@cosmicdrift/kumiko-samples 0.386.0 → 0.388.0

package/packages/bundled-features/src/jobs/job-run-logger.ts

@@ -41,9 +41,9 @@ import { tenantJobRunsTable } from "./tenant-job-run-table.ts";
 // every connection in the pool.
 const KMS_POOL_CONCURRENCY = 4;
 
-// Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
+// Direct-write job-run log: onJobStart/-Complete/-Failed write
 // straight into jobRunsTable / jobRunLogsTable instead of appending to the
-// event store and replaying through inline projections. Pre-#2243 every run
+// event store and replaying through inline projections. Before this change every run
 // left two permanent `kumiko_events` rows that nothing else ever replayed
 // or MSP-subscribed to — in two production apps that was ~99% of all
 // events. Same tables, same shape, no event stream in between.
@@ -76,7 +76,7 @@ const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
 // Run rows hang on SYSTEM_TENANT_ID and a null trigger is a cron/system run;
 // job-run-table.ts declares whenAbsent: "tenant" for exactly that case, so the
-// logger must resolve the same subject the entity chain would (fw#3654).
+// logger must resolve the same subject the entity chain would.
 function jobRunSubject(triggeredById: string | null): SubjectId {
   return triggeredById === null
     ? { kind: "tenant", tenantId: SYSTEM_TENANT_ID }
@@ -112,12 +112,12 @@ async function encryptOrSentinel(
 }
 
 // Same per-subject encryption as encryptStartedPayload, applied to each
-// batched log line's `message` (#2247) before insertMany into
+// batched log line's `message` before insertMany into
 // jobRunLogsTable — that table is unmanaged/direct-write, so there is no
 // event-piiFields catalog to lean on here either. "message" is the AAD
 // field name and must match the field passed to decryptStoredPii on read
 // (detail.query.ts) or decrypt fails loud. Same skip rule as the payload:
-// absent KMS (rollout mode) stays plaintext. Bounded concurrency (#2307) —
+// absent KMS (rollout mode) stays plaintext. Bounded concurrency —
 // unbounded Promise.all would fire one getOrCreateDek per log line at once
 // against the KMS adapter's pool.
 async function encryptLogMessages<T extends { readonly message: string }>(
@@ -133,7 +133,7 @@ async function encryptLogMessages<T extends { readonly message: string }>(
   }));
 }
 
-// Mirrors encryptFailureError for the failure-path `error` column (#2307):
+// Mirrors encryptFailureError for the failure-path `error` column:
 // stored alongside logs[].message under the same triggering user's DEK, so
 // a log/error pair from the same failed run decrypt together or erase
 // together. Exported so stale-run-sweep.ts's crash-recovery write (a
@@ -149,12 +149,12 @@ export async function encryptFailureError(
 }
 
 // The run-started payload can carry arbitrary user data; triggeredById
-// names its owning user. No event-PII catalog involved (#2243 removed the
-// jobRun r.defineEvent registrations, so there is nothing to catalog) —
-// the subject is known statically, so we encrypt directly. A null subject
+// names its owning user. No event-PII catalog involved (the
+// jobRun r.defineEvent registrations were removed, so there is nothing to
+// catalog) — the subject is known statically, so we encrypt directly. A null subject
 // (system cron runs, recipient-less triggers) encrypts under the system
 // tenant key. Absent KMS adapter stays plaintext (rollout mode, unchanged).
-// A key already erased by the time the trigger lands (#2307) must not fail
+// A key already erased by the time the trigger lands must not fail
 // the whole run-start write — sentinel like the log/error paths.
 async function encryptStartedPayload(
   payload: string | null,
@@ -173,13 +173,12 @@ const TENANT_JOB_FAILURE_LOCK_NAMESPACE = 0x746a666c;
 const TENANT_JOB_RUN_LOCK_NAMESPACE = 0x746a726c;
 const TENANT_RUN_CONFLICT_KEYS = ["tenantId", "jobName", "bullJobId"] as const;
 
