diff --git a/clients/passkeys-browser/test/admin.test.ts b/clients/passkeys-browser/test/admin.test.ts
index a670c18..78816de 100644
--- a/clients/passkeys-browser/test/admin.test.ts
+++ b/clients/passkeys-browser/test/admin.test.ts
@@ -88,21 +88,6 @@ describe("PkAuthAdminClient", () => {
     expect(updated.label).toBe("new");
   });
 
-  it("removeCredential DELETEs the credential", async () => {
-    const fetchImpl = stubFetch({
-      "/auth/admin/credentials/abc": (init) => {
-        expect(init.method).toBe("DELETE");
-        return { status: 204, body: "" };
-      },
-    });
-    const c = new PkAuthAdminClient({
-      apiBase: "https://x",
-      getToken: () => "t",
-      fetch: fetchImpl as unknown as typeof fetch,
-    });
-    await c.removeCredential("abc");
-  });
-
   it("regenerateBackupCodes POSTs and returns the batch", async () => {
     const fetchImpl = stubFetch({
       "/auth/admin/backup-codes/regenerate": (init) => {
diff --git a/examples/dropwizard-demo/e2e/tests/ceremony.spec.ts b/examples/dropwizard-demo/e2e/tests/ceremony.spec.ts
index 9f285ba..8a786b9 100644
--- a/examples/dropwizard-demo/e2e/tests/ceremony.spec.ts
+++ b/examples/dropwizard-demo/e2e/tests/ceremony.spec.ts
@@ -31,10 +31,6 @@ async function installVirtualAuthenticator(
   return { authenticatorId: result.authenticatorId };
 }
 
-async function readOut(page: Page, id: string): Promise<string> {
-  return (await page.locator(`#${id}`).textContent()) ?? "";
-}
-
 test.describe("pk-auth Dropwizard demo — full flow", () => {
   test.beforeEach(async ({ page }) => {
     await installVirtualAuthenticator(page);
diff --git a/examples/micronaut-demo/e2e/tests/ceremony.spec.ts b/examples/micronaut-demo/e2e/tests/ceremony.spec.ts
index 58405a9..bf06e34 100644
--- a/examples/micronaut-demo/e2e/tests/ceremony.spec.ts
+++ b/examples/micronaut-demo/e2e/tests/ceremony.spec.ts
@@ -31,10 +31,6 @@ async function installVirtualAuthenticator(
   return { authenticatorId: result.authenticatorId };
 }
 
-async function readOut(page: Page, id: string): Promise<string> {
-  return (await page.locator(`#${id}`).textContent()) ?? "";
-}
-
 test.describe("pk-auth Micronaut demo — full flow", () => {
   test.beforeEach(async ({ page }) => {
     await installVirtualAuthenticator(page);
diff --git a/examples/spring-boot-demo/e2e/tests/ceremony.spec.ts b/examples/spring-boot-demo/e2e/tests/ceremony.spec.ts
index 64922b9..0672d9d 100644
--- a/examples/spring-boot-demo/e2e/tests/ceremony.spec.ts
+++ b/examples/spring-boot-demo/e2e/tests/ceremony.spec.ts
@@ -31,10 +31,6 @@ async function installVirtualAuthenticator(
   return { authenticatorId: result.authenticatorId };
 }
 
