docs: clear write-good.Passive hits in docs/process/gotchas.md

7 genuine passive-voice rewrites (actor named, or the passive
construction replaced with a natural active verb/imperative); 5 false
positives left untouched — a temporal 'when it was written' reference,
two predicate-adjective necessity descriptions ('is needed'/'is
expected', same category as 'is required'), one predicate-adjective
state description ('are gone'), and one quoted literal + predicate
adjective ('these inputs are unused by rust').

docs/process/gotchas.md

@@ -15,7 +15,7 @@ The CLI doesn't accept `--bind`. Path is via `EXTRA_NSPAWN_FLAGS` in
 `systemd-nspawn` invocation. `lifecycle::host_config::set_nspawn_flags()`
 rewrites this line.
 
-### `/run/systemd/nspawn/*.nspawn` overrides are ignored
+### `nixos-container` ignores `/run/systemd/nspawn/*.nspawn` overrides
 
 `nixos-container`'s start script builds the nspawn command line
 directly. Dropping a `.nspawn` file under `/run/systemd/nspawn/`
@@ -73,7 +73,7 @@ the path entry resolves to `/run/wrappers/bin/bin` instead.
 
 …keeps `/run/hyperhive/` (and the per-agent sub-dirs) across
 hive-c0re restarts. Without it, every restart wipes bind sources and
-existing containers can't be started.
+existing containers fail to start.
 
 ### `RestrictAddressFamilies` fails as "Address family not supported by protocol"
 
@@ -144,10 +144,10 @@ store-path _string_ coerces through `lib.toDerivation`, i.e.
 `builtins.storePath`. `environment.systemPackages` and
 `systemd.services.<name>.path` both do it (the latter takes plain
 strings like `/run/wrappers` happily, but Nix treats anything under
-`builtins.storeDir` as a package). A path handed to the
-container as text has to be wrapped in a real derivation — a symlink
-farm built from the interpolated string — before it can go anywhere a
-package is expected.
+`builtins.storeDir` as a package). Wrap a path handed to the
+container as text in a real derivation — a symlink farm built from
+the interpolated string — before it can go anywhere a package is
+expected.
 
 The catch is that a path written into a generated flake is text, not a
 reference — the container's closure doesn't keep the binary alive.
@@ -156,9 +156,9 @@ The **host** does: it interpolates the package into
 and is gc-rooted by the running generation. `builtins.toJSON` preserves
 string context, which is the load-bearing detail; discard the context
 anywhere on that path and `nix-collect-garbage` will eventually take
-the hive's `claude` out from under it. The price of the root is that an
-old `claude-code` can't be reclaimed until every agent has rebuilt past
-it and the old generations are gone.
+the hive's `claude` out from under it. The price of the root is that
+`nix-collect-garbage` can't reclaim an old `claude-code` until every
+agent has rebuilt past it and the old generations are gone.
 
 ### Claude credentials are per-agent
 
@@ -352,8 +352,8 @@ cd ~/hh-work && nix fmt
 
 The root cause is specific to worktrees: a worktree shares the object
 store with its parent repo. If the parent repo's history was rewritten
-(rebase, force-push, `git gc --prune`) while the worktree was checked
-out at a branch tip that references the pruned commits via its reflog or
+(rebase, force-push, `git gc --prune`) while the worktree remained at a
+branch tip that references the pruned commits via its reflog or
 history, libgit2's rev-walk encounters the gap. A plain clone has its
 own self-consistent object store and is immune to the issue.
 
@@ -422,8 +422,8 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
 - **PAM service name**: literal `weston-remote-access` — that's the
   string libweston passes to `pam_start()` in `libweston/auth.c`.
   Using `weston` falls back to the system default PAM stack and
-  rejects auth. The service is configured to `pam_permit.so` for
-  all three module types (auth / account / session) so the
+  rejects auth. `weston-vnc.nix` configures the service to
+  `pam_permit.so` for all three module types (auth / account / session) so the
   browser's empty Apple-DH credentials (type 30) always pass —
   neatvnc ≥ 0.9 calls the PAM auth callback regardless of
   `weston.ini` `auth-method=none`, so the permit fallback is what
@@ -480,9 +480,9 @@ Pipeline:
   declaration paths and rewrites them as forge URLs, so the
   rendered docs link back to the source.
 
-Host options live entirely under `services.hyperhive.*`. The
-`pickSubtrees` filter is rooted at `["services" "hyperhive"]` so the
-options tree picks up everything under that root — picking against
+Host options live entirely under `services.hyperhive.*`. `pickSubtrees`
+takes `["services" "hyperhive"]` as its root, so the options tree picks
+up everything under that root — picking against
 stray roots produces an empty tree and renders the host page as
 template chrome with no `<h2>` headers. `docs-host` then drops the
 `swarm`/`deploy` subtrees from that picked tree (`removeAttrs`, not a