-// fw#3079 — which row the tenant-visible failure record lives in: one per
+// Which row the tenant-visible failure record lives in: one per
 // (tenant, job, subject), so the next outcome of the same work replaces or
 // clears it. `subject` is null for a job that declares no subjectFields.
 // Null target = nothing to write or clear: the job did not opt in, the run
 // was tenant-less (cron resolves to SYSTEM_TENANT_ID, where no tenant-scoped
-// query could ever read the row), or the caller predates fw#3079 and passes
-// no outcome at all.
+// query could ever read the row), or the caller passes no outcome at all.
 function tenantJobFailureTarget(
   jobName: string,
   outcome: JobOutcomeMeta | undefined,
@@ -229,7 +228,7 @@ async function clearTenantJobFailure(
   await deleteMany(db, tenantJobFailuresTable, where);
 }
 
-// fw#3616 — tenant-visible run state. One row per BullMQ job in
+// Tenant-visible run state. One row per BullMQ job in
 // store_tenant_job_runs, addressed by (tenant, job name, bullJobId): BullMQ
 // ids are only unique per queue (api and worker lane both count from 1) and
 // restart after a Redis reset, so the id alone must never pick a row. The
@@ -263,15 +262,16 @@ async function recordTenantRunQueued(
   const now = Temporal.Now.instant();
   await transaction(db, async (tx) => {
     // A finished row under the same id is left over from before a Redis reset
-    // (ids restart at 1), not this job. Only rows that went through this hook
-    // (queuedAt set) qualify: a fast worker can finish before the hook runs,
-    // and that row is this job's own and must stay.
+    // (ids restart at 1), not this job. Only rows queued before this BullMQ job
+    // was created qualify: a fast worker can finish before the hook runs (no
+    // queuedAt), and a deduplicated add of an already finished job re-announces
+    // it with a creation time older than its own row. Both rows must stay.
     await deleteMany(tx, tenantJobRunsTable, {
       tenantId: key.tenantId,
       jobName,
       bullJobId,
       status: { in: ["completed", "failed"] },
-      queuedAt: { gt: Temporal.Instant.fromEpochMilliseconds(0) },
+      queuedAt: { lt: Temporal.Instant.fromEpochMilliseconds(meta.jobCreatedAtMs) },
     });
     // DO NOTHING: a fast worker can report the start before this enqueue hook
     // returns, and a repeated jobId (debounce, fan-out dedup) is the same job.
@@ -445,7 +445,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
   // Bounded cache (LRU-ish with TTL) — worker-crash between start and
   // complete would otherwise leak entries. DB-lookup recovers evicted
   // entries via bull_job_id on jobRunsTable.
-  // triggeredById rides along with runId (#2247) — resolved once at start
+  // triggeredById rides along with runId — resolved once at start
   // (or on cache-miss DB fallback) so onJobComplete/-Failed know the log
   // subject without an extra always-on DB round trip.
   type CacheEntry = {

package/packages/bundled-features/src/jobs/job-run-table.ts

@@ -18,10 +18,10 @@ import {
 export type JobRunStatus = "queued" | "running" | "completed" | "failed";
 export type JobLogLevel = "info" | "warn" | "error";
 
-// jobRun is a system-scoped direct-write store (#2243): every job execution
+// jobRun is a system-scoped direct-write store: every job execution
 // writes straight into jobRunsTable / jobRunLogsTable from the BullMQ
 // callbacks (onJobStart / -Complete / -Failed, see job-run-logger.ts) —
-// no event-store detour. Pre-#2243 this was an events-only aggregate
+// no event-store detour. Previously this was an events-only aggregate
 // replayed through two inline projections; that generated two permanent
 // `kumiko_events` rows per run for data that is itself already the
 // system of record (no other consumer replays or MSP-subscribes to it).
@@ -38,7 +38,7 @@ export type JobLogLevel = "info" | "warn" | "error";
 // app boundary (same pattern as template-resolver kind/scope).
 // `table: "store_job_runs"` (not `read_*`) because this is no longer a
 // rebuildable projection — `defineUnmanagedTable`/`deriveEntityTableMeta`
-// reject the `read_` prefix for `source: "unmanaged"` (#1208/#1220).
+// reject the `read_` prefix for `source: "unmanaged"`.
 export const jobRunEntity = createEntity({
   table: "store_job_runs",
   fields: {

