diff --git a/README.md b/README.md
index 7ad70d1..dadb06e 100644
--- a/README.md
+++ b/README.md
@@ -1818,8 +1818,7 @@ src/                 The app — strict tsc, no build step. *.test.ts sit beside
   server.ts          Entry point; config.ts env loader; logger.ts structured log + trace span + tracedFetch
   *.test.ts          Guards with no source counterpart (compose/kratos/keto/hydra/postgres/ci-gate/function-limits)
   http/              Request pipeline: app.ts (createApp), builtin-routes, context, body, cookie,
-                     static, safe-url (safeUrl + localPath), security-headers; app*.test.ts: one per concern
-                     over shared fixtures in app-harness.ts
+                     static, safe-url (safeUrl + localPath), security-headers
   auth/              Identity + the session-JWT hot path: jwt · jwt-middleware · jwks · gen-jwks (CLI) ·
                      login · guards · csrf · denylist · flow-view · oauth-login · oauth-consent ·
                      routes · bootstrap, and the Ory REST clients (kratos-public/admin, keto, hydra,
diff --git a/examples/plugins/admin/admin-clients.test.ts b/examples/plugins/admin/admin-clients.test.ts
index 0d73640..1bce63f 100644
--- a/examples/plugins/admin/admin-clients.test.ts
+++ b/examples/plugins/admin/admin-clients.test.ts
@@ -1,6 +1,6 @@
 // Built-in OAuth2 clients admin screen: the pure view-model + Hydra-payload builders. A client
 // is an Ory Hydra OAuth2 client (apps that log in *through* us); writes go only to Hydra. The
-// HTTP routing/gate/CSRF + live Hydra calls (incl. the one-time secret) are exercised in app-admin.test.ts.
+// HTTP routing/gate/CSRF + live Hydra calls (incl. the one-time secret) are exercised in src/http/app-admin.test.ts.
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import {
diff --git a/examples/plugins/admin/admin-grants.test.ts b/examples/plugins/admin/admin-grants.test.ts
index 5c912c6..20b4f5c 100644
--- a/examples/plugins/admin/admin-grants.test.ts
+++ b/examples/plugins/admin/admin-grants.test.ts
@@ -1,5 +1,5 @@
 // The pure half of permission granting: what a submitted checkbox set changes, and the picker the
-// two screens render from it. The Keto writes and the HTTP round trip are covered in app-admin.test.ts.
+// two screens render from it. The Keto writes and the HTTP round trip are covered in src/http/app-admin.test.ts.
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import type { PermissionDecl } from "@plainpages/plugin-api";
diff --git a/examples/plugins/admin/admin-groups.test.ts b/examples/plugins/admin/admin-groups.test.ts
index 0f49697..2b65081 100644
--- a/examples/plugins/admin/admin-groups.test.ts
+++ b/examples/plugins/admin/admin-groups.test.ts
@@ -1,7 +1,7 @@
 // Built-in Groups admin screen: the pure view-model + Keto-tuple builders. A group is a
 // Keto subject set (Group:<name>#members); membership tuples carry users (subject_id) or nested
 // groups (subject_set). The HTTP routing/gate/CSRF + live Keto/Kratos calls are exercised over
-// HTTP in app-admin.test.ts.
+// HTTP in src/http/app-admin.test.ts.
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import {
diff --git a/src/http/app-harness.ts b/src/http/app-harness.ts
index 7f93aaf..6f8cb0c 100644
--- a/src/http/app-harness.ts
+++ b/src/http/app-harness.ts
@@ -1,5 +1,3 @@
-// Shared fixtures for the app.*.test.ts files: a signing key for session JWTs, an app starter,
-// and stub Ory clients.
 import { generateKeyPairSync, sign, type JsonWebKey } from "node:crypto";
 import type { AddressInfo } from "node:net";
 import type { TestContext } from "node:test";
diff --git a/src/http/app-plugins.test.ts b/src/http/app-plugins.test.ts
index 7ea32b0..831e722 100644
--- a/src/http/app-plugins.test.ts
+++ b/src/http/app-plugins.test.ts
@@ -141,7 +141,6 @@ test("a plugin view renders the native chrome; its forms are CSRF-guarded via ct
 });
 
 // JWT middleware: a verified session cookie populates ctx.user/permissions, which the gate reads.
-// The key + mintJwt + session() helper live in app-harness.ts.
 test("a verified session JWT authorizes a permission-gated route; no cookie / expired token → sign in", async (t) => {
   const app = createApp({ jwks: staticJwks([ecJwk]), plugins: [demoPlugin] });
   await new Promise<void>((r) => app.listen(0, r));