@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,34 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Preferences query reports renamed notification types under the current name",
+    "detail": "Rows stored under a former notification name are returned with the current name and collapsed per channel with the delivery precedence (current-name row wins, otherwise any disabled row disables), so settings screens show the effective state."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Inline mail image retries on transient storage errors",
+    "detail": "Only a missing file storage for the file's tenant sends the mail without the inline image; any other read error (timeout, provider failure, DB) is rethrown so the send job retries instead of mailing without the logo."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Unsubscribe tenant origin resolved once per notify call",
+    "detail": "The app's tenantOrigin callback runs once per notify call and tenant instead of once per recipient and channel, so a newsletter no longer causes one lookup and one fallback warning per address. The docs state the callback must only return verified, active domains."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "One-click unsubscribe POST keeps the JSON rejection",
+    "detail": "RFC 8058 one-click POSTs (form body List-Unsubscribe=One-Click) answer an invalid or expired token with the JSON 400 again and skip the branding lookup; only browser form submits get the HTML page."
+  },
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Resubscribe limit page has its own text",
+    "detail": "A browser that hits the resubscribe limit sees that the address cannot be subscribed again here, instead of the generic \"try again later\" error (new key mail.unsubscribe.resubscribeLimitReached in en, de, es, fr, it)."
+  },
   {
     "version": "0.383.0",
     "type": "fix",

package/packages/bundled-features/src/delivery/channel-context.ts

@@ -5,7 +5,11 @@ import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileContext } from "@cosmicdrift/kumiko-framework/files";
 import { createFallbackLogger } from "@cosmicdrift/kumiko-framework/logging";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
-import { type FileRefContent, readFileRefContent } from "../file-foundation/index.ts";
+import {
+  type FileRefContent,
+  FileStorageUnavailableError,
+  readFileRefContent,
+} from "../file-foundation/index.ts";
 import {
   collectRendererPlugins,
   createRendererFoundationApi,
@@ -86,7 +90,8 @@ function createPdfRenderer(
   };
 }
 
-// A decorative inline image (logo) that cannot be read must not fail the whole mail.
+// A decorative inline image (logo) of a tenant without file storage must not fail the whole mail;
+// transient read errors rethrow so the send job retries.
 async function readInlineImageOrNull(
   fileRefId: string,
   read: () => Promise<FileRefContent | null>,
@@ -94,9 +99,10 @@ async function readInlineImageOrNull(
   try {
     return await read();
   } catch (err) {
+    if (!(err instanceof FileStorageUnavailableError)) throw err;
     createFallbackLogger("delivery").warn("inline image could not be read, sending without it", {
       fileRefId,
-      errorName: err instanceof Error ? err.name : typeof err,
+      errorName: err.name,
     });
     return null;
   }

package/packages/bundled-features/src/delivery/db/queries/preferences.ts

@@ -1,5 +1,5 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
+import { toPostgresArrayLiteral, unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
 export type NotificationPreferenceRow = {
@@ -27,6 +27,6 @@ export async function selectNotificationPreferences(
          OR (notification_type = '*' AND channel = $4)
          OR (notification_type = ANY($3::text[]) AND channel = '*')
        )`,
-    [tenantId, userId, notificationTypeNames, channelName],
+    [tenantId, userId, toPostgresArrayLiteral(notificationTypeNames), channelName],
   );
 }

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -484,9 +484,37 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     }
   }
 