package/packages/bundled-features/src/jobs/screens.ts

@@ -111,7 +111,7 @@ export const jobRunDetailScreen: ProjectionDetailScreenDefinition = {
           "error",
         ],
       },
-      // No section `title` here (fw#2312 label-dedup fix): the section
+      // No section `title` here (label-dedup fix): the section
       // holds exactly one field, so a title would repeat the field's own
       // label (rendered by RenderField as the Field's heading) verbatim.
       {

package/packages/bundled-features/src/jobs/tenant-job-failure-table.ts

@@ -11,7 +11,7 @@ import {
   uuid,
 } from "@cosmicdrift/kumiko-framework/db";
 
-// The tenant's own view of a failed job (fw#3079). Direct-write store like
+// The tenant's own view of a failed job. Direct-write store like
 // store_job_runs: job-run-logger.ts writes it from the BullMQ callbacks,
 // outside any dispatcher transaction.
 //

package/packages/bundled-features/src/jobs/tenant-job-run-table.ts

@@ -13,7 +13,7 @@ import {
 
 export type TenantJobRunStatus = "queued" | "running" | "completed" | "failed";
 
-// The tenant's own view of a job's run state (fw#3616). Direct-write store
+// The tenant's own view of a job's run state. Direct-write store
 // like store_job_runs, written by job-run-logger.ts from the runner callbacks.
 //
 // store_job_runs cannot serve the tenant: it anchors every run on the system

package/packages/bundled-features/src/ledger/entity.ts

@@ -13,7 +13,7 @@ import { ACCOUNT_TYPES, SCHEDULE_INTERVALS, TRANSACTION_STATUS } from "./web/con
 // detail via the standard handlers); the framework projects `read_ledger_accounts`
 // from its CRUD events. `parentId` null → root account; otherwise the chart-of-
 // accounts tree. `type` drives how the report layer interprets a balance. No
-// money column — balances are DERIVED from postings (Phase 1), never stored.
+// money column — balances are DERIVED from postings, never stored.
 // tenantId is a base column set by the framework → each tenant has its own books.
 export const accountEntity = createEntity({
   table: "read_ledger_accounts",
@@ -49,13 +49,13 @@ export const accountEntity = createEntity({
 // transaction — a journal entry. The balanced posting lines live embedded as
 // `lines` (embedded list: { accountId, amount }[], Σ amount = 0), so an entry is atomic:
 // the Σ=0 invariant holds within a single command, no cross-row write. The
-// framework projects `read_ledger_transactions`; Phase 1 adds a flat
-// `read_ledger_postings` projection (one row per line) for per-account/period
+// framework projects `read_ledger_transactions`; a flat
+// `read_ledger_postings` projection (one row per line) supports per-account/period
 // report queries.
 //
 // IMMUTABLE: the feature registers NO update/delete handler for transaction. A
-// posted entry is a fact; corrections are reverse-transaction (Storno) entries.
-// `status` carries draft|posted for the later Soll/Ist work — Phase 0 posts only.
+// posted entry is a fact; corrections are reverse-transaction entries.
+// `status` carries draft|posted.
 export const transactionEntity = createEntity({
   table: "read_ledger_transactions",
   description:

package/packages/bundled-features/src/ledger/feature.ts

@@ -7,8 +7,8 @@
 //      corrections are reverse-transaction (Storno) entries.
 //
 // Everything financial — banking, accounting, rent cashflow, credits, invoices —
-// is accounts + balanced transactions on top. Balances and reports (Bilanz, GuV,
-// Cashflow) are pure queries over the postings (Phase 1), never stored state.
+// is accounts + balanced transactions on top. Balances and reports (balance
+// sheet, P&L, cashflow) are pure queries over the postings, never stored state.
 //
 // Spec: kumiko-platform/docs/plans/ledger-feature.md
 
