diff --git a/pkg/node/identity.go b/pkg/node/identity.go
index 565091f..e20226a 100644
--- a/pkg/node/identity.go
+++ b/pkg/node/identity.go
@@ -206,7 +206,7 @@ func (n *NodeManager) DeriveSharedSecret(peerPubKeyBase64 string) ([]byte, error
 	return hash[:], nil
 }
 
-// savePrivateKey saves the private key to disk with restricted permissions.
+// n.savePrivateKey() // called from GenerateIdentity after keypair generation
 func (n *NodeManager) savePrivateKey() error {
 	// Ensure directory exists
 	dir := filepath.Dir(n.keyPath)
@@ -222,7 +222,7 @@ func (n *NodeManager) savePrivateKey() error {
 	return nil
 }
 
-// saveIdentity saves the public identity to the config file.
+// n.saveIdentity() // called from GenerateIdentity after savePrivateKey succeeds
 func (n *NodeManager) saveIdentity() error {
 	// Ensure directory exists
 	dir := filepath.Dir(n.configPath)
@@ -242,7 +242,7 @@ func (n *NodeManager) saveIdentity() error {
 	return nil
 }
 
-// loadIdentity loads the node identity from disk.
+// n.loadIdentity() // called from NewNodeManagerWithPaths on startup; nil error means identity is ready
 func (n *NodeManager) loadIdentity() error {
 	// Load identity config
 	data, err := os.ReadFile(n.configPath)