+  // The app's tenantOrigin callback typically hits the DB: once per run and tenant, not per recipient.
+  const unsubscribeOriginsByRun = new WeakMap<NotifyRun, Map<TenantId, Promise<string>>>();
+
+  function unsubscribeOriginOnce(
+    run: NotifyRun,
+    links: UnsubscribeLinkConfig,
+    channelCtx: ChannelContext,
+    notificationType: string,
+  ): Promise<string> {
+    let originsByTenant = unsubscribeOriginsByRun.get(run);
+    if (originsByTenant === undefined) {
+      originsByTenant = new Map();
+      unsubscribeOriginsByRun.set(run, originsByTenant);
+    }
+    let origin = originsByTenant.get(channelCtx.tenantId);
+    if (origin === undefined) {
+      origin = unsubscribeLinkOrigin(links, channelCtx, (reason) =>
+        logError.warn(`unsubscribe link falls back to the app origin: ${reason}`, {
+          tenantId: channelCtx.tenantId,
+          notificationType,
+        }),
+      );
+      originsByTenant.set(channelCtx.tenantId, origin);
+    }
+    return origin;
+  }
+
   // A caller-supplied unsubscribeUrl wins; the recipient comes from the server-side notify
   // context, never from the notification data.
   async function withUnsubscribeUrl(
+    run: NotifyRun,
     message: ChannelMessage,
     channelName: string,
     recipient: UnsubscribeLinkRecipient,
@@ -498,11 +526,11 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     }
     const supplied = message.data?.["unsubscribeUrl"];
     if (typeof supplied === "string" && supplied !== "") return message;
-    const origin = await unsubscribeLinkOrigin(unsubscribeLinks, channelCtx, (reason) =>
-      logError.warn(`unsubscribe link falls back to the app origin: ${reason}`, {
-        tenantId: channelCtx.tenantId,
-        notificationType: message.notificationType,
-      }),
+    const origin = await unsubscribeOriginOnce(
+      run,
+      unsubscribeLinks,
+      channelCtx,
+      message.notificationType,
     );
     const unsubscribeUrl = await buildUnsubscribeUrl(unsubscribeLinks, origin, recipient, {
       tenantId: channelCtx.tenantId,
@@ -811,6 +839,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           channel,
           address,
           message: await withUnsubscribeUrl(
+            run,
             message,
             channel.name,
             { kind: "user", userId },
@@ -914,6 +943,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           channel,
           address,
           message: await withUnsubscribeUrl(
+            run,
             message,
             channel.name,
             { kind: "address", address },

package/packages/bundled-features/src/delivery/feature.ts

@@ -46,7 +46,7 @@ import {
 export type DeliveryFeatureOptions = {
   // Access gate for the delivery-log screen and the `log` query it reads —
   // both move together so the nav entry a role sees always matches a
-  // callable handler (#2033). Default access.admin includes TenantAdmin,
+  // callable handler. Default access.admin includes TenantAdmin,
   // who in a line-of-business app is the operator, not the platform — pass
   // access.systemAdmin to keep this platform-only and out of their nav.
   readonly access?: readonly string[];
@@ -99,10 +99,10 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // boot-validator accepts the projection below because at least one
     // apply-key is a registered domain-event (DELIVERY_ATTEMPT_EVENT).
     // recipientAddress is the real PII (email address); recipientId stays
-    // plaintext — pseudonymous fk, same line as config.userId (#821).
+    // plaintext — pseudonymous fk, same line as config.userId.
     // recipientId is nullable (system-triggered sends to non-users), so the
     // address falls back to the tenant key instead of the plaintext it used
-    // to be — still shreddable, one tenant wide (fw#2776).
+    // to be — still shreddable, one tenant wide.
     r.defineEvent("attempt", deliveryAttemptSchema, {
       piiFields: {
         recipientAddress: { personal: { of: "recipientId", whenAbsent: "tenant" } },

package/packages/bundled-features/src/delivery/handlers/log.query.ts

@@ -208,7 +208,7 @@ export const logQuery = definePagedQueryHandler({
     const nextCursor =
       rows.length === limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
 
-    // recipientAddress is stored encrypted under the recipient's DEK (#799)
+    // recipientAddress is stored encrypted under the recipient's DEK
     // — decrypt for the admin log view; forgotten subjects show [[erased]].
     // The notificationType/recipientAddress → type/recipient rename happens
     // here, not in the client: a projectionList screen has no entity to

package/packages/bundled-features/src/delivery/handlers/preferences.query.ts

@@ -2,6 +2,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import * as z from "zod";
+import { currentNotificationType } from "../notification-type-aliases.ts";
 import { notificationPreferencesTable } from "../tables.ts";
 
 export const preferencesQuery = defineQueryHandler({
@@ -37,6 +38,24 @@ export const preferencesQuery = defineQueryHandler({
       userId: query.user.id,
     });
 
