diff --git a/packages/nostr-client/src/bunker-signer.ts b/packages/nostr-client/src/bunker-signer.ts
index ed80f02..642b570 100644
--- a/packages/nostr-client/src/bunker-signer.ts
+++ b/packages/nostr-client/src/bunker-signer.ts
@@ -29,9 +29,11 @@ import type { Signer } from './signer.js'
 const DEFAULT_BUNKER_TIMEOUT_MS = 10_000
 
 /**
- * Raised when the bunker actively rejects a request (e.g. the operator
- * revoked the spire's binding, or a kind/method is outside the policy).
- * Callers should treat this as "unpaired" and surface a re-pair prompt.
+ * Raised when the bunker actively rejects a request. Post-bind causes
+ * (nsecbunkerd#27, sign-time lifecycle enforcement): the operator revoked the
+ * binding (`KeyUser`/`Token.revokedAt`), the token's TTL (`expiresAt`) lapsed,
+ * or the requested kind/method is outside the policy. Callers should treat
+ * this as "unpaired" and surface a re-pair prompt.
  */
 export class BunkerRejectedError extends Error {
   constructor(message: string) {