nix: finish the current-behaviour comment sweep in touched files

Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902

nix/agent-modules/renamed-options.nix

@@ -93,11 +93,11 @@
       [ "hyperhive" "frontend" "extraFiles" ]
       [ "services" "hyperhive" "agent" "frontend" "extraFiles" ]
     )
-    # `frontend.mergedDist` moved with the rest and deliberately has NO entry:
+    # `frontend.mergedDist` deliberately has NO entry:
     # it is `readOnly` and ./frontend.nix already defines it, and a rename
     # module contributes a *definition* to its target — so a shim for it makes
     # every evaluation fail with "set multiple times". Nothing could have set
-    # it anyway; a reader of the old path now gets "option does not exist",
+    # it anyway; a reader of the old path gets "option does not exist",
     # which says the same thing sooner. Same reasoning as the `hostUsersFile`
     # exclusion in ../host-modules/deploy.nix.
     (lib.mkRenamedOptionModule

nix/host-modules/deploy.nix

@@ -25,7 +25,7 @@
 # exactly that shape, and a bare bool leaves it unrepresentable.
 #
 # ⚠️ The renames below are deliberately in this one file rather than
-# spread across the service modules, so the whole move has a single home
+# spread across the service modules, so all of them have a single home
 # and a single file to delete when the deprecation window closes — the
 # shape ./swarm-peers-removed.nix already uses.
 { lib, config, ... }:
@@ -99,8 +99,8 @@ in
       [ "services" "hyperhive" "swarm" "authelia" "usersFile" ]
       [ "services" "hyperhive" "deploy" "authelia" "usersFile" ]
     )
-    # `hostClientSecretDir` and `hostUsersFile` moved in the same commit and
+    # `hostClientSecretDir` and `hostUsersFile` deliberately have NO entry
-    # deliberately have NO entry here. A rename module contributes a
+    # here. A rename module contributes a
     # *definition* to its target, and both are `readOnly`, which refuses a
     # second one — so a shim for either makes every evaluation fail with
     # "set multiple times", naming the option's own default as the rival
@@ -139,7 +139,7 @@ in
       [ "services" "hyperhive" "deploy" "swarm-otel" "enable" ]
     )
     # ⚠️ Not to be confused with `services.hyperhive.otel.clientSecretFile`,
-    # a different option on the hive tier that is not part of this move. A
+    # a different option on the hive tier that is not part of this table. A
     # bare `clientSecretFile` matches five distinct options across the tree.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "otel" "clientSecretFile" ]
@@ -177,14 +177,14 @@ in
     # The queue's callout identity. What stays under `swarm.nats` is what the
     # queue IS to every hive — the ports it answers on and the client id it is
     # registered under; these five are what the host running it decides. The
-    # responder package is one of them now, further down with the other
+    # responder package is one of them, renamed further down with the other
-    # `*.package` moves.
+    # `*.package` entries.
     #
-    # ⚠️ The two PUBLIC keys move with their seeds. A public key looks
+    # ⚠️ The two PUBLIC keys follow their seeds. A public key looks
     # swarm-wide, and the user key genuinely is published to every client that
     # connects — but peers RECEIVE it over the wire, they never configure it,
     # and splitting a keypair across two namespaces is worse than either
-    # placement. `enable` moved earlier; its shim is the one above.
+    # placement. `enable`'s shim is the one above.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "nats" "autoGenerateCallout" ]
       [ "services" "hyperhive" "deploy" "nats" "autoGenerateCallout" ]
@@ -209,8 +209,8 @@ in
     # The rest of the forge split. What stays under `swarm.forge` is what the
     # forge IS from any hive's point of view — the names and ports it answers
     # on, the URLs it advertises, the client id it is registered under; these
-    # four are what the host running it decides. Its package moved as well,
+    # four are what the host running it decides. Its package is renamed
-    # further down with the other `*.package` moves. `sso` splits
+    # further down with the other `*.package` entries. `sso` splits
     # because its two halves are different facts: the client id must match the
     # entry in authelia's register, the secret is a path on this machine.
     #
@@ -238,8 +238,8 @@ in
     # The homeserver, split the same way. `swarm.matrix` keeps what it IS to
     # every hive — the name it answers to, the ports and URLs it is reached
     # on, the client id it is registered under. These six are what the host
-    # running it decides; its two packages moved as well, further down with
+    # running it decides; its two packages are renamed further down with
-    # the other `*.package` moves. ⚠️ `enable` is NOT here: its shim lives in
+    # the other `*.package` entries. ⚠️ `enable` is NOT here: its shim lives in
     # ./hive-matrix.nix, so that file is the one
     # to check before assuming this table is the whole matrix story.
     (lib.mkRenamedOptionModule
@@ -360,11 +360,11 @@ in
       ''
     )
 
