diff --git a/apps/chanora_flutter/macos/Runner/Release.entitlements b/apps/chanora_flutter/macos/Runner/Release.entitlements
index f4614b6..5f4c7e7 100644
--- a/apps/chanora_flutter/macos/Runner/Release.entitlements
+++ b/apps/chanora_flutter/macos/Runner/Release.entitlements
@@ -3,13 +3,19 @@
 <plist version="1.0">
 <dict>
 	<!-- Release builds omit cs.allow-jit (Flutter hot-reload only). They keep
-	     network.server because the macOS App Sandbox treats every UDP bind()
-	     - including the ephemeral 0.0.0.0:0 that tsclientlib's
-	     tokio::net::UdpSocket::bind() issues for outbound traffic - as a
-	     server operation. Without this entitlement UdpSocket::bind fails
-	     with EPERM (sandbox_init: 'network-outbound deny') and the TS3
-	     connect never starts. network.client alone is insufficient because
-	     it gates connect()-style flows, not bind()-then-sendto. -->
+	     network.server because the macOS App Sandbox classifies UDP bind()
+	     against a local port - including the ephemeral 0.0.0.0:0 that
+	     tsclientlib's tokio::net::UdpSocket::bind() issues for outbound
+	     voice traffic - as a server operation that requires
+	     com.apple.security.network.server, regardless of whether the
+	     socket is later used only to sendto() a remote peer. Without it,
+	     bind() returns EPERM and the sandbox log records
+	     "Sandbox: chanora(...) deny(1) network-bind". network.client
+	     alone gates outbound connect()-style flows (TCP, connected UDP)
+	     and is insufficient for the bind()-then-sendto() pattern Tokio's
+	     UdpSocket uses. See Apple's App Sandbox entitlement reference:
+	     "Network Server" covers any process that listens on, or binds
+	     to, a network port. -->
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
 	<key>com.apple.security.network.client</key>