diff --git a/crates/manager-core/src/auth_middleware.rs b/crates/manager-core/src/auth_middleware.rs
index 551e37b..bd0cf9a 100644
--- a/crates/manager-core/src/auth_middleware.rs
+++ b/crates/manager-core/src/auth_middleware.rs
@@ -138,8 +138,9 @@ pub struct AuthState {
     pub keys: Arc<dyn ApiKeyRepository>,
     pub ttl: Duration,
     /// F-P-009 — shared cache of resolved Principals. Constructed once
-    /// at startup; cloned cheaply into every router state. `None` for
-    /// tests / harnesses that don't wire it.
+    /// at startup and cloned (same `Arc`) into every router state that
+    /// resolves or revokes credentials, so a revocation-side eviction is
+    /// visible to this resolve-side lookup.
     pub principal_cache: Arc<PrincipalCache>,
     /// Audit 2026-06-11 H-B1 — per-`(remote_ip, username)` + per-`username`
     /// burst limiter for `/auth/login`. Cheap to clone (Arc).