diff --git a/CLAUDE.md b/CLAUDE.md
index 6449ba0c..fae1a598 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -38,13 +38,20 @@ hand-maintained per-file tree drifts out of sync with the code.
   destroy|rebuild|restart|list|set-parent|…>`, `approvals <pending|
   approve|deny>`, `forge`/`matrix`/`github`/`gateway` provisioning,
   `choom`, `stop`/`start`, `wg`/`peer-config`.
-- **`hive-ag3nt/`** — in-container harness; three sibling binaries for
-  every agent (`hive-agent` serve loop, `hive-agent-mcp`,
-  `hive-agent-wake`). Turn-loop *policy* layer (`turn.rs`) over the `hive-claude`
-  driver, embedded MCP server (`mcp.rs`) + its claude launch-config layer
-  (`mcp_config.rs`: tool-group/capability → `--allowedTools`, `--mcp-config`
-  render), per-agent web UI (`web_ui/` module dir), event + turn-stats
-  sqlite sinks, login flow, system-prompt renderer, forge-notify subscriber.
+- **`hive-agent/`**, **`hive-agent-mcp/`**, **`hive-agent-wake/`** —
+  in-container harness, three sibling crates for every agent (not a
+  single `hive-ag3nt/` dir — that's the runtime/binary-family nickname,
+  not a directory).
+- **`hive-agent/`** — the serve-loop binary: turn-loop *policy* layer
+  (`turn.rs`) over the `hive-claude` driver, per-agent web UI (`web_ui/`
+  module dir), event + turn-stats sqlite sinks, login flow, system-prompt
+  renderer, forge-notify subscriber.
+- **`hive-agent-mcp/`** — the embedded MCP server (long-lived
+  streamable-http listener, `hive-mcp-http` systemd unit) + its claude
+  launch-config layer (tool-group/capability → `--allowedTools`,
+  `--mcp-config` render).
+- **`hive-agent-wake/`** — small external wake CLI for extra MCP
+  servers/helpers to nudge claude on external events.
 - **`hive-claude/`** — reusable, app-agnostic driver for headless
   `claude --print`: spawns the CLI, streams + classifies stream-json,
   parses per-turn `Telemetry`, and drives a durable self-compacting
@@ -62,9 +69,20 @@ hand-maintained per-file tree drifts out of sync with the code.
 - **`hive-bash-mcp/`** — per-agent bash-task runner daemon plus its
   stdio MCP bridge; writes task files under `/harness/bash-tasks/` and
   the favorite-tools `bash_commands` stat into turn-stats.sqlite.
-- **`hive-sh4re/`** — shared wire types (Host / Agent / Manager request
-  + response, `Message`, `Approval`, `HelperEvent`) used across the
-  unix sockets.
+- **`hive-sh4re/`** — shared wire types (Agent / Manager request +
+  response, `Message`, `Approval`, `HelperEvent`) used across the unix
+  sockets. Host-admin-socket and hive-priv-socket wire types have been
+  split out into their own crates (below) so `hivectl` and `hive-priv`
+  don't need to pull in the rest of `hive-sh4re`.
+- **`hive-host-sock/`** — wire types for the host admin socket
+  (`/run/hyperhive/host.sock`), the protocol `hivectl` speaks to
+  `hive-c0re`. Split out of `hive-sh4re` so a standalone `hivectl` only
+  depends on this protocol crate, not the whole daemon crate.
+- **`hive-priv-sock/`** — wire types for the `hive-priv` privileged-helper
+  socket (`/run/hive/priv.sock`), shared by `hive-priv` (server) and
+  `hive-c0re` (client). Also split out of `hive-sh4re`.
+- **`hive-metric/`** — small CLI to push a single labeled metric to the
+  OTEL collector via the OpenTelemetry Rust SDK / OTLP HTTP exporter.
 
 ### Other top-level dirs
 
diff --git a/README.md b/README.md
index f68f1ad6..f069ea8c 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,9 @@ Minimal `flake.nix` for a host that runs hive-c0re:
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
     hyperhive.url = "git+https://forge.darkest.space/hyperhive/hyperhive";
+    # Pin hyperhive to your own nixpkgs instead of the one it ships with
+    # (see "Overriding nixpkgs" below) — recommended for most hosts:
+    hyperhive.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = { nixpkgs, hyperhive, ... }: {
@@ -87,6 +90,16 @@ manager container, and auto-rebuilds any container whose hyperhive
 rev goes stale. `claude-code` is unfree — hyperhive scopes the
 whitelist to itself, nothing for the operator to set.
 
+### Overriding nixpkgs
+
+hyperhive pins its own `nixpkgs` so it builds standalone in CI. Add
+`hyperhive.inputs.nixpkgs.follows = "nixpkgs"` (as in the quick-start above)
+to build it against your host's `nixpkgs` instead — one less nixpkgs
+evaluation, no version drift from the rest of your system. Standard flake
+`follows` pattern; works as long as your channel is reasonably close to the
+`nixos-26.05` hyperhive develops against. Drop it again if a much
+older/newer channel hits breakage hyperhive's CI doesn't catch.
+
 For the full list of host and agent NixOS options see the
 **[options reference](https://hyperhive.darkest.space/options/)**.