diff --git a/docs/superpowers/specs/2026-05-29-zombie-invasion-backend-design.md b/docs/superpowers/specs/2026-05-29-zombie-invasion-backend-design.md
index 758c435..d4f251a 100644
--- a/docs/superpowers/specs/2026-05-29-zombie-invasion-backend-design.md
+++ b/docs/superpowers/specs/2026-05-29-zombie-invasion-backend-design.md
@@ -328,12 +328,12 @@ All under `/api/`. The catch-all route looks at the URL path and HTTP method to
 | POST | `/api/game` | Save game result |
 | GET | `/api/game/:id/players` | Get match participants |
 
-### Payments (`/api/payments`) — auto-accept mock
+### Payments (`/api/payments`) — auto-grant (no actual payment)
 | Method | Path | Purpose |
 |--------|------|---------|
-| POST | `/api/payments/robokassa/link` | Returns mock success, grants shards |
-| POST | `/api/payments/bundles/link` | Instantly unlocks bundle |
-| GET | `/api/payments/deals?steamId=` | Returns mock deal catalog |
+| POST | `/api/payments/robokassa/link` | Instantly grants purchased currency to player balance, writes to DB |
+| POST | `/api/payments/bundles/link` | Instantly grants bundle items/writes purchase to DB |
+| GET | `/api/payments/deals?steamId=` | Returns deal catalog (deals purchasable with in-game currency) |
 
 ### Leaderboard (`/api/leaderboard`)
 | Method | Path | Purpose |