-async function readOut(page: Page, id: string): Promise<string> {
-  return (await page.locator(`#${id}`).textContent()) ?? "";
-}
-
 test.describe("pk-auth Spring Boot demo — full flow", () => {
   test.beforeEach(async ({ page }) => {
     await installVirtualAuthenticator(page);
diff --git a/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminRequestsTest.java b/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminRequestsTest.java
deleted file mode 100644
index f8aa2a3..0000000
--- a/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminRequestsTest.java
+++ /dev/null
@@ -1,48 +0,0 @@
-// SPDX-License-Identifier: MIT
-package com.codeheadsystems.pkauth.admin;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import com.codeheadsystems.pkauth.admin.AdminRequests.FinishEmailVerification;
-import com.codeheadsystems.pkauth.admin.AdminRequests.FinishPhoneVerification;
-import com.codeheadsystems.pkauth.admin.AdminRequests.RenameCredential;
-import com.codeheadsystems.pkauth.admin.AdminRequests.StartEmailVerification;
-import com.codeheadsystems.pkauth.admin.AdminRequests.StartPhoneVerification;
-import org.junit.jupiter.api.Test;
-
-/** Locks the wire-shape accessors so JSON marshallers and adapter code see identical fields. */
-class AdminRequestsTest {
-
-  @Test
-  void renameCredentialCarriesLabel() {
-    assertThat(new RenameCredential("phone").label()).isEqualTo("phone");
-    assertThat(new RenameCredential(null).label()).isNull();
-  }
-
-  @Test
-  void startEmailVerificationCarriesEmail() {
-    assertThat(new StartEmailVerification("a@b.test").email()).isEqualTo("a@b.test");
-    assertThat(new StartEmailVerification(null).email()).isNull();
-  }
-
-  @Test
-  void finishEmailVerificationCarriesToken() {
-    assertThat(new FinishEmailVerification("tok.en").token()).isEqualTo("tok.en");
-    assertThat(new FinishEmailVerification(null).token()).isNull();
-  }
-
-  @Test
-  void startPhoneVerificationCarriesPhone() {
-    assertThat(new StartPhoneVerification("+15551234567").phone()).isEqualTo("+15551234567");
-    assertThat(new StartPhoneVerification(null).phone()).isNull();
-  }
-
-  @Test
-  void finishPhoneVerificationCarriesPhoneAndCode() {
-    FinishPhoneVerification body = new FinishPhoneVerification("+15551234567", "000000");
-    assertThat(body.phone()).isEqualTo("+15551234567");
-    assertThat(body.code()).isEqualTo("000000");
-    assertThat(new FinishPhoneVerification(null, null).phone()).isNull();
-    assertThat(new FinishPhoneVerification(null, null).code()).isNull();
-  }
-}
diff --git a/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminResponseShapesTest.java b/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminResponseShapesTest.java
index 93a6a88..16b5259 100644
--- a/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminResponseShapesTest.java
+++ b/pk-auth-admin-api/src/test/java/com/codeheadsystems/pkauth/admin/AdminResponseShapesTest.java
@@ -16,18 +16,6 @@
  */
 class AdminResponseShapesTest {
 
-  @Test
-  void backupCodesCountResponseCarriesRemaining() {
-    assertThat(new BackupCodesCountResponse(7).remaining()).isEqualTo(7);
-    assertThat(new BackupCodesCountResponse(0).remaining()).isZero();
-  }
-
-  @Test
-  void emailVerificationResultCarriesUserHandle() {
-    UserHandle uh = UserHandle.of(new byte[] {1, 2, 3});
-    assertThat(new EmailVerificationResult(uh).userHandle()).isEqualTo(uh);
-  }
-
   @Test
   void emailVerificationResultRejectsNullHandle() {
     assertThatThrownBy(() -> new EmailVerificationResult(null))
diff --git a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/EnumsTest.java b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/EnumsTest.java
deleted file mode 100644
index 7df879f..0000000
--- a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/EnumsTest.java
+++ /dev/null
@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: MIT
-package com.codeheadsystems.pkauth.api;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import org.junit.jupiter.api.Test;
-
-class EnumsTest {
-
-  @Test
-  void userVerificationRequirementValues() {
-    assertThat(UserVerificationRequirement.values())
-        .containsExactly(
-            UserVerificationRequirement.REQUIRED,
-            UserVerificationRequirement.PREFERRED,
-            UserVerificationRequirement.DISCOURAGED);
-    assertThat(UserVerificationRequirement.valueOf("REQUIRED"))
-        .isEqualTo(UserVerificationRequirement.REQUIRED);
-  }
-
-  @Test
-  void residentKeyRequirementValues() {
-    assertThat(ResidentKeyRequirement.values())
-        .containsExactly(
-            ResidentKeyRequirement.REQUIRED,
-            ResidentKeyRequirement.PREFERRED,
-            ResidentKeyRequirement.DISCOURAGED);
-  }
-
-  @Test
-  void attestationConveyanceValues() {
-    assertThat(AttestationConveyance.values())
-        .containsExactly(
-            AttestationConveyance.NONE,
-            AttestationConveyance.INDIRECT,
-            AttestationConveyance.DIRECT,
-            AttestationConveyance.ENTERPRISE);
-  }
-
-  @Test
-  void authenticatorAttachmentValues() {
-    assertThat(AuthenticatorAttachment.values())
-        .containsExactly(AuthenticatorAttachment.PLATFORM, AuthenticatorAttachment.CROSS_PLATFORM);
-  }
-}
diff --git a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/ResultTypesTest.java b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/ResultTypesTest.java
index e9121f8..4a2cd1c 100644
--- a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/ResultTypesTest.java
+++ b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/api/ResultTypesTest.java
@@ -1,126 +1,32 @@
 // SPDX-License-Identifier: MIT
 package com.codeheadsystems.pkauth.api;
 