-    return { rows };
+    // Rows stored under a former notification name are reported under the current
+    // one, collapsed with the same precedence as delivery: an exact row wins,
+    // otherwise any disabled former-name row disables.
+    const collapsed = new Map<string, { row: (typeof rows)[number]; isExact: boolean }>();
+    for (const row of rows) {
+      const notificationType = currentNotificationType(ctx.registry, row.notificationType);
+      const key = `${notificationType}\u0000${row.channel}`;
+      const isExact = row.notificationType === notificationType;
+      const existing = collapsed.get(key);
+      if (existing?.isExact) continue;
+      const formerNameRowDisablesAlready =
+        existing !== undefined &&
+        !isExact &&
+        (existing.row.enabled === false || row.enabled !== false);
+      if (formerNameRowDisablesAlready) continue;
+      collapsed.set(key, { row: { ...row, notificationType }, isExact });
+    }
+
+    return { rows: [...collapsed.values()].map((entry) => entry.row) };
   },
 });

package/packages/bundled-features/src/delivery/handlers/unsubscribe-page-chrome.query.ts

@@ -33,7 +33,7 @@ export const unsubscribePageChromeQuery = defineQueryHandler({
   // or createUnsubscribePageChromeReader for a tenant the app resolved server-side.
   agent: { expose: false },
   description:
-    "Returns the tenant's mail brand row and footer resolved for one locale, or null without a mail renderer; dispatched by the signed unsubscribe route to dress its pages like the mail, not meant for UI callers.",
+    "Returns the tenant's mail brand row and footer resolved for one locale, or null without a mail renderer; dispatched by the signed unsubscribe route or by createUnsubscribePageChromeReader for a tenant the app resolved server-side, to dress its pages like the mail; not meant for UI callers.",
   handler: async (query, ctx): Promise<MailChrome | null> => {
     const { tenantId } = query.user;
     if (!ctx.systemDb) {

package/packages/bundled-features/src/delivery/tables.ts

@@ -53,14 +53,15 @@ export const deliveryAttemptsTable = pgTable(
   (t) => [index(DELIVERY_ATTEMPTS_TENANT_CREATED_INDEX).on(t.tenantId, t.createdAt)],
 );
 
-// **Unmanaged table** — bewusst KEIN createEntity. Begründung:
-//   - id kommt aus dem Aggregate-Stream (kein gen_random_uuid()-DEFAULT)
-//   - kein version/inserted_by/modified_by/modified_at — keine in-place-
-//     Edits, keine Audit-Spalten nötig (idempotent-on-replay via PK-Konflikt)
-//   - created_at statt inserted_at — historischer Naming-Drift, kein Bug
-// App trägt Verantwortung für tenant-scoping in Queries + replay-idempotency.
-// pgTable bleibt source-of-truth für Query-API; Phase 4 leitet das pgTable
-// aus dieser Meta ab.
+// **Unmanaged table** — deliberately has no createEntity because:
+//   - id comes from the aggregate stream (no gen_random_uuid()-DEFAULT)
+//   - no version/inserted_by/modified_by/modified_at: no in-place edits or
+//     audit columns are needed (idempotent-on-replay via PK conflict)
+//   - created_at rather than inserted_at reflects historical naming drift, not
+//     a bug
+// The app is responsible for tenant scoping in queries and replay idempotency.
+// pgTable remains the source of truth for the query API; the pgTable is derived
+// from this metadata.
 export const deliveryAttemptsTableMeta: EntityTableMeta = defineUnmanagedTable({
   tableName: "store_delivery_attempts",
   indexes: [{ name: DELIVERY_ATTEMPTS_TENANT_CREATED_INDEX, columns: ["tenant_id", "created_at"] }],

