diff --git a/secrets b/secrets
index 02697d4..02a3415 100755
--- a/secrets
+++ b/secrets
@@ -2127,11 +2127,11 @@ cmd_verify() {
 #   secrets migrate --dry-run   # per project: report old→new, write nothing
 #   secrets migrate             # per project: write v2 twins beside v1 blobs
 #   secrets migrate --finalize  # store-wide: verify, drop v1, stamp v2
-# Per-project (needs the project manifest to know which externals are
-# `properties`); finalize is store-wide. Mirrors verify's project/--all split.
+# Per-project copy-forward is manifest-free (enumerates the store's blobs);
+# finalize is store-wide. Mirrors verify's project/--all split.
 
-# Copy-forward (or dry-run preview) for the current project. Reads
-# $PWD/.secrets.json; only `properties` external blobs rename in v2.
+# Copy-forward (or dry-run preview) for the current project. Manifest-free:
+# enumerates the store's `*.gradle-properties.age` blobs; only those rename in v2.
 _migrate_project() {
   local dry_run="$1"
   if [ "$(_store_format)" = "2" ]; then
@@ -2183,9 +2183,6 @@ _migrate_project() {
   info "Copy-forward for '$project': $moved new v2 twin(s), $already already present. v1 blobs kept (non-destructive). Run 'secrets migrate --finalize' once every project is migrated and every machine is upgraded."
 }
 
-# Store-wide finalize: the only destructive step. Refuses unless verify --all
-# is green and every v1 properties blob has a v2 twin. Cuts a recovery tag,
-# stamps the marker, then drops v1 blobs.
 # Read-only survey: walk every project dir in the store and report each one's
 # v2-readiness from the blobs on disk (no manifest, no decryption). Exits
 # non-zero when any v1 properties blob lacks a v2 twin (i.e. the store is not
@@ -2226,6 +2223,9 @@ _migrate_status() {
   return 0
 }
 
+# Store-wide finalize: the only destructive step. Refuses unless verify --all
+# is green and every v1 properties blob has a v2 twin. Cuts a recovery tag,
+# stamps the marker, then drops v1 blobs.
 _migrate_finalize() {
   local force="$1"
   check_key