVE_ASSETS_DIR`.
             # The unit tests in `hive-ag3nt::prompt` read the same
             # `prompts/system.md` directly from the workspace tree at
@@ -91,10 +91,10 @@
             # sandbox.
             # `librsvg` used to live here for `hive-c0re/build.rs`'s
             # rsvg-convert call — that whole codepath moved into the
-            # `hyperhive-assets` derivation in #555, so the rust
+            # `hyperhive-assets` derivation, so the rust
             # derivation no longer needs the dependency.
             # `sqlite` required by matrix-sdk's `sqlite` feature
-            # (`hive-matrix-mcp` workspace member, #548 phase 3) — the
+            # (`hive-matrix-mcp` workspace member) — the
             # matrix-sdk-sqlite + rusqlite stack links against system
             # libsqlite3 by default.
             nativeBuildInputs = [
@@ -129,7 +129,7 @@
           # prompt::tests` reads the production prompt template at test
           # runtime through `$HIVE_ASSETS_DIR`, so wiring the env var
           # into the build phase here would make the prompt's hash a
-          # build input of `default` (defeats #555's cache goal: a
+          # build input of `default` (defeats the asset-split cache goal: a
           # prompt edit would still bust the binary derivation, even
           # though no .rs file changed). Keeping tests in a separate
           # check derivation localises the asset-rebuild blast radius
@@ -144,12 +144,12 @@
           };
           # Bundled browser assets — see ./nix/frontend.nix. Output is
           # $out/{dashboard,agent}/ which the Rust binaries serve via
-          # tower_http::ServeDir (wired up in Phase 4 of #273).
+          # tower_http::ServeDir.
           frontend = pkgs.callPackage ./nix/frontend.nix {
             branding-svg = ./branding/hyperhive.svg;
           };
           # Static runtime assets the rust binaries read via
-          # `hive_sh4re::assets::*` (#555): branding/* + prompts/*,
+          # `hive_sh4re::assets::*`: branding/* + prompts/*,
           # plus the rendered agent-configs.png. Split out of the
           # rust derivation so a tweak to e.g. system.md doesn't bust
           # the cargo cache. Build input of the `cargo-test` check but
@@ -164,7 +164,6 @@
           # spawn dramatically because the heavy lifting (nixpkgs +
           # claude-code + hive-ag3nt binary) is already in the store
           # when the meta evaluator goes to build the container.
-          # Closes #97.
           #
           # nixosConfigurations are pinned to x86_64-linux (nixos-
           # containers only run native arch), so these toplevels are
@@ -175,7 +174,7 @@
           agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel;
           ruth-toplevel = self.nixosConfigurations.ruth.config.system.build.toplevel;
 
-          # Auto-generated nix options reference for hyperhive (#616).
+          # Auto-generated nix options reference for hyperhive.
           # `docs` bundles host + agent pages into one tree; the split
           # outputs are useful when consumers only want one surface.
           # All three are pure markdown — no rust or frontend deps in
@@ -196,7 +195,7 @@
           # is applied (manager + agent containers both apply it via
           # `mkContainer` further down).
           hyperhive-frontend = self.packages.${prev.stdenv.hostPlatform.system}.frontend;
-          # Static runtime assets (#555). Exposed alongside the binary
+          # Static runtime assets. Exposed alongside the binary
           # so the harness module can wire $HIVE_ASSETS_DIR straight
           # to `${pkgs.hyperhive-assets}/share/hyperhive`.
           hyperhive-assets = self.packages.${prev.stdenv.hostPlatform.system}.assets;
@@ -243,7 +242,7 @@
           hyperhiveNixpkgsUnstable = "path:${nixpkgs-unstable}";
           # Per-container toplevels — wired into `system.extraDependencies`
           # when `services.hyperhive.c0re.preBuildAgentTemplates` is on so the
-          # host system closure pre-fetches the heavy build inputs (#97).
+          # host system closure pre-fetches the heavy build inputs.
           # Defined only for x86_64-linux because nixosConfigurations are
           # hardcoded to that system; the option's default keeps the
           # extra deps gated so aarch64 hosts don't accidentally pull
@@ -292,7 +291,7 @@
             packages = with pkgs; [
               cargo
               clippy
-              librsvg # rsvg-convert — hive-c0re/build.rs invokes it (#424)
+              librsvg # rsvg-convert — hive-c0re/build.rs invokes it
               pkg-config
               rust-analyzer
               rustc
@@ -331,7 +330,7 @@
           # group from that gate: pedantic is the "extra, opinionated"
           # group the clippy team grows freely, so denying it means
           # every toolchain bump that adds a new pedantic lint breaks CI
-          # with zero code changes (#1368). The `pedantic = warn`
+          # with zero code changes. The `pedantic = warn`
           # workspace lint (Cargo.toml) keeps it as advisory signal in
           # local `cargo clippy` — it just no longer blocks the build.
           # (`-A` rather than `-W` here: `-W clippy::pedantic` would
@@ -361,7 +360,7 @@
             cargoTestExtraArgs = "--workspace";
             HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive";
           };
-          # Nix options docs evaluation (#616). Cheap: pulls in
+          # Nix options docs evaluation. Cheap: pulls in
           # `nixosOptionsDoc` + the host module's stub eval, no rust or
           # frontend deps. CI fails fast if a module change breaks
           # option declarations or the doc rendering. Reuses the

