diff --git a/nix/host-modules/swarm-bao.nix b/nix/host-modules/swarm-bao.nix
index 22560aa1..b02149c5 100644
--- a/nix/host-modules/swarm-bao.nix
+++ b/nix/host-modules/swarm-bao.nix
@@ -180,17 +180,9 @@ let
   # `secret`, and the engine inserts `data/`. Matching the code's spelling
   # literally would grant nothing.
   #
-  # `read` is there because the controller mints idempotently: `mint_and_verify`
-  # reads the queue credential back before writing so that a re-run keeps the
-  # value a live agent is already authenticating with instead of rotating it.
-  # That read is `read_optional`, which treats only a 404 as absence — a denial
-  # stays an error on purpose, so without `read` the first re-run of a mint
-  # aborts on a 403 rather than concluding the path is empty.
-  #
-  # It is the whole of the widening: `read` on the paths this same stanza
-  # already lets the controller create and replace, and no `list`, so it can
-  # only fetch a credential for an agent it was told the name of — which is an
-  # agent it could already overwrite.
+  # `read` too: `mint_and_verify` reads a credential back before writing so a
+  # re-run keeps the value a live agent already holds instead of rotating it —
+  # the read is required, not incidental.
   controllerPolicyText = ''
     path "auth/cert/certs/hive-*" {
       capabilities = ["create", "update", "read", "delete"]