diff --git a/crates/didbot-pds/src/policy.rs b/crates/didbot-pds/src/policy.rs
index cf8e7ea9..67ae41ea 100644
--- a/crates/didbot-pds/src/policy.rs
+++ b/crates/didbot-pds/src/policy.rs
@@ -393,12 +393,18 @@ pub trait PolicyGate: Send + Sync {
     }
 }
 
-/// The gate a deployment starts with, and the one every test not exercising
-/// policy itself uses.
+/// [`crate::provision::Provisioner`]'s default gate, and the one every test
+/// not exercising policy itself uses. `didbot-dev` -- the only binary that
+/// builds a `Provisioner` -- replaces it at startup with a
+/// [`crate::policy_tree::TreePolicyGate`], so no deployment actually serves
+/// on this one.
 ///
 /// Admits everything: "an empty policy set permits everything", from
-/// `plan/policy.md`'s "What a policy is". A deployment that never configures
-/// `didbot-policy` runs exactly as it did before this module existed.
+/// `plan/policy.md`'s "What a policy is". A gate over a tree with no
+/// policies in it is indistinguishable from this one on every channel a
+/// write reads -- the same `Allow`, the same empty observation surface --
+/// differing only in the [`PolicyVersion`] it names, which nothing on the
+/// write path records yet.
 #[derive(Debug, Default, Clone, Copy)]
 pub struct NoPolicyGate;