@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -1,7 +1,7 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { USER_STATUS, userEntity, userTable } from "../../user";
 
@@ -21,16 +21,6 @@ import { USER_STATUS, userEntity, userTable } from "../../user";
 // kann abweichen).
 const userExecutor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 
-// Stream-Tenant = die framework-injizierte tenant_id der read_users-Row. Der
-// Reducer setzt sie aus `user.created`.tenantId, ein Rebuild rekonstruiert sie
-// daraus — sie IST also der Stream-Key des Aggregats. Die Row direkt zu lesen
-// (statt das created-Event zu joinen) deckt auch direkt-geseedete Rows ab.
-async function streamTenantOf(conn: DbRunner, userId: string): Promise<TenantId | null> {
-  const row = await fetchOne<{ tenantId?: string }>(conn, userTable, { id: userId });
-  // @cast-boundary db-row — tenant_id ist eine TenantId-shaped uuid-Spalte.
-  return row?.tenantId ? (row.tenantId as TenantId) : null;
-}
-
 // `conn` ist ctx.db.raw (regulaere Handler) ODER die offene tx (forget-cleanup
 // Sub-Tx) — so bleibt der Event-Append atomar mit dem umgebenden Write.
 export async function updateUserLifecycle(
@@ -38,20 +28,14 @@ export async function updateUserLifecycle(
   userId: string,
   changes: Record<string, unknown>,
 ): Promise<void> {
-  const streamTenantId = await streamTenantOf(conn, userId);
-  if (!streamTenantId) {
-    throw new InternalError({
-      message: `read_users row ${userId} has no tenant_id — cannot rescope lifecycle write to its stream tenant`,
-    });
-  }
-
-  // Rescope BEIDE Achsen auf den Stream-Tenant: der db-Arg treibt loadById +
-  // den Stream-Read, der user-Arg die Event-tenantId + Ownership. Nur beide
-  // zusammen halten created + updated auf einem Stream.
-  const tenantDb = createTenantDb(conn, streamTenantId, "tenant");
+  // user ist systemStream (#497): der Executor-Choke-Point addressiert den
+  // Stream immer auf SYSTEM_TENANT_ID — ein Rescope auf die row-tenant_id
+  // waere wirkungslos. "system"-Mode, damit loadById auch Legacy-Rows findet,
+  // deren tenant_id noch vor dem #762-Backfill-Rebuild steht.
+  const tenantDb = createTenantDb(conn, SYSTEM_TENANT_ID, "system");
   const result = await userExecutor.update(
     { id: userId, changes },
-    createSystemUser(streamTenantId),
+    createSystemUser(SYSTEM_TENANT_ID),
     tenantDb,
     { skipOptimisticLock: true },
   );

package/src/user-data-rights/run-forget-cleanup.ts

@@ -410,7 +410,14 @@ async function resolveEffectiveTenantModel(
   appTenantModel: TenantUserModel,
 ): Promise<TenantUserModel> {
   if (appTenantModel !== "single-user") return "multi-user";
-  const members = await selectMany<{ userId: string }>(db, tenantMembershipsTable, { tenantId });
+  // Only "exactly one member vs. more than one" matters here — a LIMIT 2
+  // read answers that without pulling every historical membership row.
+  const members = await selectMany<{ userId: string }>(
+    db,
+    tenantMembershipsTable,
+    { tenantId },
+    { limit: 2 },
+  );
   return members.length === 1 ? "single-user" : "multi-user";
 }
 

package/src/user-data-rights/web/__tests__/public-deletion-gate.test.tsx

@@ -5,7 +5,7 @@
 // Provider-Wrapper lokal (Dependency-Richtung renderer-web → bundled-features
 // verbietet test-utils-Import).
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, describe, expect, test } from "bun:test";
 import type { Dispatcher } from "@cosmicdrift/kumiko-headless";
 import {
   createStaticLocaleResolver,
@@ -27,6 +27,12 @@ const stubDispatcher = {
 
 const ROUTES = { requestPath: "/account/delete", confirmPath: "/account/delete/confirm" };
 
