diff --git a/config/examples/raspi3-encrypted.config b/config/examples/raspi3-encrypted.config
index a7a2aa5d..fb09e070 100644
--- a/config/examples/raspi3-encrypted.config
+++ b/config/examples/raspi3-encrypted.config
@@ -1,7 +1,8 @@
-# NOTE: the raspi3 HAL no longer ships a hardcoded test encryption key.
-# Nothing in this target calls wolfBoot_set_encrypt_key(), so an image
-# built with this config will reject encrypted updates until a key is
-# provisioned. See "Testing with kernel encryption" in docs/Targets.md.
+# NOTE: no hardcoded test key ships with the raspi3 HAL any more, and
+# nothing in this target calls wolfBoot_set_encrypt_key(), so this build
+# rejects encrypted updates until a key is provisioned. CI builds this
+# config but does not boot it. See "Testing with kernel encryption" in
+# docs/Targets.md.
 ARCH?=AARCH64
 TARGET?=raspi3
 SIGN?=RSA4096
diff --git a/docs/Targets.md b/docs/Targets.md
index 42a560af..c798f5cd 100644
--- a/docs/Targets.md
+++ b/docs/Targets.md
@@ -3760,17 +3760,18 @@ printf "0123456789abcdef0123456789abcdef0123456789ab" > /tmp/enc_key.der
 
 * Provision the same key into the bootloader
 
-  The raspi3 HAL does not ship a hardcoded key: `hal_init()` used to call
-  `wolfBoot_set_encrypt_key()` with a fixed test key compiled into the
-  image, which meant every build shared one publicly known secret. It was
-  removed, so the bootloader now has no key until one is provisioned and
-  encrypted updates fail closed.
+  The raspi3 HAL no longer ships a hardcoded key, so the bootloader has
+  none until one is provisioned and encrypted updates fail closed. To run
+  this demo, call `wolfBoot_set_encrypt_key()` with the key and nonce from
+  the file above at the end of `hal_init()` in `hal/raspi3.c`. That is a
+  development-only shortcut; a real deployment provisions a per-device key
+  from outside the firmware image (see
+  [encrypted_partitions.md](encrypted_partitions.md)).
 
-  To run this demo, call `wolfBoot_set_encrypt_key()` with the 32-byte key
-  and 12-byte nonce from the file above at the end of `hal_init()` in
-  `hal/raspi3.c`. That is a development-only shortcut: a real deployment
-  must provision a per-device key from a source that is not in the
-  firmware image (see [encrypted_partitions.md](encrypted_partitions.md)).
+  Note that CI builds this example but does not boot it, so the end-to-end
+  encrypted path above is not covered by an automated test. Adding runtime
+  coverage would need a provisioning hook the target does not currently
+  have.
 
 * Sign and encrypt Linux kernel image
 ```
diff --git a/hal/nxp_ls1028a.c b/hal/nxp_ls1028a.c
index 9981d7b0..190fd49a 100644
--- a/hal/nxp_ls1028a.c
+++ b/hal/nxp_ls1028a.c
@@ -521,10 +521,9 @@ void xspi_read_sr(uint8_t* rxbuf, uint32_t addr, uint32_t len)
 }
 
 /* Block until the NOR device finishes its program/erase cycle.
- * XSPI_IPCMDDONE only reports that the controller finished driving the
- * sequence on the bus; the device keeps WIP set for the ~ms the cycle
- * takes, and ignores Write Enable and further program/erase commands
- * until it clears. */
+ * XSPI_IPCMDDONE only means the controller finished driving the bus;
+ * the device keeps WIP set for the ~ms the cycle takes and ignores
+ * Write Enable until it clears. */
 void xspi_wait_ready(uint32_t addr)
 {
     uint8_t status[4] = {0, 0, 0, 0};
@@ -613,8 +612,8 @@ void xspi_flash_write(uintptr_t address, const uint8_t *data, uint32_t len)
         XSPI_IPTXFCR = XSPI_IPRCFCR_FLUSH;
         XSPI_INTR = XSPI_IPCMDDONE;
 
-        /* The program cycle is still running: the next iteration's
-         * Write Enable would be ignored and its Page Program dropped. */
+        /* Else the next iteration's Write Enable is ignored and its
+         * Page Program dropped. */
         xspi_wait_ready(address);
 
         len -= size;
diff --git a/hal/nxp_p1021.c b/hal/nxp_p1021.c
index fe29fd8a..021cc5cb 100644
--- a/hal/nxp_p1021.c
+++ b/hal/nxp_p1021.c
@@ -196,12 +196,10 @@
 #define ELBC_FBAR   ((volatile uint32_t*)(ELBC_BASE + 0xEC))  /* flash address register - OR_PGS=0 (shift 5), OR_PGS=1 (shift 6) */
 #define ELBC_FPAR   ((volatile uint32_t*)(ELBC_BASE + 0xF0))  /* flash page address register */
 #define ELBC_FBCR   ((volatile uint32_t*)(ELBC_BASE + 0xF4))  /* flash byte count register */
-/* FBCR[BC] = byte count: 0 = full page + spare, the only setting that
- * generates/checks ECC (FPAR[MS] and FPAR[CI] are then treated as 0);
- * otherwise the number of bytes transferred starting at FPAR[CI].
