diff --git a/examples/app-showcase/src/system/apis/index.ts b/examples/app-showcase/src/system/apis/index.ts
index c372360fde..d1a2810258 100644
--- a/examples/app-showcase/src/system/apis/index.ts
+++ b/examples/app-showcase/src/system/apis/index.ts
@@ -77,11 +77,18 @@ export const TaskFeedEndpoint: ApiEndpoint = {
     operation: 'find',
   },
   authRequired: true,
-  // Seconds. Emitted as `Cache-Control: public, max-age=30` on a SUCCESSFUL
+  // Seconds. Emitted as `Cache-Control: private, max-age=30` on a SUCCESSFUL
   // answer only — never on a 401/429/5xx, because telling a client to reuse a
-  // failure for half a minute is worse than saying nothing. GET-only by rule:
-  // publish rejects `cacheTtl` on any other method rather than parsing it and
-  // ignoring it.
+  // failure for half a minute is worse than saying nothing. `private` is not
+  // this example's tuning choice: the runtime emits it for every positive
+  // ttl, on `authRequired: false` endpoints too, because any answer can be
+  // RLS-trimmed for its caller and a shared cache must never store one and
+  // hand it to somebody else. `computeCacheControl` in
+  // `packages/runtime/src/endpoint-policy.ts` states that rule and the rest of
+  // the ladder with it — including `cacheTtl: 0`, which is `no-store` rather
+  // than "no header": writing 0 says something, and saying nothing is spelled
+  // by omitting the key. GET-only by rule: publish rejects `cacheTtl` on any
+  // other method rather than parsing it and ignoring it.
   cacheTtl: 30,
 };