diff --git a/src/main/java/cn/van333/wxsend/business/controller/WeComCallbackController.java b/src/main/java/cn/van333/wxsend/business/controller/WeComCallbackController.java
index 76fe518..cf6f8b4 100644
--- a/src/main/java/cn/van333/wxsend/business/controller/WeComCallbackController.java
+++ b/src/main/java/cn/van333/wxsend/business/controller/WeComCallbackController.java
@@ -18,6 +18,10 @@ import javax.servlet.http.HttpServletRequest;
 import java.io.BufferedReader;
 import java.io.IOException;
 
+/**
+ * 企业微信回调。桥接 Jarvis 时，JSON 中的 {@code fromUserName} 必须取解密明文 XML 里的
+ * {@code FromUserName}（成员 UserID），与 Jarvis 侧会话 Redis 键、权限比对使用同一锚点；勿改用 MsgId 或昵称。
+ */
 @RestController
 @RequestMapping("/wecom/callback")
 public class WeComCallbackController {