diff --git a/backend/services/telegramBridgeService.ts b/backend/services/telegramBridgeService.ts
index feb898a36d..3a5043803e 100644
--- a/backend/services/telegramBridgeService.ts
+++ b/backend/services/telegramBridgeService.ts
@@ -185,6 +185,15 @@ export const relayTelegramMessageToPod = async (opts: {
     return { relayed: false };
   }
 
+  // The gate proves the Telegram sender IS the chat's counterpart. It does NOT
+  // prove the counterpart is `linkedUserId` — that half is held one layer out,
+  // by the guard in `routes/integrations.ts` (PATCH /:id), which derives
+  // `config.linkedUserId` from the authenticated caller when `liveRelay` flips
+  // on and rejects any client-supplied value. Relax that guard and this gate
+  // still passes while authoring under an identity the caller chose. No test
+  // joins the two: both bridge suites hand-build `config`, so a mutation to the
+  // route guard turns nothing here red.
+  //
   // Attribution gate. Every relayed message is authored as `linkedUserId`, so
   // relaying is only honest where Telegram itself guarantees the sender IS that
   // person: a `private` chat is 1:1 between the bot and one user. In a group,