- * P1021RM 12.3.30 numbers it bits 20-31 MSB-first, i.e. the low 12 bits
- * of the word -- unshifted, like ELBC_FPAR_*_CI below. Bits 0-19 are
- * reserved. */
+/* FBCR[BC] = byte count: 0 = full page + spare (the only ECC setting,
+ * FPAR[MS]/[CI] then read as 0), else bytes from FPAR[CI]. P1021RM
+ * 12.3.30 numbers it 20-31 MSB-first, i.e. the low 12 bits: unshifted,
+ * like ELBC_FPAR_*_CI below. */
 #define ELBC_FBCR_BC(n)   ((n) & 0xFFF)
 
 #define ELBC_LTESR  ((volatile uint32_t*)(ELBC_BASE + 0xB0))  /* transfer error status register */
@@ -685,10 +683,9 @@ static int hal_flash_command(uint8_t iswrite)
 
     ltesr = get32(ELBC_LTESR);
 
-    /* Test the completion flag rather than the loop counter: on a
-     * timeout exit "timeout" has already been incremented past
-     * FLASH_TIMEOUT_TRIES, so the old "timeout == FLASH_TIMEOUT_TRIES"
-     * never matched and a command that never completed returned 0. */
+    /* Test the completion flag, not the loop counter: on a timeout exit
+     * "timeout" has already passed FLASH_TIMEOUT_TRIES, so comparing it
+     * for equality never matched and a hung command returned 0. */
     if (!(ltesr & ELBC_LTESR_CC)) {
         ret = -1;
     }
@@ -700,11 +697,9 @@ static int hal_flash_command(uint8_t iswrite)
     return ret;
 }
 
-/* Uses 32-bit accesses only when both the FCM window offset and the
- * caller's buffer are 4-byte aligned: flash_idx starts at the page
- * column and the chunk lengths need not be multiples of 4, so either
- * side can be odd. A misaligned 32-bit access to the cache-inhibited,
- * guarded eLBC window raises an alignment interrupt on e500. */
+/* 32-bit accesses only when both the FCM offset and the caller's
+ * buffer are 4-byte aligned; either can be odd, and a misaligned
+ * access to the guarded eLBC window traps on e500. */
 static void hal_flash_read_bytes(uint8_t* data, size_t len)
 {
     uint32_t end = flash_idx + (uint32_t)len;
@@ -1758,12 +1753,9 @@ int ext_flash_read(uintptr_t address, uint8_t *data, int len)
             /* read page into FCM buffer */
             hal_flash_set_addr(page, col);
 
-            /* Always transfer the full page + spare (BC = 0). It is the
-             * only setting that checks ECC, and the bad-block marker
-             * tested below lives in the spare region, which a BC != 0
-             * transfer never loads -- the check would then sample stale
-             * FCM RAM. read_size still governs how much is copied out
-             * of the buffer and how far the loop advances. */
+            /* Always full page + spare (BC = 0): the bad-block marker
+             * below lives in the spare region, which a BC != 0 transfer
+             * never loads. read_size still bounds the copy out. */
             set32(ELBC_FBCR, 0);
 
             ret = hal_flash_command(0);
diff --git a/hal/nxp_t10xx.c b/hal/nxp_t10xx.c
index 50a7a076..be46f95c 100644
--- a/hal/nxp_t10xx.c
+++ b/hal/nxp_t10xx.c
@@ -2093,7 +2093,7 @@ static int qe_check_firmware(const struct qe_firmware *firmware, const char* t)
     /* The microcode must lie inside the declared image: the upload
      * reads code_offset + 4*count bytes from the firmware start, so an
      * out-of-image offset would copy arbitrary memory into QE IRAM and
-     * program arbitrary traps (F-8000). 64-bit so the sum cannot wrap. */
+     * program arbitrary traps. 64-bit so the sum cannot wrap. */
     for (i = 0; i < firmware->count; i++) {
         mcode_end = (uint64_t)firmware->microcode[i].code_offset +
             (uint64_t)4 * firmware->microcode[i].count;
@@ -3534,11 +3534,9 @@ int hal_dts_fixup(void* dts_addr)
             break;
         cell = fdt32_to_cpu(*reg);
 
-        /* Translate the DTS cell-index into a phydevs slot before
-         * touching the table. NXP's qoriq-fman3 dtsi numbers the 1G
-         * memacs 0..3 and the 10G memacs 0x8/0x9, while phydevs holds
-         * the 1G ports at 0..3 and the single 10G port at FM1_10GEC1.
-         * Anything with no slot is skipped rather than indexed. */
+        /* NXP's qoriq-fman3 dtsi numbers the 1G memacs 0..3 and the
+         * 10G memacs 0x8/0x9; phydevs holds 1G at 0..3 and the single
+         * 10G port at FM1_10GEC1. Skip anything with no slot. */
         if (cell <= FM1_DTSEC4)
             i = (int)cell;
         else if (cell == 8)
diff --git a/hal/nxp_t2080.c b/hal/nxp_t2080.c
index ba75b25f..7681076d 100644
--- a/hal/nxp_t2080.c
+++ b/hal/nxp_t2080.c
@@ -663,10 +663,8 @@ static int hal_fman_init(void)
         return -1;
     }
 
-    /* Everything below reads through fw. The guard above only proved
-     * that FMAN_FW_ADDR itself is inside the NOR window, so bound the
-     * fixed part of the container (header + first microcode entry)
-     * before dereferencing any of it. */
+    /* The guard above only proved FMAN_FW_ADDR itself is in the NOR
+     * window; bound the fixed part before dereferencing it. */
     fw_off = (uint64_t)((uintptr_t)fw - (uintptr_t)FLASH_BASE_ADDR);
     extent = (uint64_t)FLASH_BANK_SIZE - fw_off;
     if (extent < (uint64_t)sizeof(struct qe_firmware)) {
@@ -685,7 +683,7 @@ static int hal_fman_init(void)
      * microcode count, self-consistent length, every code range inside
      * the declared image, and the whole image inside the remaining NOR
      * bank. 64-bit arithmetic so the sums cannot wrap. Fail closed:
-     * FMan stays unconfigured on any mismatch (F-9762). */
+     * FMan stays unconfigured on any mismatch. */
     if (hdr->version != 1) {
         wolfBoot_printf("FMAN: version %d unsupported\n", hdr->version);
         return -1;
@@ -701,9 +699,8 @@ static int hal_fman_init(void)
         uint64_t calc;
         unsigned int k;
 
-        /* Bound the microcode table and the declared image against the
-         * NOR before either is walked -- the table sits past the fixed
-         * part checked above, and the loop below dereferences it. */
+        /* Bound the table and the declared image before walking
+         * them: the table sits past the fixed part checked above. */
         if (table > extent || length > extent) {
             wolfBoot_printf("FMAN: image %lu exceeds NOR extent %lu\n",
                 (unsigned long)length, (unsigned long)extent);
diff --git a/hal/stm32l5.c b/hal/stm32l5.c
index 7619dd20..63add01c 100644
--- a/hal/stm32l5.c
+++ b/hal/stm32l5.c
@@ -90,9 +90,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 
 #if TZ_SECURE()
     if (address >= FLASH_BANK2_BASE)
-        /* Claim the flash span the program touches: the last partial
-         * double word is read back and programmed whole, up to the
-         * 8-byte boundary past len. */
+        /* The last partial double word is programmed whole, so
+         * claim up to the 8-byte boundary past len. */
         hal_tz_claim_nonsecure_area(address, (len + 7) & ~7);
     /* Convert into secure address space */
     dst = (uint32_t *)((address & (~FLASHMEM_ADDRESS_SPACE)) | FLASH_SECURE_MMAP_BASE);
@@ -101,13 +100,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     while (i < len) {
         int j;
 
-        /* Build the whole 64-bit unit before opening the PG window.
