@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.108.0

package/src/delivery/attempt-log.ts

@@ -12,15 +12,13 @@ import { DELIVERY_ATTEMPT_EVENT } from "./constants";
 import { deliveryAttemptSchema } from "./events";
 import type { DeliveryLogEntry } from "./types";
 
-// Append one delivery-attempt event to `attemptId`'s stream and run the inline
-// `delivery-log` projection in the same write (low-level append() does not
-// auto-fire projections — only the dispatcher/executor paths do). getStreamVersion
-// returns 0 for a fresh stream, so the same call serves both the first event
-// (queued, or a single-shot terminal) and follow-ups (queued → sent/failed).
-export async function appendAttemptEvent(
+// Shared append + inline-projection write (low-level append() does not
+// auto-fire projections — only the dispatcher/executor paths do).
+async function writeAttemptEvent(
   db: DbConnection,
   registry: Registry,
   attemptId: string,
+  expectedVersion: number,
   entry: DeliveryLogEntry,
 ): Promise<void> {
   const { tenantId, ...rest } = entry;
@@ -28,7 +26,6 @@ export async function appendAttemptEvent(
   // service/job + feature-registration fails loudly here instead of landing on
   // the events-table and crashing a consumer later.
   const payload = deliveryAttemptSchema.parse(rest);
-  const expectedVersion = await getStreamVersion(db, attemptId, tenantId);
   const stored = await append(db, {
     aggregateId: attemptId,
     aggregateType: "deliveryAttempt",
@@ -41,14 +38,29 @@ export async function appendAttemptEvent(
   await runProjectionsForEvent(stored, registry, db);
 }
 
-// Single-shot terminal log (inline channels, skips, idempotency dups): fresh
-// aggregate id, one event.
+// Append one delivery-attempt event to `attemptId`'s stream — for the
+// MULTI-EVENT path (queued → sent/failed follow-ups), where the stream may
+// already carry the "queued" event and the real current version must be
+// looked up.
+export async function appendAttemptEvent(
+  db: DbConnection,
+  registry: Registry,
+  attemptId: string,
+  entry: DeliveryLogEntry,
+): Promise<void> {
+  const expectedVersion = await getStreamVersion(db, attemptId, entry.tenantId);
+  await writeAttemptEvent(db, registry, attemptId, expectedVersion, entry);
+}
+
+// Single-shot terminal log (inline channels, skips, idempotency dups): a
+// FRESH aggregate id is guaranteed version 0 — skip the getStreamVersion
+// round-trip that appendAttemptEvent needs for its follow-up-event case.
 export async function logAttempt(
   db: DbConnection,
   registry: Registry,
   entry: DeliveryLogEntry,
 ): Promise<string> {
   const attemptId = generateId();
-  await appendAttemptEvent(db, registry, attemptId, entry);
+  await writeAttemptEvent(db, registry, attemptId, 0, entry);
   return attemptId;
 }

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -1,5 +1,5 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   buildEntityTable,
   createEventStoreExecutor,
@@ -25,7 +25,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { createLateBoundHolder } from "@cosmicdrift/kumiko-framework/testing";
+import { createLateBoundHolder, seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
@@ -93,7 +93,7 @@ function widgetAuditFeature(): FeatureDefinition {
       if (!ctx.db) return;
       const name = result.changes!["name"] as string | undefined;
       if (!name) return;
-      await insertOne(ctx.db, widgetAuditTable, {
+      await seedRow(ctx.db, widgetAuditTable, {
         id: generateId(),
         widgetName: name,
         version: 1,
@@ -253,7 +253,7 @@ describe("feature-toggles runtime cache", () => {
   });
 
   test("refresh() re-reads the DB snapshot", async () => {
-    await insertOne(stack.db, globalFeatureStateTable, {
+    await seedRow(stack.db, globalFeatureStateTable, {
       featureName: "widget",
       enabled: false,
       version: 1,

package/src/folders/__tests__/folders.integration.test.ts

@@ -192,6 +192,32 @@ describe("folders integration — single-membership set / move / clear", () => {
   });
 });
 
