docs: fix genuine Microsoft.Contractions/Negative errors

16 of the 23 error-level hits from a full-repo vale run were real:
'is/are/does/do NOT' and bold 'not' expanded per Microsoft.Contractions,
one hyphen-as-negative-number fixed to an en dash per Microsoft.Negative
(docs/web-ui/dashboard.md's -45 deg column-header tilt).

Where the caps/bold was there for emphasis (contrasting X does this,
Y does not), kept the emphasis by bolding the contraction rather than
dropping it silently -- 'is not' -> 'isn't', 'does NOT' -> '**doesn't**',
etc.

docs/tools/swarmctl-cli.md's one genuine hit is generated -- fixed the
source doc comment in swarmctl/src/main.rs and regenerated via
'cargo run --bin swarmctl -- markdown-docs', diffed against the old
copy first to confirm only the intended line changed.

Left 7 hits unfixed, false positives from the rule matching a
substring rather than the actual pattern it names:
- 4x 'that's instead of that is': every one is the explanatory 'that
  is' idiom (~= i.e.), not a contractible subject+verb -- 'that's'
  would misparse as a demonstrative-pronoun contraction and change the
  sentence's meaning. docs/integrations/forge.md:282,
  docs/tools/forge.md:260, docs/tools/hivectl.md:243,
  docs/web-ui/dashboard.md:457 (and the swarmctl-cli.md generated
  twin of the same category, source left alone for the same reason).
- docs/agent-lifecycle/persistence.md:482 -- 'is not' matched inside
  'is nothing' (the same has-not/has-nothing substring trap noted
  before in this doc's own git history).
- docs/swarm/ca.md:182 -- 'it is' matched inside the already-correct
  'it isn't'.

Per #4128. Remaining errors on main after this: Microsoft.Avoid's 26
hits, already tracked + awaiting a house-style ruling on #4041.

docs/integrations/forge.md

@@ -216,7 +216,7 @@ pipeline steps in order:
    tab, or end-of-line), prepend `\` so the embedded body doesn't
    blow into a top-level h1/h2 inside the wrapper message when the
    dashboard renders it. Lines like `#tag`, `#123`, `#!/bin/bash`
-   are NOT headings — no escape, no cosmetic noise. Indented
+   **aren't** headings — no escape, no cosmetic noise. Indented
    "headings" inside lists / nested quotes keep their leading
    whitespace.
 

docs/integrations/matrix.md

@@ -179,7 +179,7 @@ join floor.
 - `space-room-id` — the Space itself
 - `chat-room-id` — the `hive-chat` room
 
-These paths are **outside** every agent state dir and are NOT deleted by
+These paths are **outside** every agent state dir and **aren't** deleted by
 `nixos-container destroy --purge` — both survive full agent purges, and
 hive-c0re reuses them on re-provision.
 

docs/process/conventions.md

@@ -156,7 +156,7 @@ the row with `redelivered: true`. Idempotent + cheap when there's
 nothing in flight, so the at-boot fire is unconditional.
 
 `AgentRequest::AckUntil { up_to }` is the agent-facing bulk-triage
-escape hatch (`mcp__hyperhive__ack_until`). Unlike `AckTurn` it IS
+escape hatch (`mcp__hyperhive__ack_until`). Unlike `AckTurn` **it's**
 visible to claude: each recv row and wake prompt carries a
 `[msg #<id>]` marker (the broker row id; transient pings show no
 marker — their sentinel id 0 has nothing to ack), and

docs/process/gotchas.md

@@ -163,7 +163,7 @@ it and the old generations are gone.
 ### Claude credentials are per-agent
 
 `/var/lib/hyperhive/agents/<name>/claude/` bind-mounts to
-`/home/<name>/.claude` (RW). Sharing one dir across agents is NOT viable —
+`/home/<name>/.claude` (RW). Sharing one dir across agents **isn't** viable —
 OAuth refresh tokens rotate, so any sibling refresh invalidates all
 the others. Login flow runs from the per-agent web UI; creds persist
 across `destroy`/recreate (`--purge` wipes them).

docs/scheduler/ci.md

@@ -180,7 +180,7 @@ A malicious `default.nix` or build script in a PR can therefore:
 - **Make arbitrary network requests** to any address reachable from the container. The container runs in its own netns behind the hive bridge, so it reaches the forge only through the gateway (`http://<forge.domain>`, public/read endpoints — no admin credentials) and **can't** reach host-loopback services: the unauthenticated core dashboard at `127.0.0.1:7000` and the raw forge port are off-limits (bridge→127.0.0.0/8 is dropped).
 - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials.
 
-The core admin token (`forge-core-token`) is **not** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls.
+The core admin token (`forge-core-token`) **isn't** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls.
 
 Note: `nix flake check --no-build` (eval-only) reduces the attack surface but doesn't eliminate it — `builtins.fetchGit`, `builtins.fetchurl`, and import-from-derivation can reach the network and filesystem during evaluation. The default CI workflow runs full `nix flake check` (builds derivations), which is the higher-risk path.
 
