diff --git a/packages/code-runtime/code-runtime-python/src/protocol.ts b/packages/code-runtime/code-runtime-python/src/protocol.ts
index ede2274c32..049bb38cc0 100644
--- a/packages/code-runtime/code-runtime-python/src/protocol.ts
+++ b/packages/code-runtime/code-runtime-python/src/protocol.ts
@@ -392,8 +392,9 @@ function jsonStringBytesUpTo(text: string, maxBytes: number): number | undefined
  * not the parse that produced `value`.
  * That upstream width is bounded separately, by the host-side cap on inbound
  * fd-3 frame size before `JSON.parse` runs (owned by the runtime that reads the
- * channel), so `value` cannot be arbitrarily large when it reaches here, while
- * `maxValueBytes` defaults to 32 KiB. The traversal rejects over-budget BEFORE
+ * channel), so `value` cannot be arbitrarily large when it reaches here. The
+ * budget is the `maxValueBytes` the boot frame carries — a required wire field
+ * with no default at this layer. The traversal rejects over-budget BEFORE
  * materializing a string's escaped form or enqueuing an array's/object's
  * children, so a forgery within that frame cap cannot force those secondary
  * allocations. Object key COUNTING is
diff --git a/scripts/check-workspace-constraints.ts b/scripts/check-workspace-constraints.ts
index 0b0069ffde..b575b48860 100644
--- a/scripts/check-workspace-constraints.ts
+++ b/scripts/check-workspace-constraints.ts
@@ -107,7 +107,7 @@ const packageFileExtras: Readonly<Record<string, readonly string[]>> = {
   '@deepseek-ai/dsh-web-app': ['cordis.patch.yml'],
   '@deepseek-ai/dsh-headless': ['cordis.patch.yml'],
   '@deepseek-ai/dsh-client-ui-theme': ['lib/styles'],
-  // The CPython bootstrap ships as source .py files the host spawns by path.
+  // The CPython side ships as source .py files, published as-is rather than built.
   '@deepseek-ai/dsh-code-runtime-python': ['py/**/*.py'],
   '@deepseek-ai/dsh-helper': ['lib/assets'],
   '@deepseek-ai/dsh-pty-local': ['scripts/ensure-spawn-helper.mjs'],