diff --git a/packages/client/src/store-registry.ts b/packages/client/src/store-registry.ts
index 4862077..ef51b6f 100644
--- a/packages/client/src/store-registry.ts
+++ b/packages/client/src/store-registry.ts
@@ -1126,11 +1126,11 @@ export async function openDocumentInbox(doc: Nuri): Promise<Nuri> {
   const known = (await readInboxCapsFor(doc)) ?? null;
   if (known) return known;
 
-  // OWNERSHIP is the criterion — not "is there an address yet", since every document
-  // carries one from creation (its owner's inbox). Opening a dedicated inbox REPLACES
-  // that address, so letting a non-owner do it would redirect the owner's deposits to
-  // the caller: usurpation, silent, and on a document the caller merely reads.
-  // Holding a cap is not ownership; a cap can be received.
+  // OWNERSHIP is the criterion, and holding a cap is NOT ownership — a cap can be
+  // received. Opening an inbox is what PUBLISHES this document's address, so a
+  // non-owner doing it would route the owner's deposits to itself, silently, on a
+  // document it merely reads. Upstream the equivalent act is the owner committing
+  // `AddInboxCap` with the repo's own key; nobody else can.
   if (!(await ownsDocument(doc))) {
     throw new Error(
       "[ng-eventually] openDocumentInbox: refused — you may only open an inbox on a document " +
@@ -1156,9 +1156,9 @@ export async function openDocumentInbox(doc: Nuri): Promise<Nuri> {
       console.error(accessLogPrefix() + " openDocumentInbox persist failed:", error);
     }
   }
-  // …and the PUBLIC half, in the document itself, so a depositor finds THIS inbox
-  // instead of the owner's general one that `createEntityDoc` published. Replacement,
-  // not addition: one document, one address.
+  // …and the PUBLIC half, in the document itself, so a depositor can find it at all.
+  // Without this the inbox is reachable only by its owner — the opposite of what an
+  // inbox is for, and the bug this path shipped with.
   await publishInboxAddress(doc, inbox);
   return inbox;
 }