diff --git a/docs/boundary.md b/docs/boundary.md
index c1608f7c..1fc5ed3b 100644
--- a/docs/boundary.md
+++ b/docs/boundary.md
@@ -5,11 +5,12 @@ _implementation_ work — container network isolation, the unifying
 gateway, core-daemon privsep — is tracked as `area:ops` issues on
 the forge.
 
-Today "the operator surface" and "the agent surface" are a
-_convention_, not a boundary — nothing stops a container from
-curling the core daemon on `localhost:<port>`, or another agent's
-web UI. Network isolation, the gateway, and privsep together turn
-that convention into an enforced boundary.
+The operator/agent boundary is now technically enforced, not just a
+convention. Containers run in private netns (network isolation is
+always on), the gateway proxies all operator-facing traffic, and
+`hive-c0re` runs as the unprivileged `hive-core` user. All three
+`area:ops` pillars — network isolation, the gateway, and privsep —
+are complete and active.
 
 ## Two principals, two paths
 
@@ -39,14 +40,17 @@ agent page).
 
 ## Why network isolation is the load-bearing step
 
-Containers currently share the host network namespace, so a
-container can reach `localhost:<core-port>`, the dashboard, and
-every other agent's web port. Until that changes, the
-operator/agent split is on the honour system — every boundary
-claim above is aspirational. Network isolation is what makes the
-boundary _real_; the gateway and privsep are ergonomics and
+Without network isolation, containers share the host network namespace
+and can reach `localhost:<core-port>`, the dashboard, and every other
+agent's web port — the operator/agent split is on the honour system and
+every boundary claim above is aspirational. Network isolation is what
+makes the boundary _real_; the gateway and privsep are ergonomics and
 defence-in-depth layered on top.
 
+Network isolation is now complete and always on: every agent container
+runs in a private netns behind the hive bridge. The shared-netns mode
+was removed. See `docs/network.md`.
+
 The `area:ops` issues followed this sequencing:
 
 1. **Gateway** — pure ergonomics win, unblocks same-origin (lets the
@@ -54,7 +58,8 @@ The `area:ops` issues followed this sequencing:
    behavioural risk. An nginx nixos-container now sits in front of all
    surfaces; per-agent UIs are proxied under `/agent/<name>/`.
 2. **Network isolation** — the load-bearing step that turns the
-   honour-system split into an enforced boundary. In progress.
+   honour-system split into an enforced boundary. **Complete** —
+   always-on, unconditional; the shared-netns mode was removed.
 3. **Privsep** — defence in depth on the core process; `hive-c0re`
    runs as the unprivileged `hive-core` user and delegates root
    operations to `hive-priv`, a narrow socket-activated helper. See