diff --git a/btd/src/route.rs b/btd/src/route.rs
index 1eb67679..1f713099 100644
--- a/btd/src/route.rs
+++ b/btd/src/route.rs
@@ -136,10 +136,22 @@ fn permits(call: &proto::Call) -> bool {
         // are permitted, including the two that change things.
         NetStatus => true,
         NetScan => true,
-        // Carries a wifi passphrase, which §7 requires to travel over a paired, encrypted link.
-        // It does: the characteristic sets `encrypt_authenticated_write` and the PIN agent makes
-        // the bond an authenticated one (`crate::pairing`). Routing this before that existed
-        // would have been the ordering mistake.
+        // Carries a wifi passphrase, and this arm used to claim that travels over a paired,
+        // authenticated link. It does not, and the claim was wrong in both halves.
+        //
+        // The characteristic sets `encrypt_write`, not `encrypt_authenticated_write`
+        // (`crate::bluez`) — and it sets it from `--require-pairing`, which is **off by default**,
+        // so on an ordinary board there is no encryption on this link at all. Nor could the
+        // stronger flag be satisfied if it were set: the agent leaves every handler `None`, which
+        // BlueZ publishes as `NoInputNoOutput`, so the bond is just-works and therefore encrypted
+        // but *unauthenticated*. `crate::pairing` records why a headless robot cannot do better,
+        // and `docs/design/app-path-design.md` §5.5 is the state of it.
+        //
+        // So what actually stands behind this route today is the PIN check in `crate::session` and
+        // the ten metres of radio range, and the passphrase crosses in clear. That is a known,
+        // accepted, pre-shipping cost — `btd` warns about it at every start — and §8.1 is the
+        // blocker that has to close before a robot goes to anyone. Routed anyway because a robot
+        // with no network cannot be given one any other way, which is what this transport is for.
         NetConnect(_) => true,
         NetForget(_) => true,