docs: clear write-good.Passive hits in docs/process/pr-review-gate.md

docs/integrations/forge.md

@@ -106,7 +106,8 @@ The crate builds a second, independent binary for a different host — see
 
 The host-specific calls — list unread, mark read, resolve own login —
 live behind `Source` in `hive-forge-notify/src/source.rs`;
-classification, formatting, dedupe and todo delivery are shared. Todo
+classification, formatting, dedupe and todo delivery live in `notify.rs`,
+common to both binaries. Todo
 keys here are the bare thread ids, and must stay that way: renaming them
 would orphan every in-flight forge todo on the first restart after a
 deploy.

docs/process/pr-review-gate.md

@@ -46,8 +46,9 @@ already happened. No large changes are expected to surface after
 that point — a reviewer's job past that point is to flag it if one
 does, not to assume none ever will.
 
-The practical consequence for a reviewer: on a repo where automerge
+The practical consequence for a reviewer: on a repo where someone with
-may already be armed before your review lands, a plain `APPROVED` can
+write access may already have armed automerge before your review
+lands, a plain `APPROVED` can
 be the last step before the merge actually happens, with no further
 review pass after yours. That's a reason to actually finish checking
 before approving — not a reason to hesitate over every small thing.

docs/tools/lifecycle.md

@@ -23,8 +23,8 @@ one-row answer naming itself.
 Meta-flake input bumps route through the operator approval queue.
 
 Creating a new agent is **not** in this group — agents have no tool for
-it. A new agent's config repo is scaffolded by the swarm controller's
+it. The swarm controller's `InitAgentConfigRepo` job scaffolds a new
-`InitAgentConfigRepo` job (`POST /api/agents`, see
+agent's config repo (`POST /api/agents`, see
 `swarm-controller/`), and the operator spawns the container from the
 dashboard (`◆ R3QU3ST SP4WN` / `Spawn` approval, routed via
 `HostRequest::RequestSpawn`).

docs/turn-loop/mcp.md

@@ -218,7 +218,7 @@ see [`docs/tools/subagent.md`](../tools/subagent.md).
   `TodoWrite`. `Bash` **isn't** in the managed deny — see below.
 - Allowed MCP tools: as listed above (by tool group).
 
-`Bash` is disallowed for the autonomous harness — shell execution goes
+The autonomous harness disallows `Bash` — shell execution goes
 through `mcp__bash__run` (background tasks with structured output +
 task-id tracking) instead of an interactive shell. The harness gate is
 `--tools` / `--allowedTools` (Bash absent from `ALLOWED_BUILTIN_TOOLS`),

docs/web-ui/terminal-rendering.md

@@ -11,7 +11,8 @@ as `TermEnvelope { seq?, msgs: TermMsg[] }` frames
 
 `ts` is ISO 8601 UTC (`2026-09-13T12:35:03Z`) and is the **source event's**
 time, stamped at classify time from the event's own stamp — so a row
-replayed from sqlite says when it happened, not when it was fetched. It
+replayed from sqlite says when it happened, not when a client fetched
+it. It
 lives on the row rather than on the envelope because the swarm queue
 publishes rows bare, with no envelope around them
 (`hive-agent/src/swarm_term.rs`); a subscriber there has nowhere else to