diff --git a/nix/host-modules/otel.nix b/nix/host-modules/otel.nix
index 6a756941..11ca025d 100644
--- a/nix/host-modules/otel.nix
+++ b/nix/host-modules/otel.nix
@@ -230,7 +230,8 @@
             # hive whose swarm collector lives elsewhere then names it in
             # config instead of needing this file changed. A loopback
             # literal is correct only while listener and caller share a
-            # netns — the assumption that cost #2860 and #3363.
+            # netns, an assumption that has cost this project two
+            # outages.
             endpoint = config.services.hyperhive.swarm.otel.url;
           };
 
diff --git a/nix/host-modules/swarm-otel.nix b/nix/host-modules/swarm-otel.nix
index 22ebe688..40331543 100644
--- a/nix/host-modules/swarm-otel.nix
+++ b/nix/host-modules/swarm-otel.nix
@@ -6,15 +6,16 @@
 #   - `otel.nix` is the **hive** tier. It receives from this hive's agents
 #     on the bridge and forwards, and it holds no upstream credential.
 #   - this is the **swarm** tier. It is the only holder of the upstream
-#     credential, the only writer to the swarm's metrics store, and (once
-#     #3283 lands) the place that stamps `hive=` from the authenticated
-#     connection rather than from anything a sender can choose.
+#     credential, the only writer to the swarm's metrics store, and the
+#     place that will stamp `hive=` from the authenticated connection
+#     rather than from anything a sender can choose.
 #
 # On a host that runs both, both processes run. They are not collapsed:
 # all-local is a statement about *where* processes run, not about what
 # shape the deployment has, and a local tier boundary that disappears is
 # one the local deployment stops testing. `hive=` attribution is the
-# property that would differ, and it is the one #3283 depends on.
+# property that would differ, and the ingest auth that makes it
+# unforgeable is built on this boundary existing.
 #
 # A container rather than a second host unit, for the same reason every
 # sibling swarm service is one — and because `services.opentelemetry-collector`