@@ -60,7 +60,7 @@ function registerLedger(
 
   // Chart of accounts — plain CRUD, no custom logic. No delete in v1: removing an
   // account that has postings would orphan them; a posting-aware guard lands with
-  // the postings projection (Phase 1).
+  // the postings projection.
   r.writeHandler(
     defineEntityCreateHandler("account", accountEntity, {
       access,

package/packages/bundled-features/src/ledger/handlers/confirm-schedule-period.write.ts

@@ -27,11 +27,11 @@ const CONFIRM_PERIOD_LOCK_NAMESPACE = 0x6c637370;
 // balanced transaction (debit +amount / credit −amount), tagged with
 // scheduleReference(scheduleId, period) so the host can merge Soll vs. Ist.
 //
-// Idempotent + reversal-aware: if an ACTIVE (non-reversed) booking for this
+// Idempotent and reversal-aware: if an ACTIVE (non-reversed) booking for this
 // reference already exists, it's a no-op; a booking that was reversed (Storno)
 // leaves the period re-confirmable. Referential integrity (both accounts must
-// exist) mirrors create-transaction — a schedule could name a bogus account, the
-// generic CRUD create doesn't check.
+// exist) mirrors create-transaction because a schedule could name a bogus
+// account that the generic CRUD create does not check.
 export function createConfirmSchedulePeriodHandler(
   access: AccessRule = DEFAULT_LEDGER_ACCESS,
 ): WriteHandlerDef {

package/packages/bundled-features/src/ledger/recurring.ts

@@ -1,17 +1,17 @@
 // Recurring schedules on top of the ledger primitive. A `schedule` is a standing
-// booking template ("Miete ab 1.1.2026, 500 €/Monat") from which two things fall
-// out WITHOUT booking every month up front:
+// booking template ("Rent from 1/1/2026, €500/month") used without booking every
+// month up front:
 //
-//   • projectSchedule()      — the Soll (forecast): pure projection over a window,
-//                              no transactions needed (chart, "trägt sich das?").
-//   • mergeScheduleActuals() — Soll vs. Ist: the projection left-joined against
-//                              the posted confirmations (per `reference`), so each
-//                              month is posted | open | forecast.
+//   • projectSchedule()      — the forecast: a pure projection over a window with
+//                              no transactions required (chart, "does it pay for itself?").
+//   • mergeScheduleActuals() — forecast vs. actual: the projection left-joined
+//                              against posted confirmations (by `reference`), so
+//                              each month is posted | open | forecast.
 //
-// confirm-schedule-period (handler) turns one projected month into ONE balanced
+// The confirm-schedule-period handler turns one projected month into one balanced
 // transaction tagged with `scheduleReference(id, period)`. Both functions here are
-// pure — no DB, no Date API (windows/asOf come in as params) — so the no-date-api
-// guard stays green and the forecast is deterministic.
+// pure—no DB or Date API (windows/asOf are supplied as parameters)—so the forecast
+// remains deterministic and the no-date-api guard stays green.
 
 import type { Posting } from "./schemas.ts";
 import type { ScheduleInterval } from "./web/constants.ts";
@@ -109,8 +109,8 @@ export function projectSchedule(
   return periods;
 }
 
-// Soll vs. Ist. A month is `posted` when a confirmation for its reference exists
-// AND has not been reversed (Storno); a reversed confirmation drops the month back
+// Planned vs. actual. A month is `posted` when a confirmation for its reference exists
+// AND has not been reversed; a reversed confirmation drops the month back
 // to `open` so it can be re-confirmed. Past/current unbooked months are `open`,
 // future ones `forecast` (asOf is the boundary — month-granular).
 export function mergeScheduleActuals(

package/packages/bundled-features/src/ledger/schemas.ts

@@ -24,7 +24,7 @@ export const createTransactionPayloadSchema = z
     description: z.string().min(1).max(200),
     reference: z.string().max(120).optional(),
     // Defaults to "posted" in the handler. draft lifecycle (editable) lands with
-    // the Soll/recurring work — Phase 0 only ever creates posted entries.
+    // the debit/recurring work — only ever creates posted entries.
     status: z.enum(TRANSACTION_STATUS).optional(),
     lines: z.array(postingSchema).min(2),
     // Business-object reference (e.g. a lease contract) this entry is about.

