docs: keep the cache rule in one place and drop the stale premise

backend/windmill-api-flows/src/flows.rs

@@ -889,7 +889,7 @@ async fn derived_on_behalf_of_email(
     let Some(permissioned_as) = flow.on_behalf_of.as_deref() else {
         return Ok(None);
     };
-    // Uncached, for the reason given on `prefetch_cached_script`: this pair is round-tripped.
+    // Uncached: this pair is round-tripped by the client and stored again on redeploy.
     Ok(Some(
         windmill_common::users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db)
             .await?,

backend/windmill-common/src/lib.rs

@@ -1701,10 +1701,6 @@ pub async fn on_behalf_of_from_permissioned_as(
     let Some(permissioned_as) = permissioned_as else {
         return Ok(None);
     };
-    // The address is copied onto the job row, where it stays for the life of the run and decides
-    // the superadmin flag and the instance groups. `notify_user_email_change` evicts the key on
-    // every replica for each change that can move it, so a cache hit is only ever served while it
-    // still holds.
     let email = users::get_email_from_permissioned_as(permissioned_as, w_id, db).await?;
     Ok(Some(jobs::OnBehalfOf { email, permissioned_as: permissioned_as.to_string() }))
 }

backend/windmill-common/src/users.rs

@@ -232,9 +232,8 @@ pub async fn permissioned_as_from_email(
 ///
 /// Job dispatch reads it anyway, deliberately: the address it copies onto the job row can be one
 /// poll stale, landing after `change_user_email`'s `v2_job` sweep has passed, and that run keeps
-/// it. Accepted because an address changes far more rarely than jobs are dispatched, and the
-/// blast radius is the one run. Anything stored where a *later* read will trust it uses
-/// [`get_email_from_permissioned_as_uncached`] instead.
+/// it. Accepted deliberately: the blast radius is that one run. Anything stored where a *later*
+/// read will trust it uses [`get_email_from_permissioned_as_uncached`] instead.
 ///
 /// Reads through the non-RLS pool and authorizes nothing — callers must already be authorized
 /// for `workspace_id`.