diff --git a/crates/didbot-policy-regex/src/lib.rs b/crates/didbot-policy-regex/src/lib.rs
index 5f9f3979..5f741aad 100644
--- a/crates/didbot-policy-regex/src/lib.rs
+++ b/crates/didbot-policy-regex/src/lib.rs
@@ -145,7 +145,7 @@
 //!
 //! # Case
 //!
-//! Everything here is case-sensitive, deliberately. A
+//! A pattern is case-sensitive, deliberately. A
 //! [`ValuePattern::Regex`] asks for folding with `(?i)`, per pattern, which
 //! is where that decision belongs. [`ValuePattern::Contains`] cannot: it is
 //! a byte-wise substring test with no flag, so a handle or DID appearing in
@@ -154,6 +154,14 @@
 //! does not fire, which gives a `Contains` blocklist the same advisory
 //! standing as one over free text above.
 //!
+//! A `denyLookup` selector is not a pattern. It compares what a person wrote
+//! in their own record with a name of this deployment or of the account
+//! writing, and a person may spell a name in any case. So a name that is a
+//! domain, a handle among them, compares in either ASCII case, as the atproto
+//! handle spec says handles "are not case-sensitive". Everything else a
+//! selector compares matches exactly, a DID among them, as the DID spec says
+//! DIDs "are case-sensitive".
+//!
 //! # What bounds a policy, and who can move it
 //!
 //! One pattern is bounded: `regex` compiles to a finite automaton under
@@ -727,10 +735,8 @@ impl Token {
         !matches!(self, Self::SubjectHandle | Self::DeploymentOperator)
     }
 
-    /// Whether a selector compares it in either ASCII case. A handle and a
-    /// hostname are domain names, and the atproto handle spec says handles
-    /// "are not case-sensitive". Every other fact compares exactly, a DID
-    /// among them: the DID spec says DIDs "are case-sensitive".
+    /// Whether a selector compares it in either ASCII case, as it does a
+    /// domain name. See the crate root's "Case".
     fn folds_case(self) -> bool {
         matches!(self, Self::SubjectHandle | Self::DeploymentHostname)
     }