package/packages/bundled-features/src/ledger/web/constants.ts

@@ -30,7 +30,7 @@ export const LedgerQueries = {
   transactionDetail: "ledger:query:transaction:detail",
   scheduleList: "ledger:query:schedule:list",
   scheduleDetail: "ledger:query:schedule:detail",
-  // Reports — pure aggregations over the posted entries (Phase 1).
+  // Reports — pure aggregations over the posted entries.
   reportBalances: "ledger:query:report:balances",
   reportIncomeStatement: "ledger:query:report:income-statement",
   reportBalanceSheet: "ledger:query:report:balance-sheet",
@@ -38,7 +38,7 @@ export const LedgerQueries = {
 
 // Account types double-entry needs to interpret a balance: asset/expense are
 // debit-normal, liability/equity/income are credit-normal. The report layer
-// (Phase 1) flips signs by type; the primitive only stores them.
+// flips signs by type; the primitive only stores them.
 export const ACCOUNT_TYPES = ["asset", "liability", "equity", "income", "expense"] as const;
 export type AccountType = (typeof ACCOUNT_TYPES)[number];
 

package/packages/bundled-features/src/ledger/web/index.ts

@@ -1,10 +1,10 @@
-// Client-safe ledger surface: QN constants, the pure recurring helpers
-// (projection + Soll/Ist merge), and the Zod payload schemas (for client-side
-// pre-validation before dispatch) — nothing else. The full `../ledger` entry
-// re-exports the feature/handlers/executor, which pull postgres-js — a
-// browser bundle that imports from there fails on Node builtins. A client screen
-// (e.g. a rent-cashflow view) imports the dispatch QNs + the pure forecast/merge
-// from HERE, then dispatches via the renderer's useDispatcher.
+// Client-safe ledger surface: QN constants, pure recurring helpers
+// (projection + Soll/Ist merge), and Zod payload schemas for client-side
+// pre-validation before dispatch. The full `../ledger` entry also re-exports
+// the feature/handlers/executor, which pull postgres-js; importing it in a
+// browser bundle fails on Node builtins. Client screens import dispatch QNs and
+// pure forecast/merge helpers from this module, then dispatch via the renderer's
+// useDispatcher.
 
 export {
   type LedgerTxRow,

package/packages/bundled-features/src/legal-pages/README.md

@@ -35,7 +35,7 @@ runProdApp({
   //      decoupling — legal-pages imports no code from template-resolver,
   //      only uses the API via ctx)
   anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
-  extraContext: ({ db }) => ({
+  extraContext: ({ db, registry }) => ({
     templateResolver: createTemplateResolverApi(db, registry),
   }),
 });

package/packages/bundled-features/src/legal-pages/feature.ts

@@ -24,13 +24,12 @@ import {
 
 export { type LegalPagesBootCheckCtx, runLegalPagesBootCheck } from "./lib/boot-check.ts";
 
-// QN-Konstante als dokumentierter Public-Contract des template-resolver-
-// Features. Ein magic-string statt eines Code-Imports ist hier explizit
-// gewollt: Cross-Feature-Calls gehen nur über stable Public-API
-// (handler-name + payload-shape), nicht über interne Module-Refs. Wenn
-// template-resolver's Handler-Name sich ändert, ist das ein semver-major
-// und muss in beiden Features synchronisiert werden — gleiches Risiko
-// wie bei jedem API-Endpunkt.
+// QN constant as the documented public contract of the template-resolver
+// feature. A magic string is intentional instead of a code import: cross-feature
+// calls use only the stable public API (handler name + payload shape), not
+// internal module references. If template-resolver's handler name changes, it is
+// a semver-major change and must be synchronized in both features—the same risk
+// as with any API endpoint.
 const TEXT_BLOCK_BY_SLUG_QN = "template-resolver:query:by-slug";
 
