diff --git a/hive-c0re/src/auto_update.rs b/hive-c0re/src/auto_update.rs
index 0388cfe8..875f3f24 100644
--- a/hive-c0re/src/auto_update.rs
+++ b/hive-c0re/src/auto_update.rs
@@ -195,14 +195,14 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
         } else {
             tracing::debug!("manager container already present");
         }
-        // The root/manager is required infrastructure — it must be running
-        // after every hive-c0re (re)start. A previous bring-up can leave it
-        // *created but stopped* (e.g. a first-start failure on a fresh
-        // install): the startup sweep's rebuild only restarts a container
-        // that was already running, so without this it stays down until a
-        // manual `nixos-container start`. Unlike sub-agents there is no
-        // "deliberately stopped root" intent to honour, so start it
-        // unconditionally when it isn't running.
+        // hive-c0re auto-manages the root/manager by default, so a
+        // present-but-stopped root (e.g. a first-start failure on a fresh
+        // install) is brought back up here: the startup sweep's rebuild only
+        // restarts a container that was already running, so without this it
+        // stays down until a manual `nixos-container start`. The sub-agent
+        // `was_running` guard is intentionally left untouched. (An operator
+        // opt-out of this whole auto-management is tracked as a separate
+        // host setting.)
         if !lifecycle::is_running(MANAGER_NAME).await {
             tracing::info!("manager container present but not running — starting");
             if let Err(e) = lifecycle::start(MANAGER_NAME).await {