[dormouse-bot]

Comments and spec lines that recent commits left describing older code. No behavior changes.

• Relay push — relay/src/push.ts and relay/src/app.ts said delivery goes "through web-push", supplied by index.ts. Since Harden Relay push registration and delivery #1226, web-push only builds the encrypted body and VAPID headers and postToPushService sends them; start.ts is what wires in createWebPushSender. remote-lib-common/src/security/acl.ts still described a delivery id as 32 random bytes; it is now minted by mintPushDeliveryId (random bytes plus a tag).
• Browser specs — docs/specs/dor-cli.md and docs/specs/dor-browser.md listed only dor-embed-size as handled by Dormouse rather than the provider; dor-diagnostics (Keep an agent-browser screencast on the tab it shows, size every shown page, and add dor-diagnostics for a frozen pane #1176) is too. dor-browser.md also had a sentence missing its subject ("The desktop playground's fronts…") and a rule citing viewerTextInputs whose Source of truth: line didn't name the file that holds it.
• Managed voice — the playback comment said only the standalone CSP grants media-src blob:; the VS Code webview does too since Managed voice in VS Code #1000. The serial-queue comment in managed-voice-host.ts still described rewriting a whole file, which the ManagedVoiceStore split replaced.
• native-direct-peer.test.ts — the doc block for the last case ("last because its teardown is the process's") had been separated from it when the reliability case was inserted, so it sat on the wrong test. Moved it back, and corrected the header and Negotiation.abandon doc, which no longer matched how the cases use the shipped factory and abandon.
• Smaller ones — send.ts names cli-core.ts (not cli.ts) as the caller of preParse; security-audit.yaml cites the Tag operations / Merge access rulesets instead of a "§3" that security-ci.md doesn't have; setup-token.ts says "outstanding" rather than "live" tokens, matching what #trimBurrow counts; entitlement.ts describes the alias parameter correctly; tut-runner.ts drops a reference to a flappy-term.html that was never in the repo; the pairing walkthrough README no longer says in bold that nothing is written into the repo while its Known limitations say Burrow staging is.

node scripts/spec-lint.mjs passes locally; the rest is left to CI, since the sandbox has no pnpm.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	f20d6af
Status:	✅  Deploy successful!
Preview URL:	https://ba04c8ae.mouseterm.pages.dev
Branch Preview URL:	https://nightly-stale-comments-oct20.mouseterm.pages.dev

View logs

[dormouse-bot]

The native-direct-peer.test.ts header still says the shipped factory isn't used, only half fixed. Three cases build through createNativeDirectPeerFactory: Local networks (binds the one allowed address…), Anywhere (builds a peer through Cloudflare STUN…), and the teardown case. So "these cases inject a plain factory" is wrong for those three, and this PR exists to correct exactly that kind of comment.