 // Return shape of bySlugQuery (template-resolver/handlers/by-slug.query.ts).
@@ -53,25 +52,25 @@ const PUBLIC_PAGE_CACHE = { kind: "revalidate", maxAgeSeconds: 60 } as const;
 // additional pages (e.g. terms/AGB).
 //
 // Cross-Feature-Decoupling:
-//   • Routes nutzen app.fetch zu "/api/query" mit dem QN-string
-//     `template-resolver:query:by-slug` — kein Code-Import von template-resolver
-//   • Boot-Check nutzt ctx.templateResolver (über extraContext) — symmetrisch
-//     zum config/tenant-Pattern
-//   • Single Type-Import (TemplateResolverApi) bleibt — type-only verstößt
-//     nicht gegen Cross-Feature-Coupling
+//   • Routes use app.fetch to "/api/query" with the QN string
+//     `template-resolver:query:by-slug`—no code import from template-resolver
+//   • The boot check uses ctx.templateResolver (via extraContext), symmetrically
+//     with the config/tenant pattern
+//   • The single type import (TemplateResolverApi) remains; type-only imports do
+//     not violate cross-feature coupling
 //
-// Voraussetzungen für Production:
-//   • App-Bootstrap muss extraContext: { templateResolver: createTemplateResolverApi(db, registry) }
-//     setzen — sonst wirft Boot-Check beim Start
-//   • anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID } — sonst
-//     antworten die Routes mit 503
+// Production requirements:
+//   • App bootstrap must set extraContext: { templateResolver: createTemplateResolverApi(db,
+//     registry) } —otherwise the boot check throws at startup
+//   • anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID }—otherwise
+//     the routes respond with 503
 export type LegalPagesWrapLayout = PublicPageWrapLayout;
 
 export type LegalPagesOptions = {
-  /** Custom Layout-Wrapper für die /legal/*-Routes. Default: minimaler
-   *  HTML-Skeleton aus markdown.ts (`wrapInLayout`). Apps die ihr eigenes
-   *  Marketing-Layout (Header/Footer/Theme) auch um Legal-Body legen
-   *  wollen, übergeben hier ihre Render-Function. */
+  /** Custom layout wrapper for the /legal/* routes. Default: minimal
+   *  HTML skeleton from markdown.ts (`wrapInLayout`). Apps that want to place
+   *  their own marketing layout (header/footer/theme) around the legal body
+   *  can provide their render function here. */
   readonly wrapLayout?: LegalPagesWrapLayout;
   /** Public HTML routes to register. Default: LEGAL_ROUTES (DACH: DE+EN
    *  imprint/privacy). Non-DACH apps (other default language, additional
@@ -140,18 +139,18 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
         // Public pages backed by a DB query: bound the per-IP read rate.
         rateLimit: { per: "ip+handler", limit: 60, windowSeconds: 60 },
         handler: async (c, { systemQuery }) => {
-          // Architektur: 1 App = X Tenants = 1 Impressum. Egal welche
-          // Subdomain der Visitor besucht (apex, admin.*, tenant-x.*) —
-          // legal-pages serven IMMER die SYSTEM_TENANT-Texte. systemQuery
-          // erzwingt SYSTEM_TENANT_ID in-process (kein X-Tenant-Header-
-          // Trick über app.fetch — der sähe für einen host-basierten
-          // anonymousAccess-Resolver wie ein Client-Override aus und würde
-          // von resolverTrust: "authoritative" zurecht abgelehnt).
+          // Architecture: 1 app = X tenants = 1 imprint. Regardless of which
+          // subdomain the visitor uses (apex, admin.*, tenant-x.*),
+          // legal-pages ALWAYS serves the SYSTEM_TENANT texts. systemQuery
+          // enforces SYSTEM_TENANT_ID in-process (no X-Tenant-Header trick
+          // through app.fetch—the host-based anonymousAccess resolver would
+          // see that as a client override and correctly reject it with
+          // resolverTrust: "authoritative").
           let data: TextBlockQueryResult;
           try {
             // @cast-boundary engine-payload — dispatcher.query returnt
-            // unknown; Shape ist durch bySlugQuery's Handler-Return-Type
-            // (siehe template-resolver/handlers/by-slug.query.ts) vertraut.
+            // unknown; the shape is trusted because of bySlugQuery's handler return type
+            // (see template-resolver/handlers/by-slug.query.ts).
             data = (await systemQuery(
               TEXT_BLOCK_BY_SLUG_QN,
               { slug: route.slug, locale: route.lang },
@@ -178,8 +177,8 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
             String(data.modifiedAt ?? ""),
           ]);
           const extra = { "content-type": "text/html; charset=utf-8" };
-          // 304 (Revision unverändert) und HEAD überspringen beide das
-          // Markdown-Rendern — der Body wird ohnehin verworfen.
+          // Both 304 (unchanged revision) and HEAD skip Markdown rendering—the body
+          // would be discarded anyway.
           if (
             etagMatches(c.req.raw.headers.get("if-none-match"), etag) ||
             c.req.method === "HEAD"
@@ -228,21 +227,21 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       });
     }
 