+// renderGate mutates the shared happy-dom document's history (570/1) — reset
+// so a later, unrelated test file doesn't inherit this suite's last path.
+afterEach(() => {
+  window.history.replaceState({}, "", "/");
+});
+
 function renderGate(path: string, gate: ReactNode): ReturnType<typeof within> {
   window.history.replaceState({}, "", path);
   const { container } = render(

package/src/user-data-rights/web/i18n.ts

@@ -74,11 +74,6 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Konto wirklich löschen?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Mit dem Bestätigen startet die Lösch-Frist. Du kannst die Löschung bis zu ihrem Ablauf wieder abbrechen.",
-
-    "userDataRights.privacyCenter.audit.title": "Aktivitätsprotokoll (Art. 15)",
-    "userDataRights.privacyCenter.audit.intro":
-      "Die letzten Ereignisse zu deinem Konto über alle Tenants hinweg.",
-    "userDataRights.privacyCenter.audit.empty": "Noch keine Ereignisse.",
   },
   en: {
     "userDataRights.deletion.request.title": "Request account deletion",
@@ -146,10 +141,5 @@ export const defaultTranslations: TranslationsByLocale = {
     "userDataRights.privacyCenter.deletion.dialogTitle": "Delete your account?",
     "userDataRights.privacyCenter.deletion.dialogDescription":
       "Confirming starts the deletion grace period. You can cancel the deletion until it ends.",
-
-    "userDataRights.privacyCenter.audit.title": "Activity log (Art. 15)",
-    "userDataRights.privacyCenter.audit.intro":
-      "The most recent events on your account across all tenants.",
-    "userDataRights.privacyCenter.audit.empty": "No events yet.",
   },
 };

package/src/user-data-rights-defaults/__tests__/user-data-rights-defaults.integration.test.ts

@@ -11,7 +11,7 @@
 //     fileRef-Forget beruehrt Tenant B's Files nicht)
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import {
   setupTestStack,
@@ -19,6 +19,7 @@ import {
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createDataRetentionFeature } from "../../data-retention";
 import { createFilesFeature } from "../../files";
@@ -80,7 +81,7 @@ async function seedUser(id: string, overrides: Record<string, unknown> = {}): Pr
   // Schema hat tenant_id-Spalte automatisch (Framework-Default).
   // Pragmatisch: SYSTEM_TENANT_ID fuer User-Rows in Tests.
   const SYSTEM_TENANT = "00000000-0000-4000-8000-000000000001";
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id,
     tenantId: SYSTEM_TENANT,
     email: `user-${id}@example.com`,

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -1,11 +1,24 @@
-import { deleteMany, selectMany, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type {
-  UserDataDeleteHook,
-  UserDataExportHook,
-  UserDataHookCtx,
-  UserDataStorageProvider,
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type TenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type SessionUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+  type UserDataHookCtx,
+  type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
+
+// Forget writes go through the executor (events), not deleteMany/updateMany:
+// a projection rebuild replays the events, so the erasure survives. Eventless
+// writes are wiped/resurrected on rebuild — the Art.17 hole this fixes. Bounded:
+// per-user forget flows are rare, so per-row events are acceptable.
+const crud = createEventStoreExecutor(fileRefsTable, fileRefEntity, { entityName: "fileRef" });
 
 // userData-Hook fuer fileRef-entity (S2.H2).
 //
@@ -27,7 +40,7 @@ import { fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 //
 // **Zwei Fehlerklassen, bewusst verschieden behandelt:**
 //   1. Resolution schlaegt fehl (kein Provider konfiguriert / configResolver
-//      fehlt) → NICHT fail-closed: EIN Warn pro Process + row-only-delete. Ein
+//      fehlt) → NICHT fail-closed: Warn pro Aufruf + row-only-delete. Ein
 //      fehlkonfigurierter Store darf die Art.-17-Loeschung nicht DAUERHAFT
 //      blockieren (sonst haengt jeder User fuer immer in DeletionRequested);
 //      der Boot-Guard macht die Fehlkonfiguration sichtbar, Binaries werden
@@ -94,8 +107,6 @@ export const fileRefExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
-let missingStorageWarned = false;
-
 // Resolve the per-tenant provider the forget orchestrator injected. A
 // resolution failure (no provider configured / configResolver absent) collapses
 // to `undefined` so the hook degrades to a row-only delete instead of throwing —
@@ -107,58 +118,95 @@ async function resolveProvider(ctx: UserDataHookCtx): Promise<UserDataStoragePro
     return await ctx.buildStorageProvider(ctx.tenantId);
   } catch {
     // skip: provider unresolvable (not configured) → fall through to row-only
-    // delete; warn-once below gives operator visibility, boot guard catches it.
+    // delete; the warn below gives operator visibility, boot guard catches it.
     return undefined;
   }
 }
 