+describe("folders integration — delete blocks on live assignments (658/1)", () => {
+  test("deleting a folder that still holds an assignment is rejected, row survives", async () => {
+    const f = await createFolder("occupied");
+    await setFolder(f, "credit-occupied");
+
+    const err = await stack.http.writeErr(FoldersHandlers.deleteFolder, { id: f }, admin);
+    expect(err.httpStatus).toBe(422);
+    expect((await listFolders()).some((row) => row["id"] === f)).toBe(true);
+  });
+
+  test("deleting an empty folder succeeds", async () => {
+    const f = await createFolder("empty");
+    await stack.http.writeOk(FoldersHandlers.deleteFolder, { id: f }, admin);
+    expect((await listFolders()).some((row) => row["id"] === f)).toBe(false);
+  });
+
+  test("clearing the assignment first unblocks the delete", async () => {
+    const f = await createFolder("occupied-then-cleared");
+    await setFolder(f, "credit-occupied-2");
+    await clearFolder("credit-occupied-2");
+
+    await stack.http.writeOk(FoldersHandlers.deleteFolder, { id: f }, admin);
+    expect((await listFolders()).some((row) => row["id"] === f)).toBe(false);
+  });
+});
+
 describe("folders integration — rename via folder:update", () => {
   test("update renames, optimistic-locked, bumps version", async () => {
     const id = await createFolder("Alt");

package/src/folders/feature.ts

@@ -18,7 +18,6 @@
 import {
   type AccessRule,
   defineEntityCreateHandler,
-  defineEntityDeleteHandler,
   defineEntityDetailHandler,
   defineEntityListHandler,
   defineEntityUpdateHandler,
@@ -28,6 +27,7 @@ import {
 import { DEFAULT_FOLDER_ACCESS, FOLDERS_FEATURE_NAME } from "./constants";
 import { folderAssignmentEntity, folderEntity } from "./entity";
 import { createClearFolderHandler } from "./handlers/clear-folder.write";
+import { createDeleteFolderHandler } from "./handlers/delete-folder.write";
 import { createSetFolderHandler } from "./handlers/set-folder.write";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
@@ -60,7 +60,9 @@ function registerFolders(
   // later stage, reparent: it accepts changes.parentId, optimistic-locked).
   r.writeHandler(defineEntityCreateHandler("folder", folderEntity, { access }));
   r.writeHandler(defineEntityUpdateHandler("folder", folderEntity, { access }));
-  r.writeHandler(defineEntityDeleteHandler("folder", folderEntity, { access }));
+  // Custom, not defineEntityDeleteHandler: blocks the delete when folder-
+  // assignments still point at this folder (658/1) — see delete-folder.write.ts.
+  r.writeHandler(createDeleteFolderHandler(access));
   r.queryHandler(defineEntityListHandler("folder", folderEntity, { access }));
   r.queryHandler(defineEntityDetailHandler("folder", folderEntity, { access }));
 

package/src/folders/handlers/delete-folder.write.ts

@@ -0,0 +1,40 @@
+import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { z } from "zod";
+import { DEFAULT_FOLDER_ACCESS } from "../constants";
+import { folderAssignmentExecutor, folderExecutor } from "../executor";
+
+const deleteFolderPayloadSchema = z.object({ id: z.uuid() });
+
+// delete-folder — the UI's folder-manager only blocks deleting a folder that
+// still has CHILD folders; it never checks folder-assignments. A leaf folder
+// holding entities could be deleted, leaving its folder-assignment rows
+// pointing at a folderId that no longer exists (no cascade, no cleanup path —
+// see 658/1). Block server-side instead: this is the same "referential
+// integrity has no FK here" reasoning set-folder.write.ts already applies to
+// folderId on assignment-creation.
+export function createDeleteFolderHandler(
+  access: AccessRule = DEFAULT_FOLDER_ACCESS,
+): WriteHandlerDef {
+  return {
+    name: "folder:delete",
+    schema: deleteFolderPayloadSchema,
+    access,
+    handler: async (event, ctx) => {
+      const payload = event.payload as { id: string }; // @cast-boundary engine-payload
+      const assigned = await folderAssignmentExecutor.list(
+        { filter: { field: "folderId", op: "eq", value: payload.id }, limit: 1 },
+        event.user,
+        ctx.db,
+      );
+      if (assigned.rows.length > 0) {
+        return writeFailure(
+          new UnprocessableError("folder_has_assignments", { details: { folderId: payload.id } }),
+        );
+      }
+      return folderExecutor.delete({ id: payload.id }, event.user, ctx.db);
+    },
+  };
+}
+
+export const deleteFolderHandler: WriteHandlerDef = createDeleteFolderHandler();

package/src/folders/web/__tests__/folder-manager.test.tsx

@@ -248,6 +248,30 @@ describe("FolderManager filing mode", () => {
     expect(row.className).not.toContain("ring-primary/40");
   });
 
