In case anyone looks for this in the future, here's where the 3 "Heater Core And Evaporator Core Housing" nuts are (attached to the firewall from inside the engine bay). Mine were close to hand tight - I needed to loosen them with a wrench and then spin them by hand for them to come off the 2 inches of bolt. The passenger side one was a bit more of a problem since it was rusted (possibly from leaking coolant, which brought up some further questions).
All 3 are identical and look like a nut with a large 1.5" washer attached to it. They all have a wide rubber gasket underneath. One came off with the nut, the other 2 stayed attached to the firewall. 11mm size. 7/16" may work too, but it's a bit bigger than the nut.
I removed the engine compartment brace and the cabin fresh air inlet duct and insulator. Not sure if necessary, but the bolt in point 3 might be even more difficult if you don't.
#6 in the diagram
View attachment 828570205
You can figure out the location of the bolts by looking at this image taken from inside the car (notice the two large bolt holes at the top and bottom corners of the square TXV opening).
View attachment 828570206
Or this one, of the housing itself:
View attachment 828570208
As you're looking at the firewall from the engine bay:
1. Immediately to the right (towards the driver side) of the heater 3 core hoses going into the firewall, between the heater core hose and the TXV. This one is the most accessible. 11mm socket wrench.
2. Immediately below and to the right (towards the driver side) of the A/C TXV (thermal expansion valve). Tie a string to an open ended 11mm wrench (so you can recover it if you drop it) and use that to loosen it. Then turn it by hand. You will likely drop the nut at the end, so I hope you have nimble fingers. I got lucky and mine made its way to the ground (washer and all).
3. This one is a bit hidden: it's on the firewall, behind where the A/C lines and the heater core lines first reach the firewall and bend up. See the pictures below. You have enough space between the firewall and the pipes from the top to attach an open-ended wrench to that nut and rotate it through 45 degrees. Mine was rusted, so I didn't want to risk rounding the nut. I went at it with a 7/16" ratcheting box wrench (didn't have 11mm, and the nut was also swollen from rust). The hard part was angling the wrench to fit over the bolt. If yours is not rusted, you can probably get it out by hand from here, but that wasn't the case for me - again, rust - so I soldiered on. At a certain point you have to stop and remove the wrench, since the advancing nut will be at a distance from the firewall such that the wrench wouldn't fit behind the hoses anymore. You should be able to overcome this by pulling the Heater Core And Evaporator Core Housing out a bit (from inside the vehicle), so the nut is up against the firewall again. But only if you removed the TXV bolt first. What I ended up doing was turning the wrench upside down. You can still turn it from the top with either a string OR (what I did) was move it with a long pair of hose pliers (which have a large loop at the tip); not sure how it works reaching from underneath the car.
View attachment 828570209
Here are my pics. You can notice the upside down wrench, in the middle of it all. Good luck with reaching down there.
View attachment 828570203 View attachment 828570204