comments cleanup

shared/management/client/grpc.go

@@ -952,10 +952,7 @@ func peerCapabilities(info system.Info) []proto.PeerCapability {
 		proto.PeerCapability_PeerCapabilitySourcePrefixes,
 		// PeerCapabilityComponentNetworkMap signals that this client can
 		// decode the components-format SyncResponse.NetworkMapEnvelope and
-		// run Calculate() locally. Always advertised by Step-4-capable
-		// builds — there's no opt-out flag because the server-side kill
-		// switch (NB_NETWORK_MAP_COMPONENTS_DISABLE) covers emergency
-		// rollback and the client decoder is built in.
+		// run Calculate() locally.
 		proto.PeerCapability_PeerCapabilityComponentNetworkMap,
 	}
 	if !info.DisableIPv6 {

shared/management/networkmap/envelope.go

@@ -19,8 +19,8 @@ import (
 //     running Calculate() locally + converting back through the shared
 //     proto helpers + merging the optional ProxyPatch.
 //   - Components is the *types.NetworkMapComponents the engine retains so
-//     future incremental delta updates (Step 3) have a base to apply
-//     changes against. The client keeps it under its sync lock.
+//     future incremental delta updates have a base to apply changes
+//     against. The client keeps it under its sync lock.
 type EnvelopeResult struct {
 	NetworkMap *proto.NetworkMap
 	Components *types.NetworkMapComponents

shared/management/networkmap/envelope_test.go

@@ -21,9 +21,7 @@ import (
 // TestEnvelopeToNetworkMap_RoundTrip exercises the full client-side pipeline:
 // build a small components struct, encode an envelope, marshal/unmarshal the
 // wire bytes, decode back via EnvelopeToNetworkMap, and verify the result is
-// non-empty and consistent. Deeper per-field semantic equivalence with the
-// legacy server path is covered by the prod-DB equivalence test in
-// management/server/store/networkmap_envelope_equivalence_test.go.
+// non-empty and consistent.
 func TestEnvelopeToNetworkMap_RoundTrip(t *testing.T) {
 	c, localPeerKey := buildSmokeComponents(t)
 
@@ -51,10 +49,9 @@ func TestEnvelopeToNetworkMap_RoundTrip(t *testing.T) {
 // TestCalculate_FirewallRuleProtocol_NeverNetbirdSSH guards against the
 // scenario where a rule with Protocol=NetbirdSSH leaks the enum value into
 // proto.FirewallRule.Protocol. Calculate() must rewrite NetbirdSSH → TCP
-// before forming firewall rules (see networkmap_components.go:282 and
-// account.go:868). Without that rewrite, agents fall into UNKNOWN-protocol
-// handling, which on some platforms downgrades to allow-all — a real
-// security regression.
+// before forming firewall rules. Without that rewrite, agents fall into
+// UNKNOWN-protocol handling, which on some platforms downgrades to
+// allow-all — a real security regression.
 func TestCalculate_FirewallRuleProtocol_NeverNetbirdSSH(t *testing.T) {
 	c, localPeerKey := buildSmokeComponents(t)
 	// Replace the smoke policy with a NetbirdSSH-protocol allow.

shared/management/proto/management.pb.go

@@ -4511,8 +4511,8 @@ func (*StopExposeResponse) Descriptor() ([]byte, []int) {
 	return file_management_proto_rawDescGZIP(), []int{52}
 }
 
-// NetworkMapEnvelope wraps either a full snapshot or a delta. Step 2 ships
-// only Full; Delta is reserved for the incremental-update work.
+// NetworkMapEnvelope wraps either a full snapshot or a delta. Only Full is
+// emitted today; Delta is reserved for the incremental-update work.
 type NetworkMapEnvelope struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -5121,9 +5121,9 @@ func (x *AccountNetwork) GetSerial() uint64 {
 	return 0
 }
 
-// NetworkMapComponentsDelta is reserved for the incremental update protocol
-// (Step 3 of the migration plan). Field numbers 1–100 are pre-allocated to
-// keep room for the planned event types without needing a renumber.
+// NetworkMapComponentsDelta is reserved for the incremental update
+// protocol. Field numbers 1–100 are pre-allocated to keep room for the
+// planned event types without needing a renumber.
 type NetworkMapComponentsDelta struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -5358,7 +5358,7 @@ type PolicyCompact struct {
 
 	// Per-account integer id (matches policies.account_seq_id). Used as a
 	// stable reference for ResourcePoliciesMap.indexes and future delta
-	// updates (Step 3).
+	// updates.
 	Id            uint32       `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
 	Action        RuleAction   `protobuf:"varint,2,opt,name=action,proto3,enum=management.RuleAction" json:"action,omitempty"`
 	Protocol      RuleProtocol `protobuf:"varint,3,opt,name=protocol,proto3,enum=management.RuleProtocol" json:"protocol,omitempty"`

shared/management/proto/management.proto

@@ -734,8 +734,8 @@ message StopExposeResponse {}
 // NetworkMap from the server.
 // =====================================================================
 
-// NetworkMapEnvelope wraps either a full snapshot or a delta. Step 2 ships
-// only Full; Delta is reserved for the incremental-update work.
+// NetworkMapEnvelope wraps either a full snapshot or a delta. Only Full is
+// emitted today; Delta is reserved for the incremental-update work.
 message NetworkMapEnvelope {
   oneof payload {
     NetworkMapComponentsFull full = 1;
@@ -898,9 +898,9 @@ message AccountNetwork {
   uint64 serial = 5;
 }
 
-// NetworkMapComponentsDelta is reserved for the incremental update protocol
-// (Step 3 of the migration plan). Field numbers 1–100 are pre-allocated to
-// keep room for the planned event types without needing a renumber.
+// NetworkMapComponentsDelta is reserved for the incremental update
+// protocol. Field numbers 1–100 are pre-allocated to keep room for the
+// planned event types without needing a renumber.
 message NetworkMapComponentsDelta {
   reserved 1 to 100;
 }
@@ -984,7 +984,7 @@ message PeerCompact {
 message PolicyCompact {
   // Per-account integer id (matches policies.account_seq_id). Used as a
   // stable reference for ResourcePoliciesMap.indexes and future delta
-  // updates (Step 3).
+  // updates.
   uint32 id = 1;
 
   RuleAction action = 2;