diff --git a/TODO.md b/TODO.md
index 7fdac75..3bd03b2 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2425,11 +2425,20 @@ and borrows `pr`'s conventions rather than inventing new ones beside them.
       only a workspace split would do it. Both were violated in the tree at
       some point and both were found by grep, which is the argument for the
       test
-- [ ] The one edge still pointing the wrong way: `clients/atproto/oauth/
-      pages.rs` calls `cmd::about::field_html`. Named as the single allowed
-      exception in `tests/module_layout.rs`, which fails once it stops being
-      needed, so landing the `html/`+`art.rs` move tightens the rule by
-      deleting a line
+- [x] The one edge that pointed the wrong way: `clients/atproto/oauth/
+      pages.rs` called `cmd::about::field_html`. It was named as the single
+      allowed exception in `tests/module_layout.rs`, and the `html/`+`art.rs`
+      move deleted both the call and the allowlist entry — the page and the
+      field of DNA now live in `html/` and `art.rs`, and `pages.rs` is gone.
+      Nothing outside `cmd/` imports `cmd/` any more, in code or in the
+      allowlist
+- [x] `auth.rs` split into `clients/atproto/oauth/{client,sessions,store,
+      login}.rs` and `cmd/auth.rs`, which is the piece the folder move
+      deliberately left behind. A pure move: no printed string and no step of
+      the OAuth flow changed. The seam is the `config/` constraint rather
+      than the verbs — `login` and `agent_for_did` read
+      `crate::config::account` to pick a DID and so stay in `cmd/`, while
+      everything they call takes that DID as an argument
 - [x] The HTTP bounds are the user's to set: `--connect-timeout` /
       `ATGC_CONNECT_TIMEOUT` and `--read-timeout` / `ATGC_READ_TIMEOUT`,
       flag over environment over default, the same precedence `--account`
diff --git a/docs/module-layout.md b/docs/module-layout.md
index e52cbd5..3839ecd 100644
--- a/docs/module-layout.md
+++ b/docs/module-layout.md
@@ -57,6 +57,20 @@ something a column can show are a third that neither of the first two owns.
 Each `cmd/` module carries its own clap definitions, with help text as doc
 comments. There is no parallel structure mirroring the args.
 
-**Still wrong:** `auth.rs` is two subjects at the crate root, the OAuth client
-and the `auth` verbs. It wants splitting into `clients/atproto/oauth/` and
-`cmd/auth.rs`. Do not add to it in place.
+## Where the `auth` split fell
+
+`auth.rs` used to be two subjects in one file at the crate root, and it is
+the worked example of the rule above. The OAuth client is
+`clients/atproto/oauth/`: `client.rs` for the jacquard wiring and the client
+metadata a grant is bound to, `sessions.rs` for what is on disk and what
+state it says an account's credentials are in, `store.rs` for jacquard's own
+typed view of that file, and `login.rs` for the loopback callback server and
+the state one in-flight login owns. The verbs are `cmd/auth.rs`, which is
+where every printed line and every clap definition went.
+
+The dividing line is the `config/` constraint, not the verbs. `login` and
+`agent_for_did` read `crate::config::account` to decide *which* DID to act
+for, so they are commands; the `start_auth`, `callback` and `restore` calls
+they make take that DID as an argument, so those are the client. Splitting
+by verb would have put `login` on the other side of the line and dragged the
+account registry into `clients/` with it.