-export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
-  if (strategy === "delete") {
-    const storageProvider = await resolveProvider(ctx);
-    if (storageProvider) {
-      const rows = await selectMany(ctx.db, fileRefsTable, {
-        tenantId: ctx.tenantId,
-        insertedById: ctx.userId,
-      });
-      const failedKeys: string[] = [];
-      for (const row of rows) {
-        const key = (row as Record<string, unknown>)["storageKey"]; // @cast-boundary db-row
-        if (typeof key !== "string" || key.length === 0) continue;
-        try {
-          await storageProvider.delete(key);
-        } catch (err) {
-          // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
-          console.warn(
-            `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
-          );
-          failedKeys.push(key);
-        }
-      }
-      // Fail-closed: abort before the row hard-delete so the sub-tx rolls back
-      // and the next forget run retries (delete is idempotent → converges).
-      if (failedKeys.length > 0) {
-        throw new Error(
-          `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
-        );
-      }
-    } else if (!missingStorageWarned) {
-      missingStorageWarned = true;
-      // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+// Delete every row's binary via the provider. Returns the keys whose delete
+// threw — the caller fails closed on a non-empty list so the sub-tx rolls back
+// and the next forget run retries (delete is idempotent → converges).
+async function deleteBinaries(
+  rows: readonly Record<string, unknown>[],
+  provider: UserDataStorageProvider,
+): Promise<readonly string[]> {
+  const failedKeys: string[] = [];
+  for (const row of rows) {
+    const key = row["storageKey"]; // @cast-boundary db-row
+    if (typeof key !== "string" || key.length === 0) continue;
+    try {
+      await provider.delete(key);
+    } catch (err) {
+      // biome-ignore lint/suspicious/noConsole: operator-visibility for binary-cleanup-failure
       console.warn(
-        "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
+        `[user-data-rights-defaults:fileRef] storage delete failed key=${key} err=${err instanceof Error ? err.message : String(err)}`,
+      );
+      failedKeys.push(key);
+    }
+  }
+  return failedKeys;
+}
+
+// Null the person-link on every row via the executor (event → rebuild-safe).
+// tdb: the executor needs a TenantDb (loadById → db.fetchOne), not the raw
+// ctx.db runner.
+async function severPersonLink(
+  tdb: TenantDb,
+  systemUser: SessionUser,
+  rows: readonly Record<string, unknown>[],
+): Promise<void> {
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.update({ id, changes: { insertedById: null } }, systemUser, tdb, {
+      skipOptimisticLock: true,
+    });
+  }
+}
+
+export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const rows = await selectMany<Record<string, unknown>>(ctx.db, fileRefsTable, {
+    tenantId: ctx.tenantId,
+    insertedById: ctx.userId,
+  });
+
+  if (strategy !== "delete") {
+    // anonymize: insertedById=null, FileRef + binary bleiben. Use-case: shared
+    // chat-Attachment im Multi-User-Channel — Author-ID raus, Datei bleibt sichtbar.
+    await severPersonLink(tdb, systemUser, rows);
+    // skip: anonymize is complete — the hard-delete path below runs only for strategy "delete".
+    return;
+  }
+
+  const storageProvider = await resolveProvider(ctx);
+  if (storageProvider) {
+    const failedKeys = await deleteBinaries(rows, storageProvider);
+    if (failedKeys.length > 0) {
+      throw new Error(
+        `[user-data-rights-defaults:fileRef] ${failedKeys.length} binary delete(s) failed — aborting forget so the rows are retried next run (keys: ${failedKeys.join(", ")})`,
       );
     }
-    await deleteMany(ctx.db, fileRefsTable, { tenantId: ctx.tenantId, insertedById: ctx.userId });
   } else {
-    // anonymize: insertedById=null, FileRef + binary bleiben.
-    // Use-case: shared chat-Attachment in einem Multi-User-Channel —
-    // Author-Identifikation raus, Datei bleibt fuer andere User
-    // sichtbar.
-    await updateMany(
-      ctx.db,
-      fileRefsTable,
-      { insertedById: null },
-      { tenantId: ctx.tenantId, insertedById: ctx.userId },
+    // No warn-once guard: a forget-cleanup cron runs rarely enough (not a hot
+    // path) that logging every occurrence is fine, and an operator who fixes the
+    // provider config mid-process sees the warning stop on the very next run —
+    // a module-level "warned once" flag would silence it for the rest of the
+    // process even after the misconfiguration is corrected.
+    // biome-ignore lint/suspicious/noConsole: misconfiguration visibility — disk-leak in forget-flow
+    console.warn(
+      "[user-data-rights-defaults:fileRef] no file provider resolvable from ctx.buildStorageProvider — file binaries are NOT deleted on forget (row-only delete). Mount file-foundation + a file-provider-* feature and set the provider config so erasure can reach the binaries.",
     );
   }
+  // Hard-purge each row via the executor forget-verb: emits fileRef.forgotten,
+  // which hard-deletes the row even though fileRef is softDelete — and, being an
+  // auto-verb, the erasure replays on rebuild (created → forgotten → row gone).
+  // The old hard deleteMany was resurrected on rebuild; this closes that Art.17
+  // hole without a direct write.
+  for (const row of rows) {
+    const id = row["id"]; // @cast-boundary db-row
+    if (typeof id !== "string") continue;
+    await crud.forget({ id }, systemUser, tdb);
+  }
 };