-    # The WireGuard mesh, whole. Unlike every rename above this one moves a
+    # The WireGuard mesh, whole. Unlike every rename above this one covers a
     # namespace rather than a toggle: nothing under it is a fact another hive
     # reads. A peer needs this host's `wireguardEndpoint` — the roster entry
     # in ./swarm.nix, which stays — and nothing about the interface this host
-    # brings up. `listenPort` moves for the same reason and is easy to read
+    # brings up. `listenPort` follows for the same reason and is easy to read
     # the other way: it is what this host *binds*, while the port a peer
     # *dials* is the one inside `wireguardEndpoint`.
     (lib.mkRenamedOptionModule
@@ -389,10 +389,9 @@ in
     )
 
     # Which build a service runs is a decision of the host that runs it, so
-    # every `*.package` follows its `enable` across. The split these replace
+    # every `*.package` follows its `enable` across. Left in separate
-    # was the sharpest case: `gui.enable` had already moved while
+    # namespaces they split one client's two halves, as `gui.enable` and
-    # `gui.package` stayed, so one client's two halves sat in two namespaces
+    # `gui.package` would.
-    # and ./hive-matrix.nix said so in a comment above the option.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "matrix" "package" ]
       [ "services" "hyperhive" "deploy" "matrix" "package" ]
@@ -413,9 +412,9 @@ in
       [ "services" "hyperhive" "swarm" "victoriametrics" "package" ]
       [ "services" "hyperhive" "deploy" "victoriametrics" "package" ]
     )
-    # With this one `services.hyperhive.swarm.ui` holds nothing at all — it had
+    # With this one `services.hyperhive.swarm.ui` holds nothing at all — its
-    # exactly two options and both have moved, so the namespace now exists only
+    # two options are both renamed, so the namespace exists only as this
-    # as this entry and the `enable` one above it.
+    # entry and the `enable` one above it.
     (lib.mkRenamedOptionModule
       [ "services" "hyperhive" "swarm" "ui" "package" ]
       [ "services" "hyperhive" "deploy" "swarm-ui" "package" ]

nix/host-modules/glue-bao-tls.nix

@@ -228,7 +228,7 @@ in
         # is what OPENS the mint, so it cannot come out of it. A certificate
         # authority that issues the credential admitting you to it is the
         # cycle this file's header exists to keep out — which is exactly why
-        # the swarm-services root moved into the store and this one did not.
+        # the swarm-services root lives in the store and this one does not.
         #
         # Its own CN, not the reader's: the hive's own leaf reads every secret
         # its policy names, while this principal may do one thing — `update`

nix/host-modules/hive-ci.nix

@@ -197,8 +197,8 @@ in
     ];
 
     # Tell hive-c0re that CI is enabled so its startup sweep registers the
-    # runner. Registration moved OFF the container's boot-critical path into
+    # runner. Registration is OFF the container's boot-critical path:
-    # hive-c0re (`forge/ci_runner.rs`): it validates the persisted `.runner`
+    # hive-c0re (`forge/ci_runner.rs`) validates the persisted `.runner`
     # against the forge and, when absent/stale, mints a registration token and
     # hands it to hive-priv to write `/run/hive-ci/runner-token` + restart the
     # runner. The forge admin token stays in hive-c0re; only the registration