-import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
-import com.codeheadsystems.pkauth.credential.AuthenticatorData;
-import com.codeheadsystems.pkauth.credential.CredentialRecord;
-import java.time.Instant;
-import java.util.Set;
 import org.junit.jupiter.api.Test;
 
+/**
+ * Compact-constructor validation for the sealed ceremony result variants. Accessor read-backs and
+ * exhaustive-switch coverage are exercised by the ceremony service tests that actually produce
+ * these results; only the hand-written validation guards are tested here.
+ */
 class ResultTypesTest {
 
   @Test
-  void registrationResultSuccessConstruction() {
-    UserHandle uh = UserHandle.random();
-    CredentialRecord cred =
-        new CredentialRecord(
-            CredentialId.of(new byte[] {1, 2, 3}),
-            uh,
-            new byte[] {4, 5},
-            0L,
-            "Yubikey",
-            null,
-            Set.of(Transport.USB),
-            true,
-            true,
-            Instant.now(),
-            null);
-    AuthenticatorData authData =
-        new AuthenticatorData(new byte[] {1}, true, true, false, false, true, false, 0L);
-
-    RegistrationResult result = new RegistrationResult.Success(cred, authData);
-
-    String formatted =
-        switch (result) {
-          case RegistrationResult.Success s -> "ok:" + s.credential().label();
-          case RegistrationResult.InvalidChallenge ic -> "ic:" + ic.detail();
-          case RegistrationResult.OriginMismatch om -> "om:" + om.expected();
-          case RegistrationResult.AttestationRejected ar -> "ar:" + ar.reason();
-          case RegistrationResult.DuplicateCredential dc -> "dup";
-          case RegistrationResult.InvalidPayload ip -> "ip:" + ip.detail();
-          case RegistrationResult.RateLimited rl -> "rl:" + rl.bucket();
-        };
-    assertThat(formatted).isEqualTo("ok:Yubikey");
-  }
-
-  @Test
-  void registrationResultVariantsBuildAndValidate() {
-    assertThat(new RegistrationResult.InvalidChallenge("nope").detail()).isEqualTo("nope");
-    assertThat(new RegistrationResult.OriginMismatch("a", "b").actual()).isEqualTo("b");
-    assertThat(new RegistrationResult.AttestationRejected("fail").reason()).isEqualTo("fail");
-    assertThat(new RegistrationResult.InvalidPayload("bad").detail()).isEqualTo("bad");
-
-    CredentialId credId = CredentialId.of(new byte[] {7, 8, 9});
-    RegistrationResult.DuplicateCredential dup = new RegistrationResult.DuplicateCredential(credId);
-    assertThat(dup.credentialId()).isEqualTo(credId);
-    assertThat(dup)
-        .isEqualTo(
-            new RegistrationResult.DuplicateCredential(CredentialId.of(new byte[] {7, 8, 9})))
-        .hasSameHashCodeAs(
-            new RegistrationResult.DuplicateCredential(CredentialId.of(new byte[] {7, 8, 9})));
-
+  void registrationResultInvalidChallengeRejectsNullDetail() {
     assertThatThrownBy(() -> new RegistrationResult.InvalidChallenge(null))
         .isInstanceOf(NullPointerException.class);
   }
 
