diff --git a/containers/stalwart/tools/stalwart_set_mode.sh b/containers/stalwart/tools/stalwart_set_mode.sh
index 72421f4..26ccf5d 100644
--- a/containers/stalwart/tools/stalwart_set_mode.sh
+++ b/containers/stalwart/tools/stalwart_set_mode.sh
@@ -70,6 +70,14 @@ appStalwartSetMode() {
             # server that was private has never had one — so create it here
             # rather than failing with "ACME provider not found".
             #
+            # NOT FULLY VERIFIED. The private direction below is exercised end to
+            # end, but this one has only ever been run against a throwaway .test
+            # domain, where Let's Encrypt refuses the contact address before the
+            # provider is created — so the AcmeProvider -> Domain link past that
+            # point is reasoned, not observed. The plan shape is confirmed up to
+            # the LE call (contact is a set, matchOn is the directory URL, an
+            # acmeProviderId is required). Worth one run on a real domain.
+            #
             # Two things about this are worth knowing. Creating the provider
             # REGISTERS AN ACCOUNT with Let's Encrypt there and then, so it is a
             # real outbound action, not a local setting. And the challenge type