docs/agent-lifecycle/agent-hierarchy.md

@@ -128,9 +128,21 @@ Manager}` switch picks the MCP tool allow-list claude sees. Both are
   per-capability-group version (`cap:<group>` prompt blocks + a
   matching tool allow-list) is additive rather than a rewrite.
 - **State dirs** — _not_ special-cased: `HYPERHIVE_STATE_DIR` is
-injected uniformly via `systemd.globalEnvironment` for every
+  injected uniformly via `systemd.globalEnvironment` for every
-container including the manager, so all token/state paths resolve
+  container including the manager, so all token/state paths resolve
-through it the same way everywhere.
+  through it the same way everywhere.
+- **Scattered ownership checks** — a handful of independent
+manager-only overrides exist across `hive-c0re` today: loose-ends
+visibility (manager sees hive-wide, sub-agents only their own),
+`destroy` refusing to act on the manager, and crash-watch skipping
+the manager (it autorestarts via systemd instead of going through
+the crash-watch loop). Each is planned to become a capability
+check instead of a manager-name check — see the
+module docs for `loose_ends.rs`, `stores/broker.rs`, `actions.rs`,
+and `workers/crash_watch.rs` for the current owner-check logic in
+each. (The harness handles reminder cancellation fully in-agent — see
+the note on `CancelLooseEndKind::Reminder` in
+`hive-c0re/src/socket_server/mod.rs`.)
 <!-- vale write-good.Passive = YES -->
 
 None of the above is a stable interface — treat the module doc

docs/process/conventions.md

@@ -165,8 +165,8 @@ the dashboard's "mark all read" (unbounded, per-agent).
 
 ### Loose-ends wire shape
 
-`LooseEnd` is the per-row response shape for `GetLooseEnds` — one
+`LooseEnd` is the per-row response shape for `GetLooseEnds` (both
-request shape, no per-socket flavours. Tagged enum so
+the agent-flavour and manager-flavour requests). Tagged enum so
 new thread kinds (forge PRs, long-running approvals from a
 privileged bot, etc.) can land later without breaking existing
 handlers. Each row carries enough context that the caller renders
@@ -194,7 +194,7 @@ Per-variant fields:
 - `PendingMessages { count }` — undelivered inbox messages the
   agent still owes itself a `recv` for. Informational + not
   cancellable (drain with `recv`); only emitted when `count > 0`,
-  and surfaced first in the list as the most
+  and surfaced first in the agent-flavour list as the most
   actionable signal. Counted host-side from the broker
   (`count_pending`), so it reflects what's genuinely still queued —
   the wake-message that drove the current turn is already delivered

hive-c0re/src/socket_server/mod.rs

@@ -4,9 +4,10 @@
 //! you are `foo`; the manager socket simply serves as `ruth`. There is no
 //! privilege flag — both transports run the same [`serve`] / [`dispatch`]
 //! code, and authority derives uniformly from the caller's identity:
-//! tool-group membership for the orchestration verbs. An agent-targeting
+//! capabilities for the hive-wide queries and tool-group membership for the
-//! verb may name any agent, so `ruth` reaches every agent exactly the way
+//! orchestration verbs. An agent-targeting verb may name any agent, so `ruth`
-//! every other agent does, not via any hardcoded name match.
+//! reaches every agent exactly the way every other agent does, not via any
+//! hardcoded name match.
 
 use std::path::{Path, PathBuf};
 use std::sync::Arc;