diff --git a/DESIGN-bns-indexer-service.md b/DESIGN-bns-indexer-service.md
index 115865e3..6955d2bb 100644
--- a/DESIGN-bns-indexer-service.md
+++ b/DESIGN-bns-indexer-service.md
@@ -249,6 +249,29 @@ mirrored in Theseus. It lives in `policy.json`: `"power": "performance" |
 - **Desktops** (no battery) never enter Economy, and the switch is hidden.
 
 ### Theseus
+Theseus has its own complete BNS resolver: the **index** (`bns-indexer.js`,
+a utilityProcess) and **serving** (the `bns://` protocol handler: on-chain
+`h`, Sia via the gateway, `ip` with the TLS pin, `p`, signed DNS, all under
+Tor or the session proxy). Serving stays in Theseus always; it costs nothing
+when not in use and is what makes `bns://` work with Tor. **The index is a
+standby:**
+- **While Ariadne's indexer is healthy,** Theseus does not start its own at
+  all. That saves about 60–75 MB and its own electrum traffic.
+- **Unhealthy means any of:**
+  - the pipe does not answer at launch;
+  - the pipe fails the server-process check;
+  - no update has arrived within the heartbeat window (a few minutes);
+  - Ariadne's snapshot is older than a set limit while Ariadne reports itself
+    running.
+- **Taking over:** Theseus starts its own indexer, warm-started from
+  Ariadne's last snapshot file, so there is no download and no cold sync.
+  Lookups meanwhile keep using the source chain; nothing waits on the switch.
+- **Handing back:** once Ariadne has been healthy again for a minute or two,
+  Theseus stops its own indexer. The delay keeps a flapping service from
+  starting and stopping Theseus's indexer over and over.
+- **Until the Ariadne pipe exists** (migration step 2), Theseus's indexer is
+  its only working source and runs always, as in 0.3.70.
+
 - **Launch:** the source chain above. In practice: Ariadne's local snapshot
   file (milliseconds, parsed in Theseus's indexer process, never on the main
   thread), then `subscribe` to the pipe for changes.