Each grew to a full didactic guide (~400-700 lines) following the
established template: overview, why a separate module, mental model
ASCII, quick start, public surface table, configuration, common
patterns, pitfalls, internals, dependencies, Java mapping.

Notable additions:
- Orchestration: full saga DAG/workflow signal/TCC two-phase
  execution traces, compensation policy presets, recovery+cleanup
  composition with the scheduler, REST control plane routes.
- Cache: primary/fallback failover model, prefix-eviction guarantees,
  SETNX-style PutIfAbsent lock pattern.
- Observability: end-to-end OTLP-collector diagram, low-cardinality
  tag set table, MdcConstants log-context contract, sampling and
  Kubernetes probe gotchas.
- Data: filter DSL semantics matrix (string LIKE, IEnumerable IN,
  null sentinels), [FilterableId] opt-in rationale, EF Core 10
  ExecuteDeleteAsync caveat.

Plugins.Api / Plugins.Core: full lifecycle SPI explanation, state
machine, [Plugin] attribute discovery, McMaster-based assembly
isolation, hot-reload patterns, parameterless ctor pitfall.

RuleEngine.Interfaces / Models / Core / Web / Sdk: complete
five-tier walkthrough — DSL operator matrices, AST node hierarchy,
visitor pattern with worked example, REST endpoint table, typed
HttpClient resilience composition, batch evaluation pattern.

Idp.AzureAd / Idp.InternalDb: full operation coverage tables,
NotSupportedException rationale (no RFC 7662 endpoint, no session
listing API), pluggable storage SPI (user repo / revocation store /
role catalog), JWT signing-key rotation strategy, BCrypt workFactor
guidance.

Ecm (port tier): hexagonal mental-model diagram, [EcmAdapter]
attribute walk-through, AdapterRegistry/Selector resolution
algorithm, multi-tenant prefix patterns.

Ecm.Storage.Aws / Azure: cloud-specific auth chains (IAM role vs
DefaultAzureCredential), MinIO + Azurite local-dev paths, byte-range
streaming through ASP.NET, soft-delete & snapshot guidance.

Ecm.ESignature.DocuSign / AdobeSign / Logalty: provider auth flows
(JWT-grant RSA, OAuth2 refresh, OAuth2 client_credentials), envelope
lifecycle quirks (Logalty immutability, DocuSign demo-vs-prod URL
trap, AdobeSign region pod selection).

Notifications.Resend / Firebase: provider-specific auth (bearer
token vs ADC), domain-verification gotchas, FCM token-not-registered
handling, multi-platform routing (FCM-as-APNs proxy).

Webhooks five-tier walkthrough:
- Interfaces: WebhookEventDto / WebhookResponseDto contract,
  status-value semantics matrix.
- Core: full pipeline diagram (validate → rate-limit → enrich →
  dispatch → DLQ), token-bucket rate-limiter, dead-letter redrive.
- Processor: signature validators (Stripe / GitHub / Twilio / generic
  HMAC), constant-time comparison, idempotency window guidance.
- Web: ingestion controller routes, response-code mapping (REJECTED
  is 200, RATE_LIMITED is 429), forwarded-headers gotcha.
- Sdk: edge-to-pipeline forwarding, header-forwarding handler
  pattern.

Callbacks.Sdk: full-replace update semantics, secret rotation
roundtrip, FailureCount read-only-over-wire detail.

Client (large module): full mental-model diagram of the per-request
pipeline (dedup → discovery → load-balance → resilience → auth),
auth scheme matrix, resilience options table, four service discovery
clients, four load-balancer strategies, OAuth2 token cache,
deduplication, chaos handler, GraphQL helper.

Starter.Data: ETL/batch fit, Polly v8 ResiliencePipelineBuilder
patterns, EF Core 10 ExecuteUpdate caveat, cursor-pagination loop
for high-volume tables.

BackOffice: header-driven impersonation context, full BackofficeContext
helper matrix, custom resolver pattern with security-centre lookup,
audit filter pattern, fail-closed rationale.

ConfigServer: Spring-Cloud-Config-native protocol, lookup-precedence
algorithm (4 levels x 4 extensions), Kubernetes ConfigMap mounting,
Steeltoe + Spring Cloud Config consumer wiring.

samples (6 files): hexagonal layout walk-through, full
contract/persistence/business/host tier explanations, idempotency +
query-cache demo flow, project-graph diagram, production-checklist
for swapping in EF Core / OAuth / brokers.

Code comments (7 files) — added at non-obvious decision points where
the WHY behind a choice would not be derivable from the code:
- IdempotencyMiddleware: why cache key includes path, why we swap
  Response.Body for a MemoryStream, why only 2xx is cached.
- PiiMaskingService: why we keep prefix/suffix visible (human
  troubleshooting) and clamp to input length.
- FireflyException: why the context dictionary is defensively copied
  (caller mutation leakage rationale).
- GlobalExceptionHandlerMiddleware: translation order rationale,
  HasStarted log-and-bail explanation.
- DefaultCommandBus: validation-then-auth ordering rationale, why
  reflection-based dispatch is the right call.
- DefaultQueryBus: why the cache lookup runs before dispatch, why
  the default(TResult) check guards null-cache hits.
- EventDrivenCacheInvalidator: why the no-op early exit matters,
  why one event can invalidate multiple patterns.