§8 comment cleanup (todo §8); targeted density pass over the §8 accretion. The §8 modules (scripts/ci.sh, the browser-E2E harness — proxy.mjs/mock-oidc.mjs/full-flow.spec.ts + the e2e overlays — fetch-timeout.ts, and the §8-review comment additions across app/config/jwks/admin-users/flow-view/data-table) were authored dense, each comment carrying a real non-obvious why, so two wins: fixed a stale forward-ref (config/menu.ts logo said 'next §2 item' but §2 wired branding into the shell long ago → 'rendered in the sidebar brand'); trimmed a locally-duplicated restatement (full-flow.spec.ts header re-listed coverage already enumerated by the test() titles below + the README — collapsed to point at them, kept the non-derivable gateway/fresh-stack/parallel-safety framing). README §8 additions already concise; Status/_(planned)_/Layout refresh stays §9. Docs/comments-only; typecheck + 310 units green.

config/menu.ts

@@ -9,7 +9,7 @@ export default defineMenu({
   branding: {
     name: "Plainpages", // app name shown in the sidebar
     sub: "Console", // optional subtitle under the name
-    // logo: "/public/logo.svg", // optional logo asset (rendered in the shell — next §2 item)
+    // logo: "/public/logo.svg", // optional logo asset (rendered in the sidebar brand)
     // theme: "auto",            // default color theme: auto | light | dark
   },
 

e2e/full-flow.spec.ts

@@ -2,9 +2,8 @@ import { type Browser, type Page, expect, test } from "@playwright/test";
 import { randomUUID } from "node:crypto";
 
 // Full browser E2E (todo §8): the real Playwright UI against the live stack via the same-origin
-// gateway (compose.e2e-full.yml). Covers password + mocked-SSO login, menu filtering by role, the
+// gateway (compose.e2e-full.yml) — the browser-UI login the earlier full-stack suites deferred here.
-// users/groups/roles admin CRUD, a permission-gated plugin page, and logout. The earlier full-stack
+// Coverage is the test titles below, plus the standalone SSO test.
-// suites drove flows over HTTP and deferred the browser-UI login here; this is that coverage.
 //
 // Runs on a fresh stack (`down -v` after, like the other full-stack suites). The serial admin
 // journey and the standalone SSO test run in parallel (fullyParallel) but stay independent: each