diff --git a/infra/ansible/roles/node_baseline/tasks/disks.yml b/infra/ansible/roles/node_baseline/tasks/disks.yml
index ba43eec..e1591fc 100644
--- a/infra/ansible/roles/node_baseline/tasks/disks.yml
+++ b/infra/ansible/roles/node_baseline/tasks/disks.yml
@@ -331,6 +331,15 @@
 # The devices this role must never, under any circumstances, hand to e2label. Built from
 # gathered facts (`gather_facts: true` in the play) plus the live swap list, so it is the
 # NODE's account of what is load-bearing, not a hardcoded list of partition names.
+#
+# EXPECT THIS LIST TO BE EMPTY. Since the swap tasks in tasks/main.yml mask swap.target,
+# a baselined node has no active swap for `swapon` to report, so the swap half of
+# node_baseline_lh_protected_devices below contributes nothing. That is not a weakened
+# guard: the claim CANDIDATE is derived from whatever is mounted at
+# node_baseline_longhorn_claim_mountpoint, and a swap partition is neither mounted nor an
+# ext4 filesystem, so it can never be the candidate in the first place. The task stays
+# because the list must be the node's own account of what is load-bearing — including on
+# a node reached before baseline has run, or one an operator has deliberately swapped on.
 - name: "Longhorn (claim): list the devices currently backing active swap"
   ansible.builtin.command: swapon --noheadings --show=NAME
   register: node_baseline_lh_swapdevs