Answer prose round 1: 0 🔴, 2 🟡 (0 misread); the harness and plugins-test comments and the README clause are gone, the admin pointers name the full path

src/http/app-harness.ts

@@ -1,5 +1,3 @@
-// Shared fixtures for the app.*.test.ts files: a signing key for session JWTs, an app starter,
-// and stub Ory clients.
 import { generateKeyPairSync, sign, type JsonWebKey } from "node:crypto";
 import type { AddressInfo } from "node:net";
 import type { TestContext } from "node:test";

src/http/app-plugins.test.ts

@@ -141,7 +141,6 @@ test("a plugin view renders the native chrome; its forms are CSRF-guarded via ct
 });
 
 // JWT middleware: a verified session cookie populates ctx.user/permissions, which the gate reads.
-// The key + mintJwt + session() helper live in app-harness.ts.
 test("a verified session JWT authorizes a permission-gated route; no cookie / expired token → sign in", async (t) => {
   const app = createApp({ jwks: staticJwks([ecJwk]), plugins: [demoPlugin] });
   await new Promise<void>((r) => app.listen(0, r));