diff --git a/docs/swarm/README.md b/docs/swarm/README.md
index 4c6a4b07..a012bb04 100644
--- a/docs/swarm/README.md
+++ b/docs/swarm/README.md
@@ -114,8 +114,9 @@ wire a swarm service name into: [`ui.md`](ui.md).
 
 ```nix
 services.hyperhive.swarm.hives = {
-  pr1ma = { domain = "pr1ma.example.com"; };   # this host, per hiveName
-  lab   = { domain = "lab.example.com"; };     # a second hive in the swarm
+  pr1ma = { };                                     # this host, per hiveName
+  lab   = { };                                     # a second hive in the swarm
+  edge  = { domain = "edge.elsewhere.example"; };  # addressed off-convention
 };
 ```
 
@@ -130,9 +131,12 @@ hive. That assertion is load-bearing rather than pedantic — "my peers"
 is derived as _everything that isn't me_, so a directory that doesn't
 contain you derives every hive as a peer and you peer with yourself.
 
-`domain` is required per entry and deliberately undefaulted: it's
-conventionally `<name>.<swarm.domain>`, but a wrong domain that
-evaluates cleanly points at a real machine that isn't the one you meant.
+`domain` defaults to `<name>.<swarm.domain>`, the convention every hive
+follows, so a conventional directory is names only. The default is a
+derivation from two values the operator already had to state — the swarm's
+domain and the entry's own name — rather than a guess, which is what makes
+it safe here when a guessed hostname wouldn't be. Set it only for a hive
+addressed by something else.
 
 > **No per-hive CA field exists, and no per-hive cert pinning.** Trust
 > inside a swarm comes from the swarm root ([`ca.md`](ca.md)): every