diff --git a/docs/security.md b/docs/security.md
index d2051adc..dda8f4b5 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -5,9 +5,8 @@
 The sections below document specific mechanisms (the state-file endpoint,
 nixbld isolation, privilege separation). This section frames the model they
 serve: **what hyperhive defends, what it deliberately does not, and where the
-operator is accepting risk.** It emerged from a security discussion on
-2026-06-24 (prompted by the `gh` CLI helper work) and is the reference for
-"is it safe to give an agent capability X?".
+operator is accepting risk.** It is the reference for "is it safe to give an
+agent capability X?".
 
 ### The trust boundary is the container, not credential storage
 
@@ -167,8 +166,8 @@ token policy bounds file reads; network isolation bounds network reach.
 - `/home/<name>/.claude/` — mode `0700`, owned by the per-agent
   user `<name>`. nixbld users cannot read it.
 - `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents/<name>/state/forge-token`)
-  — written at mode `0600` by `hive-c0re/src/forge.rs` and chowned to the
-  per-agent uid:gid by `lifecycle::chown_to_agent`. nixbld users
+  — written at mode `0600` and chowned to the per-agent uid:gid (see
+  `hive-c0re/src/forge.rs`'s module doc for exactly where). nixbld users
   cannot read it.
 
 **Policy**: all credential files written to agent state directories MUST be mode