diff --git a/pkg/ueps/packet.go b/pkg/ueps/packet.go
index a93c758..36cf0f3 100644
--- a/pkg/ueps/packet.go
+++ b/pkg/ueps/packet.go
@@ -34,7 +34,7 @@ type UEPSHeader struct {
 	CurrentLayer uint8  // header.CurrentLayer = 5 // Application; 3 = Network, 4 = Transport
 	TargetLayer  uint8  // header.TargetLayer = 3 // Network; 5 = Application (loopback)
 	IntentID     uint8  // header.IntentID = 0x01 (ping), 0x02 (data), 0x03 (auth)
-	ThreatScore  uint16 // 0–65535; elevated by integrity violations
+	ThreatScore  uint16 // header.ThreatScore = 100 // elevated on HMAC mismatch; 0 = clean, 65535 = maximum threat
 }
 
 // builder := ueps.NewPacketBuilder(intentID, payload); frame, _ := builder.MarshalAndSign(secret)