-         * The flash has no 32-bit program mode: both words of the
-         * double word must be stored inside one PG window or the
-         * operation never starts. Bytes outside [i, len) are read back
-         * from flash and written unchanged, so nothing past the
-         * requested length is modified and the source is never read
-         * past len (same read-modify-write shape as hal/stm32h5.c). */
+        /* Read-modify-write the whole 64-bit unit (as stm32h5.c):
+         * there is no 32-bit program mode, so both words must be
+         * stored inside one PG window or nothing is programmed. */
         for (j = 0; j < 8; j++) {
             if (i + j < len)
                 dword_bytes[j] = data[i + j];
diff --git a/hal/stm32n6.c b/hal/stm32n6.c
index d67a8a3d..7cc3c298 100644
--- a/hal/stm32n6.c
+++ b/hal/stm32n6.c
@@ -140,10 +140,9 @@ octospi_err:
 
 static int RAMFUNCTION octospi_write_enable(void)
 {
-    /* A failed WREN leaves the write-enable latch clear: the device then
-     * silently ignores the program/erase that follows, never goes BUSY, and
-     * octospi_wait_ready() reports idle on its first poll. The command must
-     * fail the operation instead of being discarded. */
+    /* A failed WREN leaves the latch clear: the device then ignores the
+     * program/erase, never goes BUSY, and octospi_wait_ready() reports
+     * idle on its first poll. */
     return octospi_cmd(0, WRITE_ENABLE_CMD, 0, SPI_MODE_NONE,
                        NULL, 0, SPI_MODE_NONE, 0);
 }
diff --git a/hal/stm32u5.c b/hal/stm32u5.c
index fe8e918e..b24185ae 100644
--- a/hal/stm32u5.c
+++ b/hal/stm32u5.c
@@ -95,14 +95,9 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
     while (i < len) {
         int j;
 
-        /* Build the whole 128-bit unit before opening the PG window.
-         * The controller only starts the program once all four words
-         * have been stored -- a partial quad-word leaves FLASH_SR_WDW
-         * set and hal_flash_wait_complete() never returns. Bytes
-         * outside [i, len) are read back from flash and written
-         * unchanged, so nothing past the requested length is modified
-         * and the source is never read past len (same read-modify-write
-         * shape as hal/stm32h5.c). */
+        /* Read-modify-write the whole 128-bit unit (as stm32h5.c):
+         * the program only starts on the 4th word, and a partial
+         * quad-word leaves FLASH_SR_WDW set, hanging the wait. */
         for (j = 0; j < 16; j++) {
             if (i + j < len)
                 qword_bytes[j] = data[i + j];
diff --git a/hal/ti_hercules.c b/hal/ti_hercules.c
index 4cb6506c..bb3fbca6 100644
--- a/hal/ti_hercules.c
+++ b/hal/ti_hercules.c
@@ -147,9 +147,8 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
          * (aligned) block; len < WRITE_BLOCK_SIZE keeps it to one more */
         if (st == 0 && (uint32_t)len > first) {
             /* The first program is still in flight: the FSM rejects a
-             * second command while busy, and a read from a bank under
-             * program returns undefined data -- which the read-modify-
-             * write below would then stage and program. */
+             * command while busy, and reading a bank under program
+             * returns undefined data. */
             while(FAPI_CHECK_FSM_READY_BUSY != Fapi_Status_FsmReady)
                 ;
             memcpy(temp, (void*)(address + first), WRITE_BLOCK_SIZE);
diff --git a/hal/x86_64_efi.c b/hal/x86_64_efi.c
index 59d3afcd..f1c29dc6 100644
--- a/hal/x86_64_efi.c
+++ b/hal/x86_64_efi.c
@@ -237,9 +237,9 @@ static int open_kernel_image(EFI_FILE_HANDLE vol, CHAR16 *filename,
     UINTN pages;
     UINT64 filesz;
 
-    /* Always leave *_addr well-defined so the caller's "no image" check is
-     * reliable: 0 on any failure, the loaded address only on full success.
-     * (F-9738) */
+    /* Always leave *_addr well-defined so the caller's "no image" check
+     * is reliable: 0 on any failure, the loaded address only on full
+     * success. */
     *_addr = 0;
     *sz = 0;
     file = openFile(filename, vol);
diff --git a/src/libwolfboot.c b/src/libwolfboot.c
index 3c69f69c..ace53440 100644
--- a/src/libwolfboot.c
+++ b/src/libwolfboot.c
@@ -2033,12 +2033,10 @@ static int RAMFUNCTION hal_set_key(const uint8_t *k, const uint8_t *nonce)
     ret = hal_flash_erase(addr_align, WOLFBOOT_SECTOR_SIZE);
 #endif
 exit_lock:
-    /* The raw key and nonce were staged in ENCRYPT_CACHE above. Scrub it
-     * on every build where wolfBoot owns the buffer: the two static
-     * cases -- NVM_FLASH_WRITEONCE aliases ENCRYPT_CACHE to NVM_CACHE,
-     * WOLFBOOT_SMALL_STACK gives it its own static array -- are exactly
-     * the ones where the plaintext would otherwise stay resident for the
-     * rest of the boot. Only a caller-supplied buffer is left alone. */
+    /* Scrub the staged key/nonce on every build where wolfBoot owns the
+     * buffer. The static cases (NVM_FLASH_WRITEONCE aliases it to
+     * NVM_CACHE, WOLFBOOT_SMALL_STACK has its own array) are exactly
+     * where the plaintext would otherwise stay resident. */
 #if !defined(WOLFBOOT_ENCRYPT_CACHE)
     ForceZero(ENCRYPT_CACHE, NVM_CACHE_SIZE);
 #endif
@@ -2945,7 +2943,7 @@ int wolfBoot_ram_decrypt(uint8_t *src, uint8_t *dst)
  * permission bits are deliberately not required, as they read back as 0 when the
  * NS MPU is disabled (NO_MPU) and do not constrain Secure accesses to NS memory
  * anyway. Outside a CMSE secure build there is no security boundary, so the check
- * collapses to a non-NULL pass-through. Same fix pattern as F-4416/F-4417/F-4644. */
+ * collapses to a non-NULL pass-through. Same fix pattern as earlier reports. */
 #if defined(__ARM_FEATURE_CMSE) && (__ARM_FEATURE_CMSE == 3U)
 #include <arm_cmse.h>
 #define WOLFBOOT_NSC_NS_RW(p, sz) \
diff --git a/src/sdhci.c b/src/sdhci.c
index 39879fba..cc659bdb 100644
--- a/src/sdhci.c
+++ b/src/sdhci.c
@@ -65,9 +65,8 @@ int __attribute__((weak)) sdhci_platform_block_copy(
 }
 #endif
 