+  test("a second drop while a reassign is still in flight is ignored (busy guard)", async () => {
+    folderRows = [
+      { id: "f1", name: "A", parentId: null, version: 1 },
+      { id: "f2", name: "B", parentId: null, version: 1 },
+    ];
+    let resolveWrite: (v: { isSuccess: true; data: undefined }) => void = () => {};
+    dispatchSpy.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          resolveWrite = resolve;
+        }),
+    );
+    render(
+      <Wrapper>
+        <FolderManager filing={filingWith(() => {})} />
+      </Wrapper>,
+    );
+    dropLeaf("folder-node-f2", "c-1");
+    // Second drop lands WHILE the first write is still pending.
+    dropLeaf("folder-node-f2", "c-1");
+    resolveWrite({ isSuccess: true, data: undefined });
+    await waitFor(() => expect(dispatchSpy).toHaveBeenCalledTimes(1));
+  });
+
   test("the unfiled bucket stays a drop target even when nothing is currently unfiled", () => {
     folderRows = [{ id: "f1", name: "A", parentId: null, version: 1 }];
     const allFiled: FolderFiling = {

package/src/folders/web/folder-manager.tsx

@@ -238,21 +238,26 @@ export function FolderManager({
   // No-op if it already lives there (both handlers are idempotent, but a re-set
   // would burn a redundant event).
   const reassign = async (entityId: string, folderId: string | null): Promise<void> => {
-    if (filing === undefined) return;
+    if (filing === undefined || busy) return;
     if ((currentFolderByEntity.get(entityId) ?? null) === folderId) return;
+    setBusy(true);
     setErrorKey(null);
-    const entityType = typeByEntity.get(entityId) ?? filing.entityType;
-    const ok =
-      folderId === null
-        ? await writeOk(FoldersHandlers.clearFolder, { entityType, entityId })
-        : await writeOk(FoldersHandlers.setFolder, {
-            folderId,
-            entityType,
-            entityId,
-          });
-    if (ok) {
-      await catalog.refetch();
-      await filing.onReassigned();
+    try {
+      const entityType = typeByEntity.get(entityId) ?? filing.entityType;
+      const ok =
+        folderId === null
+          ? await writeOk(FoldersHandlers.clearFolder, { entityType, entityId })
+          : await writeOk(FoldersHandlers.setFolder, {
+              folderId,
+              entityType,
+              entityId,
+            });
+      if (ok) {
+        await catalog.refetch();
+        await filing.onReassigned();
+      }
+    } finally {
+      setBusy(false);
     }
   };
 

package/src/folders/web/i18n.ts

@@ -18,7 +18,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Speichert…",
 
     "folders.manager.loading": "Lädt…",
-    "folders.manager.empty": "Noch keine Ordner.",
     "folders.manager.newRoot": "Neuer Ordner",
     "folders.manager.add": "Anlegen",
     "folders.manager.addChild": "Unterordner",
@@ -44,7 +43,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "folders.section.working": "Saving…",
 
     "folders.manager.loading": "Loading…",
-    "folders.manager.empty": "No folders yet.",
     "folders.manager.newRoot": "New folder",
     "folders.manager.add": "Create",
     "folders.manager.addChild": "Subfolder",

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -0,0 +1,69 @@
+// folderAssignmentExportHook — GDPR export must not surface cleared
+// (soft-deleted) folder-assignment rows. Regression (658/3): the hook read
+// via selectMany without an isDeleted filter — folderAssignmentEntity is
+// softDelete: true, so a cleared assignment (clear-folder) still had a row
+// in read_folder_assignments and rode along in the export.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createFoldersFeature, FoldersHandlers } from "../../folders";
+import { folderAssignmentEntity, folderEntity } from "../../folders/entity";
+import { folderAssignmentExportHook } from "../hooks";
+
+let stack: TestStack;
+const admin = createTestUser({ roles: ["TenantAdmin"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [createFoldersFeature()] });
+  await unsafeCreateEntityTable(stack.db, folderEntity);
+  await unsafeCreateEntityTable(stack.db, folderAssignmentEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("folderAssignmentExportHook", () => {
+  test("excludes a cleared (soft-deleted) assignment from the export", async () => {
+    const folder = await stack.http.writeOk<{ id: string }>(
+      FoldersHandlers.createFolder,
+      { name: "Active loans" },
+      admin,
+    );
+
+    await stack.http.writeOk(
+      FoldersHandlers.setFolder,
+      { folderId: folder.id, entityType: "credit", entityId: "credit-kept" },
+      admin,
+    );
+    await stack.http.writeOk(
+      FoldersHandlers.setFolder,
+      { folderId: folder.id, entityType: "credit", entityId: "credit-cleared" },
+      admin,
+    );
+    // clear-folder soft-deletes the assignment row (isDeleted: true).
+    await stack.http.writeOk(
+      FoldersHandlers.clearFolder,
+      { entityType: "credit", entityId: "credit-cleared" },
+      admin,
+    );
+
+    const snippet = await folderAssignmentExportHook({
+      db: stack.db,
+      tenantId: admin.tenantId,
+      userId: admin.id,
+    });
+
+    expect(snippet).not.toBeNull();
+    const entityIds = (snippet?.rows ?? []).map((r) => r["entityId"]);
+    expect(entityIds).toContain("credit-kept");
+    expect(entityIds).not.toContain("credit-cleared");
+  });
+});

