From 11db710ddf76213328ff32edfe2cebd6881b0732 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Fri, 29 May 2026 13:12:45 +0200
Subject: [PATCH] hive-matrix: refresh stale bindMounts comment after
 activation-script fix (argus)

---
 nix/modules/hive-matrix.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/nix/modules/hive-matrix.nix b/nix/modules/hive-matrix.nix
index 2e03f51b..d029728d 100644
--- a/nix/modules/hive-matrix.nix
+++ b/nix/modules/hive-matrix.nix
@@ -209,10 +209,10 @@ in
       privateNetwork = false;
       # Read-only bind of the host-managed registration token so
       # tuwunel can resolve `registration_token_file` to a real
-      # file inside the container. The host path doesn't need to
-      # exist at eval time (the file is generated by hive-c0re's
-      # `matrix::ensure_register_token` on first boot); nspawn will
-      # create the bind mount on container start either way.
+      # file inside the container. The activation script above
+      # ensures the host path exists with a valid 64-char hex token
+      # before any container starts, so the bind always finds real
+      # content (no first-boot empty-file race; argus #565 nit).
       bindMounts.${cfg.registrationTokenFile} = {
         hostPath = cfg.registrationTokenFile;
         isReadOnly = true;