Answer prose round 1: 0 🔴, 4 🟡 (0 misread); comments say what the forms post where, restating test comments go

src/auth/flow-view.test.ts

@@ -101,7 +101,6 @@ test("collects oidc nodes as SSO providers (text logo = initial), keeping csrf a
 });
 
 test("the code field takes a pasted code: one-time-code autofill + numeric inputmode + digits, whitespace around them allowed", () => {
-  // The host trims the code before Kratos sees it (routes.ts), so only a stray non-digit is refused.
   const view = buildFlowView(
     flow([
       node({ name: "csrf_token", type: "hidden", value: "tok" }),

src/auth/flow-view.ts

@@ -69,7 +69,7 @@ export const AUTH_FLOWS: Record<string, FlowType> = {
   "/verification": "verification",
 };
 
-// The flows that take an emailed one-time code, whose form posts to the host to have it trimmed.
+// The flows that take an emailed one-time code. Their form posts to the host, which trims the code.
 export const CODE_FLOWS: ReadonlySet<FlowType> = new Set(["recovery", "verification"]);
 
 // Where each flow's card links; its words come from the catalog under `auth.<flow>.*`.
@@ -126,8 +126,8 @@ const ssoLogo = (value: string): string => (value.charAt(0) || "?").toUpperCase(
 
 function toField(node: UiNode, name: string, type: string, t: Translate): FlowField {
   const value = str(node.attributes["value"]);
-  // The recovery/verification one-time code: numeric, so a numeric keypad and a digits pattern, which
+  // The recovery/verification one-time code is numeric: a numeric keypad and a digits pattern. The
-  // allows the whitespace a paste brings since the host trims it (routes.ts → codeFlowSubmit).
+  // pattern allows whitespace around the digits, as a paste brings; routes.ts → codeFlowSubmit trims it.
   // one-time-code enables OS/email autofill (Kratos sends no autocomplete for the node).
   const isCode = name === "code";
   const autocomplete = str(node.attributes["autocomplete"]) ?? (isCode ? "one-time-code" : undefined);

todo.md

@@ -29,7 +29,7 @@
 ### 45. Link the admin's recovery-code notice to the flow the code was minted on, so the user can enter it.
 
 The notice (`examples/plugins/admin/views/partials/user-form-body.ejs`) links a bare `/recovery`,
-which starts a fresh flow at its email step. Kratos binds an admin-minted code to the flow it minted,
+which starts a fresh flow at its email step. Kratos binds an admin-minted code to the flow it was minted on,
 whose URL is the `recovery_link` that `createRecoveryCode` returns as `RecoveryCode.link`. Render that
 link instead.
 

views/auth.ejs

@@ -1,9 +1,9 @@
 <%#
   Themed Kratos self-service page inside the unified app shell: sign-in / register /
   reset / verify / settings. Renders a FlowView (src/auth/flow-view.ts) into the shell content, reusing the
-  auth-card + field partials. The form posts to flow.action — Kratos owns its CSRF. The
+  auth-card + field partials. The shell's menu is permission-filtered (anonymous ⇒ public items +
-  shell's menu is permission-filtered (anonymous ⇒ public items + Sign in); the topbar carries no heading,
+  Sign in); the topbar carries no heading, so the card's own <h1> is the page's single
-  so the card's own <h1> is the page's single heading. Data: chrome (PageChrome), flow (FlowView).
+  heading. Data: chrome (PageChrome), flow (FlowView).
 %><%
   const nav = include("partials/nav-tree", { nodes: chrome.nav });
   const card = include("partials/auth-card", {