diff --git a/apps/root/applicationset.yaml b/apps/root/applicationset.yaml
index 5738808..eb56674 100644
--- a/apps/root/applicationset.yaml
+++ b/apps/root/applicationset.yaml
@@ -11,14 +11,11 @@ spec:
         repoURL: https://git.ivanch.me/ivanch/haven-ops.git
         revision: main
         files:
-          # one Application per <app>.yaml under apps/<ns>/
           - path: "apps/*/*.yaml"
-          # never generate apps for the bootstrap/root manifests themselves
           - path: "apps/root/*.yaml"
             exclude: true
   template:
     metadata:
-      # apps/default/notepad.yaml -> Application "notepad"
       name: '{{ .path.filename | trimSuffix ".yaml" }}'
       namespace: argocd
       finalizers:
@@ -28,13 +25,12 @@ spec:
       source:
         repoURL: https://git.ivanch.me/ivanch/haven-ops.git
         targetRevision: main
-        # in the git files generator .path.path IS the containing directory
-        path: '{{ .path.path }}'
+        path: "{{ .path.path }}"
         directory:
-          include: '{{ .path.filename }}'
+          include: "{{ .path.filename }}"
       destination:
         server: https://kubernetes.default.svc
-        namespace: '{{ index .path.segments 1 }}'
+        namespace: "{{ index .path.segments 1 }}"
       syncPolicy:
         automated:
           prune: true
diff --git a/bootstrap/argocd-install/kustomization.yaml b/bootstrap/argocd-install/kustomization.yaml
index 728dbbf..0d2d7ee 100644
--- a/bootstrap/argocd-install/kustomization.yaml
+++ b/bootstrap/argocd-install/kustomization.yaml
@@ -4,14 +4,8 @@ kind: Kustomization
 namespace: argocd
 
 resources:
-  # cluster-install already includes ALL CRDs (applications, appprojects,
-  # applicationsets). Do NOT also add manifests/crds — kustomize fails with
-  # "may not add resource with an already registered id".
   - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
   - ingress.yaml
 
-# Serve plain HTTP behind the nginx ingress (TLS terminates at nothing —
-# internal-only app convention). Applied live via kubectl patch on first
-# install; this file keeps git as the source of truth.
 patches:
   - path: server-insecure-patch.yaml