diff --git a/TODO.md b/TODO.md
index 0dce3b2..fc67332 100644
--- a/TODO.md
+++ b/TODO.md
@@ -75,3 +75,5 @@
 - [ ] #wire-templates-to-load [!medium] Wire templates to load their page-type bundle instead of base.min.css — Update each template's <link> tags to point at the appropriate per-page bundle. Ensure no page loads CSS it doesn't need and that shared pages still get full styling.
 - [ ] #measure-before-after-css-bytes [!low] Measure before/after CSS bytes shipped per page type — Moot: part of split stream which is NO-GO (task 14). Skip unless split is revived.
 - [ ] #add-lightningcss-unusedsymbols-report-only [!high] Add lightningcss unusedSymbols report-only pass for base.min.css — SEQUENCING: do this (unusedSymbols report-only) BEFORE the per-page split (u). Reasoning: high priority, zero-risk diagnostic-only, produces reclaimable-byte go/no-go (14) against ~216KB baseline; if pruning is not worthwhile the split may not be either. Reuses inventory from v (docs/css-split-analysis.md). Start: 11 collect-content-sources.
+
+- [x] #trim-deploy-code-comments Remove oversized comment blocks from deploy-code/deploy-permissions recipes in justfile.
diff --git a/justfile b/justfile
index 35ea279..fd2405c 100644
--- a/justfile
+++ b/justfile
@@ -112,36 +112,13 @@ deploy: build deploy-code deploy-nginx deploy-deps deploy-migrate deploy-sudoers
 
 [group('deploy')]
 deploy-code:
-    # Sync application code only (no Composer deps, no migrations, no nginx config).
-    # nginx + server-side setup are handled by `deploy-nginx` (via deploy).
-    # No -p/-t/-o/-g: the destination tree is owned by www-data:xamxam (setgid),
-    # so this SSH user can read/write it but cannot chmod/chown/settime files it
-    # doesn't own — preserving perms/times would fail every file with
-    # "Operation not permitted" and exit rsync 23. Ownership/perms are restored
-    # by `deploy-permissions` right after. Times are only used as a transfer
-    # heuristic here; --size-only keeps unchanged files from being re-uploaded
-    # since their remote mtimes are no longer preserved.
     rsync -rlDz --size-only --info=progress2 --delete \
         --exclude-from=.rsync-exclude \
           app/ xamxam:/var/www/xamxam/
-    # Plain rsync (as this user) leaves newly-synced files owned by the caller,
-    # not www-data:xamxam — php-fpm then can't create SQLite journals in
-    # storage/ → HTTP 500. Restore ownership right after, so `just deploy-code`
-    # alone can never break the live site.
     @just deploy-permissions
 
 [group('deploy')]
 deploy-permissions:
-    # Fix app-tree ownership/permissions on the host so www-data (php-fpm) can
-    # read code and write storage (/sqlite wal+shm), cache/, tmp/, var/. Needs
-    # sudo. Run after any deploy-code resync and as a dep of `deploy`.
-    #
-    # sudo here is NOPASSWD-scoped to /tmp/fix-permissions.sh via the
-    # deploy/xamxam-fix-permissions.sudoers drop-in (installed once by `just
-    # deploy-sudoers`). That avoids relying on an interactive remote pty, which
-    # is fragile: `ssh -t` silently drops the pty when local stdin is not a TTY,
-    # so sudo's prompt prints but accepts no input. If you have not installed
-    # the drop-in yet, this step will prompt for your password interactively.
     @echo "🔒 Fixing www-data ownership/permissions…"
     rsync -v scripts/fix-permissions.sh xamxam:/tmp/fix-permissions.sh
     ssh -t xamxam "sudo bash /tmp/fix-permissions.sh && rm -f /tmp/fix-permissions.sh"