nix/host-modules/hive-forge/default.nix

@@ -925,25 +925,29 @@ in
               # re-mint instead of being silently masked by a stamp that
               # outlived what it claims exists.
               if [ ! -s "$token_path" ]; then
-                # `write:admin` is required by `swarm-controller::forge::Client::
+                # `write:admin` added for `swarm-controller::forge::Client::
-                # ensure_agent_user` (the `CreateForgeUser` jobq node):
+                # ensure_agent_user` (the `CreateForgeUser` jobq node) —
-                # Forgejo's `admin_create_user` HTTP endpoint refuses a
+                # Forgejo's `admin_create_user` HTTP endpoint refused every
-                # token without it ("token does not have at least one of
+                # call with "token does not have at least one of required
-                # required scope(s): [write:admin]"). A host whose token was
+                # scope(s): [write:admin]" without it, an already-deployed
-                # minted without this scope keeps it — the
+                # swarm hitting this the moment that node shipped. A host
-                # `[ ! -s "$token_path" ]` guard above only mints when the
+                # whose token was minted before this scope was added won't
-                # file is absent, by design (see its own comment) — so such a
+                # pick it up automatically — the `[ ! -s "$token_path" ]`
-                # deployment needs its token file deleted to force a re-mint
+                # guard above only mints when the file is absent, by design
-                # with the full scope.
+                # (see its own comment) — so an existing deployment needs
+                # its token file deleted to force a re-mint with the new
+                # scope.
                 #
-                # Token name carries a timestamp suffix rather than a fixed
+                # Token name carries a timestamp suffix rather than the
-                # name: deleting the token *file* (the remediation above)
+                # fixed `swarm-controller-boot` this used to be — a real
-                # doesn't delete the token Forgejo already has under that
+                # incident, not a hypothetical: deleting the token *file*
-                # name, so re-running this unit would fail with "Command
+                # (the remediation above) doesn't delete the token Forgejo
-                # error: access token name has been used already". Same
+                # already has under that name, so re-running this unit hit
-                # approach `hive-c0re::forge::users::mint_token` uses for its
+                # "Command error: access token name has been used already"
-                # own agent tokens — a monotonic suffix means a re-mint can
+                # and failed outright. Same fix `hive-c0re::forge::users::
-                # never collide with whatever this account already has.
+                # mint_token` already uses for its own agent tokens, for
+                # the identical reason — a monotonic suffix means a re-mint
+                # can never collide with whatever this account already has.
                 out=$(forgejo admin user generate-access-token \
                   --username ${lib.escapeShellArg swarmControllerForgeUser} \
                   --token-name "swarm-controller-boot-$(date +%s)" \

nix/host-modules/hive-forge/service.nix

@@ -98,10 +98,8 @@ in
         swarm's domain, not this hive's, because a swarm runs **one**
         forge that every hive in it talks to.
 
-        ⚠️ A deployment that was running before this moved keeps its
+        ⚠️ To use the per-hive name `forge.''${services.hyperhive.domain}`
-        current name by pinning it here:
+        instead, pin it here. Certificates follow either way: the
-        `forge.''${services.hyperhive.domain}`, which is exactly what
-        the old default rendered. Certificates follow either way: the
         swarm-services sub-CA is name-constrained to the configured
         names (see `./swarm-ca.nix`), not to a fixed tree.
 

nix/host-modules/hive-gateway/vhosts.nix

@@ -44,7 +44,7 @@ let
   publicPortSuffix = if publicPort == 443 then "" else ":${toString publicPort}";
 
   # `<hive>/matrix/*` → 301 → `gatewayHost`'s vhost/$1 (`chat.<swarm-domain>`
-  # by default; legacy deep-link shim during the fluffychat sub-domain move).
+  # by default; legacy deep-link shim for the fluffychat sub-domain).
   # See `docs/networking/gateway.md`.
   matrixRedirectLocations =
     lib.optionalAttrs (matrixDeployCfg.enable && matrixCfg.gatewayHost != null)

nix/host-modules/hive-tls.nix

@@ -130,9 +130,9 @@ let
     # leaf to hold, and its absence there is the correct state rather
     # than a stale one — its own vhosts are covered by the hive leaf
     # above. Anywhere else it is expected: the leaf comes from the
-    # secret store's `pki` mount, reachable from every host rather than
+    # secret store's `pki` mount now, not from a sub-CA that exists on
-    # from a sub-CA on one host in the swarm, so "this host cannot issue
+    # one host in the swarm, so "this host cannot issue it" is no longer
-    # it" is not one of the answers.
+    # one of the answers.
     want_svc=${if localServiceDomains == [ ] then "0" else "1"}
 