package/src/user-data-rights-defaults/hooks/user.userdata-hook.ts

@@ -1,5 +1,10 @@
-import { fetchOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type UserDataDeleteHook,
+  type UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   USER_ANONYMIZED_DISPLAY_NAME,
   USER_ANONYMIZED_EMAIL_DOMAIN,
@@ -7,9 +12,14 @@ import {
   USER_DELETED_DISPLAY_NAME,
   USER_DELETED_EMAIL_PREFIX,
   USER_STATUS,
+  userEntity,
   userTable,
 } from "../../user";
-import { anonymizeDeletedUser } from "../db/queries/user-hook";
+
+// Forget writes go through the executor (events), not a raw UPDATE: a
+// projection rebuild replays the events, so the anonymization survives it.
+// A direct write would be wiped on rebuild — the Art.17 hole this fixes.
+const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
 
 // userData-Hook fuer user-entity (S2.H1).
 //
@@ -63,27 +73,55 @@ export const userDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   // korrelieren — user.id ist tenant-agnostic (User kann in mehreren
   // Tenants Member sein), kein tenantId-Filter noetig.
 
+  // System actor + skipOptimisticLock: the forget pipeline has no read
+  // version and writes privileged identity columns ("system" is privileged).
+  // The executor needs a TenantDb (loadById → db.fetchOne); ctx.db is a raw
+  // runner, so wrap it. "system" mode = no tenant filter — user is a systemStream
+  // entity (tenant-agnostic) and forget must reach the row in any tenant.
+  const systemUser = createSystemUser(ctx.tenantId);
+  const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+
   if (strategy === "delete") {
-    await anonymizeDeletedUser(ctx.db, {
-      email: `${USER_DELETED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
-      displayName: USER_DELETED_DISPLAY_NAME,
-      status: USER_STATUS.Deleted,
-      userId: ctx.userId,
-    });
+    // PII raus + status=deleted (Login geblockt) via Event → Rebuild spielt den
+    // Forget mit. KEIN softDelete: user ist systemStream (eine tenant-agnostische
+    // Row), der Forget laeuft pro Tenant — wuerde isDeleted gesetzt, faende der
+    // loadById (isDeleted:false) die Row beim zweiten Tenant nicht mehr
+    // (not_found). status=Deleted blockt Login; die Row bleibt findbar +
+    // idempotent ueber mehrere Tenant-Durchlaeufe (wie der alte raw UPDATE).
+    await crud.update(
+      {
+        id: ctx.userId,
+        changes: {
+          email: `${USER_DELETED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
+          displayName: USER_DELETED_DISPLAY_NAME,
+          passwordHash: null,
+          status: USER_STATUS.Deleted,
+          // deleted_at as an audit timestamp only — NOT isDeleted (see above).
+          // Frozen into the event payload, so a rebuild replays the same value.
+          deletedAt: Temporal.Now.instant(),
+        },
+      },
+      systemUser,
+      tdb,
+      { skipOptimisticLock: true },
+    );
   } else {
     // anonymize: PII raus, aber Row bleibt active (damit FK-References
     // weiter aufloesbar sind). Account ist effektiv weiter nutzbar
     // wenn der User sich neu authentifiziert — pragmatisch akzeptabel
     // weil "anonymize" auf user-entity ein seltener Edge-Case ist
     // (typisch hard-delete fuer User).
-    await updateMany(
-      ctx.db,
-      userTable,
+    await crud.update(
       {
-        email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
-        displayName: USER_ANONYMIZED_DISPLAY_NAME,
+        id: ctx.userId,
+        changes: {
+          email: `${USER_ANONYMIZED_EMAIL_PREFIX}-${ctx.userId}@${USER_ANONYMIZED_EMAIL_DOMAIN}`,
+          displayName: USER_ANONYMIZED_DISPLAY_NAME,
+        },
       },
-      { id: ctx.userId },
+      systemUser,
+      tdb,
+      { skipOptimisticLock: true },
     );
   }
 };

package/src/user-profile/__tests__/profile-screen.test.tsx

@@ -88,6 +88,15 @@ describe("ProfileScreen", () => {
     expect(cardCount(view.getByTestId("profile-password"))).toBe(1);
   });
 