package/packages/bundled-features/src/delivery/unsubscribe-link.ts

@@ -10,7 +10,9 @@ export type UnsubscribeLinkConfig = {
   readonly secret: string;
   readonly baseUrl: string;
   /** The sending tenant's own public origin (subdomain or custom domain), null when it has
-   *  none. The host must serve this app's `/api` routes. Null, a throw or an unusable value
+   *  none. The host must serve this app's `/api` routes, and the callback must only return a
+   *  verified, active domain of the tenant (the check that lets the app serve under it), else null:
+   *  the link carries a bearer token that unsubscribes and yields a resubscribe token. Null, a throw or an unusable value
    *  fall back to `baseUrl`, so a missing tenant origin never fails a send. */
   readonly tenantOrigin?: (ctx: ChannelContext) => Promise<string | null | undefined>;
 };

package/packages/bundled-features/src/delivery/unsubscribe-page-strings.ts

@@ -14,6 +14,7 @@ export const UNSUBSCRIBE_PAGE_EN = {
   "mail.unsubscribe.resubscribedMessage": "You have been subscribed again.",
   "mail.unsubscribe.failed": "That did not work. Please try again later.",
   "mail.unsubscribe.failedTitle": "Something went wrong",
+  "mail.unsubscribe.resubscribeLimitReached": "This address cannot be subscribed again here.",
   "mail.unsubscribe.invalidTitle": "Link no longer valid",
   "mail.unsubscribe.invalidMessage":
     "This link is invalid or has expired. Please use the unsubscribe link in a more recent email.",

package/packages/bundled-features/src/delivery/unsubscribe-page.ts

@@ -11,6 +11,7 @@ export type UnsubscribePageState =
   | { readonly kind: "unsubscribed"; readonly resubscribeToken?: string }
   | { readonly kind: "resubscribed" }
   | { readonly kind: "failed" }
+  | { readonly kind: "resubscribeLimitReached" }
   | { readonly kind: "invalid" };
 
 export type UnsubscribePageInput = {
@@ -162,6 +163,11 @@ ${tokenForm(DELIVERY_RESUBSCRIBE_PATH, state.resubscribeToken, mailT(lang, "mail
         title: mailT(lang, "mail.unsubscribe.failedTitle"),
         bodyHtml: paragraph("mail.unsubscribe.failed"),
       };
+    case "resubscribeLimitReached":
+      return {
+        title: mailT(lang, "mail.unsubscribe.failedTitle"),
+        bodyHtml: paragraph("mail.unsubscribe.resubscribeLimitReached"),
+      };
     case "invalid":
       return {
         title: mailT(lang, "mail.unsubscribe.invalidTitle"),

package/packages/bundled-features/src/delivery/unsubscribe.ts

@@ -31,13 +31,13 @@ const localeClaimSchema = z
   .regex(/^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{1,8})*$/)
   .optional();
 
-// Shape des verified-JWT-payloads. tenantId kommt als string aus jose und
-// wird NACH erfolgreichem parse() zur Branded TenantId — kein blind-cast.
+// Shape of verified JWT payloads. `tenantId` arrives from jose as a string and
+// becomes a branded `TenantId` only after successful `parse()`—never via a blind cast.
 //
 // `kind` is explicitly typed as "absent or undefined, nothing else" here
 // (not bare `.optional()`, which would also accept any other value on an
-// unrelated key) so an address-token payload — which always carries
-// `kind: "address"` — fails this schema instead of silently parsing with
+// unrelated key) so an address-token payload—which always carries
+// `kind: "address"`—fails this schema instead of silently parsing with
 // `addressHash` mistaken for a userId.
 const unsubscribeJwtPayloadSchema = z.object({
   kind: z.undefined().optional(),
@@ -569,11 +569,20 @@ async function verifyPost(
   encodedSecret: Uint8Array,
   purpose: TokenPurpose,
 ): Promise<VerifiedUnsubscribe | RejectedForPage> {
-  return isFormRequest(request.headers["content-type"])
+  return isFormRequest(request.headers["content-type"]) && !isOneClickPost(request)
     ? verifyForPage(token, encodedSecret, purpose, request.headers)
     : verifyUnsubscribeToken(token, encodedSecret, purpose);
 }
 