package/src/folders-user-data/hooks.ts

@@ -4,16 +4,21 @@
 // Mirrors credit-user-data — standard tenant-scoped pattern, no name-stripping
 // (a folder name is tenant data, not per-user PII).
 
-import { deleteMany, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createTenantDb, type EventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntityExecutor,
+  createSystemUser,
   type UserDataDeleteHook,
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { folderAssignmentEntity, folderEntity } from "../folders";
 
-const { table: folderTable } = createEntityExecutor("folder", folderEntity);
-const { table: folderAssignmentTable } = createEntityExecutor(
+const { table: folderTable, executor: folderExecutor } = createEntityExecutor(
+  "folder",
+  folderEntity,
+);
+const { table: folderAssignmentTable, executor: folderAssignmentExecutor } = createEntityExecutor(
   "folder-assignment",
   folderAssignmentEntity,
 );
@@ -30,8 +35,12 @@ export const folderExportHook: UserDataExportHook = async (ctx) => {
 };
 
 export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
+  // folderAssignmentEntity is softDelete: true — a cleared assignment
+  // (isDeleted: true) is a removed folder membership, not something the GDPR
+  // export should still surface as current data.
   const rows = await selectMany<Record<string, unknown>>(ctx.db, folderAssignmentTable, {
     tenantId: ctx.tenantId,
+    isDeleted: false,
   });
   if (rows.length === 0) return null;
   return { entity: "folder-assignment", rows };
@@ -43,16 +52,30 @@ export const folderAssignmentExportHook: UserDataExportHook = async (ctx) => {
 // tenant would destroy co-members' folders. anonymize is also a no-op — folder
 // rows carry no person-link to strip (name is tenant data, not PII), so a
 // retention hold simply keeps them.
-function tenantScopedDelete(table: typeof folderTable): UserDataDeleteHook {
+function tenantScopedDelete(
+  table: typeof folderTable,
+  executor: EventStoreExecutor,
+): UserDataDeleteHook {
   return async (ctx, strategy) => {
     // skip: multi-user tenant — a tenant-wide delete would destroy co-members' folders
     if (ctx.tenantModel !== "single-user") return;
     // skip: anonymize is a no-op — folder rows carry no per-user PII to strip
     if (strategy === "anonymize") return;
-    await deleteMany(ctx.db, table, { tenantId: ctx.tenantId });
+    // Per-row via the executor (event -> rebuild-safe): a bulk deleteMany is
+    // eventless, so a projection rebuild resurrects the rows. Bounded — forget
+    // only fires for single-user tenants.
+    const systemUser = createSystemUser(ctx.tenantId);
+    // The executor needs a TenantDb (loadById → db.fetchOne), not the raw ctx.db.
+    const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+    const rows = await selectMany<{ id: string }>(ctx.db, table, { tenantId: ctx.tenantId });
+    for (const row of rows) {
+      await executor.delete({ id: row.id }, systemUser, tdb);
+    }
   };
 }
 
