diff --git a/nix/host-modules/hive-c0re/environment.nix b/nix/host-modules/hive-c0re/environment.nix
index a88572fb..64975b30 100644
--- a/nix/host-modules/hive-c0re/environment.nix
+++ b/nix/host-modules/hive-c0re/environment.nix
@@ -99,13 +99,17 @@ in
     HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = otel.extraResourceAttributes;
   }
   # HYPERHIVE_OTEL_HEADERS_CREDENTIAL is deliberately NOT emitted, and
-  # its absence is the security half of this design. It is the variable
-  # that put the upstream token in an agent's own settings.json:
-  # host_config.rs forwards it into the container as an nspawn
-  # credential, and claude-settings.nix's `hive-otel-header` oneshot
-  # then writes the value into a file the agent can read. The collector
-  # holding the credential achieves nothing while the harness keeps
-  # handing out a copy — so there is exactly one holder, on the host.
+  # its absence is the security half of this design: it was the variable
+  # that put the upstream token into an agent's own settings.json. The
+  # delivery path it drove — an nspawn credential forwarded by
+  # host_config.rs, then written to an agent-readable file by
+  # claude-settings.nix's `hive-otel-header` oneshot — no longer exists
+  # anywhere; it was removed along with this variable's last consumer.
+  #
+  # Kept as a comment rather than deleted because the useful part is the
+  # RULE, not the history: the collector holding the credential achieves
+  # nothing while anything else hands out a copy, so there is exactly one
+  # holder and it is on the host.
   // lib.optionalAttrs (otel.metricIntervalMs != null) {
     HYPERHIVE_OTEL_METRIC_INTERVAL_MS = toString otel.metricIntervalMs;
   }