+// RFC 8058 mail-provider POSTs are form-encoded too, but nobody looks at the answer: they keep
+// the JSON rejection and get no branded page.
+function isOneClickPost(request: SignatureExtraRouteVerifyRequest): boolean {
+  return (
+    isFormRequest(request.headers["content-type"]) &&
+    request.rawBody.trim() === DELIVERY_UNSUBSCRIBE_ONE_CLICK_HEADER_VALUE
+  );
+}
+
 function isFormRequest(contentType: string | undefined): boolean {
   return contentType?.includes("application/x-www-form-urlencoded") === true;
 }
@@ -635,22 +644,37 @@ export function createUnsubscribeRoutes(
         : pageResponse(c, deps, { kind: "confirm", token: verified.token }, verified, 200),
   });
 
-  const writeRoute = signatureRoute<VerifiedUnsubscribe | RejectedForPage>({
+  const writeRoute = signatureRoute<
+    (VerifiedUnsubscribe & { readonly oneClick: boolean }) | RejectedForPage
+  >({
     method: "POST",
     path: DELIVERY_UNSUBSCRIBE_PATH,
     entry: "signature",
-    verify: async (request) =>
-      verifyPost(request, tokenFromPostRequest(request), encodedSecret, "unsubscribe"),
+    verify: async (request) => {
+      const verified = await verifyPost(
+        request,
+        tokenFromPostRequest(request),
+        encodedSecret,
+        "unsubscribe",
+      );
+      return verified.kind === "rejected"
+        ? verified
+        : { ...verified, oneClick: isOneClickPost(request) };
+    },
     handler: async (c, verified, deps) => {
       if (verified.kind === "rejected") {
         return pageResponse(c, deps, { kind: "invalid" }, verified, 400);
       }
+      // No chrome lookup for a one-click client: it never renders the page.
+      const pageScope: PageScope = verified.oneClick
+        ? { tenantId: undefined, locale: verified.locale }
+        : verified;
       // Token-verify passed — everything below is a legitimate write. Don't
       // swallow write-errors as "invalid token", that would mask real bugs
       // (e.g. events-table missing, DB down) behind a misleading 400.
       const succeeded = await dispatchUnsubscribeWrite(verified, deps);
       if (!succeeded) {
-        return pageResponse(c, deps, { kind: "failed" }, verified, 500);
+        return pageResponse(c, deps, { kind: "failed" }, pageScope, 500);
       }
       return pageResponse(
         c,
@@ -659,7 +683,7 @@ export function createUnsubscribeRoutes(
           kind: "unsubscribed",
           resubscribeToken: await signResubscribeToken(verified, encodedSecret),
         },
-        verified,
+        pageScope,
         200,
       );
     },
@@ -681,15 +705,12 @@ export function createUnsubscribeRoutes(
       const outcome = await dispatchResubscribeWrite(verified, deps);
       // The undo button on the unsubscribed page posts a form; a browser should land on a page.
       if (isFormRequest(c.req.header("content-type"))) {
-        return outcome === "success"
-          ? pageResponse(c, deps, { kind: "resubscribed" }, verified, 200)
-          : pageResponse(
-              c,
-              deps,
-              { kind: "failed" },
-              verified,
-              outcome === "limit_reached" ? 409 : 500,
-            );
+        if (outcome === "success") {
+          return pageResponse(c, deps, { kind: "resubscribed" }, verified, 200);
+        }
+        return outcome === "limit_reached"
+          ? pageResponse(c, deps, { kind: "resubscribeLimitReached" }, verified, 409)
+          : pageResponse(c, deps, { kind: "failed" }, verified, 500);
       }
       if (outcome === "limit_reached") {
         return c.json(

package/packages/bundled-features/src/delivery/upsert-preference.ts

@@ -28,10 +28,9 @@ const executor = createEventStoreExecutor(
   { entityName: "notification-preference" },
 );
 