     # Expiry is not the only way a leaf goes wrong. One signed when the
@@ -976,15 +976,14 @@ in
     # they mint a token from authelia over TLS. Declared HERE, beside the
     # bundle, rather than in each consumer's module: the path is this
     # module's fact, and two consumers re-deriving `${stateDir}/…` would be
-    # two places to fix the day it moves.
+    # two places to fix when it changes.
     #
-    # ⚠️ This is what was missing. `swarm-queue-client` built a bare
+    # ⚠️ `swarm-queue-client` builds a bare `reqwest::Client`, so it trusts
-    # `reqwest::Client`, so it trusted only the platform roots and died at
+    # only the platform roots and dies at `invalid peer certificate:
-    # `invalid peer certificate: UnknownIssuer` against a swarm whose
+    # UnknownIssuer` against a swarm whose authelia is signed by the swarm
-    # authelia is signed by the swarm CA — while this very bundle sat on
+    # CA. The bundle is already assembled on disk and handed to hive-c0re
-    # disk, already assembled, already handed to hive-c0re under a different
+    # under a different variable name; this declaration is what points the
-    # variable name. The anchor was never missing; nothing pointed the queue
+    # queue client at it.
-    # client at it.
     #
     # Where the gateway is not self-signed this module contributes nothing, and
     # the clients then fall back to the platform roots — which is correct for

nix/host-modules/hyperhive.nix

@@ -11,8 +11,8 @@ let
   hiveCfg = config.services.hyperhive;
 in
 {
-  # The swarm's display name moved under `swarm` when the swarm-global
+  # The swarm's display name lives under `swarm`, with the other
-  # settings were consolidated; the hive's own name and domain stayed put,
+  # swarm-global settings; the hive's own name and domain are top-level,
   # because they describe this hive rather than the swarm it joins.
   imports = [
     (lib.mkRenamedOptionModule
@@ -39,11 +39,10 @@ in
     # "the other hives can't reach me", on a machine other than the
     # misconfigured one.
     #
-    # ⚠️ The `<hiveName>.<swarm.domain>` formula did NOT move here from
+    # ⚠️ The `<hiveName>.<swarm.domain>` formula lives once, on
-    # there and back: it lives once, on `hives.<name>.domain`, which
+    # `hives.<name>.domain`, which this reads. A direct fallback here
-    # this reads. Restoring a direct fallback here would recreate the
+    # would recreate the second path (and, since that default reads
-    # second path (and, since that default reads `swarm.domain` too, a
+    # `swarm.domain` too, a value that can differ from the directory's).
-    # value that can differ from the directory's).
     default =
       if hiveCfg.hiveName != null && hiveCfg.swarm.hives ? ${hiveCfg.hiveName} then
         hiveCfg.swarm.hives.${hiveCfg.hiveName}.domain

nix/host-modules/swarm-authelia-service.nix

@@ -18,7 +18,7 @@ let
   unitName = "authelia-${instance}";
 in
 {
-  # `enable` and both packages moved to `services.hyperhive.deploy.authelia`
+  # `enable` and both packages are under `services.hyperhive.deploy.authelia`
   # — see ./deploy.nix. Whether this host runs the swarm's SSO provider, and
   # which build it runs, are deployment decisions, in ./swarm-authelia.nix.
   # Here is what authelia IS, including `url` and the OIDC client registry

nix/host-modules/swarm-bao.nix

@@ -2914,9 +2914,8 @@ in
       # difference between a mount nobody may issue from and one the gateway's
       # certificate comes out of.
       #
-      # The policy text moved here from the controller's unit, where it sat
+      # The policy text lives beside the role that carries it: a policy and
-      # while it attached to nothing — a policy and the role that carries it
+      # its role belong in one place, with the principal they grant.
-      # belong in one place, and now there is a principal to put them with.
       systemd.services.swarm-bao-services-issuer-policy = lib.mkIf haveGranter {
         description = "write the swarm services issuer's bao policy and cert-auth role";
         after = [

nix/host-modules/swarm-controller.nix

@@ -375,13 +375,14 @@ in
       '';
     };
 
-    # `enable` moved to `services.hyperhive.deploy.swarm-controller.enable` — see
+    # `enable` is `services.hyperhive.deploy.swarm-controller.enable` — see
-    # ./deploy.nix. `services.hyperhive.deploy.singleHostSwarm` still
+    # ./deploy.nix. `services.hyperhive.deploy.singleHostSwarm` asserts
-    # asserts it, and that was never an exception to "not derived from
+    # it, and that is not an exception to "not derived from
     # deploy.hive-controller.enable": that mode says "this box is the whole
     # deployment", which answers the topology question outright, where
-    # `enable` alone never can. Both packages moved to that same
+    # `enable` alone never can. Both packages are in that same
-    # `deploy.swarm-controller` block. What stays here is what the daemon IS.
+    # `deploy.swarm-controller` block. What is declared here is what the
+    # daemon IS.
 
