diff --git a/clients/cli/README.md b/clients/cli/README.md
index 098fe620..98eed8f6 100644
--- a/clients/cli/README.md
+++ b/clients/cli/README.md
@@ -153,7 +153,7 @@ npx @modelcontextprotocol/inspector --cli --catalog mcp.json --server my-http-se
   --method tools/list
 ```
 
-See [EMA / enterprise-managed auth](../../specification/v2_auth_ema.md) and [OAuth smoke testing](../../specification/v2_auth_smoke_testing.md) (§3 Stytch/CIMD; [§5 mid-session manual validation](v2_auth_smoke_testing.md#5-mid-session-auth--step-up--manual-validation) — CLI **C1–C2**).
+See [EMA / enterprise-managed auth](../../specification/v2_auth_ema.md) and [OAuth smoke testing](../../specification/v2_auth_smoke_testing.md) (§3 Stytch/CIMD; [§5 mid-session manual validation](../../specification/v2_auth_smoke_testing.md#5-mid-session-auth--step-up--manual-validation) — CLI **C1–C2**).
 
 ## Exit codes & error envelopes
 
diff --git a/core/mcp/node/transport.ts b/core/mcp/node/transport.ts
index ee04c855..59260bc2 100644
--- a/core/mcp/node/transport.ts
+++ b/core/mcp/node/transport.ts
@@ -148,7 +148,8 @@ export function createTransportNode(
     const url = new URL(sseConfig.url);
 
     // A caller-supplied eventSourceInit.fetch wins as-is (explicit fetch is not
-    // re-wrapped for proxying); the default path uses the proxy-aware baseFetch.
+    // re-wrapped for proxying); the default path uses fetchWithOptionalAuthIntercept
+    // (the proxy-aware baseFetch plus the optional auth-challenge intercept).
     const sseFetch =
       (sseConfig.eventSourceInit?.fetch as typeof fetch) ||
       fetchWithOptionalAuthIntercept;