-// Konkretes Lookup-Result-Shape — nur die Felder die der upsert
-// tatsächlich für den Update-Path braucht. Vermeidet `row["x"] as T` index-
-// access casts; der Generic-Param am fetchOne macht den Cast zentralisiert
-// im Helper (db-row-boundary), nicht 4× pro Callsite.
+// Concrete lookup result shape containing only the fields needed by the upsert update path. Avoids
+// `row["x"] as T` index-access casts; the generic parameter on fetchOne centralizes the cast in the
+// helper (`db-row-boundary`) instead of repeating it at each call site.
 type PreferenceLookupRow = {
   readonly id: string;
   readonly version: number;

package/packages/bundled-features/src/document-ingest-foundation/entity.ts

@@ -6,7 +6,7 @@ import {
   createTextField,
 } from "@cosmicdrift/kumiko-framework/engine";
 
-// Phase-1 (MVP) page shape — LiteParse fills this in (kumiko-enterprise#273).
+// (MVP) page shape — LiteParse fills this in.
 // Kept minimal on purpose: downstream themes (provider, recipe) extend it.
 // Stored as JSON.stringify(IngestPage[]) in the encrypted `pages` column —
 // jsonb has no encryption support in the engine, and this column holds the
@@ -29,7 +29,7 @@ export type DocumentExtractMeta = {
 
 // documentExtract — implicit entity-projection (r.entity, NOT r.projection):
 // an explicit r.projection would make `forget` non-rebuild-safe and require
-// archiveStream instead of the regular forget path (kumiko-framework#1495).
+// archiveStream instead of the regular forget path.
 // fileRefId points at the source file_refs row; storageKey duplicates it for
 // direct provider access without a join.
 export const documentExtractEntity = createEntity({
@@ -42,11 +42,11 @@ export const documentExtractEntity = createEntity({
       reason: "technical_reference",
     }),
     // Holds the full extracted document text (PII). `personal: "tenant"`,
-    // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
+    // NOT `encrypted: true`: the master-key path has no erasure subject,
     // so nothing here would ever be shreddable. Tenant-subject ciphertext
-    // dies with eraseSubjectKeys on tenant-destroy (#800 pattern). Whose
+    // dies with eraseSubjectKeys on tenant-destroy. Whose
     // subject a third party named inside a document is stays open, same as
-    // inbound-mail-foundation (#957). meta is provider telemetry only and
+    // inbound-mail-foundation. meta is provider telemetry only and
     // stays plaintext jsonb.
     pages: createLongTextField({
       personal: "tenant",

package/packages/bundled-features/src/document-ingest-foundation/events.ts

@@ -4,8 +4,8 @@ import * as z from "zod";
 // stream per fileRef with aggregateId derived from the fileRefId
 // (documentIngestAggregateId), never the fileRefId itself: foreign events on
 // the fileRef stream would break the fileRef's optimistic lock. Not backed by an r.entity;
-// this is a pure saga-anchor event (kumiko-framework#1497) that the Phase-2
-// worker job (kumiko-enterprise LiteParse provider) subscribes to.
+// this is a pure saga-anchor event that the worker job (kumiko-enterprise LiteParse provider)
+// subscribes to.
 export const DOCUMENT_INGEST_AGGREGATE_TYPE = "document-ingest";
 
 // Stream name of stored extract events; differs from the camelCase r.entity name

package/packages/bundled-features/src/document-ingest-foundation/feature.ts

@@ -166,7 +166,7 @@ export function createDocumentIngestFoundationFeature() {
           default: "deu+eng",
           // Tesseract -l argument syntax: one or more 3-letter language codes
           // joined by "+" (e.g. "deu+eng"). Unconstrained free text here would
-          // reach the OCR provider call unvalidated (#1501).
+          // reach the OCR provider call unvalidated.
           pattern: { regex: "^[a-z]{3}(\\+[a-z]{3})*$" },
           write: access.roles("TenantAdmin", "SystemAdmin"),
           read: access.roles("TenantAdmin", "SystemAdmin", "User"),
@@ -178,7 +178,7 @@ export function createDocumentIngestFoundationFeature() {
           default: 50,
           // Without a bound a tenant could set 0 (silently kills ingest) or an
           // unbounded value (OCR worker runs per-file for as long as the PDF
-          // has pages — job-queue starvation) (#1501).
+          // has pages — job-queue starvation).
           bounds: { min: 1, max: 500 },
           write: access.roles("TenantAdmin", "SystemAdmin"),
           read: access.roles("TenantAdmin", "SystemAdmin", "User"),

