diff --git a/README.md b/README.md
index 04b472c0..f84d9096 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ the substrate.
 - blast radius = container
 
 ```
-host (NixOS, runs hive-c0re.service)
+every hive (NixOS host, runs hive-c0re.service)
 │
 ├── operator
 │   ├── browser → :80 (hive-gateway)    dashboard + per-agent UIs
@@ -28,24 +28,25 @@ host (NixOS, runs hive-c0re.service)
 ├── hive-c0re  (Rust daemon: lifecycle / broker / approvals /
 │               auto-update / dashboard / sockets)
 │
-├── optional containers
-│   ├── hive-gateway   nginx — proxies :80 → c0re dashboard + per-agent sockets
-│   ├── hive-forge     Forgejo — per-agent accounts, config mirror (agent-configs/)
-│   └── hive-matrix    tuwunel — Matrix homeserver + per-agent accounts
+├── hive-gateway (optional)   nginx — proxies :80 → c0re dashboard + per-agent sockets
 │
-├── agent containers
-│   ├── h-ruth     manager (privileged MCP surface, approval gating)
-│   └── h-<name>   sub-agent (claude + MCP tools + per-agent web UI + unix socket)
+└── agent containers
+    ├── h-ruth     manager (privileged MCP surface, approval gating)
+    └── h-<name>   sub-agent (claude + MCP tools + per-agent web UI + unix socket)
+
+one host per swarm (optional — connects hives; can be any hive, including
+one that's also running the tree above)
 │
-└── swarm (optional — connects hives; one host per swarm runs these)
-    ├── swarm-controller       cross-hive state: hive directory, agent roster, jobs
-    ├── swarm-ui               swarm-wide SPA, served straight off the gateway (no own container)
-    ├── swarm-authelia         SSO — one login gates swarm-ui + Grafana + more
-    ├── swarm-nats             message queue (JetStream KV: hive-status, …)
-    ├── swarm-otel             telemetry collector, sole holder of the upstream credential
-    ├── swarm-victoriametrics  metrics store
-    ├── swarm-victorialogs     log store
-    └── swarm-grafana          dashboards over the metrics/log stores, own OIDC login
+├── hive-forge             Forgejo — swarm-wide singleton, per-agent accounts + config mirror
+├── hive-matrix            tuwunel — swarm-wide singleton, Matrix homeserver + per-agent accounts
+├── swarm-controller       cross-hive state: hive directory, agent roster, jobs
+├── swarm-ui               swarm-wide SPA, served straight off the gateway (no own container)
+├── swarm-authelia         SSO — one login gates swarm-ui + Grafana + more
+├── swarm-nats             message queue (JetStream KV: hive-status, …)
+├── swarm-otel             telemetry collector, sole holder of the upstream credential
+├── swarm-victoriametrics  metrics store
+├── swarm-victorialogs     log store
+└── swarm-grafana          dashboards over the metrics/log stores, own OIDC login
 ```
 
 **[→ website](https://hyperhive.darkest.space)** ·