diff --git a/CLAUDE.md b/CLAUDE.md
index 6449ba0c..5490dce2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -38,13 +38,18 @@ hand-maintained per-file tree drifts out of sync with the code.
   destroy|rebuild|restart|list|set-parent|…>`, `approvals <pending|
   approve|deny>`, `forge`/`matrix`/`github`/`gateway` provisioning,
   `choom`, `stop`/`start`, `wg`/`peer-config`.
-- **`hive-ag3nt/`** — in-container harness; three sibling binaries for
-  every agent (`hive-agent` serve loop, `hive-agent-mcp`,
-  `hive-agent-wake`). Turn-loop *policy* layer (`turn.rs`) over the `hive-claude`
-  driver, embedded MCP server (`mcp.rs`) + its claude launch-config layer
-  (`mcp_config.rs`: tool-group/capability → `--allowedTools`, `--mcp-config`
-  render), per-agent web UI (`web_ui/` module dir), event + turn-stats
-  sqlite sinks, login flow, system-prompt renderer, forge-notify subscriber.
+- **`hive-agent/`**, **`hive-agent-mcp/`**, **`hive-agent-wake/`** —
+  in-container harness, three sibling crates for every agent (not a
+  single `hive-ag3nt/` dir — that's the runtime/binary-family nickname,
+  not a directory). `hive-agent` is the serve-loop binary: turn-loop
+  *policy* layer (`turn.rs`) over the `hive-claude` driver, per-agent web
+  UI (`web_ui/` module dir), event + turn-stats sqlite sinks, login flow,
+  system-prompt renderer, forge-notify subscriber. `hive-agent-mcp` is
+  the embedded MCP server (long-lived streamable-http listener,
+  `hive-mcp-http` systemd unit) + its claude launch-config layer
+  (tool-group/capability → `--allowedTools`, `--mcp-config` render).
+  `hive-agent-wake` is a small external wake CLI for extra MCP
+  servers/helpers to nudge claude on external events.
 - **`hive-claude/`** — reusable, app-agnostic driver for headless
   `claude --print`: spawns the CLI, streams + classifies stream-json,
   parses per-turn `Telemetry`, and drives a durable self-compacting
@@ -62,9 +67,20 @@ hand-maintained per-file tree drifts out of sync with the code.
 - **`hive-bash-mcp/`** — per-agent bash-task runner daemon plus its
   stdio MCP bridge; writes task files under `/harness/bash-tasks/` and
   the favorite-tools `bash_commands` stat into turn-stats.sqlite.
-- **`hive-sh4re/`** — shared wire types (Host / Agent / Manager request
-  + response, `Message`, `Approval`, `HelperEvent`) used across the
-  unix sockets.
+- **`hive-sh4re/`** — shared wire types (Agent / Manager request +
+  response, `Message`, `Approval`, `HelperEvent`) used across the unix
+  sockets. Host-admin-socket and hive-priv-socket wire types have been
+  split out into their own crates (below) so `hivectl` and `hive-priv`
+  don't need to pull in the rest of `hive-sh4re`.
+- **`hive-host-sock/`** — wire types for the host admin socket
+  (`/run/hyperhive/host.sock`), the protocol `hivectl` speaks to
+  `hive-c0re`. Split out of `hive-sh4re` so a standalone `hivectl` only
+  depends on this protocol crate, not the whole daemon crate.
+- **`hive-priv-sock/`** — wire types for the `hive-priv` privileged-helper
+  socket (`/run/hive/priv.sock`), shared by `hive-priv` (server) and
+  `hive-c0re` (client). Also split out of `hive-sh4re`.
+- **`hive-metric/`** — small CLI to push a single labeled metric to the
+  OTEL collector via the OpenTelemetry Rust SDK / OTLP HTTP exporter.
 
 ### Other top-level dirs
 
diff --git a/README.md b/README.md
index f68f1ad6..e006c5ed 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,9 @@ Minimal `flake.nix` for a host that runs hive-c0re:
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     hyperhive.url = "git+https://forge.darkest.space/hyperhive/hyperhive";
+    # Pin hyperhive to your own nixpkgs instead of the one it ships with
+    # (see "Overriding nixpkgs" below) — recommended for most hosts:
+    hyperhive.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = { nixpkgs, hyperhive, ... }: {
@@ -87,6 +90,25 @@ manager container, and auto-rebuilds any container whose hyperhive
 rev goes stale. `claude-code` is unfree — hyperhive scopes the
 whitelist to itself, nothing for the operator to set.
 
+### Overriding nixpkgs
+
+hyperhive's own `flake.nix` pins `nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"`
+so the repo builds standalone (`nix flake check`, CI, `nix develop`) without
+depending on a consumer's host flake. When you import hyperhive as a flake
+input into your own host config, that pin becomes a second nixpkgs
+evaluation living alongside your host's — extra closure to build/cache, and
+a second place package versions can drift from what the rest of your system
+runs.
+
+Add `hyperhive.inputs.nixpkgs.follows = "nixpkgs"` to your input declaration
+(as in the quick-start above) to make hyperhive build against your host's
+`nixpkgs` input instead of its own pinned one. This is the standard flake
+`follows` pattern — nothing hyperhive-specific — and works as long as your
+`nixpkgs` is reasonably close to the `nixos-26.05` release hyperhive is
+developed against; a much older or newer channel may hit `nixpkgs`-side
+breakage hyperhive's CI doesn't catch. If you hit that, drop the `follows`
+line and let hyperhive use its own pin again.
+
 For the full list of host and agent NixOS options see the
 **[options reference](https://hyperhive.darkest.space/options/)**.