     staleAfterSeconds = lib.mkOption {
       type = lib.types.ints.positive;
@@ -612,8 +613,8 @@ in
     matrixHomeserverUrl = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       # `gatewayHost`'s own vhost, not a re-derivation of its default: a
-      # deployment that pins `gatewayHost` (e.g. to keep a name from before
+      # deployment that pins `gatewayHost` (e.g. to the per-hive name) still
-      # it moved under the swarm domain) still has one homeserver, and this
+      # has one homeserver, and this
       # option has to name the same one.
       default = if matrixCfg.gatewayHost == null then null else "https://${matrixCfg.gatewayHost}";
       defaultText = lib.literalExpression ''"https://''${services.hyperhive.swarm.matrix.gatewayHost}"'';

nix/host-modules/swarm-grafana.nix

@@ -277,7 +277,7 @@ in
   # store path, and the directory it shares a socket with nginx through.
   # `enable` already lives in ./deploy.nix, which also carries the renames.
   #
-  # ⚠️ Both datasource URLs are wiring and still move. A URL's scope is the
+  # ⚠️ Both datasource URLs are wiring, so they live here. A URL's scope is the
   # scope of what it ADDRESSES, not the fact that it is a URL: both stores
   # bind loopback, so these can only ever mean "on this host".
   options.services.hyperhive.deploy.grafana = {

nix/host-modules/swarm-nats.nix

@@ -118,14 +118,13 @@ let
       # Two accounts, and the callout user lives in neither of the accounts
       # it authorizes into.
       accounts = {
-        # ⚠️ The nkey is not decoration and its absence was a real hole: a
+        # ⚠️ The nkey is not decoration, and without it there is a hole: a
         # `users` entry carrying only a `user` name has no credential, and
         # `CONNECT {"user":"auth"}` is then accepted with no password at
         # all. Since the name is a literal in this public module, that made
         # the callout-exempt identity walk-in-able from every container on
         # the shared netns — the same class of hole this module exists to
-        # close, moved rather than fixed. Caught in review on the first
+        # close. An nkey and NOTHING else, both halves
-        # version of this file. An nkey and NOTHING else, both halves
         # measured against a running server rather than reasoned about:
         #
         #   { user = "auth"; }               → `CONNECT {"user":"auth"}`

nix/host-modules/swarm-otel-service.nix

@@ -41,7 +41,7 @@ in
     '')
   ];
 
-  # `enable` moved to `services.hyperhive.deploy.swarm-otel.enable` — see ./deploy.nix.
+  # `enable` is `services.hyperhive.deploy.swarm-otel.enable` — see ./deploy.nix.
   # ⚠️ That is the SWARM collector. The per-hive one keeps its own
   # `services.hyperhive.otel.enable` (./otel.nix) and is a different
   # option entirely — every hive runs that one.

nix/host-modules/swarm-otel.nix

@@ -555,8 +555,8 @@ in
         # that runs it without a leaf, because a Grafana with no SSO has no way
         # in at all, while a collector with none still receives telemetry. So
         # this fires only where the host already reads the store and is missing
-        # this one pair — which before the four-way split rendered the unit off
+        # this one pair: the unit is rendered off the collector's own leaf, so
-        # `clientCertFile`, and now silently does not.
+        # without it the unit would silently not render.
         assertion = !hiveReaderIdentity || haveClientIdentity;
         message = ''
           This host reads the swarm secret store (services.hyperhive.deploy.bao.clientCertFile
@@ -586,10 +586,10 @@ in
           from that CA out of band and named here — see docs/swarm/secrets.md.
         '';
       }
-      # ⚠️ An assertion that this collector has "somewhere to send" was REMOVED
+      # ⚠️ There is deliberately no assertion that this collector has
-      # rather than relaxed: it read the store's *per-host* enable, so it
+      # "somewhere to send": it would read the store's *per-host* enable, and
-      # rejected at eval the very deployment the stores are reached by domain
+      # so reject at eval the very deployment the stores are reached by domain
-      # for — a collector on its own host never built.
+      # for — a collector on its own host would never build.
       {
         # Whether there is a journal on disk to collect from.
         # A `bindMounts` entry never creates its `hostPath`, and unlike

