diff --git a/lib/src/components/wall/lath-wall-store.test.ts b/lib/src/components/wall/lath-wall-store.test.ts
index 34d18accc..ccb411abb 100644
--- a/lib/src/components/wall/lath-wall-store.test.ts
+++ b/lib/src/components/wall/lath-wall-store.test.ts
@@ -566,8 +566,8 @@ describe('doored leaves', () => {
   it('seed keeps parked leaves, minus any it admits to the new tree', () => {
     const store = seeded();
     store.doorLeaf('b', { park: true });
-    // The workspaces-rollout switch parks the outgoing Workspace, then seeds the
-    // incoming one — clearing here would unmount exactly what parking preserved.
+    // Hydration may reseed a store that already holds parked documents —
+    // clearing here would unmount exactly what parking preserved.
     store.seed({ root: { kind: 'leaf', id: 'z' } }, [['z', leafMeta()]]);
     expect(store.parkedIds()).toEqual(['b']);
     // The park's meta has to survive with it, or the store would be holding DOM it
diff --git a/relay/test/e2e-relay.test.mjs b/relay/test/e2e-relay.test.mjs
index fbdf8f696..0b288b8df 100644
--- a/relay/test/e2e-relay.test.mjs
+++ b/relay/test/e2e-relay.test.mjs
@@ -3,10 +3,9 @@
  * (docs/specs/relay.md -> "Routing"): one Noise IK ceremony between a fake Client
  * and a fake Burrow, with both statics injected by the test.
  *
- * What it proves, in the order the scope asks for it
- * (docs/specs/remote-security-model.md -> `## Future` -> **Scope:
- * e2e-client-burrow**, stage 3): prologue and transcript binding, directional
- * cipher states, counters, framing, and tamper rejection. Its routing half —
+ * What it proves (docs/specs/remote-security-model.md -> "Noise suite"):
+ * prologue and transcript binding, directional cipher states, counters,
+ * framing, and tamper rejection. Its routing half —
  * teardown, relay opacity, the binding, and the relay's own bounds — is the
  * cases every Relay passes (`remote-lib-common/test/harness/relay-parity.mjs`),
  * registered at the end. The framing in isolation is
diff --git a/remote-lib-common/test/harness/fake-client.mjs b/remote-lib-common/test/harness/fake-client.mjs
index 7ebc13ab2..d60ff529e 100644
--- a/remote-lib-common/test/harness/fake-client.mjs
+++ b/remote-lib-common/test/harness/fake-client.mjs
@@ -1,8 +1,7 @@
 /**
  * A headless Client (Dormouse Pocket) speaking only the `e2e` relay envelope —
- * the initiator half of the harness in
- * `docs/specs/remote-security-model.md` -> `## Future` -> **Scope:
- * e2e-client-burrow**. Deliberately `PocketClient`-free: it is a bare
+ * the initiator half of the e2e harness (`docs/specs/relay.md` -> "E2E
+ * framing"). Deliberately `PocketClient`-free: it is a bare
  * `/ws/client` socket plus the real ceremonies, so the suite tests the wire
  * rather than a production class that does not send these frames yet.
  *
diff --git a/standalone/sidecar/dor-control-server.js b/standalone/sidecar/dor-control-server.js
index 9deebb9c5..4e56e49e3 100644
--- a/standalone/sidecar/dor-control-server.js
+++ b/standalone/sidecar/dor-control-server.js
@@ -25,7 +25,7 @@ function proveToken(token, domain, nonce) {
 // so hash both sides to fixed-length digests (side-stepping timingSafeEqual's
 // length-mismatch throw, which would itself leak the length) and compare those.
 // Mirrors the SHA-256 + timingSafeEqual pattern the selfhost server uses in
-// relay/src/state.ts.
+// relay/src/secrets.ts.
 function proofMatches(provided, expected) {
   if (typeof provided !== 'string') return false;
   const a = crypto.createHash('sha256').update(provided).digest();
@@ -253,8 +253,8 @@ function createDorControlServer({ socketPath, socketDir, token, send, getHelperP
     return true;
   }
 
-  // A malformed request is answered with an error and never forwarded; the
-  // connection stays open for the client's next line.
+  // A malformed request is answered with an error and never forwarded. Like
+  // every response, the answer ends its connection; the server keeps serving.
   function handleRequest(socket, line) {
     let request;
     try {
diff --git a/standalone/src-tauri/src/routing.rs b/standalone/src-tauri/src/routing.rs
index f0876c706..33375b6ba 100644
--- a/standalone/src-tauri/src/routing.rs
+++ b/standalone/src-tauri/src/routing.rs
@@ -25,7 +25,7 @@ pub const AWAITING_REPLAY_MAX: Duration = Duration::from_secs(5);
 /// target's own collection times out at 3 s and a torn-out window boots in
 /// well under this; past it the target webview is wedged, and its shells
 /// would otherwise stay silent in the source forever.
-/// Must remain below `CLOSE_WORKSPACE_TIMEOUT_MS` in `dor/src/control-client.ts`,
+/// Must remain below `CLOSE_WORKSPACE_TIMEOUT_MS` in `dor/src/control-methods.ts`,
 /// so a hand-back reaches the CLI before its transport deadline.
 pub const ARRIVAL_MAX: Duration = Duration::from_secs(20);
 
diff --git a/website/src/components/DocsLayout.tsx b/website/src/components/DocsLayout.tsx
index 534f74de7..24eb685b6 100644
--- a/website/src/components/DocsLayout.tsx
+++ b/website/src/components/DocsLayout.tsx
@@ -230,8 +230,8 @@ export default function DocsLayout({
   }, [navOpen]);
 
   const { current, prev, next } = docsRailPosition(activePath);
-  // Three of five pages name themselves exactly as the rail does; the two that
-  // differ pass their own, so the rail label stays the one owner of the rest.
+  // A page that names itself differently from the rail passes its own title;
+  // the rail label stays the one owner of the rest.
   const heading = title ?? current?.label ?? "";
 
   return (
diff --git a/website/src/lib/docs-rail.test.tsx b/website/src/lib/docs-rail.test.tsx
index f348a53cc..4785a0c41 100644
--- a/website/src/lib/docs-rail.test.tsx
+++ b/website/src/lib/docs-rail.test.tsx
@@ -3,9 +3,9 @@
  *
  * A `TocEntry` is a link to an anchor on the page it belongs to, so every id
  * the rail names must be an id that page actually renders — nested entries
- * included. The seven pages produce their entries four different ways (a
- * Markdown generator, a JSON changelog, a hand-written section list), which is
- * exactly why the check belongs here once rather than in each page's own test.
+ * included. The pages produce their entries different ways (a Markdown
+ * generator, a JSON changelog, a hand-written section list), which is exactly
+ * why the check belongs here once rather than in each page's own test.
  */
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter, Route, Routes } from "react-router";
diff --git a/website/src/pages/Changelog.tsx b/website/src/pages/Changelog.tsx
index 15861402d..ec67e71b5 100644
--- a/website/src/pages/Changelog.tsx
+++ b/website/src/pages/Changelog.tsx
@@ -164,7 +164,7 @@ function ReleaseArticle({ release }: { release: ChangelogRelease }) {
 /**
  * How many releases the rail lists.
  *
- * The page renders every release; the rail carries four other pages beside
+ * The page renders every release; the rail carries the other docs pages beside
  * this one, and an entry per release would be longer than all of them.
  */
 export const CHANGELOG_TOC_RELEASES = 5;