diff --git a/frontend/packages/agent/src/components/Header.tsx b/frontend/packages/agent/src/components/Header.tsx
index 00b7d276..8c7117b5 100644
--- a/frontend/packages/agent/src/components/Header.tsx
+++ b/frontend/packages/agent/src/components/Header.tsx
@@ -9,13 +9,10 @@
 // visual language needed for the chrome itself.
 
 // Measures its own rendered height via ResizeObserver, writes it to
-// `--agent-header-real-h` (agent.css's downstream consumers —
-// `.agent-status-overlay`, `.agent-main`'s scroll padding — prefer
-// this over the static `--agent-header-h` guess). A static guess was
-// the root cause of two "login card behind the header" reports on
-// this PR (mara, live): any header content that can wrap an extra
-// line breaks the guess at whatever width triggers it, and no width
-// can be promised safe. Deliberately a SEPARATE var, not an overwrite
+// `--agent-header-real-h` (`.agent-main`'s scroll padding, in agent.css,
+// prefers this over the static `--agent-header-h` guess). A static guess
+// broke whenever header content wrapped an extra line, at whatever width
+// triggered it, and no width can be promised safe. Deliberately a SEPARATE var, not an overwrite
 // of `--agent-header-h` in place: `.agent-header`'s own `min-height`
 // also reads that var — overwriting it in place would make the
 // header's own size react to its own just-measured height every
diff --git a/hive-c0re/src/gateway_nginx.rs b/hive-c0re/src/gateway_nginx.rs
index 6654c9de..240d8a09 100644
--- a/hive-c0re/src/gateway_nginx.rs
+++ b/hive-c0re/src/gateway_nginx.rs
@@ -66,8 +66,8 @@ const PROXY_HEADER_BLOCK: &str = "    proxy_http_version 1.1;
 ///   store dist. These load even while the agent daemon is restarting.
 /// - Static assets (`/static/`) → `alias` from the nix store with cache
 ///   headers. Served by nginx directly, no agent socket round-trip.
-/// - Everything else (all `/api/*`, `/events/*`, `/screen/ws`, `/icon`,
-///   `/login/*`) → proxied to the agent daemon as before.
+/// - Everything else (all `/api/*`, `/events/*`, `/screen/ws`, `/icon`)
+///   → proxied to the agent daemon as before.
 ///
 /// When `frontend_dir` is `None` (legacy) each agent gets a single
 /// `location /agent/<name>/` proxy block.