diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 351f2a4..73f2846 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ concurrency:
 # The committed Cargo.toml resolves libfreemkv from a git TAG (it is off
 # crates.io). That means CI was building this branch against the LAST RELEASE
 # of libfreemkv, never against libfreemkv's dev tip — so a coordinated change
-# across the two repos could not be verified until release.sh cut the tags.
+# across the two repos could not be verified until release-orchestrate.yml cut the tags.
 # Green here meant "compiles against last month's library".
 #
 # The fix mirrors the developer's local layout via the shared composite
@@ -42,7 +42,7 @@ concurrency:
 # the `deny` job audits the resolved graph, but CI's sibling path-patch layout
 # resolves the freemkv crates as path packages, which `--locked` can't satisfy —
 # the same reason the binary crates omit it. The lock that has to hold is the one
-# release.sh regenerates in each consuming binary.
+# release-orchestrate.yml regenerates in each consuming binary.
 
 jobs:
   # Single source of truth for the MSRV — read rust-version from Cargo.toml once
@@ -170,9 +170,8 @@ jobs:
     # to agree is what a release candidate is for.
     #
     # `if` SKIPS the job (it does not queue). A queued job would be far worse
-    # than a slow one: release.sh's CI gate refuses while any run for the
-    # commit is still in progress, so a never-scheduled job blocks releases
-    # silently -- see the note on real-media in qa.yml.
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
     needs: resolve-msrv
     if: github.ref_name == 'qa' || github.ref_name == 'main'
     runs-on: macos-latest
@@ -239,9 +238,8 @@ jobs:
     # to agree is what a release candidate is for.
     #
     # `if` SKIPS the job (it does not queue). A queued job would be far worse
-    # than a slow one: release.sh's CI gate refuses while any run for the
-    # commit is still in progress, so a never-scheduled job blocks releases
-    # silently -- see the note on real-media in qa.yml.
+    # than a slow one: a never-scheduled job leaves the run pending forever, so
+    # the branch's required checks never report complete.
     needs: resolve-msrv
     if: github.ref_name == 'qa' || github.ref_name == 'main'
     runs-on: windows-latest
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index ae153f8..93000de 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -16,9 +16,8 @@ name: qa
 # The shared checkout-siblings composite resolves qa->qa from the caller branch.
 #
 # What this gate CANNOT cover: `disc://` and real `iso://` need physical media,
-# and no hosted runner has an optical drive or the image hoard. Those run on a
-# self-hosted runner (see the media job at the end) and are the one leg that
-# stays on hardware.
+# and no hosted runner has an optical drive or the image hoard. That coverage
+# lives in freemkv's qa.yml (the real-media EC2 matrix), not in this file.
 on:
   push:
     branches: [qa]
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3314185..f5a7883 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,14 +29,14 @@ jobs:
 
   # Tests run as a PARALLEL TRIPWIRE: they fail the run if they fail, but the
   # release job does NOT `needs:` this job. The tag decision was already gated by
-  # the local precommit (same MSRV, same commit).
+  # CI (ci.yml on dev, then a green qa.yml on the same commit).
   #
   # Cargo.lock is now committed (issue #15), but --locked is still omitted: on
   # the runner the libfreemkv dep resolves from crates.io, not the local path
   # patch, which --locked can't reconcile. Its
   # libfreemkv dep resolves from crates.io (the dev .cargo/config.toml patch is
   # gitignored and absent on the runner), so libfreemkv must already be published
-  # at this version — the release script enforces that ordering before tagging.
+  # at this version — release-orchestrate.yml enforces that ordering before tagging.
   test:
     needs: verify
     runs-on: ubuntu-latest
@@ -51,12 +51,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - run: cargo test
 
-  # NOTE: the crates.io publish is driven by the maintainer's release tooling
-  # from local credentials, not from CI — this repo has no CARGO_REGISTRY_TOKEN
-  # secret. release.sh runs `cargo publish --no-verify` locally. CI here only
-  # verifies the version/tag match, runs tests (tripwire), and cuts the GitHub
-  # Release. The binaries git-tag-pin keysources, so they don't wait on the
-  # crates.io publish — it serves external consumers in parallel.
+  # NOTE: there is no crates.io publish — keysources is `publish = false` and
+  # git-tag-only. Consumers git-tag-pin it via a committed [patch.crates-io], so
+  # the git tag itself is the release artifact. CI here only verifies the
+  # version/tag match, runs tests (tripwire), and cuts the GitHub Release.
 
   release:
     # Only needs `verify`; the GitHub Release is cut as soon as the version