diff --git a/sidecar/radicale.ts b/sidecar/radicale.ts
index 992e94b..cd4ea59 100644
--- a/sidecar/radicale.ts
+++ b/sidecar/radicale.ts
@@ -92,7 +92,17 @@ type = multifilesystem
 filesystem_folder = ${storagePath}
 
 [rights]
-# The owner is the only principal that exists; single-user is a platform invariant.
+# Every account is its own principal, and owns only its own collections.
+#
+# This said "the owner is the only principal that exists; single-user is a platform invariant" until
+# 2026-08-27, which had been false since multi-user landed on 2026-08-07 — the SETTING was right the whole
+# time and the sentence explaining it was not, which is the worse of the two failures: anyone reading this
+# config would conclude caldav is single-user and either build around a limit that is not there or
+# "fix" a line that was never broken.
+#
+# What makes it per-user is upstream: the sync door resolves an app password to one account and sends that
+# account's id as X-Remote-User, so `owner_only` scopes each principal to its own tree under
+# `collections/collection-root/<id>/`.
 type = owner_only
 
 [logging]