[dormouse-bot]

Seven comments pointed at spec text that has moved or never existed, or described code that has since grown. This PR changes only comments, plus one line of a self-test's failure message, and changes no behavior. Found in the nightly survey.

• lib/src/components/wall/IframePanel.tsx: the sandbox comment cited dor-browser.md → "Iframe Renderer" for omitting allow-top-navigation. That rule is now S138 under docs/specs/security-local.md → "Browser panes", so the comment points there.
• standalone/src/window-recovery.ts: transport.md → "Persisted session" is now the heading "Persisted session types".
• lib/src/lib/vscode-message-token.ts: the comment said "the spec section above" explains why the code uses a token and not the CSP nonce. vscode.md only marks that rule (rationale). The reasons are in docs/specs/vscode.rationale.md → "Webview message authentication", so the comment names that file.
• lib/src/components/wall/browser-url.ts: the header said both helpers are pure string parsing. The file now also holds browserSurfaceUrl and iframeRefusal, and iframeRefusal reads the platform. The header now says so.
• lib/src/components/motion-test-utils.ts: installFakeFrames said to call it only at a test file's top level. WorkspaceStrip.test.tsx calls it inside a describe, which works because it registers beforeEach/afterEach. The comment now allows both.
• scripts/loopback-lint-selftest.mjs: the failure message quoted the clause "A new non-test listener without a guard reference fails the build" from security-local.md, and a comment said the spec claims the lint scans every JS/TS file. Neither text is in the spec. The message now names the guard-reference half of S141, and the comment cites only the audit prompt and the lint header, which do make that claim.
• scripts/security-audit-local.sh: removes a stray "a" in a comment.

No test is included because only comments and message text change. spec-lint passes, and bash -n and node --check pass on the two scripts. The rest of pnpm test runs in CI.

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	cb3319e
Status:	✅  Deploy successful!
Preview URL:	https://5038eccf.mouseterm.pages.dev
Branch Preview URL:	https://nightly-stale-pointers-oct26.mouseterm.pages.dev

View logs