diff --git a/sepolicy/pawlet_cache.te b/sepolicy/pawlet_cache.te
index 15ea7f8..5583ec4 100644
--- a/sepolicy/pawlet_cache.te
+++ b/sepolicy/pawlet_cache.te
@@ -1,13 +1,17 @@
 # pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver.
 # Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService.
 #
-# Seeded in permissive mode, same caveat as bg_upd.te: shaped from the actual
-# code paths (NsdManager discovery, HTTPS central lookup, policy override file
-# read) but not yet validated against real avc denials on-device.
+# Rules below were reconciled against every real code path in this repo
+# (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride,
+# PawletCacheService) — traced source-to-sepolicy, not live avc denials, same
+# caveat as bg_upd.te. No gaps found: NsdManager discovery routes through
+# system_server + servicediscovery_service (both already granted below),
+# CentralLookupClient is plain HTTPS (net_domain), and both policy file tiers
+# (pawletcache_policy_file, vendor_configs_file) already match Constants.kt's
+# POLICY_OVERRIDE_PATH/VENDOR_POLICY_PATH exactly.
 
 type pawlet_cache, domain, coredomain;
 app_domain(pawlet_cache)
-permissive pawlet_cache;
 
 type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;