-    // Boot-Check via ctx.templateResolver (extraContext-Pattern, symmetrisch
-    // zu requireConfigResolver in config). App-Bootstrap muss templateResolver
-    // wired haben — der Helper gibt einen klaren Wiring-Hinweis wenn nicht.
+    // Boot check via ctx.templateResolver (extraContext pattern, symmetrical
+    // with requireConfigResolver in config). App bootstrap must wire
+    // templateResolver; the helper gives a clear wiring hint if it is missing.
     //
-    // Body als named function extrahiert (`runLegalPagesBootCheck`) damit
-    // die Logik direkt unit-testbar ist statt nur indirekt über Routes.
-    // Pattern: thin job-shell ruft testable function — keine Test-Coupling
-    // zum JobRunner.
+    // The body is extracted as the named function (`runLegalPagesBootCheck`) so
+    // the logic can be unit-tested directly instead of only indirectly through
+    // routes. Pattern: a thin job shell calls a testable function, avoiding
+    // coupling tests to the JobRunner.
     r.job(
       "legal-pages-boot-check",
       {
         trigger: { manual: true },
         // bootGate, not runOnBoot: only an inline gate can actually abort the
         // boot. runOnBoot merely enqueues, so a missing imprint would fail a
-        // queue job while the pod goes ready anyway (fw#2590).
+        // queue job while the pod goes ready anyway.
         bootGate: true,
         runIn: "api",
       },

package/packages/bundled-features/src/legal-pages/markdown.ts

@@ -1,6 +1,6 @@
-// Re-export aus dem geteilten page-render-Kern (managed-pages nutzt
-// denselben gehärteten Renderer + Default-Layout). Namen bleiben stabil
-// für legal-pages' Public-API (index.ts exportiert renderMarkdownToHtml +
+// Re-export from the shared page-rendering core (managed pages use
+// the same hardened renderer and default layout). Keep these names stable
+// for legal-pages' public API (index.ts exports renderMarkdownToHtml and
 // wrapInLayout).
 
 export { wrapInLayout } from "../page-render/layout.ts";

