diff --git a/nix/host-modules/hive-gateway/vhosts.nix b/nix/host-modules/hive-gateway/vhosts.nix
index 5f74f059..e54dddda 100644
--- a/nix/host-modules/hive-gateway/vhosts.nix
+++ b/nix/host-modules/hive-gateway/vhosts.nix
@@ -1,14 +1,14 @@
-# nginx virtual-host tree for the gateway: the `_` default server —
-# now only a catch-all that rejects — and the hive's own domain, which
-# carries the dashboard, per-agent routing, matrix discovery and the
-# swagger UI.
+# nginx virtual-host tree for the **hive's own** gateway surface: the `_`
+# default server, which answers unmatched `Host` with a bare 444, and the
+# vhost named for the hive domain, which carries the dashboard, per-agent
+# routing, matrix discovery, the swagger UI and the legacy
+# `<hive>/matrix/*` redirect.
 #
-# ⚠️ The swarm services' vhosts are NOT here. Forge, matrix and authelia
-# each declare their own, built from the same kit this file consumes
-# (`services.hyperhive.gateway.lib`, ./vhost-lib.nix), so a service owns
-# its whole gateway surface — vhost and dns name — inside its own
-# module. A service name appearing in this file is the signal that the
-# coupling is growing back.
+# Scope: a swarm service declares its own vhost and dns name in its own
+# module, built from the kit this file also consumes
+# (`services.hyperhive.gateway.lib`, ./vhost-lib.nix). That keeps a
+# service's gateway surface next to the service, and keeps this file to
+# the surface the hive itself serves.
 #
 # Pure function — called from ./default.nix with the outer-scope config
 # values as arguments; returns `{ virtualHosts }`.