diff --git a/nix/host-modules/swarm-authelia.nix b/nix/host-modules/swarm-authelia.nix
index 10f18da0..38fbb08b 100644
--- a/nix/host-modules/swarm-authelia.nix
+++ b/nix/host-modules/swarm-authelia.nix
@@ -9,20 +9,13 @@
 #     `deploy.allSwarmServices` asserts this module's `enable`
 #     (see ./swarm-required-services.nix); a hive is a client by default.
 #
-# Operator and agents are both subjects of the same provider,
-# differentiated by roles/claims rather than by mechanism — there is one
-# IdP and one auth path. The users store is written by a program
-# (`swarm-authelia-bridge`, see that option's doc comment), not
-# maintained by hand: agents are created and destroyed continuously, so
-# the subject set is *dynamic*. That is also why the file backend is
-# right here, not a placeholder for LDAP: what makes a directory
-# necessary is the size of the subject set, bounded by one swarm.
+# The file backend is the right shape, not a placeholder for LDAP: what
+# makes a directory necessary is the size of the subject set, and this
+# one is bounded by a swarm. Who writes that store, and why it is a
+# program rather than a config file, is in `docs/swarm/sso.md`.
 #
-# Two roles: a **session** provider always, an **OIDC** provider when
-# `oidc.clients` is non-empty (derived, not flagged). In practice OIDC
-# is always on now: the bridge needs its own machine-client identity for
-# its introspection calls, contributed unconditionally, not behind
-# `oidc.hiveIdentities`. Secrets map: docs/swarm/sso.md.
+# `docs/swarm/sso.md` owns the role model — session provider always, OIDC
+# provider derived from the client list — and the secrets map.
 #
 # Per-service integration — putting authelia's `auth_request` in front
 # of the gateway's existing `auth_basic` locations — is deliberately NOT
@@ -183,9 +176,8 @@ let
     redirectUris = [ ];
   };
 
-  # authelia refuses to start with an OIDC provider that has no clients,
-  # so the provider is derived from the client list rather than carrying
-  # its own `enable`: one fact, and it cannot contradict itself.
+  # Derived from the client list rather than carrying its own `enable`;
+  # `docs/swarm/sso.md` says why that is one fact instead of two.
   #
   # ⚠️ In practice this is now unconditionally `true` whenever the module
   # is enabled: `bridgeClient` above is an unconditional definition of