diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index b7b25ee8..6a7630d6 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -843,10 +843,13 @@
     # `PathExists=` fires at activation if the file is already there
     # (covers re-deploys + restarts after first provisioning); the
     # underlying inotify watch picks up subsequent creates (covers
-    # first-boot race). Manager mounts state at `/state` (legacy
-    # path), sub-agents at `/agents/<label>/state` (per
-    # lifecycle.rs's `notes_mount`); `PathExistsGlob=` matches both
-    # without needing the agent name at module-eval time.
+    # first-boot race). matrix-token can live at one of two paths
+    # depending on whether the container is the manager (legacy
+    # `/state/` mount, pending removal in #604) or a sub-agent
+    # (`/agents/<name>/state/` per lifecycle.rs's `notes_mount`).
+    # `PathExistsGlob=` matches the sub-agent shape without baking
+    # the agent name into module-eval; once #604 lands the manager
+    # will use the same shape and the explicit `PathExists=` line drops.
     systemd.paths.hive-matrix-daemon = lib.mkIf config.hyperhive.matrix.enable {
       description = "trigger hive-matrix-daemon when matrix-token appears";
       wantedBy = [ "multi-user.target" ];
@@ -867,10 +870,13 @@
     # `PathExists=` fires at activation if the file is already there
     # (covers re-deploys + restarts after first provisioning); the
     # underlying inotify watch picks up subsequent creates (covers
-    # first-boot race). Manager mounts state at `/state` (legacy
-    # path), sub-agents at `/agents/<label>/state` (per
-    # lifecycle.rs's `notes_mount`); `PathExistsGlob=` matches both
-    # without needing the agent name at module-eval time.
+    # first-boot race). matrix-token can live at one of two paths
+    # depending on whether the container is the manager (legacy
+    # `/state/` mount, pending removal in #604) or a sub-agent
+    # (`/agents/<name>/state/` per lifecycle.rs's `notes_mount`).
+    # `PathExistsGlob=` matches the sub-agent shape without baking
+    # the agent name into module-eval; once #604 lands the manager
+    # will use the same shape and the explicit `PathExists=` line drops.
     systemd.paths.matrix-avatar-sync = {
       description = "trigger matrix-avatar-sync when matrix-token appears";
       wantedBy = [ "multi-user.target" ];