Remove obvious comments; leave only the why of things

client/internal/engine.go

@@ -592,10 +592,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	publicKey := e.config.WgPrivateKey.PublicKey()
 	e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder)
 
-	// Rosenpass and ML-KEM are mutually exclusive post-quantum providers: both
+	// Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence
-	// program the same WireGuard PSK, so running them together would race on
-	// SetPresharedKey. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence; when it is
-	// enabled Rosenpass is skipped even if configured on.
 	if e.config.RosenpassEnabled && pqkem.Enabled() {
 		log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled")
 	}
@@ -690,9 +687,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 
 	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
-	// transport can bind on the WG overlay IP. ML-KEM takes precedence over
+	// transport can bind on the WG overlay IP.
-	// Rosenpass (see the mutual-exclusion note at rosenpass startup above), so
-	// when it is enabled rosenpass has already been skipped.
 	if pqkem.Enabled() {
 		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
 		if pqErr != nil {

client/internal/pqkem/manager.go

@@ -139,7 +139,7 @@ func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manage
 }
 
 // Start installs the data-path transport and begins its inbound delivery. The Manager
-// owns it from here; Stop closes it. Start/Stop are the transport lifecycle pair.
+// owns it from here; Stop closes it.
 func (m *Manager) Start(t Transport) {
 	m.mu.Lock()
 	m.transport = t
@@ -184,7 +184,7 @@ func (m *Manager) trace(msg string, args ...any) {
 }
 
 // AddPeer registers where a peer's data-path messages are sent and received: its
-// overlay endpoint (IP:port). Re-adding updates the endpoint.
+// overlay endpoint (IP:port).
 func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
 	if !endpoint.IsValid() {
 		return
@@ -322,14 +322,12 @@ func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
 	}
 }
 
-// OnDataPathRekeyed notifies that the peer's data path is up and freshly keyed with
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey
-// the latest PSK (fired on first establishment AND every rekey). If we are the
+// (fired on first establishment AND every rekey). If we are the initiator that just
-// initiator that just derived a PSK, it chains the next exchange: a fresh offer over
+// derived a PSK, it chains the next exchange: a fresh offer over the data path that
-// the data path that acknowledges the just-completed one (its arrival under the new
+// acknowledges the just-completed one (its arrival under the new key proves to the
-// key proves to the responder that the key works).
+// responder the key works). sinceActivity is how long ago the peer last exchanged real
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey.
+// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is
-// sinceActivity is how long ago the peer last exchanged real user data; when it
-// exceeds rotationActivityWindow the tunnel is treated as idle and rotation is
 // skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
 // traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
 func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {

client/internal/pqkem_adapter.go

@@ -26,7 +26,7 @@ type pqCallbackHandler struct {
 }
 
 // OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
-// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey.
+// if the peer is not present, mirroring Rosenpass).
 func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
 	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
 	// peer is not configured yet, so this is a no-op there and the PSK is instead