diff --git a/docs/gotchas.md b/docs/gotchas.md
index c63438f6..22351306 100644
--- a/docs/gotchas.md
+++ b/docs/gotchas.md
@@ -30,16 +30,12 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+.
 
 …in the `.conf`. The start script's `if HOST_ADDRESS set →
 --network-veth` branch then forces a private netns — silently fatal
-for our web UIs (the bind is invisible from the host).
-`hive-priv`'s `write_nspawn_flags` rewrites these vars every time it
-touches the conf file: `PRIVATE_NETWORK=1` plus a veth pair onto the
-host bridge, `HOST_ADDRESS` set to the bridge gateway IP (so
-`nixos-container`'s in-container init installs a default route before
-the DHCP lease arrives), rest left for DHCP. Network isolation is the
-hive's only mode (`hive-network.nix` sets it up unconditionally
-whenever hyperhive is enabled; `isolateContainers` and the module's own
-`enable` option were both removed via `lib.mkRemovedOptionModule` —
-"network isolation is the only mode" is the removal message itself).
+for our web UIs (the bind is invisible from the host). Every agent
+container runs isolated: `hive-priv`'s `write_nspawn_flags` writes
+`PRIVATE_NETWORK=1` plus a veth pair onto the host bridge, `HOST_ADDRESS`
+set to the bridge gateway IP (so `nixos-container`'s in-container init
+installs a default route before the DHCP lease arrives), rest left for
+DHCP.
 
 ### systemd service PATH ≠ host PATH