docs: tidy the scan spec

docs/superpowers/specs/2026-11-02-e1608-network-scan-design.md

@@ -22,7 +22,7 @@ host with several interfaces; the existing "find by MAC" lookup has the same fla
   (`SO_BINDTODEVICE`, falling back to binding the interface address if the call is refused), enables
   `SO_BROADCAST`, and sends `D` to 255.255.255.255 on each. `poll()` drains every socket without
   blocking and returns the devices found so far (E-1608 product id only, one entry per MAC, the same
-  reply parsing as `discover`). `done(ms)` is not part of the class: the caller owns the clock.
+  reply parsing as `discover`). The caller owns the clock.
 - `discover()` keeps its signature. A new overload or helper `discover_broadcast(port, wait_ms)` is
   `Scan` plus a blocking wait. `E1608Source`'s lookup uses it when the subnet is empty; a given
   subnet still uses `sweep_targets` + `discover` as today.