diff --git a/backend/src/handlers/upload.rs b/backend/src/handlers/upload.rs
index 3034753..1728d0b 100644
--- a/backend/src/handlers/upload.rs
+++ b/backend/src/handlers/upload.rs
@@ -1477,9 +1477,21 @@ async fn stream_media_file(
 ///
 /// A per-IP bucket cannot separate "one scraper" from "the entire party" when they share an
 /// address, and these four media routes are unauthenticated by design (an `<img>` cannot send a
-/// bearer token), so there is no per-user key to move to. Bandwidth abuse belongs at the proxy,
-/// where per-connection limits still work; the certain harm here outweighed the speculative
-/// protection.
+/// bearer token), so there is no per-user key to move to. The certain harm outweighed the
+/// speculative protection.
+///
+/// BE HONEST ABOUT WHAT REPLACED IT: nothing did. This used to say "bandwidth abuse belongs at the
+/// proxy, where per-connection limits still work", which reads as though a control exists there.
+/// It does not — the `Caddyfile` sets timeouts and no rate or concurrency directive, and the tower
+/// stack is `TraceLayer` alone. So this route is unbounded, deliberately, and the cost is real
+/// rather than theoretical: `no-store` below plus the feed's fallback to `/original` for any photo
+/// whose derivatives are still compressing plus `VirtualFeed`'s nonce'd retry means a hundred open
+/// feeds can re-fetch full-resolution originals off the same disk Postgres writes WAL to, each one
+/// also holding a connection from a 15-slot pool that upload commits are competing for.
+///
+/// If that needs bounding, the shape that fits is a concurrency semaphore over media streaming
+/// (like `upload_admission`), NOT a request-rate bucket — the venue is one IP, which is what made
+/// the previous attempt a self-inflicted outage.
 pub async fn get_original(
     State(state): State<AppState>,
     headers: axum::http::HeaderMap,