diff --git a/nix/agent-modules/matrix.nix b/nix/agent-modules/matrix.nix
index 036f4af3..06c50331 100644
--- a/nix/agent-modules/matrix.nix
+++ b/nix/agent-modules/matrix.nix
@@ -169,7 +169,7 @@ in
       # Token files must land at the `matrix-token*` name the daemon
       # path-watcher globs (`/agents/*/state/matrix-token*`), or the account
       # never gets picked up live (it loads only on a full daemon restart).
-      # Enforce the basename prefix so a deviating name (e.g. the historical
+      # Enforce the basename prefix so a deviating name (e.g.
       # `matrix-catgirl-token`) is caught at build time, not silently.
       {
         assertion = lib.all (a: lib.hasPrefix "matrix-token" (baseNameOf a.tokenFile)) (
diff --git a/nix/host-modules/hive-ci.nix b/nix/host-modules/hive-ci.nix
index 15251720..d4bbfac1 100644
--- a/nix/host-modules/hive-ci.nix
+++ b/nix/host-modules/hive-ci.nix
@@ -127,10 +127,10 @@ let
       fi
       CORE_TOKEN=$(cat ${coreTokenPath})
       # Capture the HTTP status so a stale/invalid core token (401/403) is
-      # distinguished from a transient forge hiccup. With the old bare
-      # `curl -sf | jq`, a forge-core-token that's stale for the current
-      # forge (e.g. after a forge rebuild) 401s and fails silently every
-      # attempt for the full 60s loop, then exits with a misleading
+      # distinguished from a transient forge hiccup. A bare
+      # `curl -sf | jq` would let a forge-core-token that is stale for
+      # the current forge (e.g. after a forge rebuild) 401 silently on
+      # every attempt for the full 60s loop and exit with a misleading
       # "core token absent or forge unreachable" — masking the real cause.
       # Fail fast + loudly on 401/403 so the failure mode is legible and
       # the operator/hive-c0re knows to re-mint forge-core-token.
diff --git a/nix/host-modules/hive-tls.nix b/nix/host-modules/hive-tls.nix
index 765887a4..3a1594c7 100644
--- a/nix/host-modules/hive-tls.nix
+++ b/nix/host-modules/hive-tls.nix
@@ -191,9 +191,8 @@ in
     # container start). A host-side `systemctl -M hive-gateway` call
     # triggers the re-import + reload, mirroring how hive-c0re reloads the
     # gateway after each agents.conf write. A path unit *inside* the
-    # container was tried first but does not work: IN_MOVED_TO from an
-    # atomic rename on the host does not propagate across the nspawn
-    # mount-namespace boundary.
+    # container cannot do this: IN_MOVED_TO from an atomic rename on the
+    # host does not propagate across the nspawn mount-namespace boundary.
     #
     # `|| true` on propagation so a stopped gateway never fails the unit —
     # its next boot will import the already-rotated leaf anyway.
diff --git a/nix/host-modules/swarm.nix b/nix/host-modules/swarm.nix
index a97c1ead..a6750900 100644
--- a/nix/host-modules/swarm.nix
+++ b/nix/host-modules/swarm.nix
@@ -184,8 +184,8 @@
     };
   };
 
-  # Gated on the c0re daemon being enabled (the historical shape — the
-  # mesh is part of the coordinator host's networking).
+  # Gated on the c0re daemon being enabled — the mesh is part of the
+  # coordinator host's networking.
   config = lib.mkIf config.services.hyperhive.c0re.enable {
     assertions = lib.optionals config.services.hyperhive.swarm.wireguard.enable [
       {