-/* Watchdog service hook. Not tied to SDHCI_BLOCK_VIA_PDMA: the bounded
- * busy waits call it on every build, and a platform with a hardware
- * watchdog overrides it. */
+/* Watchdog service hook, called by the bounded busy waits on every
+ * build. A platform with a hardware watchdog overrides it. */
 void __attribute__((weak)) sdhci_platform_wdt_pet(void)
 {
 }
@@ -438,10 +437,8 @@ static void sdhci_uhs_recover_rollback(void)
 {
     wolfBoot_printf("SDHCI: 1.8V retry failed, restoring 3.3V signaling\n");
 
-    /* Roll the one-shot back with the registers: leaving it set would
-     * put the host in a state the base code could not reach -- back at
-     * 3.3V but with the recovery spent -- so a genuinely UHS-I card
-     * could never be retried for the rest of the boot. */
+    /* Roll the one-shot back with the registers: back at 3.3V with the
+     * recovery spent, a real UHS-I card could never be retried. */
     g_uhs_recovered = 0;
 
     sdhci_reg_and(SDHCI_SRS11, ~SDHCI_SRS11_SDCE);
@@ -630,7 +627,7 @@ int sdhci_cmd(uint32_t cmd_index, uint32_t cmd_arg, uint8_t resp_type)
 
 /* Worst-case programming time (erase) in milliseconds. Finite, so a
  * removed card or a card stuck in the programming state fails with an
- * I/O error instead of spinning forever (F-7984). The budget is sized
+ * I/O error instead of spinning forever. The budget is sized
  * for an erase because sdhci_wait_busy() is the wait after every R1b
  * command, erase included; the watchdog is serviced inside both loops
  * so a long wait cannot turn into a reset. */
diff --git a/tools/unit-tests/Makefile b/tools/unit-tests/Makefile
index 9ccf567a..e9441026 100644
--- a/tools/unit-tests/Makefile
+++ b/tools/unit-tests/Makefile
@@ -828,7 +828,7 @@ unit-zynq-erase-loop: unit-zynq-erase-loop.c zynq_erase_extract.h
 	gcc -o $@ unit-zynq-erase-loop.c $(CFLAGS) $(LDFLAGS)
 
 # unit-zynq-ext-write runs the real ext_flash_write() from hal/zynq.c
-# (F-7979: page chunks crossed physical NOR page boundaries and the
+# (page chunks crossed physical NOR page boundaries and the
 # wrap clobbered the page start). Same extraction approach as the
 # erase test; the emulated NOR models the wrap.
 zynq_write_extract.h: ../../hal/zynq.c
@@ -838,7 +838,7 @@ unit-zynq-ext-write: unit-zynq-ext-write.c zynq_write_extract.h
 	gcc -o $@ unit-zynq-ext-write.c $(CFLAGS) $(LDFLAGS)
 
 # unit-versal-qspi-dma drives the real DMA RX path of qspi_transfer() in
-# hal/versal.c (F-7982: an unaligned read larger than the 4096-byte
+# hal/versal.c (an unaligned read larger than the 4096-byte
 # temp buffer copied the full requested length out of the buffer). The
 # generated host copies differ from the real files only in:
 #   - ARM asm statements blanked (cannot assemble on x86; the cache
@@ -880,7 +880,7 @@ unit-versal-qspi-dma: unit-versal-qspi-dma.c versal_host.c
 	gcc -o $@ unit-versal-qspi-dma.c -DTARGET_versal -DEXT_FLASH -DARCH_AARCH64 -DARCH_64BIT $(CFLAGS) $(LDFLAGS)
 
 # unit-versal-ext-write runs the real ext_flash_write() from
-# hal/versal.c (F-7981: page chunks crossed physical NOR page
+# hal/versal.c (page chunks crossed physical NOR page
 # boundaries and the wrap clobbered the page start). The QspiDev_t
 # struct and the function are extracted verbatim (the qspi_* helpers
 # are file-static, so the test provides emulated ones); the emulated
@@ -895,7 +895,7 @@ unit-versal-ext-write: unit-versal-ext-write.c versal_qspidev_extract.h versal_e
 	gcc -o $@ unit-versal-ext-write.c -DEXT_FLASH -DARCH_AARCH64 -DARCH_64BIT $(CFLAGS) $(LDFLAGS)
 
 # unit-t10xx-qe-firmware runs the real qe_check_firmware() from
-# hal/nxp_t10xx.c (F-8000: the per-microcode code_offset was never
+# hal/nxp_t10xx.c (the per-microcode code_offset was never
 # bounded against the declared image, so a self-consistent blob could
 # make the upload copy arbitrary memory into QE IRAM). The qe_*
 # structures and the check function are extracted verbatim; the check
@@ -910,7 +910,7 @@ unit-t10xx-qe-firmware: unit-t10xx-qe-firmware.c t10xx_qe_firmware_extract.h
 	gcc -o $@ unit-t10xx-qe-firmware.c -DWOLFBOOT_NO_PRINTF $(CFLAGS) $(LDFLAGS)
 
 # unit-aurix-erased-fill runs the real cacheSector() and
-# programBytesToErasedFlash() from hal/aurix_tc3xx.c (F-9737: the
+# programBytesToErasedFlash() from hal/aurix_tc3xx.c (the
 # uint32_t page buffers were filled with the byte-valued
 # FLASH_BYTE_ERASED, so default-polarity builds got 0x000000FF words
 # instead of the erased 0xFFFFFFFF). The tc3_flash_* API is emulated
@@ -927,7 +927,7 @@ unit-aurix-erased-fill-invert: unit-aurix-erased-fill.c aurix_erased_extract.h
 	gcc -o $@ unit-aurix-erased-fill.c -DWOLFBOOT_FLAGS_INVERT $(CFLAGS) $(LDFLAGS)
 
 # unit-t2080-fman-loader runs the real hal_fman_init() from
-# hal/nxp_t2080.c (F-9762: the loader checked only the QEF magic and
+# hal/nxp_t2080.c (the loader checked only the QEF magic and
 # then copied attacker-shaped offsets/counts into FMan IRAM). The qe_*
 # structures and the function are extracted verbatim; the test owns the
 # NOR image (FMAN slot at a nonzero bank offset so the remaining-extent
@@ -942,7 +942,7 @@ unit-t2080-fman-loader: unit-t2080-fman-loader.c t2080_fman_extract.h
 	gcc -o $@ unit-t2080-fman-loader.c $(CFLAGS) $(LDFLAGS)
 
 # unit-stm32l5-write runs the real hal_flash_write() from hal/stm32l5.c
-# (F-9763: an 8-byte program unit was read whole even when len left a
+# (an 8-byte program unit was read whole even when len left a
 # partial unit, over-reading the caller's buffer and writing the excess
 # bytes to flash). The function and its wait/clear helpers are
 # extracted verbatim; FLASH_SR/CR live on a host register file and the
@@ -956,8 +956,8 @@ stm32l5_write_extract.h: ../../hal/stm32l5.c
 unit-stm32l5-write: unit-stm32l5-write.c stm32l5_write_extract.h
 	gcc -o $@ unit-stm32l5-write.c $(CFLAGS) $(LDFLAGS)
 
-# unit-stm32u5-write is the 16-byte-unit twin of the STM32L5 test
-# (F-9764): the real hal_flash_write() and its wait/clear helpers from
+# unit-stm32u5-write is the 16-byte-unit twin of the STM32L5 test:
+# the real hal_flash_write() and its wait/clear helpers from
 # hal/stm32u5.c, FLASH_NS_SR/CR on a host register file, destination
 # flash at a 32-bit host address, canary after the source buffer.
 stm32u5_write_extract.h: ../../hal/stm32u5.c
@@ -969,7 +969,7 @@ unit-stm32u5-write: unit-stm32u5-write.c stm32u5_write_extract.h
 	gcc -o $@ unit-stm32u5-write.c $(CFLAGS) $(LDFLAGS)
 
 # unit-nvm-cache-scrub runs the real trailer_write() and
-# partition_magic_write() from src/libwolfboot.c (F-9765: under
+# partition_magic_write() from src/libwolfboot.c (under
 # NVM_FLASH_WRITEONCE the staged sector can hold the firmware
 # key/nonce, and the buffer was never scrubbed on return). The test
 # owns NVM_CACHE, stages a key-bearing sector image, and stubs the
@@ -983,7 +983,7 @@ unit-nvm-cache-scrub: unit-nvm-cache-scrub.c nvm_cache_scrub_extract.h
 	gcc -o $@ unit-nvm-cache-scrub.c $(CFLAGS) $(LDFLAGS)
 
 # unit-sdhci-uhs-recover drives disk_read()'s UHS recovery path from the
-# real src/sdhci.c (F-9735: any read error permanently switched the host
+# real src/sdhci.c (any read error permanently switched the host
 # to 1.8V signaling with no rollback). sdhci_host.c (generated below) is
 # identical to the real file except the three `asm volatile` statements
 # are blanked (they cannot assemble on x86) and the real sdhci_read() is
@@ -1001,7 +1001,7 @@ unit-sdhci-uhs-recover: unit-sdhci-uhs-recover.c sdhci_host.c
 	gcc -o $@ unit-sdhci-uhs-recover.c -DDISK_SDCARD $(CFLAGS) $(LDFLAGS)
 
 # unit-sdhci-wait-busy drives sdhci_wait_busy()'s DATA0/CMD13 loops
-# from the real src/sdhci.c (F-7984: neither loop had a timeout, so a
+# from the real src/sdhci.c (neither loop had a timeout, so a
 # stuck/removed card spun forever). The controller is scripted through
 # the host register file. SDHCI_WAIT_BUSY_TIMEOUT_MS is deliberately
 # NOT overridden: the test's timer stub steps 1ms per read so the
@@ -1010,7 +1010,7 @@ unit-sdhci-wait-busy: unit-sdhci-wait-busy.c sdhci_host.c
 	gcc -o $@ unit-sdhci-wait-busy.c -DDISK_SDCARD -DWOLFBOOT_NO_PRINTF $(CFLAGS) $(LDFLAGS)
 
 # unit-ti-hercules-write runs the real hal_flash_write() staging logic
-# from hal/ti_hercules.c (F-9736: a short write crossing a block
+# from hal/ti_hercules.c (a short write crossing a block
 # boundary overran the staging buffer and lost the next block's bytes).
 # ti_hercules.c needs the TI FAPI vendor headers (board build tree) and
 # cannot be compiled on the host, but the bug is entirely in this
@@ -1029,7 +1029,7 @@ unit-ti-hercules-write: unit-ti-hercules-write.c ti_hercules_write_extract.h
 	gcc -o $@ unit-ti-hercules-write.c $(CFLAGS) $(LDFLAGS)
 
 # unit-p1021-qe-firmware drives the real qe_upload_firmware() from
-# hal/nxp_p1021.c (F-9759 bounds part: microcode offsets/counts were
+# hal/nxp_p1021.c (microcode offsets/counts were
 # never bounded to the 64 KiB buffer read from the update partition).
 # Reuses the nxp_p1021_host.c generated for the FCM tests, with the
 # PowerPC accessors shadowed the same way.
@@ -1038,7 +1038,7 @@ unit-p1021-qe-firmware: unit-p1021-qe-firmware.c nxp_p1021_host.c
 	gcc -o $@ unit-p1021-qe-firmware.c -DTARGET_nxp_p1021 -I../../hal $(CFLAGS) $(LDFLAGS)
 
