diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index 9ca5abe1..0cbf08ff 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -1,13 +1,16 @@
 //! Runtime nginx include-file generator for the gateway's per-agent
-//! `/agent/<name>/` location blocks (#869).
+//! `/agent/<name>/` location blocks.
 //!
 //! Writes `/var/lib/hyperhive/gateway/agents.conf` on every topology change.
-//! The gateway container bind-mounts the whole `/var/lib/hyperhive/`
-//! directory at `/run/hive-state/` and nginx includes
-//! `/run/hive-state/agents.conf`. A systemd path unit inside the
-//! gateway container watches the file and triggers `nginx -s reload`
-//! on every atomic rename — no `nixos-rebuild switch` needed when
-//! agents start, stop, or flip `useUnixSocket`.
+//! The gateway container bind-mounts `/var/lib/hyperhive/gateway/` (NOT the
+//! whole parent dir) at `/run/hive-state/`; nginx includes
+//! `/run/hive-state/agents.conf`. After each write, c0re triggers
+//! `nginx -s reload` inside the gateway container via
+//! `systemd-run --machine=hive-gateway` from the host — no `nixos-rebuild
+//! switch` needed when agents start, stop, or flip `useUnixSocket`.
+//! (A path unit inside the container was tried first but `IN_MOVED_TO`
+//! from the atomic rename does not cross the nspawn mount-namespace
+//! boundary — see #889 for the failure analysis.)
 //!
 //! Upstream selection mirrors `agent_sockets::build_map`: an agent
 //! gets a UDS upstream when its `.bound` marker exists (harness has
@@ -168,7 +171,10 @@ fn reload_gateway_nginx() {
         .status();
     match status {
         Ok(s) if s.success() => {
-            tracing::debug!("gateway nginx reloaded successfully");
+            // systemd-run accepted the request; nginx reload runs
+            // asynchronously inside the container and may still fail
+            // silently, but that's acceptable given the best-effort contract.
+            tracing::debug!("systemd-run accepted gateway nginx reload request");
         }
         Ok(s) => {
             tracing::warn!(