diff --git a/CLAUDE.md b/CLAUDE.md
index 5fb6c70c..2da3cccf 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -217,7 +217,7 @@ frontend/             npm workspaces (esbuild → static dist). Built
                          + agent.css → dist/{*.html, static/*}.
 
 hive-ag3nt/        in-container harness crate; produces ONE `hive`
-                   binary picking role from `HIVE_ROLE` env
+                   binary for all agents
   src/lib.rs            re-exports + DEFAULT_SOCKET, DEFAULT_WEB_PORT
   src/client.rs         generic JSON-line request/response over unix socket
   src/web_ui.rs         per-container axum HTTP page (incl /api/cancel,
@@ -255,12 +255,13 @@ hive-ag3nt/        in-container harness crate; produces ONE `hive`
   src/login_session.rs  drives `claude auth login` over stdio pipes
   src/prompt.rs         system prompt renderer: filters the unified
                          template through `<!-- role:agent -->` /
-                         `<!-- role:manager -->` markers per
-                         `mcp::Flavor`; owns `write_system_prompt`
-                         (re-exported from turn.rs for callers).
+                         `<!-- role:manager -->` markers (always
+                         renders the agent section); owns
+                         `write_system_prompt` (re-exported from
+                         turn.rs for callers).
   src/bin/hive.rs       unified harness main (Serve + Mcp + Wake
-                         subcommands); role from `HIVE_ROLE` env, picks
-                         agent or manager wire surface server-side. Static UI assets
+                         subcommands); privilege boundary enforced
+                         server-side at the broker socket. Static UI assets
                          served by ServeDir from $HIVE_STATIC_DIR
                          (= hyperhive.frontend.mergedDist — default agent
                          dist + per-agent extraFiles, set per the