package/packages/bundled-features/src/document-ingest-foundation/pages.ts

@@ -2,7 +2,7 @@
 // longText (jsonb has no encryption support), so writers must persist
 // JSON.stringify(IngestPage[]) and readers must parse back. Centralising
 // the codec here keeps liteparse + recipe consumers lockstep with the
-// entity shape (kumiko-framework#1549/1).
+// entity shape.
 
 import { isPlainObject } from "@cosmicdrift/kumiko-types/type-guards";
 import type { IngestPage } from "./entity.ts";

package/packages/bundled-features/src/document-ingest-foundation/tenant-destroy-hook.ts

@@ -1,4 +1,4 @@
-// Tenant-destroy hook for the documentExtract entity-projection (#1621).
+// Tenant-destroy hook for the documentExtract entity-projection.
 //
 // Per-row forget() through the executor, not a bulk deleteMany: documentExtract
 // is an ES-managed implicit projection, so a store-table write here would be
@@ -6,9 +6,9 @@
 // resurrect every row this hook removed. forget() (Art. 17 hard-purge) is
 // replayed by the implicit projection itself, which keeps the erasure
 // rebuild-safe — the same reasoning as tenant-lifecycle's membership stage,
-// and the reason the feature owns an r.entity instead of an r.projection
-// (kumiko-framework#1495). The `pages` ciphertext dies separately when the
-// pipeline's later `subject-keys` stage erases the tenant subject key.
+// and the reason the feature owns an r.entity instead of an r.projection.
+// The `pages` ciphertext dies separately when the pipeline's later
+// `subject-keys` stage erases the tenant subject key.
 
 import { createSystemUser, type TenantDataDestroyHook } from "@cosmicdrift/kumiko-framework/engine";
 import { documentExtractsTable } from "./entity.ts";

package/packages/bundled-features/src/feature-toggles/compose-tier-resolver.ts

@@ -66,7 +66,7 @@ export function composeTierResolverWithGlobalToggles(
       // Non-toggleable (always-on) names must keep reaching `result` through the
       // globalCascade loop below even if this resolver's SYSTEM_TENANT_ID answer
       // satisfies the emptiness guard above without also merging always-on into
-      // every per-tenant tierSet (framework#1528).
+      // every per-tenant tierSet.
       tierManaged = new Set(
         [...managed].filter((name) => {
           const feature = registry.getFeature(name);

package/packages/bundled-features/src/feature-toggles/feature.ts

@@ -104,7 +104,7 @@ export function createFeatureTogglesFeature(
     r.translations({ keys: FEATURE_TOGGLES_I18N });
 
     // toggle-cache-sync — multi-instance snapshot propagation. One shared
-    // cursor reads every toggle-set event once (fw#2625); the winning
+    // cursor reads every toggle-set event once; the winning
     // process's handler calls runtime.broadcastToggle, which publishes on
     // GlobalFeatureToggleRuntime's syncSignal so every process (including
     // the one that won the cursor) applies the flip to its own snapshot —

package/packages/bundled-features/src/feature-toggles/global-feature-state-table.ts

@@ -38,7 +38,7 @@ export const globalFeatureStateTable: WritableSchemaTable & TenancyBrand<"global
 // sees the table, so `kumiko schema generate` reports no changes and no
 // app ever gets a migration for it (framework gap, not app-local). Derived
 // from the pgTable above instead of hand-written a second time — the two
-// used to drift independently (framework#1529): a column added only to
+// used to drift independently: a column added only to
 // the pgTable made queries type-check while the migration generator stayed
 // blind to it, failing in prod with "column ... does not exist" while every
 // mocked-stack test stayed green.

