diff --git a/crates/segment/src/bin/lightcraft-sam3-worker.rs b/crates/segment/src/bin/lightcraft-sam3-worker.rs
index 9929d2ebb..62c183346 100644
--- a/crates/segment/src/bin/lightcraft-sam3-worker.rs
+++ b/crates/segment/src/bin/lightcraft-sam3-worker.rs
@@ -1,3 +1,8 @@
+//! Serves SAM 3 on this Mac's Metal GPU to one LightCraft editor over a loopback socket (an SSH
+//! tunnel); see docs/ai-masks.md → Remote Metal inference.
+#![forbid(unsafe_code)]
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+
 fn main() -> Result<(), Box<dyn std::error::Error>> {
     let mut args = std::env::args().skip(1);
     let dir = args.next().ok_or("usage: lightcraft-sam3-worker MODEL_DIR [127.0.0.1:8793]")?;
diff --git a/docs/ai-masks.md b/docs/ai-masks.md
index 00de50166..574130ec1 100644
--- a/docs/ai-masks.md
+++ b/docs/ai-masks.md
@@ -68,7 +68,10 @@ stay in the local library, so later adjustments and exports work without the con
 The worker requires Metal and accepts one editing connection at a time. It loads weights
 on demand and releases them when the client disconnects or remains idle for ten minutes.
 Both endpoints require loopback addresses: SSH provides authentication and encryption.
-The listener has no independent authentication; do not expose it through a public proxy.
+The listener has no independent authentication; do not expose it through a public proxy. Any
+process of any user on the worker Mac can connect to it, and on the editing computer a local
+process listening on the port while the tunnel is down receives the rendered model input, so use
+this only on machines whose local users you trust.
 
 No local weights are required in remote mode. An unavailable worker produces an explicit
 error, not a silent CPU fallback. Restore the tunnel and retry. Unset