docs: state current behaviour, drop change-log wording

Refs #3902

docs/tools/bash.md

@@ -129,9 +129,8 @@ loose-end follows.
 controls whether the `bash` MCP server reaches the agent's claude
 config at all, suppressing every `mcp__bash__*` tool
 when absent — not just leaving them unused. Its own `tools()` returns
-`&[]` and stays that way: `mcp__bash__run`/`status`/`kill` belong to a
+`&[]`: `mcp__bash__run`/`status`/`kill` belong to a
 different, out-of-process MCP server (`bash`, not `hyperhive`), so they
-were never real entries in the `mcp__hyperhive__*` allowlist `tools()`
-builds — the two dead `["run", "status"]` strings it used to return
-matched nothing, so they're gone now. Removing `execution` from an
+aren't entries in the `mcp__hyperhive__*` allowlist `tools()`
+builds. Removing `execution` from an
 agent's groups **does** remove bash availability.

docs/tools/forge.md

@@ -281,8 +281,7 @@ to discover valid label names before triaging or to audit the label set.
   falling back. `--job` selects the job (0-based, default 0);
   `--attempt` picks the run attempt for the durable path (default 1;
   re-runs increment it). `--json` wraps the output.
-- `ci-rerun` re-runs CI without pushing an empty commit (the old
-  retrigger path, which littered PR history). Forgejo has no token-usable
+- `ci-rerun` re-runs CI without pushing an empty commit. Forgejo has no token-usable
   REST endpoint to re-run an _existing_ run (the run-page rerun buttons
   are CSRF-gated web routes a token POST 404s), so this dispatches a
   **fresh** run of the workflow via the workflow-dispatch API

docs/tools/matrix.md

@@ -98,9 +98,9 @@ route refuses to create an account by that name.
 mechanism behind "accounts are the enable signal": an agent with no
 homeserver and no account of its own has an empty set, so it gets no
 daemon, no path watcher and no injected MCP entry. That's how you give
-an agent no matrix tools — it replaces the removed
-`services.hyperhive.agent.matrix.enable = false`, which now fails
-evaluation with a message saying so. Declaring an external account with
+an agent no matrix tools. Setting
+`services.hyperhive.agent.matrix.enable` fails evaluation with a
+message saying so. Declaring an external account with
 its own `homeserver` is enough on its own; a hive homeserver isn't
 required.
 

docs/tools/subagent.md

@@ -103,9 +103,7 @@ there is no such identity to hold a file open for, so the daemon omits
 anything task-shaped.
 
 ⚠️ This applies to every dispatch, not just role-bearing ones — no agent
-ships roles yet, so today it's the only path in real use. Before this fix
-the no-role path put the task straight into the system prompt, same as
-every `start` before roles existed at all.
+ships roles yet, so today it's the only path in real use.
 
 ### A role with no file refuses the call
 
@@ -356,10 +354,8 @@ Everything else in claude's built-in set is absent, in particular the
 tools that let a session act outside the run for which it began: peer and
 operator messaging, nested agents (including the stop verb, which takes
 an _agent_ id rather than a session), schedule and webhook creation, and
-worktree switching. Before the harness passed this flag, a subagent
-reached all of them — `--dangerously-skip-permissions` had removed the
-only thing that would have asked, and `--allowedTools` would not have
-helped: it approves prompts in advance rather than restricting anything.
+worktree switching. `--allowedTools` would not achieve this exclusion on
+its own: it approves prompts in advance rather than restricting anything.
 
 One rule worth knowing before editing any of this: **the daemon never
 emits an empty `--tools` value**, and asserts rather than doing so. Not