@@ -214,7 +214,7 @@ following to your host config:
   #
   # `randomizedDelaySec` because a fixed daily time lands on the same wall
   # clock as whatever else runs nightly. A collection that overlaps a CI
-  # job does not fail it — the runner builds through the host nix-daemon,
+  # job doesn't fail it — the runner builds through the host nix-daemon,
   # so an in-flight build's temp roots are protected — but the first build
   # after a collection rebuilds what the collection deleted, so a run that
   # lands just behind one pays for it in wall time.

docs/tools/forge.md

@@ -325,7 +325,7 @@ to discover valid label names before triaging or to audit the label set.
   <n> --list-allowed` prints the instance's actual configured shortcode
   list (`GET /settings/ui`'s `allowed_reactions`) instead of guessing —
   instance-global, this path ignores `<n>`/`--comment`.
-- Do NOT use raw `curl` for forge access -- the CLI handles auth,
+- **Don't** use raw `curl` for forge access -- the CLI handles auth,
   error checking, and output formatting.
 - `issue-create --label <name>` / `pr-create --label <name>` are
   repeatable and take the same spelling `labels <n> add` does. **An

docs/tools/lifecycle.md

@@ -64,7 +64,7 @@ flake. Pass specific input names (for example `["bitburner-agent"]`) or omit
 / pass `[]` for all inputs. Returns immediately; the lock update runs
 on operator approval.
 
-Does NOT trigger container rebuilds — call `update(name)` on affected
+**Doesn't** trigger container rebuilds — call `update(name)` on affected
 agents after the approval resolves.
 
 ## Boundary summary

docs/tools/swarmctl-cli.md

@@ -67,7 +67,7 @@ Add a user, generating a password for them
 
 Change an existing user's attributes.
 
-Every flag is optional and they compose, so one call can set multiple things at once. Deliberately does **not** touch the password: regenerating a credential is a different intent from editing an attribute, and folded together an attribute edit can invalidate a login by accident.
+Every flag is optional and they compose, so one call can set multiple things at once. Deliberately **doesn't** touch the password: regenerating a credential is a different intent from editing an attribute, and folded together an attribute edit can invalidate a login by accident.
 
 **Usage:** `swarmctl user update [OPTIONS] <USERNAME>`
 

docs/turn-loop/claude-invocation.md

@@ -250,7 +250,7 @@ needs to `chown` a bind mount), once at startup:
 
   **Marker grammar.** `<!-- role:X -->` opens a block; any
   `<!-- /role:X -->` closes the current block. The renderer always uses
-  role `agent`, so it elides blocks with other role tags. Nesting is NOT
+  role `agent`, so it elides blocks with other role tags. Nesting **isn't**
   supported — a stray opener with no closer runs until end of file.
   The renderer tolerates whitespace inside markers (`<!--role:foo-->` parses the
   same as `<!-- role:foo -->`). Content outside any marker is always

docs/turn-loop/mcp.md

@@ -209,7 +209,7 @@ status hint lives in the wake prompt + UI header, not here.
   `Bash`, `Task`, `NotebookEdit`, `TodoWrite`.
 - Additionally in the managed-settings deny list
   (`/etc/claude-code/managed-settings.json`, un-overridable): `Task`,
-  `TodoWrite`. `Bash` is **not** in the managed deny — see below.
+  `TodoWrite`. `Bash` **isn't** in the managed deny — see below.
 - Allowed MCP tools: as listed above (by tool group).
 
 `Bash` is disallowed for the autonomous harness — shell execution goes

docs/web-ui/css-vars.md

@@ -73,7 +73,7 @@ default palette). Default hexes shown are Catppuccin Mocha.
 
 ## Common mistakes
 
-The Catppuccin colour names do **not** map 1:1 to the variable names.
+The Catppuccin colour names **don't** map 1:1 to the variable names.
 Variables to avoid (undefined — they will silently resolve to transparent / inherited):
 
 | Wrong                      | Correct                                             |

docs/web-ui/dashboard.md

@@ -99,8 +99,8 @@ messages are visible from any tab even while inactive. Backed by
 in_reply_to, file_refs).
 
 **◆ PR3F3R3NC3S ◆** — operator-local preferences. State lives in the
-browser's `localStorage` — preferences do NOT sync between devices and
+browser's `localStorage` — preferences **don't** sync between devices and
-do NOT survive a profile wipe. One section today (browser
+**don't** survive a profile wipe. One section today (browser
 notifications); future preferences land here as sibling `<h3>` blocks
 in `dashboard.html`. Was its own S3TT1NGS page/tile (`/settings.html`)
 until mara moved it in here — a standalone page for one toggle didn't
@@ -508,7 +508,7 @@ live container + any extra name that appears as a target on
 some schedule but isn't a current container (same
 `buildTargetChips` membership rule the new/edit forms use,
 so table and forms agree on what's addressable). Column
-headers tilt -45° via CSS so each column reads as a narrow
+headers tilt –45° via CSS so each column reads as a narrow
 ~28px strip; per-agent cells render as:
 
 - **active target** → `<button>✓</button>` that cancels just
@@ -614,7 +614,7 @@ the model id, longest match wins) mapping to
 `{ input, output, cache_read, cache_write }` USD-per-million-token
 prices. Models not covered fall back to hive-c0re's built-in estimate.
 
-The FL0W page does NOT host the PR3F3R3NC3S pane — it lives only on the
+The FL0W page **doesn't** host the PR3F3R3NC3S pane — it lives only on the
 dashboard's Y3R C4LL tab (reach it via the FL0W page's `← home`
 back-link → Dashboard). Notifications still fire on the FL0W page when
 they're enabled there, because `NOTIF.show()` in

swarmctl/src/main.rs

@@ -146,7 +146,7 @@ enum UserVerb {
     /// Change an existing user's attributes.
     ///
     /// Every flag is optional and they compose, so one call can set
-    /// multiple things at once. Deliberately does **not** touch the
+    /// multiple things at once. Deliberately **doesn't** touch the
     /// password: regenerating a credential is a different intent from
     /// editing an attribute, and folded together an attribute edit can
     /// invalidate a login by accident.