 # unit-t10xx-dts-memac drives the real hal_dts_fixup() FDT memac loop
-# (F-7052: unvalidated cell-index into phydevs[5]) with hand-built
+# (unvalidated cell-index into phydevs[5]) with hand-built
 # DTBs. Extracts the function plus its liodn/qman static tables from
 # hal/nxp_t10xx.c.
 nxp_t10xx_fixup_extract.h: ../../hal/nxp_t10xx.c
diff --git a/tools/unit-tests/unit-aurix-erased-fill.c b/tools/unit-tests/unit-aurix-erased-fill.c
index b9c9255b..361f0760 100644
--- a/tools/unit-tests/unit-aurix-erased-fill.c
+++ b/tools/unit-tests/unit-aurix-erased-fill.c
@@ -1,6 +1,6 @@
 /* unit-aurix-erased-fill.c
  *
- * Regression test for F-9737: cacheSector() and
+ * Regression test: cacheSector() and
  * programBytesToErasedFlash() in hal/aurix_tc3xx.c filled their
  * uint32_t page buffers with the byte-valued FLASH_BYTE_ERASED, so in
  * the default (non-inverted) build every 32-bit word became
diff --git a/tools/unit-tests/unit-efi-x86-open-image.c b/tools/unit-tests/unit-efi-x86-open-image.c
index 0fcc8a9c..2a783cb3 100644
--- a/tools/unit-tests/unit-efi-x86-open-image.c
+++ b/tools/unit-tests/unit-efi-x86-open-image.c
@@ -1,6 +1,6 @@
 /* unit-efi-x86-open-image.c
  *
- * Regression test for F-9734: open_kernel_image() in hal/x86_64_efi.c passed
+ * Regression test: open_kernel_image() in hal/x86_64_efi.c passed
  * the caller's uint32_t *sz directly as the BufferSize argument of
  * EFI_FILE_PROTOCOL.Read(). That parameter is a UINTN, which is 64 bits on
  * x86-64, and the UEFI spec requires the firmware to write the number of
@@ -478,7 +478,7 @@ START_TEST(test_open_image_too_small)
     ck_assert_int_eq(ret, -1);
     ck_assert(canary_intact(&canary));
 
-    /* F-9738: a rejected load must not publish the allocated address, and
+    /* a rejected load must not publish the allocated address, and
      * the pages plus the file handle must be released. */
     ck_assert_uint_eq(addr, 0);
     ck_assert_int_eq(mock_free_pages, 1);
@@ -488,9 +488,9 @@ END_TEST
 
 /* A file larger than 4 GiB must be rejected before any allocation: the
  * loader's size type is uint32_t, and a 64-bit FileSize() truncated into
- * it would allocate and read a tiny fragment of the real image
- * (F-9739). The guard runs before AllocatePages, so nothing is
- * allocated and nothing must be freed. */
+ * it would allocate and read a tiny fragment of the real image. The
+ * guard runs before AllocatePages, so nothing is allocated and nothing
+ * must be freed. */
 START_TEST(test_open_image_oversized_rejected)
 {
     sz_canary_t canary;
@@ -514,7 +514,7 @@ START_TEST(test_open_image_oversized_rejected)
 END_TEST
 
 /* A failed Read() must not publish the allocated address, and must free
- * the pages and close the file (F-9738). */
+ * the pages and close the file. */
 START_TEST(test_open_image_read_failure)
 {
     sz_canary_t canary;
@@ -541,7 +541,7 @@ START_TEST(test_open_image_read_failure)
 END_TEST
 
 /* A failed allocation must not publish an address, and must close the
- * file (F-9738). */
+ * file. */
 START_TEST(test_open_image_alloc_failure)
 {
     sz_canary_t canary;
diff --git a/tools/unit-tests/unit-flash-write-cc26x2.c b/tools/unit-tests/unit-flash-write-cc26x2.c
index 8eca198f..85ab8123 100644
--- a/tools/unit-tests/unit-flash-write-cc26x2.c
+++ b/tools/unit-tests/unit-flash-write-cc26x2.c
@@ -1,6 +1,6 @@
 /* unit-flash-write-cc26x2.c
  *
- * Regression test for F-6869: hal_flash_write() and hal_flash_erase() in
+ * Regression test: hal_flash_write() and hal_flash_erase() in
  * hal/cc26x2.c discarded the Fapi status returned by FlashProgram() and
  * FlashSectorErase() and unconditionally returned 0, so a program or erase
  * that the flash controller rejected was reported to wolfBoot as a success.
diff --git a/tools/unit-tests/unit-ls1028a-xspi-write.c b/tools/unit-tests/unit-ls1028a-xspi-write.c
index 56acc78f..ad06fed0 100644
--- a/tools/unit-tests/unit-ls1028a-xspi-write.c
+++ b/tools/unit-tests/unit-ls1028a-xspi-write.c
@@ -1,6 +1,6 @@
 /* unit-ls1028a-xspi-write.c
  *
- * Regression test for F-7977: hal_flash_write() and ext_flash_write() in
+ * Regression test: hal_flash_write() and ext_flash_write() in
  * hal/nxp_ls1028a.c issue xspi_write_en() once before xspi_flash_write(),
  * but xspi_flash_write() issues one Page Program command per 256-byte
  * chunk when len > XSPI_IP_BUF_SIZE. NOR flash clears its
@@ -388,7 +388,7 @@ END_TEST
  * inside its loop, so it is not affected by this finding (and its SE
  * command encoding is a separate matter, not covered here).
  *
- * Suite for the F-7977 write path: */
+ * Suite for the write path: */
 Suite *ls1028a_xspi_suite(void)
 {
     Suite *s = suite_create("ls1028a-xspi-write");
diff --git a/tools/unit-tests/unit-nvm-cache-scrub.c b/tools/unit-tests/unit-nvm-cache-scrub.c
index d048f250..5a6c81e5 100644
--- a/tools/unit-tests/unit-nvm-cache-scrub.c
+++ b/tools/unit-tests/unit-nvm-cache-scrub.c
@@ -1,6 +1,6 @@
 /* unit-nvm-cache-scrub.c
  *
- * Regression test for F-9765: under NVM_FLASH_WRITEONCE the
+ * Regression test: under NVM_FLASH_WRITEONCE the
  * partition-trailer read-modify-write helpers stage a full flash
  * sector into the file-scope buffer NVM_CACHE. In EXT_ENCRYPTED
  * builds that same sector is where the firmware key/nonce live
diff --git a/tools/unit-tests/unit-p1021-fcm-bytes.c b/tools/unit-tests/unit-p1021-fcm-bytes.c
index d286e23a..17465d40 100644
--- a/tools/unit-tests/unit-p1021-fcm-bytes.c
+++ b/tools/unit-tests/unit-p1021-fcm-bytes.c
@@ -1,8 +1,9 @@
 /* unit-p1021-fcm-bytes.c
  *
- * Regression test for F-7975 and F-7976 in hal/nxp_p1021.c.
+ * Regression tests for the FCM byte helpers and page loops in
+ * hal/nxp_p1021.c.
  *
- * F-7975: hal_flash_read_bytes() and hal_flash_write_bytes() loop on
+ * hal_flash_read_bytes() and hal_flash_write_bytes() loop on
  * `while (flash_idx < len)`, comparing the FCM buffer index (which
  * hal_flash_set_addr() initializes to the page column, `flash_idx = col`)
  * against the caller's relative byte count. With col != 0:
@@ -17,7 +18,7 @@
  * The fix computes an absolute end (flash_idx + len) and copies exactly
  * len bytes, handling the tail byte-wise.