-export const folderDeleteHook: UserDataDeleteHook = tenantScopedDelete(folderTable);
-export const folderAssignmentDeleteHook: UserDataDeleteHook =
-  tenantScopedDelete(folderAssignmentTable);
+export const folderDeleteHook: UserDataDeleteHook = tenantScopedDelete(folderTable, folderExecutor);
+export const folderAssignmentDeleteHook: UserDataDeleteHook = tenantScopedDelete(
+  folderAssignmentTable,
+  folderAssignmentExecutor,
+);

package/src/folders-user-data/index.ts

@@ -16,10 +16,10 @@ export const foldersUserDataFeature = defineFeature("folders-user-data", (r) =>
   r.describe(
     "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `folders` feature's `folder` + `folder-assignment` entities. Mounts the EXT_USER_DATA export + delete hooks so a tenant's folder tree and its entity-to-folder assignments are included in the user-data export bundle and erased on a tenant-scoped forget (single-user tenants only; multi-user + anonymize are no-ops since folder rows carry no per-user PII). Kept separate from `folders` so folder consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `folders`.",
   );
-  // user-data-rights ist die harte Abhängigkeit (EXT_USER_DATA-Host). `folders` ist
-  // OPTIONAL: ist es toggleable(default=false) gemountet (z.B. per-Tenant via Tier),
-  // würde ein hartes r.requires eine „effectively disabled"-Boot-Warnung werfen,
-  // obwohl die folder-Entities existieren und die Hooks korrekt greifen.
+  // user-data-rights is the hard dependency (EXT_USER_DATA host). `folders` is
+  // OPTIONAL: if it's mounted toggleable(default=false) (e.g. per-tenant via
+  // tier), a hard r.requires would throw an "effectively disabled" boot
+  // warning even though the folder entities exist and the hooks work fine.
   r.requires("user-data-rights");
   r.optionalRequires("folders");
   r.useExtension(EXT_USER_DATA, "folder", {

package/src/jobs/feature.ts

@@ -57,9 +57,9 @@ export function createJobsFeature(): FeatureDefinition {
       table: jobRunsTable,
       apply: {
         [JOB_RUN_STARTED_EVENT]: defineApply<z.infer<typeof runStartedSchema>>(
-          async (event, tx) => {
+          async (event, tx, table) => {
             const p = event.payload;
-            await insertOne(tx, jobRunsTable, {
+            await insertOne(tx, table, {
               id: event.aggregateId,
               tenantId: event.tenantId,
               version: event.version,
@@ -76,11 +76,11 @@ export function createJobsFeature(): FeatureDefinition {
           },
         ),
         [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx) => {
+          async (event, tx, table) => {
             const p = event.payload;
             await updateMany(
               tx,
-              jobRunsTable,
+              table,
               {
                 status: "completed",
                 duration: p.duration,
@@ -93,23 +93,25 @@ export function createJobsFeature(): FeatureDefinition {
             );
           },
         ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(async (event, tx) => {
-          const p = event.payload;
-          await updateMany(
-            tx,
-            jobRunsTable,
-            {
-              status: "failed",
-              error: p.error,
-              duration: p.duration,
-              finishedAt: Temporal.Instant.from(p.finishedAt),
-              version: event.version,
-              modifiedAt: event.createdAt,
-              modifiedById: event.metadata?.userId ?? "system",
-            },
-            { id: event.aggregateId },
-          );
-        }),
+        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(
+          async (event, tx, table) => {
+            const p = event.payload;
+            await updateMany(
+              tx,
+              table,
+              {
+                status: "failed",
+                error: p.error,
+                duration: p.duration,
+                finishedAt: Temporal.Instant.from(p.finishedAt),
+                version: event.version,
+                modifiedAt: event.createdAt,
+                modifiedById: event.metadata?.userId ?? "system",
+              },
+              { id: event.aggregateId },
+            );
+          },
+        ),
       },
     });
 

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -6,10 +6,15 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import { z } from "zod";
 
-export const projectionRebuildPayloadSchema = z.object({ projection: z.string().min(1) });
+export const projectionRebuildPayloadSchema = z.object({
+  projection: z.string().min(1),
+  // Quarantine mode (#760): skip + dead-letter poison events instead of
+  // failing the whole rebuild. Operator opt-in per run.
+  skipApplyErrors: z.boolean().optional(),
+});
 
 export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
-  const { projection } = projectionRebuildPayloadSchema.parse(rawPayload);
+  const { projection, skipApplyErrors } = projectionRebuildPayloadSchema.parse(rawPayload);
   if (!ctx.db) {
     throw new InternalError({
       message:
@@ -23,8 +28,13 @@ export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promi
     });
   }
   const db = ctx.db as DbConnection; // @cast-boundary db-operator
-  const result = await rebuildProjection(projection, { db, registry: ctx.registry });
+  const result = await rebuildProjection(projection, {
+    db,
+    registry: ctx.registry,
+    ...(skipApplyErrors === true && { errorPolicy: { skipApplyErrors: true } }),
+  });
   ctx.log?.info?.(
-    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events in ${result.durationMs}ms`,
+    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
+      `${result.eventsSkipped > 0 ? ` (${result.eventsSkipped} quarantined)` : ""} in ${result.durationMs}ms`,
   );
 };

