diff --git a/docs/tools/hivectl.md b/docs/tools/hivectl.md
index 2bfbfb24..51f8f1a8 100644
--- a/docs/tools/hivectl.md
+++ b/docs/tools/hivectl.md
@@ -43,7 +43,7 @@ hivectl forge reconcile-config iris --verbose      # include the full diff, not
   `create-user` persists the token to `<state>/forge-token`. Re-running refreshes the
   token (idempotent — scope always matches current `TOKEN_SCOPES`).
 - For **non-agents** (humans): creates the account and prints the token to
-  stdout; no state dir is created. Re-running after account already exists
+  stdout, creating no state dir. Re-running after account already exists
   re-mints the token and prints it again — safe for password resets.
 - Without `--password` / `--password-stdin` `create-user` uses a random
   throwaway password (fine for agents — they auth by token).
@@ -133,8 +133,8 @@ username updates the password hash in place.
 
 Container lifecycle shortcuts that go through the host admin socket.
 Requires the `hive-c0re` daemon to be running. Everything scoped to a
-single agent lives under `hivectl agent <name> <verb>` — the name is
-hoisted onto the parent command, so none of the verbs below repeat it.
+single agent lives under `hivectl agent <name> <verb>` — `hivectl` hoists
+the name onto the parent command, so none of the verbs below repeat it.
 
 ```bash
 hivectl list-agents                # roster: every agent's status + technical state
@@ -221,8 +221,8 @@ granting that group the one action `machinectl shell` needs); `choom`
 checks this itself and refuses up front with a message naming the
 requirement rather than letting systemd reject the exec later with an
 opaque polkit prompt. Same caveat as the socket grant: a shell opened
-before you were added to `hive-admin` won't see it until you log back in
-— secondary group membership applies at login.
+before the operator added you to `hive-admin` won't see it until you log
+back in — secondary group membership applies at login.
 
 It also needs the daemon socket, unlike the other exec-into-a-container
 paths: the "is this actually an agent?" pre-flight reads the agents root,
@@ -241,9 +241,9 @@ through as `claude --resume <value>` to rejoin a prior session by its
 session id — the flag name deliberately matches the claude flag it maps
 to. (choom never uses claude's `--continue`: that's a bare flag that
 takes no argument and resumes the cwd's _latest_ session, that is, the
-harness's; a value after it would be consumed as the first prompt,
-silently poking the live harness session.) A value is required when the
-flag is given. Either way choom never collides with the harness's live
+harness's; claude would consume a value after it as the first prompt,
+silently poking the live harness session.) A value is required when you
+pass the flag. Either way choom never collides with the harness's live
 session in the same project dir: the harness pins its own id via
 `--resume`, so a blank choom session is invisible to it. The container
 must be running.