diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index dbe0536f..6fadb368 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -510,10 +510,12 @@ in
     example = "https://matrix.darkest.space";
     description = ''
       Matrix homeserver URL the agent's `hive-matrix-daemon` connects
-      to. Default points at the in-host tuwunel (shared netns).
-      Override per-agent when an agent should talk to an external
-      homeserver instead (e.g. a federation-only setup or a remote
-      hive's tuwunel reached via a vpn).
+      to. At runtime hive-c0re forwards the isolation-aware URL
+      (`matrix.<domain>` via the gateway) so isolated agents reach
+      the homeserver without crossing host loopback. Override
+      per-agent when an agent should talk to an external homeserver
+      instead (e.g. a federation-only setup or a remote hive's
+      tuwunel reached via a vpn).
     '';
   };
 
@@ -1516,8 +1518,7 @@ in
     # for the hive's own zones, so `forge.<domain>` stops resolving. We
     # disable resolvconf and tell dhcpcd not to touch resolv.conf (without
     # disabling dhcpcd itself, so the veth still gets its address); then
-    # whoever wrote resolv.conf last owns it: the nixos-container host-copy
-    # in shared netns, or the oneshot in isolated mode. (Same "take
+    # the hyperhive-isolated-dns oneshot owns resolv.conf. (Same "take
     # resolvconf out of the loop" approach the matrix container uses.)
     networking.resolvconf.enable = false;
     networking.dhcpcd.extraConfig = "nohook resolv.conf";
@@ -1528,11 +1529,11 @@ in
     # 127.0.0.53) is unreachable from a private netns and isn't
     # authoritative for the hive's own zones (forge.<domain> etc.). The
     # bridge dnsmasq (gateway IP) is. hive-priv drops the marker
-    # `/etc/hyperhive-bridge-dns` (containing the gateway IP) only when
-    # isolation is on, so this oneshot is inert in shared-netns mode — the
-    # same shared container toplevel does the right thing in both modes.
-    # Ordered before the first DNS consumer (tea-login) and the network
-    # targets so name resolution works for the very first turn.
+    # `/etc/hyperhive-bridge-dns` (containing the gateway IP) since
+    # isolation is always on; the oneshot reads it and rewrites
+    # resolv.conf on every boot. Ordered before the first DNS consumer
+    # (tea-login) and the network targets so name resolution works for
+    # the very first turn.
     systemd.services.hyperhive-isolated-dns = {
       description = "point resolv.conf at the hive bridge resolver (isolated containers)";
       wantedBy = [ "multi-user.target" ];