docs: replace vague provenance prose with recorded facts

packages/bash/bash-sandbox/src/helpers.ts

@@ -23,7 +23,7 @@ function isUsableWorkdir(path: string): boolean {
 }
 
 /**
- * Attribute only Node ENOENT/EACCES failures with positive argv[0] provenance
+ * Attribute only Node ENOENT/EACCES failures whose error path equals argv[0]
  * after independently ruling out the caller-owned cwd. A supplied error path
  * must exactly identify the runner; without one, the syscall must. With a
  * usable cwd, these codes describe resolution or execute permission for that

packages/bash/bash-sandbox/src/index.ts

@@ -124,7 +124,7 @@ export class SandboxBashExecutor extends LocalBashExecutor {
     try {
       proc = this.startArgv(spec, confined.argv)
     } catch (error) {
-      // LocalSubprocessService reports provenanced ENOENT/EACCES through async
+      // LocalSubprocessService reports ENOENT/EACCES with the failed executable path through async
       // `done` rejection; this covers alternatives that throw that shape synchronously.
       if (isRunnerSpawnFailure(error, confined.argv[0], spec.workdir)) {
         throw new SandboxUnavailableError(mode, String(error))