1 files changed, 7 insertions, 0 deletions
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
index 5e67a42..e624fb9 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/blobs.py
@@ -120,6 +120,13 @@ class BlobsMixin:
             "detail": "keypair_bundle_stored",
         })
 
+    # ── Per-account blobs (playlists, docs/playlists.md §8.2) ────────────────
+    #
+    # The node stores bytes it cannot read and hands them back. `self._user_id`
+    # comes from the authenticated session and never from the message: a
+    # `user_id` in the body would let any member of this group read or
+    # overwrite any other member's blob, which is finding C5 one size down.
+
     def _user_blob_refuse(self, detail: str, kind: str = "") -> None:
         """
         Refuse, and say so in the audit log.