diff --git a/docs/swarm/services.md b/docs/swarm/services.md
index 000fca4e..750c6ffe 100644
--- a/docs/swarm/services.md
+++ b/docs/swarm/services.md
@@ -203,7 +203,7 @@ kept.
 - `agents`: per-agent resource usage and Claude Code activity.
 - `authelia`, `bao`, `queue`: the identity provider, the secret store and the NATS queue.
 - `claude-usage`: Claude use by model, effort, token type and source. Filter by hive, service (agents or the review classifier) and agent. The service filter separates the classifier's API-key spend from the agents.
-- `egress`: what agents send through the egress proxy, in three tabs. **overview** has the totals (requests, agents active, refused, credential challenges, data transferred), requests over time by status, and the busiest agents and destinations. **refused** lists the hosts the proxy refused for each agent. **would-deny** lists what agents in `log` mode reached that restricted mode would refuse. Filter by agent.
+- `egress`: what agents send through the egress proxy, in three tabs. **overview** has the totals (requests, agents active, refused, credential challenges, data transferred), requests over time by status, and the busiest agents and destinations. **refused** lists the hosts the proxy refused for each agent. **would-deny** lists what agents in `log` mode reached that restricted mode would refuse. The host lists are tables, one row per host (and agent), with a count column you can sort. Filter by agent.
 - `controller`: the swarm controller's job graph by state, and the push and commit rates it sees on the forge.
 - `review-classifier`: review requests by outcome, the verdict mix, results per check, retried asks, and run duration p50 and p95.
 - `forge`: what the forge holds, and the forge process's CPU, memory and descriptors.