package/packages/bundled-features/src/feature-toggles/handlers/registered.query.ts

@@ -38,11 +38,11 @@ export const registeredQuery = defineQueryHandler({
     const overrideRows = await db.global(globalFeatureStateTable).selectMany<OverrideRow>();
     const overrides = new Map(overrideRows.map((r) => [r.featureName, r.enabled]));
 
-    // SystemAdmin operator-tooling: das listing soll die PLATTFORM-truth
-    // zeigen (alle features im Registry), nicht den eigenen tier-cut.
-    // Sprint-8a per-tenant signature → wir rufen mit SYSTEM_TENANT_ID,
-    // App-resolver returnt union-of-all-tier-features. Sentinel-Convention
-    // dokumentiert in DispatcherOptions.effectiveFeatures.
+    // SystemAdmin operator tooling: the listing must show platform truth
+    // (all features in the registry), not its own tier cut.
+    // The per-tenant signature requires SYSTEM_TENANT_ID; the app resolver
+    // returns the union of all tier features. The sentinel convention is
+    // documented in DispatcherOptions.effectiveFeatures.
     const effective = ctx.effectiveFeatures?.(SYSTEM_TENANT_ID);
 
     const rows: Array<{

package/packages/bundled-features/src/feature-toggles/toggle-runtime.ts

@@ -16,7 +16,7 @@ import { createCacheSyncToggleSignal } from "./toggle-sync-signal.ts";
 
 const log = createFallbackLogger("kumiko:feature-toggles");
 
-// Cross-replica transport for a toggle flip (fw#2625). Deliberately narrow
+// Cross-replica transport for a toggle flip. Deliberately narrow
 // (featureName + enabled, not a generic channel/payload pair) so a caller
 // can't wire the wrong signal instance in by accident — see
 // createRedisToggleSyncSignal (toggle-sync-signal.ts) for the Redis-backed

package/packages/bundled-features/src/feature-toggles/toggle-sync-signal.ts

@@ -27,7 +27,7 @@ function isTogglePayload(value: unknown): value is { featureName: string; enable
   );
 }
 
-// fw#2625: gives toggle-cache-sync the cross-replica transport its shared
+// Gives toggle-cache-sync the cross-replica transport its shared
 // dispatcher cursor needs — without this, only the one process that won
 // the shared cursor's toggle-set event would ever learn about a flip.
 // Standalone Redis transport for callers that want their own connections;

package/packages/bundled-features/src/feature-toggles/web/constants.ts

@@ -11,7 +11,7 @@ export const FEATURE_TOGGLE_AGGREGATE_TYPE = "feature-toggles";
 
 // Shared acknowledgeCrossTenant() reason across all three handlers that read
 // or write globalFeatureStateTable — one string so the three call sites
-// can't drift (framework#2076).
+// can't drift.
 export const FEATURE_TOGGLE_CROSS_TENANT_REASON =
   "global feature-toggle state, no tenant scope by design";
 

package/packages/bundled-features/src/file-derivatives/feature.ts

@@ -35,13 +35,13 @@ const FEATURE_NAME = "file-derivatives";
 // charset constraint (`Readonly<Record<string, VariantSpec>>`), so this
 // stays permissive rather than guessing a convention — narrower than this
 // would silently 404 a legitimately declared name again. Do not reintroduce
-// a name list here "for safety" — see #1985.
+// a name list here "for safety".
 const VARIANT_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 
 /** Host → tenantId for the anonymous media route.
  *  MUST be cheap/synchronous (in-memory map or cached lookup): it runs
  *  *before* the query-handler rate limit, so a DB round-trip here is an
- *  unthrottled DoS surface for anonymous callers rotating Host headers (#1977). */
+ *  unthrottled DoS surface for anonymous callers rotating Host headers. */
 export type PublicVariantResolveApexTenant = (
   host: string,
 ) => Promise<TenantId | null> | TenantId | null;