nix/modules/hive-c0re.nix

@@ -458,7 +458,7 @@ in
         Pre-fetch the per-container system closures (agent-base +
         manager toplevels) into the host's /nix/store as part of this
         host's NixOS build, instead of letting the first agent spawn
-        do all the work. Closes #97.
+        do all the work.
 
         Enabling this adds roughly the full nixpkgs runtime closure +
         claude-code + the harness binary to your system closure size
@@ -612,8 +612,8 @@ in
       pkgs.git
     ];
 
-    # Pull the per-container toplevels into the host system closure
+    # Pull the per-container toplevels into the host system closure.
-    # (#97). `system.extraDependencies` adds paths to the system build
+    # `system.extraDependencies` adds paths to the system build
     # without referencing them at runtime — nixos-rebuild fetches /
     # builds them, they end up in /nix/store, and the first
     # nixos-container update + start for an agent has nothing left to

nix/modules/hive-ci.nix

@@ -118,7 +118,7 @@ let
       # attempt for the full 60s loop, then exits with a misleading
       # "core token absent or forge unreachable" — masking the real cause.
       # Fail fast + loudly on 401/403 so the failure mode is legible and
-      # the operator/hive-c0re knows to re-mint forge-core-token (#1475).
+      # the operator/hive-c0re knows to re-mint forge-core-token.
       RESP=$(${pkgs.curl}/bin/curl -s -w $'\n%{http_code}' \
         "$FORGE_URL/api/v1/admin/runners/registration-token" \
         -H "Authorization: token $CORE_TOKEN" || printf '\n000')
@@ -287,9 +287,9 @@ in
       # `nixos-container@…`. The earlier `nixos-container@hive-ci.service`
       # matched no real unit, so before/wantedBy/partOf were silent
       # no-ops — the partOf never bound, the oneshot stayed
-      # `active (exited)`, and the token was never refreshed on restart
+      # `active (exited)`, and the token was never refreshed on restart.
-      # (a contributor to #1475). Confirmed against the live
+      # Confirmed against the live `container@hive-matrix.service` unit
-      # `container@hive-matrix.service` unit during the #1465 incident.
+      # during the matrix-outage incident.
       partOf = [ "container@hive-ci.service" ];
       serviceConfig = {
         Type = "oneshot";

nix/modules/hive-gateway.nix

@@ -973,8 +973,8 @@ in
               # Hive authoritative records — answer queries for the
               # hive domain + its sub-domains with the bridge IP
               # (where nginx is reachable from container netns once
-              # #14 lands; today it's the host loopback alias and
+              # per-agent netns isolation lands; today it's the host
-              # works in either shape).
+              # loopback alias and works in either shape).
               #
               # The forge / matrix entries are redundant in the
               # common case where `forge.domain` /

nix/modules/hive-network.nix

@@ -97,8 +97,8 @@ in
       default = false;
       example = true;
       description = ''
-        Flip agent containers from shared host netns to private netns
+        Flip agent containers from shared host netns to private netns.
-        (#14). When true, each agent container gets a dedicated veth
+        When true, each agent container gets a dedicated veth
         pair attached to `bridgeName` and a deterministic IP from
         the bridge subnet. The bridge (already up when `enable = true`)
         becomes the sole routed path between the host and agent