From 47655fc7c44be781a6ba46b26a39ac56bb5ddc19 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Sun, 2 Aug 2026 23:37:03 +0000
Subject: [PATCH] docs: keep the cache rule in one place and drop the stale
 premise

---
 backend/windmill-api-flows/src/flows.rs | 2 +-
 backend/windmill-common/src/lib.rs      | 4 ----
 backend/windmill-common/src/users.rs    | 5 ++---
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/backend/windmill-api-flows/src/flows.rs b/backend/windmill-api-flows/src/flows.rs
index 71b98b22bd..1975be9f2f 100644
--- a/backend/windmill-api-flows/src/flows.rs
+++ b/backend/windmill-api-flows/src/flows.rs
@@ -889,7 +889,7 @@ async fn derived_on_behalf_of_email(
     let Some(permissioned_as) = flow.on_behalf_of.as_deref() else {
         return Ok(None);
     };
-    // Uncached, for the reason given on `prefetch_cached_script`: this pair is round-tripped.
+    // Uncached: this pair is round-tripped by the client and stored again on redeploy.
     Ok(Some(
         windmill_common::users::get_email_from_permissioned_as_uncached(permissioned_as, w_id, db)
             .await?,
diff --git a/backend/windmill-common/src/lib.rs b/backend/windmill-common/src/lib.rs
index bdc2dfbba7..a147255034 100644
--- a/backend/windmill-common/src/lib.rs
+++ b/backend/windmill-common/src/lib.rs
@@ -1701,10 +1701,6 @@ pub async fn on_behalf_of_from_permissioned_as(
     let Some(permissioned_as) = permissioned_as else {
         return Ok(None);
     };
-    // The address is copied onto the job row, where it stays for the life of the run and decides
-    // the superadmin flag and the instance groups. `notify_user_email_change` evicts the key on
-    // every replica for each change that can move it, so a cache hit is only ever served while it
-    // still holds.
     let email = users::get_email_from_permissioned_as(permissioned_as, w_id, db).await?;
     Ok(Some(jobs::OnBehalfOf { email, permissioned_as: permissioned_as.to_string() }))
 }
diff --git a/backend/windmill-common/src/users.rs b/backend/windmill-common/src/users.rs
index 89b05f08ba..89a734ed43 100644
--- a/backend/windmill-common/src/users.rs
+++ b/backend/windmill-common/src/users.rs
@@ -232,9 +232,8 @@ pub async fn permissioned_as_from_email(
 ///
 /// Job dispatch reads it anyway, deliberately: the address it copies onto the job row can be one
 /// poll stale, landing after `change_user_email`'s `v2_job` sweep has passed, and that run keeps
-/// it. Accepted because an address changes far more rarely than jobs are dispatched, and the
-/// blast radius is the one run. Anything stored where a *later* read will trust it uses
-/// [`get_email_from_permissioned_as_uncached`] instead.
+/// it. Accepted deliberately: the blast radius is that one run. Anything stored where a *later*
+/// read will trust it uses [`get_email_from_permissioned_as_uncached`] instead.
 ///
 /// Reads through the non-RLS pool and authorizes nothing — callers must already be authorized
 /// for `workspace_id`.