package/src/ledger/__tests__/ledger.integration.test.ts

@@ -188,6 +188,50 @@ describe("ledger integration — reverse-transaction (Storno)", () => {
     // Original + Storno cancel → books net to zero.
     expect(trialBalance(rows)).toBe(0);
   });
+
+  test("reversing a draft transaction is rejected (only posted entries count)", async () => {
+    const bank = await createAccount("Bank Draft", "asset");
+    const rent = await createAccount("Draft Income", "income");
+    const draft = await stack.http.writeOk<{ id: string }>(
+      LedgerHandlers.createTransaction,
+      {
+        date: "2026-01-15",
+        description: "Draft entry",
+        status: "draft",
+        lines: [
+          { accountId: bank, amount: 5000 },
+          { accountId: rent, amount: -5000 },
+        ],
+      },
+      admin,
+    );
+
+    const err = await stack.http.writeErr(
+      LedgerHandlers.reverseTransaction,
+      { id: draft.id },
+      admin,
+    );
+    expect(err.code).toBe("unprocessable");
+
+    // No Storno booked — the draft is the only row.
+    expect(await listTransactions()).toHaveLength(1);
+  });
+
+  test("reversing the same transaction twice is rejected on the second call", async () => {
+    const bank = await createAccount("Bank Dup", "asset");
+    const rent = await createAccount("Dup Income", "income");
+    const tx = await createTransaction([
+      { accountId: bank, amount: 20000 },
+      { accountId: rent, amount: -20000 },
+    ]);
+
+    await stack.http.writeOk(LedgerHandlers.reverseTransaction, { id: tx.id }, admin);
+    const err = await stack.http.writeErr(LedgerHandlers.reverseTransaction, { id: tx.id }, admin);
+    expect(err.code).toBe("conflict");
+
+    // Original + exactly ONE Storno — a second reverse must not book again.
+    expect(await listTransactions()).toHaveLength(2);
+  });
 });
 
 describe("ledger integration — trial balance (golden invariant)", () => {

package/src/ledger/__tests__/reports.test.ts

@@ -5,6 +5,7 @@ import {
   incomeStatement,
   type LedgerAccount,
   type LedgerEntry,
+  normalizeLines,
 } from "../reports";
 
 // Pure report math — no DB. A small but complete set of books:
@@ -50,6 +51,25 @@ function balanceOf(report: ReturnType<typeof accountBalances>, id: string): numb
   return report.accounts.find((a) => a.id === id)?.balance ?? Number.NaN;
 }
 
+describe("normalizeLines — jsonb array-or-string driver surfacing", () => {
+  test("passes an already-parsed array through unchanged", () => {
+    const lines = [{ accountId: "bank", amount: 100 }];
+    expect(normalizeLines(lines)).toEqual(lines);
+  });
+
+  test("parses a JSON-string-encoded array (the other driver path)", () => {
+    const lines = [{ accountId: "bank", amount: 100 }];
+    expect(normalizeLines(JSON.stringify(lines))).toEqual(lines);
+  });
+
+  test("falls back to [] for malformed JSON or a non-array value", () => {
+    expect(normalizeLines("not json")).toEqual([]);
+    expect(normalizeLines(null)).toEqual([]);
+    expect(normalizeLines(undefined)).toEqual([]);
+    expect(normalizeLines(42)).toEqual([]);
+  });
+});
+
 describe("accountBalances — natural balances + trial balance", () => {
   test("natural balances are sign-corrected by account type", () => {
     const r = accountBalances(accounts, posted);

package/src/ledger/entity.ts

@@ -73,7 +73,7 @@ export const scheduleEntity = createEntity({
     // Absent → open-ended (projects to the window's end).
     endDate: createDateField(),
     interval: createSelectField({ options: SCHEDULE_INTERVALS, required: true }),
-    amount: createNumberField({ required: true }),
+    amount: createNumberField({ required: true, min: 1, integer: true }),
     debitAccountId: createTextField({ required: true, maxLength: 64 }),
     creditAccountId: createTextField({ required: true, maxLength: 64 }),
   },