diff --git a/docs/rfcs/session-sse-contract-v1.md b/docs/rfcs/session-sse-contract-v1.md
index 58c33026..0673d7e2 100644
--- a/docs/rfcs/session-sse-contract-v1.md
+++ b/docs/rfcs/session-sse-contract-v1.md
@@ -38,7 +38,8 @@ against current source before any route is added.
 - This RFC does **not** implement `GET /api/sessions/{session_id}/events`. No
   route, handler, or related code is added in this PR.
 - This RFC does **not** modify `GET /api/sessions/events` (the existing global
-  session-list invalidation stream at `api/routes.py:16118`).
+  session-list invalidation stream routed at `api/routes.py:12320-12321` and
+  implemented by `_handle_session_events_stream()` at `api/routes.py:16142`).
 - This RFC does **not** replace or modify existing streams: `/api/chat/stream`,
   `/api/approval/stream`, or `/api/clarify/stream`.
 - This RFC does **not** introduce Android, iOS, or PWA client code.
@@ -52,8 +53,8 @@ against current source before any route is added.
 ### Existing global session-list stream
 
 `GET /api/sessions/events` is a **different endpoint** from the one this RFC
-proposes. It is routed at `api/routes.py:12296-12297` and implemented by
-`_handle_session_events_stream()` at `api/routes.py:16118-16131`. It emits bare
+proposes. It is routed at `api/routes.py:12320-12321` and implemented by
+`_handle_session_events_stream()` at `api/routes.py:16142`. It emits bare
 `sessions_changed` events and keepalives for any change to the session list. It
 is a global invalidation signal, not a per-session lifecycle stream. The proposed
 `GET /api/sessions/{session_id}/events` is per-session and path-distinct.
@@ -68,6 +69,10 @@ adding a separate configurable knob.
 
 Current replay identity is run/stream-scoped:
 
+Line ranges in this inventory were verified against WebUI `master` when this
+RFC was written. Function, constant, and endpoint names are the stable anchors
+if source layout moves later.
+
 - `_parse_run_journal_event_id()` and `_parse_run_journal_after_seq()` at
   `api/routes.py:15638-15665` parse the cursor from `Last-Event-ID`.
 - `_runner_event_id()` at `api/routes.py:15730-15737` constructs the event `id`
diff --git a/tests/test_issue4812_session_sse_contract_rfc.py b/tests/test_issue4812_session_sse_contract_rfc.py
index 6d0ab43e..c4db78d6 100644
--- a/tests/test_issue4812_session_sse_contract_rfc.py
+++ b/tests/test_issue4812_session_sse_contract_rfc.py
@@ -84,6 +84,17 @@ class TestEndpointDistinction:
             "RFC must explicitly state the two endpoints are distinct"
         )
 
+    def test_rfc_cites_current_global_endpoint_source(self):
+        text = _rfc()
+        assert "api/routes.py:12320-12321" in text, (
+            "RFC must cite the current global sessions/events route match"
+        )
+        assert "api/routes.py:16142" in text, (
+            "RFC must cite the current _handle_session_events_stream definition"
+        )
+        assert "api/routes.py:12296-12297" not in text
+        assert "api/routes.py:16118" not in text
+
     def test_contracts_distinguishes_both_endpoints(self):
         text = _contracts()
         assert "/api/sessions/{session_id}/events" in text, (
@@ -158,7 +169,7 @@ class TestHeartbeat:
     def test_rfc_does_not_add_new_heartbeat_knob(self):
         text = _rfc()
         assert "new per-session configurable heartbeat" not in text or (
-            "not** added" in text or "not added" in text.lower()
+            "not added" in text.replace("*", "").lower()
         ), (
             "RFC must not add a new per-session heartbeat knob in Phase 1"
         )