   @Test
-  void assertionResultSuccessConstructionAndAccessors() {
-    UserHandle uh = UserHandle.random();
-    CredentialId credId = CredentialId.of(new byte[] {10, 11});
-    AssertionResult.Success success =
-        new AssertionResult.Success(uh, credId, 42L, AssertionResult.CounterStatus.OK);
-
-    assertThat(success.userHandle()).isEqualTo(uh);
-    assertThat(success.credentialId()).isEqualTo(credId);
-    assertThat(success.signCount()).isEqualTo(42L);
-    assertThat(success.counterStatus()).isEqualTo(AssertionResult.CounterStatus.OK);
-    assertThat(success)
-        .isEqualTo(
-            new AssertionResult.Success(
-                uh, CredentialId.of(new byte[] {10, 11}), 42L, AssertionResult.CounterStatus.OK))
-        .hasSameHashCodeAs(
-            new AssertionResult.Success(
-                uh, CredentialId.of(new byte[] {10, 11}), 42L, AssertionResult.CounterStatus.OK));
+  void assertionResultSuccessRejectsNegativeSignCount() {
     assertThatThrownBy(
             () ->
                 new AssertionResult.Success(
-                    uh, CredentialId.of(new byte[] {0}), -1, AssertionResult.CounterStatus.OK))
+                    UserHandle.random(),
+                    CredentialId.of(new byte[] {0}),
+                    -1,
+                    AssertionResult.CounterStatus.OK))
         .isInstanceOf(IllegalArgumentException.class);
   }
-
-  @Test
-  void assertionResultVariantsExhaustiveSwitch() {
-    AssertionResult[] cases = {
-      new AssertionResult.UnknownCredential(CredentialId.of(new byte[] {1})),
-      new AssertionResult.InvalidChallenge("x"),
-      new AssertionResult.OriginMismatch("a", "b"),
-      new AssertionResult.CounterRegression(5, 4),
-      new AssertionResult.UserVerificationRequired(),
-      new AssertionResult.InvalidSignature(),
-    };
-    for (AssertionResult r : cases) {
-      String tag =
-          switch (r) {
-            case AssertionResult.Success s -> "success";
-            case AssertionResult.UnknownCredential uc ->
-                "unknown:" + uc.credentialId().value().length;
-            case AssertionResult.InvalidChallenge ic -> "ic";
-            case AssertionResult.OriginMismatch om -> "om";
-            case AssertionResult.CounterRegression cr -> "cr:" + cr.stored() + "/" + cr.received();
-            case AssertionResult.UserVerificationRequired uvr -> "uvr";
-            case AssertionResult.InvalidSignature is -> "is";
-            case AssertionResult.RateLimited rl -> "rl:" + rl.bucket();
-          };
-      assertThat(tag).isNotBlank();
-    }
-
-    AssertionResult.UnknownCredential uc1 =
-        new AssertionResult.UnknownCredential(CredentialId.of(new byte[] {1, 2}));
-    AssertionResult.UnknownCredential uc2 =
-        new AssertionResult.UnknownCredential(CredentialId.of(new byte[] {1, 2}));
-    assertThat(uc1).isEqualTo(uc2).hasSameHashCodeAs(uc2);
-  }
 }
diff --git a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/config/ConfigTest.java b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/config/ConfigTest.java
index 084f297..984dacd 100644
--- a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/config/ConfigTest.java
+++ b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/config/ConfigTest.java
@@ -54,10 +54,4 @@ void ceremonyConfigRejectsNonPositiveTtl() {
                     CounterRegressionPolicy.REJECT))
         .isInstanceOf(IllegalArgumentException.class);
   }
-
-  @Test
-  void counterRegressionPolicyValues() {
-    assertThat(CounterRegressionPolicy.values())
-        .containsExactly(CounterRegressionPolicy.REJECT, CounterRegressionPolicy.WARN);
-  }
 }
diff --git a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/ChallengeRecordTest.java b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/ChallengeRecordTest.java
index d15b63e..5e272d9 100644
--- a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/ChallengeRecordTest.java
+++ b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/ChallengeRecordTest.java
@@ -47,11 +47,4 @@ void rejectsEmptyChallenge() {
                     new byte[0], ChallengeRecord.Purpose.REGISTRATION, null, Instant.now()))
         .isInstanceOf(IllegalArgumentException.class);
   }
-
-  @Test
-  void purposeEnumValues() {
-    assertThat(ChallengeRecord.Purpose.values())
-        .containsExactly(
-            ChallengeRecord.Purpose.REGISTRATION, ChallengeRecord.Purpose.AUTHENTICATION);
-  }
 }
diff --git a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/SpiCarrierRecordsTest.java b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/SpiCarrierRecordsTest.java
index 2543ec4..e35a103 100644
--- a/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/SpiCarrierRecordsTest.java
+++ b/pk-auth-core/src/test/java/com/codeheadsystems/pkauth/spi/SpiCarrierRecordsTest.java
@@ -1,7 +1,6 @@
 // SPDX-License-Identifier: MIT
 package com.codeheadsystems.pkauth.spi;
 
