diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 298105c0..aae7b5b0 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -2974,17 +2974,14 @@ async fn sync_agent_tmpfiles(agents: &[AgentTmpfilesEntry]) -> Result<(String, S
         // (dials web.sock, and has all of /run/hive-agent bind-mounted in).
         // Both sockets are 0666, so traversal is all they need.
         //
-        // 0751 rather than the historical 0777 is a fix, not a tidy-up:
-        // write permission on a *directory* is what confers the right to
-        // unlink its entries, whoever owns them — the sticky bit is the only
-        // thing that would restrain that, and it was never set here. So the
-        // old world-writable mode let anything able to reach the path delete
-        // an agent's socket, bind its own, and receive that agent's todos.
-        // Dropping `o=w` removes that permission outright rather than
-        // qualifying it. Declaring the owner here also ends the tug-of-war
-        // with the
-        // old ChownSocketDir: `d` re-applies on every sync, so a chown made
-        // afterwards was reset by the next agent's spawn.
+        // ⚠️ 0751 is load-bearing, not tidiness. A world-writable socket dir
+        // lets anything that can reach the path unlink an agent's socket and
+        // bind its own, receiving that agent's todos. Why directory-write
+        // confers that and the sticky bit does not save it:
+        // `docs/trust-boundary/boundary.md::the per-agent socket dir`.
+        //
+        // The owner is declared here because `d` re-applies on every sync, so
+        // a chown made anywhere else does not survive the next agent's spawn.
         if let (Some(uid), Some(gid)) = (entry.uid, entry.gid) {
             writeln!(content, "d {SOCKET_DIR_ROOT}/{name} 0751 {uid} {gid} -").ok();
         } else {