diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 6ba6e96f..f1031f53 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -245,10 +245,17 @@ in
 {
   # One service, two namespaces, and the split decides who may set what.
   #
-  # `deploy.bao.*` is what the host RUNNING the store decides: whether to run
-  # it (`enable`, declared in ./deploy.nix with its siblings), which build,
-  # how the root key is sealed, what it listens on. None of it means anything
-  # on a host that only reads secrets.
+  # `deploy.bao.*` is mostly what the host RUNNING the store decides: whether
+  # to run it (`enable`, declared in ./deploy.nix with its siblings), which
+  # build, how the root key is sealed, what it listens on.
+  #
+  # ⚠️ Except the reader's own identity. `clientCertFile`, `clientKeyFile` and
+  # `serverCaFile` live here too, and they are set by whoever authenticates TO
+  # the store — which includes a host that runs none of it. A reader is defined
+  # by holding a certificate the store accepts, never by sharing a host with
+  # one; ./glue-matrix-bao-token.nix gates on exactly that and not on `enable`.
+  # Reading this block as store-runner-only is what makes an off-host reader
+  # look inexpressible when it is already supported.
   #
   # `swarm.bao.*` below is what every host in the swarm has to agree on — the
   # name the store answers to, its port, its container. A host that is purely
@@ -378,9 +385,7 @@ in
         Certificate a **reader on this machine** presents to the store.
 
         The counterpart to {option}`services.hyperhive.deploy.bao.clientCaFile`,
-        which is the store's side of the same handshake. Only the store's side
-        was declarable, so a hive that did not run the store had no way to be
-        pointed at a certificate even when one was placed for it.
+        which is the store's side of the same handshake.
 
         On a hive that runs the store, a glue module supplies the leaf it minted,
         as a `mkDefault`. Everywhere else this is the credential an operator