diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index c19de50f8..57900b016 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -7271,10 +7271,11 @@ func (x *RespondApprovalRequest) GetViewOnly() bool {
 type RespondApprovalResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// matched is true when request_id named a prompt that was still waiting.
-	// False covers three cases and does not distinguish them: request_id was
-	// never known, the prompt had already been answered, or it had expired and
-	// the connection was denied. In all three this call changed nothing, so the
-	// UI must not report the outcome the user picked as having taken effect.
+	// False means it was not, for any reason and without saying which: never
+	// known, already answered, expired, or abandoned because the prompt never
+	// reached a UI or the daemon shut the request down. What they share is that
+	// this call changed nothing, so the UI must not report the outcome the user
+	// picked as having taken effect.
 	Matched       bool `protobuf:"varint,1,opt,name=matched,proto3" json:"matched,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index 2dd7f3ebe..e477893b9 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -1127,9 +1127,10 @@ message RespondApprovalRequest {
 
 message RespondApprovalResponse {
   // matched is true when request_id named a prompt that was still waiting.
-  // False covers three cases and does not distinguish them: request_id was
-  // never known, the prompt had already been answered, or it had expired and
-  // the connection was denied. In all three this call changed nothing, so the
-  // UI must not report the outcome the user picked as having taken effect.
+  // False means it was not, for any reason and without saying which: never
+  // known, already answered, expired, or abandoned because the prompt never
+  // reached a UI or the daemon shut the request down. What they share is that
+  // this call changed nothing, so the UI must not report the outcome the user
+  // picked as having taken effect.
   bool matched = 1;
 }
diff --git a/client/vnc/server/session.go b/client/vnc/server/session.go
index e34f59a8f..5f450aaac 100644
--- a/client/vnc/server/session.go
+++ b/client/vnc/server/session.go
@@ -127,10 +127,15 @@ type session struct {
 	cursorSkipMu sync.Mutex
 	// cursorSkipSeen holds the cursor-skip diagnostics already emitted, so the
 	// Cursor pseudo-encoding path says each distinct reason once instead of
-	// taking all of them silently. Keyed by the formatted line rather than
-	// throttled once per session: a client can negotiate the encoding
-	// mid-session and the cursor source can start failing later, and the reason
-	// that happens to come first must not swallow the ones that follow.
+	// taking all of them silently. Per reason rather than once per session: a
+	// client can negotiate the encoding mid-session and the cursor source can
+	// start failing later, and whichever reason comes first must not swallow the
+	// ones that follow.
+	//
+	// Keyed by the fixed reason token logCursorSkip is called with, never by the
+	// formatted line: the messages carry sprite dimensions from the capturer, so
+	// keying on them would let a source returning junk metadata mint an entry
+	// per frame and grow this map for the life of the session.
 	cursorSkipSeen map[string]struct{}
 	// clientJPEGQuality and clientZlibLevel hold the 0..9 levels the client
 	// advertised via the QualityLevel / CompressLevel pseudo-encodings, or