-import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import com.codeheadsystems.pkauth.api.UserHandle;
@@ -32,19 +31,6 @@ private static OtpRepository.StoredOtp validOtp(int attempts, int maxAttempts) {
         NOW.plusSeconds(60));
   }
 
-  @Test
-  void storedOtpExposesAllFields() {
-    OtpRepository.StoredOtp otp = validOtp(1, 5);
-    assertThat(otp.otpId()).isEqualTo("otp-1");
-    assertThat(otp.userHandle()).isEqualTo(USER);
-    assertThat(otp.phoneE164()).isEqualTo("+15551234567");
-    assertThat(otp.hashedCode()).isEqualTo("hash");
-    assertThat(otp.attempts()).isEqualTo(1);
-    assertThat(otp.maxAttempts()).isEqualTo(5);
-    assertThat(otp.consumed()).isFalse();
-    assertThat(otp.expiresAt()).isEqualTo(NOW.plusSeconds(60));
-  }
-
   @Test
   void storedOtpRejectsNullRequiredFields() {
     assertThatThrownBy(
@@ -79,18 +65,6 @@ void storedOtpRejectsNegativeAttemptsAndNonPositiveMax() {
 
   // -- StoredBackupCode ---------------------------------------------------------------------
 
-  @Test
-  void storedBackupCodeExposesFieldsAndAllowsNullConsumedAt() {
-    BackupCodeRepository.StoredBackupCode code =
-        new BackupCodeRepository.StoredBackupCode("c-1", USER, "hash", false, NOW, null);
-    assertThat(code.codeId()).isEqualTo("c-1");
-    assertThat(code.userHandle()).isEqualTo(USER);
-    assertThat(code.hashedCode()).isEqualTo("hash");
-    assertThat(code.consumed()).isFalse();
-    assertThat(code.createdAt()).isEqualTo(NOW);
-    assertThat(code.consumedAt()).isNull();
-  }
-
   @Test
   void storedBackupCodeRejectsNullRequiredFields() {
     assertThatThrownBy(
diff --git a/pk-auth-dropwizard/src/test/java/com/codeheadsystems/pkauth/dropwizard/config/PkAuthConfigTest.java b/pk-auth-dropwizard/src/test/java/com/codeheadsystems/pkauth/dropwizard/config/PkAuthConfigTest.java
index ce1fca4..8bf95c1 100644
--- a/pk-auth-dropwizard/src/test/java/com/codeheadsystems/pkauth/dropwizard/config/PkAuthConfigTest.java
+++ b/pk-auth-dropwizard/src/test/java/com/codeheadsystems/pkauth/dropwizard/config/PkAuthConfigTest.java
@@ -40,12 +40,6 @@ void jwtSecretIsDefensivelyCopied() {
     assertThat(jwt.secret()[0]).isEqualTo((byte) 1);
   }
 
-  @Test
-  void ceremonyDefaultsToNullTtl() {
-    PkAuthConfig.Ceremony c = new PkAuthConfig.Ceremony();
-    assertThat(c.challengeTtl()).isNull();
-  }
-
   @Test
   void configRequiresEveryBlock() {
     assertThatThrownBy(() -> new PkAuthConfig(null, null, null))
@@ -76,16 +70,4 @@ void magicLinkRequiresNonBlankBaseUrl() {
     assertThatThrownBy(() -> new PkAuthConfig.MagicLink(null))
         .isInstanceOf(NullPointerException.class);
   }
-
-  @Test
-  void legacyThreeArgConstructorLeavesAltFlowBlocksNull() {
-    PkAuthConfig cfg =
-        new PkAuthConfig(
-            new PkAuthConfig.RelyingParty("example.com", "Example", Set.of("https://example.com")),
-            new PkAuthConfig.Jwt("iss", "aud", new byte[32], null),
-            new PkAuthConfig.Ceremony());
-    assertThat(cfg.otp()).isNull();
-    assertThat(cfg.magicLink()).isNull();
-    assertThat(cfg.backupCode()).isNull();
-  }
 }
diff --git a/pk-auth-magic-link/src/test/java/com/codeheadsystems/pkauth/magiclink/MagicLinkServiceTest.java b/pk-auth-magic-link/src/test/java/com/codeheadsystems/pkauth/magiclink/MagicLinkServiceTest.java
index 8c4bf4d..7dd3cd0 100644
--- a/pk-auth-magic-link/src/test/java/com/codeheadsystems/pkauth/magiclink/MagicLinkServiceTest.java
+++ b/pk-auth-magic-link/src/test/java/com/codeheadsystems/pkauth/magiclink/MagicLinkServiceTest.java
@@ -127,11 +127,6 @@ void tamperedTokenRejected() {
         .isInstanceOf(MagicLinkService.ConsumeResult.Invalid.class);
   }
 
