diff --git a/server/src/utils/ssrfGuard.ts b/server/src/utils/ssrfGuard.ts
index bf4c7ced0..666ec7ee9 100644
--- a/server/src/utils/ssrfGuard.ts
+++ b/server/src/utils/ssrfGuard.ts
@@ -447,7 +447,7 @@ export function capResponse(response: Response, maxBytes: number | null): Respon
  * Redirects are followed through safeFetchFollow, so every hop is re-checked and
  * re-pinned, with safeFetchFollow's defaults: a body cap and, for a call without
  * a signal, a bounded wait for the headers. It used to hand the platform a
- * `redirect: 'follow'` with a dispatcher pinned to the FIRST hop only — the same shape as
+ * `redirect: 'follow'` with a dispatcher pinned to the FIRST hop only, the same shape as
  * GHSA-8mw6-xphx-886m, and pinning does not help there because Node skips the
  * pinned lookup for an IP-literal host. Sixteen callers ride on this, several
  * with a URL out of a per-user setting (Immich, Synology, AirTrail), and one
diff --git a/server/vitest.config.ts b/server/vitest.config.ts
index bf730a163..b88b2ec7f 100644
--- a/server/vitest.config.ts
+++ b/server/vitest.config.ts
@@ -110,9 +110,9 @@ export default defineConfig({
         'src/nest/geo/**/*.ts': { statements: 99, branches: 95, functions: 99, lines: 99 },
         // google-quota, managed, mcp-shared, mcp-transport, public-api,
         // receipt-scan, route-usage, scheduling, school-holidays, tokens and tours
-        // sat on the 80 catch-all until 2026-10-08. Each is pinned at
-        // floor(measured) - 1 over the unit, integration and e2e suites that load
-        // it, a subset a full run can only measure higher. managed holds an empty
+        // sat on the 80 catch-all until 2026-10-08. Each is pinned one point under
+        // what the unit, integration and e2e suites that load it measure, as the
+        // script prints it: a subset a full run can only measure higher. managed holds an empty
         // module and nothing to count. mcp-shared and route-usage measure below
         // the 80 floor on branches and functions and are pinned where they are.
         // tests/unit/coverage-thresholds.test.ts fails on a domain without an entry.