nix/host-modules/swarm-ui.nix

@@ -61,10 +61,10 @@ let
   apex = if swarmCfg.domain == null then "swarm.invalid" else swarmCfg.domain;
 in
 {
-  # `enable` moved to `services.hyperhive.deploy.swarm-ui.enable` — see
+  # `enable` is `services.hyperhive.deploy.swarm-ui.enable` — see
-  # ./deploy.nix, where it still derives from the controller's own deploy
+  # ./deploy.nix, where it derives from the controller's own deploy
-  # toggle for the same reason. `domain` is gone too: the UI answers on the
+  # toggle for the same reason. There is no `domain` option: the UI answers
-  # swarm apex, which the swarm already declares once.
+  # on the swarm apex, which the swarm already declares once.
   imports = [
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ui" "domain" ] ''
       The swarm UI answers on services.hyperhive.swarm.domain and nothing

nix/host-modules/swarm.nix

@@ -211,7 +211,7 @@ in
             # it — and this field was set on real deployments.
             #
             # ⚠️ `lib.mkRemovedOptionModule` cannot do this job here, and
-            # neither of its two halves survives the move into a submodule:
+            # neither of its two halves survives inside a submodule:
             # its `apply = throw` fires only when the value is READ, and
             # nothing reads this (that being the point of removing
             # it); its `config.assertions` half would land on a submodule

nix/module-eval/bao-otel-collector.nix

@@ -334,7 +334,7 @@ let
         && (baoForwarder baoWithHiveOtel).settings.exporters.otlphttp.endpoint == route;
     }
     {
-      # 🎯 The credential half of this move, and the arm that says the hop
+      # 🎯 The credential half of the hop, and the arm that says it
       # DELIVERS rather than merely resolves. The receiver at the far end
       # takes an OIDC token and nothing else, so an exporter with no
       # authenticator is a forwarder that retries into 401s while every other

nix/module-eval/name-guards.nix

@@ -229,7 +229,7 @@ let
       ok = !(equalityGuardFired hiveNamesAllLegal) && !(fragmentGuardFired hiveNamesAllLegal);
     }
     {
-      # The substring guard came along in the move and has to still work.
+      # The substring guard has to work with the collector off too.
       # `h1-agent` mints exactly the client id hive `h1`'s agents present.
       name = "a hive name containing a composed-identifier word is refused, with the collector off";
       ok = fragmentGuardFired hiveNameWithComposedWord;

nix/module-eval/nats-authelia.nix

@@ -268,9 +268,9 @@ let
     }
     {
       # Not a rename test. `hostClientSecretDir` is `readOnly`, so the fixture
-      # cannot define it; what can break is a reader left pointing at the
+      # cannot define it; what can break is a reader left pointing at
-      # namespace it moved out of. Several modules read this through an
+      # `swarm.authelia` instead of `deploy.authelia`. Several modules read this
-      # `autheliaCfg` alias, where a path-shaped grep does not see it.
+      # through an `autheliaCfg` alias, where a path-shaped grep does not see it.
       name = "a consumer of authelia's host client-secret dir renders it from the deploy namespace";
       ok = lib.hasPrefix "/var/lib/nixos-containers/swarm-authelia/var/lib/authelia-swarm/oidc-clients/" autheliaOldPath.services.hyperhive.otel.clientSecretFile;
     }
@@ -332,10 +332,11 @@ let
     }
     {
       # …and the name it resolves through is a DOMAIN, not a host this config
-      # picked. `127.0.0.1` is what the old default rendered on the IdP host,
+      # picked. `127.0.0.1` is what a co-location-derived default renders on
-      # the bridge address is what the queue's defaults still render, and
+      # the IdP host, the bridge address is what the queue's defaults render,
-      # neither is an address a client may be handed: the domain is allowed to
+      # and neither is an address a client may be handed: the domain is
-      # resolve differently in different places, which is the whole property.
+      # allowed to resolve differently in different places, which is the
+      # whole property.
       name = "the swarm IdP address names no host address";
       ok =
         let