-  @Test
-  void loggingSenderIsNoOp() {
-    new LoggingEmailSender().send("a@example.com", "subj", "body");
-  }
-
   /** Captures emails for inspection. */
   private static final class RecordingEmailSender implements EmailSender {
     private final List<Sent> sent = new ArrayList<>();
diff --git a/pk-auth-otp/src/test/java/com/codeheadsystems/pkauth/otp/OtpServiceTest.java b/pk-auth-otp/src/test/java/com/codeheadsystems/pkauth/otp/OtpServiceTest.java
index d6126f0..a70a019 100644
--- a/pk-auth-otp/src/test/java/com/codeheadsystems/pkauth/otp/OtpServiceTest.java
+++ b/pk-auth-otp/src/test/java/com/codeheadsystems/pkauth/otp/OtpServiceTest.java
@@ -120,11 +120,6 @@ void expiredOtpIsRejected() {
         .isInstanceOf(OtpService.VerifyResult.Expired.class);
   }
 
-  @Test
-  void smsSendersDoNotThrowForLoggingFlavor() {
-    new LoggingSmsSender().send(PHONE, "test");
-  }
-
   @Test
   void maskPhoneKeepsCountryPrefixAndLast4() {
     // Normal E.164 numbers: keep '+' + first country digit + '***' + last 4 digits.
diff --git a/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenConfigTest.java b/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenConfigTest.java
index 8817238..ec0c857 100644
--- a/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenConfigTest.java
+++ b/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenConfigTest.java
@@ -13,12 +13,8 @@ class RefreshTokenConfigTest {
   private final RefreshTtlPolicy policy = RefreshTtlPolicy.single(Duration.ofDays(14));
 
   @Test
-  void defaultsUsePinnedConstants() {
-    RefreshTokenConfig config = RefreshTokenConfig.defaults();
-    assertThat(config.secretBytes()).isEqualTo(RefreshTokenConfig.DEFAULT_SECRET_BYTES);
-    assertThat(config.refreshIdBytes()).isEqualTo(RefreshTokenConfig.DEFAULT_REFRESH_ID_BYTES);
-    assertThat(config.cleanupRetention()).isEqualTo(RefreshTokenConfig.DEFAULT_CLEANUP_RETENTION);
-    assertThat(config.ttlPolicy().refreshTtl("web"))
+  void defaultsResolveAudienceTtlThroughPolicy() {
+    assertThat(RefreshTokenConfig.defaults().ttlPolicy().refreshTtl("web"))
         .isEqualTo(RefreshTokenConfig.DEFAULT_REFRESH_TTL);
   }
 
diff --git a/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenRecordTest.java b/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenRecordTest.java
index 336faa8..ddd8e4e 100644
--- a/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenRecordTest.java
+++ b/pk-auth-refresh-tokens/src/test/java/com/codeheadsystems/pkauth/refresh/RefreshTokenRecordTest.java
@@ -36,14 +36,6 @@ private static RefreshTokenRecord valid() {
         List.of("pkauth"));
   }
 
-  @Test
-  void validRecordRoundTrips() {
-    RefreshTokenRecord r = valid();
-    assertThat(r.refreshId()).isEqualTo("rid");
-    assertThat(r.audience()).isEqualTo("web");
-    assertThat(r.amr()).containsExactly("pkauth");
-  }
-
   @Test
   void rejectsBlankRefreshId() {
     assertThatThrownBy(
@@ -268,13 +260,9 @@ void tokenHashAccessorReturnsDefensiveCopy() {
   }
 
