glue-matrix-bao-token: state the bound the comment claims

The comment said it bounds the wait rather than hanging the boot, and
nothing in the unit bounded anything. What actually held was systemd's
default start timeout plus the homeserver only Wants= this unit — both
true, neither stated here, so a reader had to already know them.

TimeoutStartSec puts the number a boot waits on in the file that waits,
and the comment now names the degradation: hitting it keeps the locally
minted token, same as every other failure path in this unit.

Caught by argus reviewing the slice it shipped in.

nix/host-modules/glue-matrix-bao-token.nix

@@ -70,6 +70,10 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # What actually bounds the read below. Stated here rather than
+        # left to systemd's default, so the number a boot waits on is in
+        # the file that waits.
+        TimeoutStartSec = 30;
       };
       environment = {
         BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
@@ -80,9 +84,11 @@ in
       script = ''
         set -euo pipefail
 
-        # A sealed or uninitialised store answers on the port and times out on
+        # A sealed or uninitialised store answers on the port and never
-        # every read, so "the store is up" is not the same as "the store can
+        # answers the read, so "the store is up" is not the same as "the
-        # answer" -- bound the wait rather than hanging the boot behind it.
+        # store can answer". `TimeoutStartSec` above is the bound; the
+        # homeserver only `Wants=` this unit, so hitting it degrades to
+        # keeping the local token rather than holding up the container.
         if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
           echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
           echo "Keeping the token hive-matrix already has." >&2

nix/host-modules/swarm-bao.nix

@@ -23,8 +23,8 @@
 # distribute: reach the store to get the CA material, need a cert from that CA
 # to reach the store. Service↔store mTLS is therefore its own trust domain,
 # separate from the gateway's HTTPS certificates and from both CAs in this
-# tree. The cert paths are inputs with no defaults and nothing here fills them
+# tree. The cert paths are inputs this module declares no default for and never
-# in; whatever comes to mint that identity is what they will point at.
+# fills in; a glue module mints that identity and points them at it.
 {
   pkgs,
   lib,
@@ -199,10 +199,13 @@ in
         Certificate the store serves, covering
         {option}`services.hyperhive.swarm.bao.domain`.
 
-        No default, and this module deliberately does not know what could
+        This module declares no default and deliberately does not know
-        provide one — for the same reason
+        what could provide one — for the same reason
-        {option}`services.hyperhive.deploy.bao.clientCaFile` doesn't. The
+        {option}`services.hyperhive.deploy.bao.clientCaFile` doesn't: the
-        deployment names the file; the store never reaches for an authority.
+        store never reaches for an authority.
+
+        On a hive that runs the store, a glue module supplies a path as a
+        `mkDefault`, so naming your own here wins over it.
 
         A path, never a value.
       '';
@@ -226,11 +229,14 @@ in
       description = ''
         Authority the store validates hive **client** certificates against.
 
-        Deliberately has no default, and does not reach for the hive CA:
+        This module declares no default and does not reach for the hive
-        the hive CA is a future *consumer* of the store, so a store that
+        CA: the hive CA is a future *consumer* of the store, so a store
-        authenticated against it could not come up before the thing it
+        that authenticated against it could not come up before the thing
-        issues. It is a value someone points at — the swarm root for a
+        it issues.
-        swarm that runs one, an operator's own CA otherwise.
+
+        On a hive that runs the store, a glue module supplies the CA it
+        minted for exactly this, as a `mkDefault`. Point this at something
+        else — the swarm root, an operator's own CA — and yours wins.
 
         `null` leaves client-certificate verification off, which is only
         appropriate where something else authenticates the connection.
@@ -328,10 +334,14 @@ in
             The swarm secret store has no server certificate: set both
             services.hyperhive.deploy.bao.serverCertFile and .serverKeyFile.
 
-            Nothing defaults them, on purpose — a store must not take its
+            This module defaults neither, on purpose — a store must not
-            identity from an authority it will itself distribute, and
+            take its identity from an authority it will itself distribute,
-            service-to-store mTLS is a separate trust domain from the
+            and service-to-store mTLS is a separate trust domain from the
             gateway's certificates and from either CA in this tree.
+
+            A hive that runs the store normally gets both from a glue
+            module, so reaching this means that glue is absent or
+            something set these back to null.
           '';
         }
       ];