package/packages/bundled-features/src/legal-pages/web/client-plugin.ts

@@ -1,26 +1,25 @@
-// Client-Feature-Factory für legal-pages Visual-Tree. Liefert statische
-// Tree-Knoten für die DACH-Compliance-Blöcke (imprint, privacy in de/en).
-// Jeder Knoten linkt auf text-content's edit-Action — reines Cross-Feature-
-// Linking, kein eigener State oder Fetch nötig.
+// Client feature factory for the legal-pages visual tree. Provides static
+// tree nodes for the DACH compliance blocks (imprint, privacy in de/en).
+// Each node links to text-content's edit action — pure cross-feature
+// linking, with no own state or fetch required.
 //
-// **Static statt fetch**: legal-pages weiß out-of-the-box welche Blocks
-// existieren (LEGAL_REQUIRED_BLOCKS + LEGAL_OPTIONAL_BLOCKS aus constants).
-// Anders als text-content's Provider (der alle Slugs des Tenants holt)
-// ist diese Liste bekannt zur Build-Zeit — kein /api/query-Round-trip nötig.
+// **Static instead of fetch**: legal-pages knows out of the box which blocks
+// exist (LEGAL_REQUIRED_BLOCKS + LEGAL_OPTIONAL_BLOCKS from constants).
+// Unlike text-content's provider (which fetches all tenant slugs), this list
+// is known at build time — no /api/query round trip is needed.
 //
-// **Content-State unbekannt**: V.1.2 setzt keine state-Markierung; alle
-// Knoten erscheinen "filled" (default). V.1.3+ könnte via by-slug-Query
-// ermitteln ob ein Block tatsächlich body hat und „stub" markieren wenn
-// leer (Provider-Author-Hinweis dass Block existiert aber befüllt werden
-// muss). Aktuell ist legal-pages's Boot-Check der primäre Wächter für
-// fehlende Pflicht-Blocks.
+// **Content state unknown**: no state marker is set; all nodes appear
+// "filled" (default). A by-slug query could determine whether a block
+// actually has a body and mark it as "stub" when empty (a provider-author hint
+// that the block exists but must be filled). Currently, legal-pages's boot
+// check is the primary guard for missing required blocks.
 
 import type { TreeChildrenSubscribe, TreeNode } from "@cosmicdrift/kumiko-framework/engine";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer/web";
 import { LEGAL_OPTIONAL_BLOCKS, LEGAL_REQUIRED_BLOCKS } from "./constants.ts";
 
 const treeProvider: TreeChildrenSubscribe = () => (emit) => {
-  // V.1.5d Slug-first Verschachtelung (Variante C):
+  // Slug-first nesting:
   //   📁 Legal
   //     📁 imprint
   //       de
@@ -29,10 +28,10 @@ const treeProvider: TreeChildrenSubscribe = () => (emit) => {
   //       de
   //       en
   //
-  // Slug ist der Übersetzungs-Anker — User pflegt DE+EN-Versionen
-  // desselben Inhalts zusammen statt nach Sprache zu gruppieren.
-  // Sub-Items sind reine Sprach-Leaves; Label = Sprache, target zeigt
-  // auf template-resolver:edit mit slug+locale.
+  // The slug is the translation anchor — users maintain the DE+EN versions
+  // of the same content together instead of grouping them by language.
+  // Sub-items are language-only leaves; label = language, and target points
+  // to template-resolver:edit with slug+locale.
 
   // Group all blocks by slug, collect set of langs per slug.
   const bySlug = new Map<string, string[]>();
@@ -62,15 +61,15 @@ const treeProvider: TreeChildrenSubscribe = () => (emit) => {
     });
   }
 
-  // Der App-seitige r.nav-Knoten IST der "Legal"-Container → der Provider
-  // emittiert die slug-Folder direkt darunter.
+  // The app-side r.nav node IS the "Legal" container → the provider
+  // emits the slug folders directly beneath it.
   emit(slugFolders);
   return () => {};
 };
 
-// `navId` = QN des r.nav({ provider: true })-Knotens den die App registriert.
-// Statisch (kein Fetch, keine Entities) → kein SSE-Refresh nötig. Ohne navId:
-// kein Sidebar-Knoten (server-only-Consumer leaken nichts).
+// `navId` = the QN of the r.nav({ provider: true }) node registered by the app.
+// Static (no fetch, no entities) → no SSE refresh is needed. Without navId:
+// no sidebar node (server-only consumers expose nothing).
 export function legalPagesClient(opts?: { readonly navId?: string }): ClientFeatureDefinition {
   const navId = opts?.navId;
   return {

package/packages/bundled-features/src/legal-pages/web/index.ts

@@ -1,3 +1 @@
-// Public exports für die Browser-Seite des legal-pages Features.
-
 export { legalPagesClient } from "./client-plugin.ts";

package/packages/bundled-features/src/mail-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.388.0",
+    "type": "fix",
+    "title": "Tenant mail transport falls back to the app transport without tenant config",
+    "detail": "tenantMailTransport returns null when the channel context carries no tenant config, instead of throwing on every send, so the channel uses the app transport as documented."
+  },
   {
     "version": "0.378.0",
     "type": "improvement",