diff --git a/client/internal/ipcauth/privileged.go b/client/internal/ipcauth/privileged.go
index a9ef0f0fa..4da69cede 100644
--- a/client/internal/ipcauth/privileged.go
+++ b/client/internal/ipcauth/privileged.go
@@ -28,8 +28,7 @@ const (
 	ErrorMetaCommand = "command"
 
 	// ErrorReasonSessionHeld identifies a refusal caused by another user's live
-	// connection. Nothing the caller can run satisfies it, since the session is
-	// not theirs to end, so the detail carries no command.
+	// connection.
 	ErrorReasonSessionHeld = "SESSION_HELD"
 
 	// ErrorReasonNotProfileOwner identifies a refusal caused by the profile
diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go
index 2a96a3ebc..b2a2b9984 100644
--- a/client/internal/profilemanager/service.go
+++ b/client/internal/profilemanager/service.go
@@ -569,7 +569,7 @@ func (s *ServiceManager) profilesDirPath() string {
 	return filepath.Join(DefaultConfigPathDir, DefaultProfilePathDir)
 }
 
-// loadAllProfiles returns every profile acessible by a given kernal attested
+// loadAllProfiles returns every profile accessible by a given kernel attested
 // user. The returned slice is sorted by ID for a stable display order.
 //
 // Each Profile is fully populated: ID is the filename stem, Name comes
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index d507874b0..6a01a9d26 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -829,8 +829,8 @@ message ClaimProfileRequest {
   // handle is an exact ID, a unique ID prefix, or a unique display name.
   // Resolution happens server-side.
   string handle = 1;
-  // owner is the principal to record, "uid:1000" or "sid:S-1-5-21-...".
-  // The daemon validates its shape and does not require the account to exist.
+  // owner is either principal to record ("uid:1000" or "sid:S-1-5-21-...") or
+  // an account the daemon resolves.
   string owner = 2;
 }