Small factual errors: Codex "publicly editable" caveat (Security), Web App Manifest listed as a cache (Performance), RECs called offsets (Sustainability) #462

Three small factual errors in the guidance pages:

1. Security, intro (security.md#L9): "This guide borrows heavily from the WordPress Codex's guide on Hardening WordPress. Since it's publicly editable, advice in the codex should be viewed with caution." That page is no longer a publicly editable Codex page. It now lives in the Advanced Administration Handbook, and changes go through pull request review on GitHub. The caveat should go, and the link should point to the new location (the URL change itself is also listed in Update links that now only work through a redirect (Learn WordPress, Developer Resources, GitHub Docs, vendor pages) #448).
2. Performance, caching layers (performance.md#L15): "Local Browser cache / Local Storage / Web App Manifest". A Web App Manifest is install metadata for a PWA (name, icons), not a cache. Client-side response caching is the HTTP cache and the Service Worker Cache API. This is probably left over from the removed HTML5 Application Cache "cache manifest". Suggested: "Local Browser cache / Local Storage / Service Worker cache".
3. Sustainability, RECs (sustainability.md#L77): "Renewable Energy Certificates (RECs), which offset energy consumption". The US EPA is explicit: "Offsets and RECs, however, are fundamentally different instruments with different impacts." A REC represents the environmental attributes of 1 MWh of renewable generation. It isn't an offset. Hosts make public claims based on this wording, so it matters. Suggested: "...RECs, each representing the environmental attributes of 1 MWh of renewable electricity generation that can be matched against the provider's electricity use (RECs are distinct from carbon offsets)."

None of these lines are changed by the open PRs (#418-#423, #441).

AI Assisted Claude Code fact-checked the guidance pages against primary sources, and each quote above was then checked.