  *
- * F-7976: the ext_flash_write()/ext_flash_read() page loops size every
+ * the ext_flash_write()/ext_flash_read() page loops size every
  * iteration from the total request length instead of the remaining
  * length, do not cap it to the page, and program ELBC_FBCR with the
  * column offset - so the byte-count field (FBCR[BC], P1021RM 12.3.30
@@ -84,7 +85,7 @@ static uint32_t g_ccsr_regs[0x200000 / sizeof(uint32_t)];
 #define get16(addr)  (*(const volatile uint16_t *)(addr))
 #define set16(addr, v)  (*(volatile uint16_t *)(addr) = (uint16_t)(v))
 #define get32(addr)  (*(const volatile uint32_t *)(addr))
-/* set32 goes through a host hook so the F-7976 tests can log FBCR
+/* set32 goes through a host hook so the tests can log FBCR
  * writes and emulate the FCM<->NAND data move the hardware performs on
  * an LSOR write (see p1021_set32() below). */
 static void p1021_set32(volatile uint32_t *addr, uint32_t v);
@@ -153,11 +154,11 @@ static uint8_t g_fcm8k[8 * 1024];
  * (see there for the single mechanical difference). */
 #include "nxp_p1021_host.c"
 
-/* Stand-in FCM buffer for the F-7975 helper tests (they drive
+/* Stand-in FCM buffer for the helper tests (they drive
  * flash_buf directly, without hal_flash_set_addr()). */
 static uint8_t fcm[1024];
 
-/* ---- F-7976: emulated NAND and FCM transfer hook ----
+/* ---- emulated NAND and FCM transfer hook ----
  *
  * The hardware moves data between the FCM buffer and the NAND page when
  * hal_flash_command() writes the LSOR register. On the host that write
@@ -274,7 +275,7 @@ START_TEST(test_write_col_zero)
 }
 END_TEST
 
-/* The core F-7975 case: with col != 0 and len <= col the pre-fix loop
+/* The core case: with col != 0 and len <= col the pre-fix loop
  * ran zero times and the page program went ahead with stale FCM
  * contents. All len bytes must land at FCM offset col. */
 START_TEST(test_write_len_le_col)
@@ -386,7 +387,7 @@ START_TEST(test_read_len_gt_col)
 }
 END_TEST
 
-/* ---- F-7976: ext_flash_write()/ext_flash_read() page loops ---- */
+/* ---- ext_flash_write()/ext_flash_read() page loops ---- */
 
 /* A full-page write from column 0 must keep BC = 0 (full page + spare,
  * the only ECC-generating setting). */
diff --git a/tools/unit-tests/unit-p1021-qe-firmware.c b/tools/unit-tests/unit-p1021-qe-firmware.c
index 5ab40465..22f8bd8a 100644
--- a/tools/unit-tests/unit-p1021-qe-firmware.c
+++ b/tools/unit-tests/unit-p1021-qe-firmware.c
@@ -1,6 +1,6 @@
 /* unit-p1021-qe-firmware.c
  *
- * Regression test for F-9759 (bounds part): qe_upload_firmware() in
+ * Regression test (bounds part): qe_upload_firmware() in
  * hal/nxp_p1021.c validated only the self-declared consistency of the
  * QE microcode blob (magic, version, count range, length == computed
  * size, optional CRC32). The per-microcode code_offset/count fields and
@@ -10,7 +10,7 @@
  * code_offset or word count made the upload loop read (and copy into
  * QE instruction RAM) arbitrarily far past the buffer.
  *
- * Note: the full F-9759 recommendation also calls for cryptographic
+ * Note: the full recommendation also calls for cryptographic
  * authentication of the microcode before activation. That is a design
  * decision (keys, signed manifest, build flow) beyond a minimal patch
  * and is tracked as a note on the finding; this test covers the
diff --git a/tools/unit-tests/unit-sdhci-uhs-recover.c b/tools/unit-tests/unit-sdhci-uhs-recover.c
index 52f2cb24..26783cb4 100644
--- a/tools/unit-tests/unit-sdhci-uhs-recover.c
+++ b/tools/unit-tests/unit-sdhci-uhs-recover.c
@@ -1,6 +1,6 @@
 /* unit-sdhci-uhs-recover.c
  *
- * Regression test for F-9735: disk_read() called sdhci_uhs_recover()
+ * Regression test: disk_read() called sdhci_uhs_recover()
  * after any nonzero status from a data transfer, which permanently
  * switched the host to 1.8V signaling (SDHCI_SRS15_V18SE) on a plain
  * 3.3V cold boot whenever the first transfer failed for any reason
diff --git a/tools/unit-tests/unit-sdhci-wait-busy.c b/tools/unit-tests/unit-sdhci-wait-busy.c
index 19041c0e..d48afa4f 100644
--- a/tools/unit-tests/unit-sdhci-wait-busy.c
+++ b/tools/unit-tests/unit-sdhci-wait-busy.c
@@ -1,6 +1,6 @@
 /* unit-sdhci-wait-busy.c
  *
- * Regression test for F-7984: sdhci_wait_busy() had no timeout in
+ * Regression test: sdhci_wait_busy() had no timeout in
  * either its DATA0 polling loop or its repeated CMD13 loop (the
  * in-code TODO acknowledged it). A removed card, a controller fault,
  * or a card stuck in the programming state left wolfBoot spinning
diff --git a/tools/unit-tests/unit-stm32l5-write.c b/tools/unit-tests/unit-stm32l5-write.c
index 49ed621d..5ebb9ca1 100644
--- a/tools/unit-tests/unit-stm32l5-write.c
+++ b/tools/unit-tests/unit-stm32l5-write.c
@@ -1,6 +1,6 @@
 /* unit-stm32l5-write.c
  *
- * Regression test for F-9763: hal_flash_write() in hal/stm32l5.c
+ * Regression test: hal_flash_write() in hal/stm32l5.c
  * looped while (i < len) but each iteration unconditionally read both
  * 32-bit words of the 8-byte program unit (src[i>>2] and
  * src[(i>>2)+1]) and programmed both, regardless of how many bytes
diff --git a/tools/unit-tests/unit-stm32u5-write.c b/tools/unit-tests/unit-stm32u5-write.c
index fdbd29f9..6ccbdd40 100644
--- a/tools/unit-tests/unit-stm32u5-write.c
+++ b/tools/unit-tests/unit-stm32u5-write.c
@@ -1,6 +1,6 @@
 /* unit-stm32u5-write.c
  *
- * Regression test for F-9764: hal_flash_write() in hal/stm32u5.c
+ * Regression test: hal_flash_write() in hal/stm32u5.c
  * looped while (i < len) but each iteration unconditionally read all
  * four 32-bit words of the 16-byte program unit (src[i>>2] through
  * src[(i>>2)+3]) and programmed the full quadword regardless of the
diff --git a/tools/unit-tests/unit-t10xx-dts-memac.c b/tools/unit-tests/unit-t10xx-dts-memac.c
index c52f679d..f1f6a83e 100644
--- a/tools/unit-tests/unit-t10xx-dts-memac.c
+++ b/tools/unit-tests/unit-t10xx-dts-memac.c
@@ -1,6 +1,6 @@
 /* unit-t10xx-dts-memac.c
  *
- * Regression test for F-7052: the fsl,fman-memac loop in
+ * Regression test: the fsl,fman-memac loop in
  * hal_dts_fixup() (hal/nxp_t10xx.c) read the node's cell-index
  * straight from the device tree and used it to index the file-static
  * phydevs[5] with no bounds check - unlike the qman-portal loop right
diff --git a/tools/unit-tests/unit-t10xx-qe-firmware.c b/tools/unit-tests/unit-t10xx-qe-firmware.c
index 01cf2a42..9e4cece1 100644
--- a/tools/unit-tests/unit-t10xx-qe-firmware.c
+++ b/tools/unit-tests/unit-t10xx-qe-firmware.c
@@ -1,6 +1,6 @@
 /* unit-t10xx-qe-firmware.c
  *
- * Regression test for F-8000: qe_check_firmware() in hal/nxp_t10xx.c
+ * Regression test: qe_check_firmware() in hal/nxp_t10xx.c
  * validated the QE microcode header for self-consistency (magic,
  * version, count, length == computed size) but never bounded the
  * per-microcode code_offset against the declared image length.
