chore: drop design-section cross-refs from core comments

Keep module docs self-describing without pointing at DESIGN §N.

Co-authored-by: Cursor <cursoragent@cursor.com>

DESIGN-DEVICE-HISTORY.md

@@ -454,8 +454,6 @@ wake-up: refresh durable state via list/get APIs. Mid-transfer progress polish
 | `offer-accepted` | Local approval completed; authorization is in core custody. |
 | `offer-declined` | Local decline completed. |
 
-See also [`crates/vnidrop/CORE_FLOW.md`](crates/vnidrop/CORE_FLOW.md) (same catalog, linked so the lists cannot fork).
-
 Failures remain typed where callers can act differently, including:
 
 - Device unavailable or offer timeout.

crates/vnidrop/CORE_FLOW.md

@@ -49,9 +49,15 @@ bytes through Kotlin memory.
 
 ### Pairing and targeted-transfer event catalog
 
-Canonical catalog: [DESIGN-DEVICE-HISTORY.md §13.1](../../DESIGN-DEVICE-HISTORY.md).
-Do not maintain a second kind list here — link only. Events are wake-ups; query
-durable state after receive. Mid-transfer progress polish may follow.
+Treat every event as a wake-up: refresh durable state via list/get APIs.
+Mid-transfer progress polish may follow.
+
+**`pairing`:** `eligibility-available`, `eligibility-removed`,
+`relationship-changed`, `relationship-grant-rotated`, `saved-device-forgotten`,
+`device-blocked`.
+
+**`targeted_transfer`:** `offer-received`, `offer-accepted`, `offer-declined`.
+
 ## Platform File Rules
 
 - Desktop uses normal filesystem paths.

crates/vnidrop/src/api.rs

@@ -302,7 +302,7 @@ pub struct CoreLimits {
     pub max_pending_offers: u64,
     pub max_concurrent_transfers: u64,
     pub event_queue_capacity: u64,
-    /// Cap on Saved + pending mutual-consent relationships (design §14).
+    /// Cap on Saved + pending mutual-consent relationships.
     pub max_saved_devices: u64,
     /// Quiet period after a decline or repeated malformed control-plane traffic.
     pub identity_cooldown_ms: u64,

crates/vnidrop/src/control_plane.rs

@@ -1,4 +1,4 @@
-//! Saved-device control-plane hardening (design §14).
+//! Saved-device control-plane hardening.
 //!
 //! Bounds hostile / noisy peers without imposing quotas on transfers the
 //! receiver has already accepted.

crates/vnidrop/src/device_relationship/crypto.rs

@@ -1,4 +1,4 @@
-//! Relationship-grant possession proofs (design §7).
+//! Relationship-grant possession proofs.
 
 use crate::{
     error::VnidropError,

crates/vnidrop/src/device_relationship/lifecycle.rs

@@ -1,4 +1,4 @@
-//! Forget, block, grant rotation, and minimal revocation tombstones (design §7–§8).
+//! Forget, block, grant rotation, and minimal revocation tombstones.
 
 use serde_json::json;
 

crates/vnidrop/src/device_relationship/mod.rs

@@ -1,7 +1,7 @@
 //! Experimental saved-device mutual-consent relationships.
 //!
-//! Implements design §6/§7: pending outgoing/incoming states, directional grants
-//! bound to relationship generation, and Saved only after mutual acknowledgement.
+//! Pending outgoing/incoming states, directional grants bound to relationship
+//! generation, and Saved only after mutual acknowledgement.
 
 mod crypto;
 mod lifecycle;

crates/vnidrop/src/device_relationship/service.rs

@@ -875,7 +875,7 @@ impl DeviceRelationshipService {
             )));
         }
         // Established relationships record a protocol floor and reject silent
-        // downgrade attempts (design §7 / §15).
+        // downgrade attempts.
         if protocol_version < row.minimum_protocol_version {
             return Err(VnidropError::protocol_incompatible(anyhow::anyhow!(
                 "relationship protocol downgrade is forbidden"

crates/vnidrop/src/runtime/saved_devices.rs

@@ -110,7 +110,7 @@ impl CoreInner {
             "device-blocked",
             json!({ "peer_endpoint_id": peer_endpoint_id }),
         );
-        // Silence: blocked peers are not notified (design §8).
+        // Silence: blocked peers are not notified.
         Ok(())
     }
 

crates/vnidrop/src/targeted_transfer/protocol.rs

@@ -1,4 +1,4 @@
-//! Targeted-transfer control-plane protocol (design §10).
+//! Targeted-transfer control-plane protocol.
 //!
 //! Separate ALPN from ordinary offers: pre-approval messages carry a manifest
 //! summary and relationship proof only — never a reusable share ticket.
@@ -443,7 +443,7 @@ fn parse_offer_relay_urls(values: &[String]) -> Result<Vec<RelayUrl>, ()> {
     Ok(urls)
 }
 
-/// Map a receiver refuse reason to a typed public error (design §13).
+/// Map a receiver refuse reason to a typed public error.
 pub(crate) fn map_offer_refuse_reason(reason: &str) -> VnidropError {
     match reason {
         "relay-policy-incompatible" => VnidropError::relay_policy_incompatible(anyhow::anyhow!(

crates/vnidrop/src/ticket.rs

@@ -185,7 +185,7 @@ pub(crate) fn ticket_matches_relay_profile(
 }
 
 /// Whether a remote peer's advertised network profile can be used under the
-/// local profile (design §3 / §10 relay-policy validation).
+/// local profile.
 pub(crate) fn relay_profiles_compatible(
     local_mode: CoreRelayMode,
     local_urls: &[RelayUrl],