Answer stability round 1: 0 🔴, 2 🟡 (0 misread); the admin recovery journey gets an E2E, the Kratos comments no longer claim a mailed link

src/auth/kratos-admin.test.ts

@@ -100,9 +100,9 @@ test("updateMetadataPublic PATCHes a JSON-Patch `add /metadata_public` so it nev
 });
 
 test("createRecoveryCode POSTs the identity id to /admin/recovery/code → { code, link }", async () => {
-  const { calls, fetchImpl } = recorder(() => res(200, { recovery_code: "123456", recovery_link: "http://kratos/self-service/recovery?flow=f&code=123456" }));
+  const { calls, fetchImpl } = recorder(() => res(200, { recovery_code: "123456", recovery_link: "http://kratos/self-service/recovery?flow=f" }));
   const out = await createKratosAdmin({ baseUrl: BASE, fetchImpl }).createRecoveryCode(ID);
-  assert.deepEqual(out, { code: "123456", link: "http://kratos/self-service/recovery?flow=f&code=123456" });
+  assert.deepEqual(out, { code: "123456", link: "http://kratos/self-service/recovery?flow=f" });
   assert.equal(calls[0]!.method, "POST");
   assert.match(calls[0]!.url, /\/admin\/recovery\/code$/);
   assert.deepEqual(JSON.parse(calls[0]!.body!), { identity_id: ID });

src/auth/kratos-admin.ts

@@ -25,7 +25,7 @@ export interface ListOptions {
   pageToken?: string;
 }
 
-// A one-time recovery code + the self-service link wrapping it (admin "trigger recovery").
+// A one-time recovery code + the URL of the recovery flow it was minted on, the only flow that accepts it.
 export interface RecoveryCode {
   code: string;
   link: string;
@@ -65,8 +65,8 @@ export function createKratosAdmin(config: { baseUrl: string; fetchImpl?: typeof
       return (await res.json()) as Identity;
     },
 
-    // Mint a recovery code for an identity (admin "trigger recovery") — the link is mailed to the
-    // user by Kratos; the code/link are also returned so an operator can hand them over directly.
+    // Mint a recovery code for an identity (admin "trigger recovery"). Kratos mails nothing, so the
+    // operator hands the code and link to the user.
     async createRecoveryCode(userId, opts = {}) {
       const body: Record<string, unknown> = { identity_id: userId };
       if (opts.expiresIn) body.expires_in = opts.expiresIn;