diff --git a/backend/windmill-api-workspaces/src/workspaces.rs b/backend/windmill-api-workspaces/src/workspaces.rs
index 067a81d0c0..80db26fe47 100644
--- a/backend/windmill-api-workspaces/src/workspaces.rs
+++ b/backend/windmill-api-workspaces/src/workspaces.rs
@@ -6409,8 +6409,8 @@ fn downgrade_cloned_app_policy(policy: &mut serde_json::Value, authed: &ApiAuthe
         "on_behalf_of_email".to_string(),
         serde_json::Value::String(authed.email.clone()),
     );
-    // A policy missing `execution_mode` counts as anonymous: the safe reading, since no
-    // reader here decides what it would have meant.
+    // A policy without `execution_mode` gets one too: `Policy` declares no serde default
+    // for the field, so such a row does not read back as a policy until something writes it.
     let anonymous = obj
         .get("execution_mode")
         .and_then(|m| m.as_str())
diff --git a/backend/windmill-common/src/apps.rs b/backend/windmill-common/src/apps.rs
index 1f53cee9d0..e1caa784bd 100644
--- a/backend/windmill-common/src/apps.rs
+++ b/backend/windmill-common/src/apps.rs
@@ -19,8 +19,8 @@ lazy_static::lazy_static! {
 }
 
 /// Whether an app's custom path names it within its workspace rather than instance-wide.
-/// Every site that stores or resolves one must agree: a path stored under a narrower scope
-/// than the resolver's makes two apps answer the same public URL.
+/// A path stored under a narrower scope than the one its resolver applies leaves two apps
+/// answering the same public URL, so storage and resolution must decide it the same way.
 pub fn custom_path_is_workspace_scoped() -> bool {
     *crate::worker::CLOUD_HOSTED || APP_WORKSPACED_ROUTE.load(std::sync::atomic::Ordering::Relaxed)
 }