diff --git a/tools/unit-tests/unit-t2080-fman-loader.c b/tools/unit-tests/unit-t2080-fman-loader.c
index ec4e7eed..baf88557 100644
--- a/tools/unit-tests/unit-t2080-fman-loader.c
+++ b/tools/unit-tests/unit-t2080-fman-loader.c
@@ -1,6 +1,6 @@
 /* unit-t2080-fman-loader.c
  *
- * Regression test for F-9762: hal_fman_init() in hal/nxp_t2080.c
+ * Regression test: hal_fman_init() in hal/nxp_t2080.c
  * checked only the NOR window guard and the QEF magic, then copied
  * fw->microcode[i].count words from fw + code_offset into FMan
  * instruction RAM and marked the engine ready. No version, count,
@@ -209,7 +209,7 @@ START_TEST(test_multi_risc_blob_accepted)
 END_TEST
 
 /* count == 0 used to be accepted as a successful upload of nothing
- * (F-9762); it must now be rejected. */
+ *; it must now be rejected. */
 START_TEST(test_zero_count_rejected)
 {
     make_blob(0, 0, 1, 0);
@@ -219,7 +219,7 @@ START_TEST(test_zero_count_rejected)
 END_TEST
 
 /* A self-consistent blob whose microcode offset lies past the declared
- * image must be rejected (F-9762: the loader used to read from there
+ * image must be rejected (the loader used to read from there
  * straight into FMan IRAM). */
 START_TEST(test_mcode_offset_past_image_rejected)
 {
@@ -230,7 +230,7 @@ START_TEST(test_mcode_offset_past_image_rejected)
 END_TEST
 
 /* A self-consistent blob whose declared image extends past the end of
- * the NOR bank must be rejected (F-9762). */
+ * the NOR bank must be rejected. */
 START_TEST(test_image_past_nor_extent_rejected)
 {
     struct qe_firmware *fw;
diff --git a/tools/unit-tests/unit-ti-hercules-write.c b/tools/unit-tests/unit-ti-hercules-write.c
index e0fc8546..d83cec32 100644
--- a/tools/unit-tests/unit-ti-hercules-write.c
+++ b/tools/unit-tests/unit-ti-hercules-write.c
@@ -1,6 +1,6 @@
 /* unit-ti-hercules-write.c
  *
- * Regression test for F-9736: the short-write path of hal_flash_write()
+ * Regression test: the short-write path of hal_flash_write()
  * in hal/ti_hercules.c checked only len < WRITE_BLOCK_SIZE, not whether
  * (address % WRITE_BLOCK_SIZE) + len stayed inside the block. A short
  * write starting near the end of a block copied past the end of the
@@ -200,7 +200,7 @@ START_TEST(test_short_write_fits_block)
 }
 END_TEST
 
-/* A short write crossing a block boundary (the F-9736 case): the first
+/* A short write crossing a block boundary (the case): the first
  * partial block and the remainder in the next block must both be
  * programmed, and nothing may be copied past the staging buffer. The
  * second program must also wait for the FSM: issued back-to-back it is
diff --git a/tools/unit-tests/unit-versal-ext-write.c b/tools/unit-tests/unit-versal-ext-write.c
index d61fffef..5383e02d 100644
--- a/tools/unit-tests/unit-versal-ext-write.c
+++ b/tools/unit-tests/unit-versal-ext-write.c
@@ -1,6 +1,6 @@
 /* unit-versal-ext-write.c
  *
- * Regression test for F-7981: ext_flash_write() in hal/versal.c
+ * Regression test: ext_flash_write() in hal/versal.c
  * chunked the request into length-based FLASH_PAGE_SIZE transfers
  * (page 0, page 1, ...) without accounting for the start address's
  * offset inside the physical page. A write starting mid-page sent a
diff --git a/tools/unit-tests/unit-versal-qspi-dma.c b/tools/unit-tests/unit-versal-qspi-dma.c
index 8afbc62c..842737e2 100644
--- a/tools/unit-tests/unit-versal-qspi-dma.c
+++ b/tools/unit-tests/unit-versal-qspi-dma.c
@@ -1,6 +1,6 @@
 /* unit-versal-qspi-dma.c
  *
- * Regression test for F-7982: the DMA RX path of qspi_transfer() in
+ * Regression test: the DMA RX path of qspi_transfer() in
  * hal/versal.c. For an unaligned destination or a length not divisible
  * by four, the transfer runs through the 4096-byte dma_tmpbuf. If the
  * requested rxLen exceeded the temp buffer, dmaLen was truncated to
diff --git a/tools/unit-tests/unit-zynq-erase-loop.c b/tools/unit-tests/unit-zynq-erase-loop.c
index f6602063..deac7d5b 100644
--- a/tools/unit-tests/unit-zynq-erase-loop.c
+++ b/tools/unit-tests/unit-zynq-erase-loop.c
@@ -1,6 +1,6 @@
 /* unit-zynq-erase-loop.c
  *
- * Regression test for F-7980: ext_flash_erase() in hal/zynq.c initializes
+ * Regression test: ext_flash_erase() in hal/zynq.c initializes
  * idx once before the multi-sector while (len > 0) loop and never resets
  * it, even though cmd is memset to zero each iteration. From the second
  * sector on, the erase command is written at cmd[idx] (past the start of
diff --git a/tools/unit-tests/unit-zynq-ext-write.c b/tools/unit-tests/unit-zynq-ext-write.c
index abb92563..66a145ca 100644
--- a/tools/unit-tests/unit-zynq-ext-write.c
+++ b/tools/unit-tests/unit-zynq-ext-write.c
@@ -1,6 +1,6 @@
 /* unit-zynq-ext-write.c
  *
- * Regression test for F-7979: ext_flash_write() in hal/zynq.c divided
+ * Regression test: ext_flash_write() in hal/zynq.c divided
  * the request into length-based FLASH_PAGE_SIZE chunks (page 0, page
  * 1, ...) without accounting for the start address's offset inside
  * the device page. A write starting mid-page sent a full-page Page