diff --git a/nix/host-modules/hive-gateway/vhosts.nix b/nix/host-modules/hive-gateway/vhosts.nix
index ee855739..5f74f059 100644
--- a/nix/host-modules/hive-gateway/vhosts.nix
+++ b/nix/host-modules/hive-gateway/vhosts.nix
@@ -1,9 +1,17 @@
-# nginx virtual-host tree for the gateway: the `_` default server
-# (dashboard, per-agent routing, matrix discovery), the forge, matrix
-# and authelia sub-domain vhosts, and the Accept-header SPA map for the
-# matrix GUI. Pure function — called from ./default.nix with the
-# outer-scope config values as arguments; returns
-# `{ virtualHosts }`.
+# nginx virtual-host tree for the gateway: the `_` default server —
+# now only a catch-all that rejects — and the hive's own domain, which
+# carries the dashboard, per-agent routing, matrix discovery and the
+# swagger UI.
+#
+# ⚠️ The swarm services' vhosts are NOT here. Forge, matrix and authelia
+# each declare their own, built from the same kit this file consumes
+# (`services.hyperhive.gateway.lib`, ./vhost-lib.nix), so a service owns
+# its whole gateway surface — vhost and dns name — inside its own
+# module. A service name appearing in this file is the signal that the
+# coupling is growing back.
+#
+# Pure function — called from ./default.nix with the outer-scope config
+# values as arguments; returns `{ virtualHosts }`.
 {
   lib,
   cfg, # services.hyperhive.gateway