   @Test
-  void equalsAndHashCodeComparePerFieldIncludingHashContents() {
-    RefreshTokenRecord a = valid();
-    RefreshTokenRecord b = valid();
-    assertThat(a).isEqualTo(b).hasSameHashCodeAs(b);
-    assertThat(a).isNotEqualTo(null).isNotEqualTo("not a record");
-
-    // A differing tokenHash (array content) breaks equality — the record uses Arrays.equals.
+  void equalsComparesTokenHashByArrayContents() {
+    // The record overrides equals/hashCode to compare tokenHash with Arrays.equals — the
+    // JVM-generated record equals would compare byte[] by reference and wrongly report unequal.
     RefreshTokenRecord differentHash =
         new RefreshTokenRecord(
             "rid",
@@ -290,24 +278,6 @@ void equalsAndHashCodeComparePerFieldIncludingHashContents() {
             Optional.empty(),
             Optional.empty(),
             List.of("pkauth"));
-    assertThat(a).isNotEqualTo(differentHash);
-
-    // A differing scalar field also breaks equality.
-    RefreshTokenRecord differentAudience =
-        new RefreshTokenRecord(
-            "rid",
-            new byte[] {1, 2, 3, 4},
-            USER,
-            "cli",
-            Optional.empty(),
-            "rid",
-            Optional.empty(),
-            NOW,
-            NOW.plusSeconds(3600),
-            Optional.empty(),
-            Optional.empty(),
-            Optional.empty(),
-            List.of("pkauth"));
-    assertThat(a).isNotEqualTo(differentAudience);
+    assertThat(valid()).isEqualTo(valid()).hasSameHashCodeAs(valid()).isNotEqualTo(differentHash);
   }
 }
diff --git a/pk-auth-spring-boot-starter/src/test/java/com/codeheadsystems/pkauth/spring/PkAuthPropertiesTest.java b/pk-auth-spring-boot-starter/src/test/java/com/codeheadsystems/pkauth/spring/PkAuthPropertiesTest.java
index 89e0bae..0ac3eaa 100644
--- a/pk-auth-spring-boot-starter/src/test/java/com/codeheadsystems/pkauth/spring/PkAuthPropertiesTest.java
+++ b/pk-auth-spring-boot-starter/src/test/java/com/codeheadsystems/pkauth/spring/PkAuthPropertiesTest.java
@@ -5,7 +5,6 @@
 
 import com.codeheadsystems.pkauth.spring.config.PkAuthProperties;
 import java.time.Duration;
-import java.util.Map;
 import java.util.Set;
 import org.junit.jupiter.api.Test;
 
@@ -30,31 +29,6 @@ void optionalBlocksFallToDefaultsWhenAbsent() {
     assertThat(props.devMode()).isFalse();
   }
 
-  @Test
-  void preservesExplicitValues() {
-    Map<String, Duration> perAudience = Map.of("web", Duration.ofMinutes(15));
-    PkAuthProperties props =
-        new PkAuthProperties(
-            new PkAuthProperties.RelyingParty(
-                "example.com", "Example", Set.of("https://example.com")),
-            new PkAuthProperties.Jwt(
-                "iss",
-                "aud",
-                "secret-that-is-long-enough-32b!!",
-                Duration.ofMinutes(30),
-                perAudience),
-            new PkAuthProperties.Ceremony(Duration.ofMinutes(2)),
-            new PkAuthProperties.Otp("dGVzdC1wZXBwZXItYmFzZTY0LWVuY29kZWQ="),
-            new PkAuthProperties.Refresh(Duration.ofDays(14), null, null, "/auth/refresh"),
-            true);
-    assertThat(props.relyingParty().id()).isEqualTo("example.com");
-    assertThat(props.jwt().defaultTtl()).isEqualTo(Duration.ofMinutes(30));
-    assertThat(props.jwt().ttlsByAudience()).isEqualTo(perAudience);
-    assertThat(props.ceremony().challengeTtl()).isEqualTo(Duration.ofMinutes(2));
-    assertThat(props.otp().pepper()).isEqualTo("dGVzdC1wZXBwZXItYmFzZTY0LWVuY29kZWQ=");
-    assertThat(props.devMode()).isTrue();
-  }
-
   @Test
   void requiredBlocksAreNoLongerDefaulted() {
     // PkAuthProperties no longer auto-populates relyingParty / jwt — adapters fail fast when