+  test("Passwort- und Email-Section rendern auf einem echten <form> (Enter-to-submit, Password-Manager-Boundary) (555/1)", async () => {
+    const view = renderProfile(activeMe);
+    await waitFor(() => {
+      if (view.queryByTestId("profile-screen") === null) throw new Error("not mounted yet");
+    });
+    expect(view.getByTestId("profile-password").tagName).toBe("FORM");
+    expect(view.getByTestId("profile-email").tagName).toBe("FORM");
+  });
+
   test("deletionRequested: Frist-Banner + Abbrechen statt Lösch-Button", async () => {
     const view = renderProfile({
       ...activeMe,

package/src/user-profile/handlers/change-email.write.ts

@@ -1,9 +1,13 @@
-import { access, createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createSystemUser,
+  defineWriteHandler,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
-import { getAggregateStreamTenant } from "@cosmicdrift/kumiko-framework/event-store";
 import { z } from "zod";
 import { AuthErrors, verifyPassword } from "../../auth-email-password";
-import { USER_FEATURE, UserErrors, UserHandlers, UserQueries } from "../../user";
+import { UserErrors, UserHandlers, UserQueries } from "../../user";
 import { UserProfileErrors } from "../constants";
 
 // Gleiche Failure-Shape wie auth-email-password (anti-enumeration):
@@ -66,11 +70,10 @@ export const changeEmailWrite = defineWriteHandler({
       );
     }
 
-    // Stream-Tenant-Auflösung wie in change-password: das user-Aggregate
-    // ist systemScope, sein Event-Stream kann in einem anderen Tenant
-    // liegen als die Session — optimistic locking braucht den echten.
-    const streamTenant = await getAggregateStreamTenant(ctx.db.raw, event.user.id, USER_FEATURE);
-    const writer = createSystemUser(streamTenant ?? event.user.tenantId);
+    // user ist systemStream (#497): der Event-Stream liegt deterministisch
+    // auf SYSTEM_TENANT_ID. Pre-#497-Streams brauchen einmalig
+    // backfillUserStreamTenants (#762).
+    const writer = createSystemUser(SYSTEM_TENANT_ID);
 
     const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
       id: me.id,

package/src/user-profile/web/profile-screen.tsx

@@ -59,7 +59,7 @@ function StatusBanner({ status }: { readonly status: SectionStatus }): ReactNode
 
 function ChangePasswordSection(): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button } = usePrimitives();
+  const { Form, Field, Input, Button } = usePrimitives();
   const dispatcher = useDispatcher();
   const [oldPassword, setOldPassword] = useState("");
   const [newPassword, setNewPassword] = useState("");
@@ -90,11 +90,12 @@ function ChangePasswordSection(): ReactNode {
 
   const submitting = status.kind === "submitting";
   return (
-    <Section
+    <Form
       testId="profile-password"
       title={t("profile.password.title")}
+      onSubmit={onSubmit}
       actions={
-        <Button onClick={() => onSubmit()} disabled={submitting} testId="profile-password-submit">
+        <Button type="submit" disabled={submitting} testId="profile-password-submit">
           {t("profile.password.submit")}
         </Button>
       }
@@ -136,7 +137,7 @@ function ChangePasswordSection(): ReactNode {
         />
       </Field>
       <StatusBanner status={status} />
-    </Section>
+    </Form>
   );
 }
 
@@ -148,7 +149,7 @@ function ChangeEmailSection({
   readonly onChanged: () => void;
 }): ReactNode {
   const t = useTranslation();
-  const { Section, Field, Input, Button } = usePrimitives();
+  const { Form, Field, Input, Button } = usePrimitives();
   const dispatcher = useDispatcher();
   const [newEmail, setNewEmail] = useState("");
   const [currentPassword, setCurrentPassword] = useState("");
@@ -192,16 +193,17 @@ function ChangeEmailSection({
 
   const submitting = status.kind === "submitting";
   return (
-    <Section
+    <Form
       testId="profile-email"
       title={t("profile.email.title")}
+      onSubmit={onSubmit}
       subtitle={
         <span data-testid="profile-email-current">
           {t("profile.email.current")}: {me.email}
         </span>
       }
       actions={
-        <Button onClick={() => onSubmit()} disabled={submitting} testId="profile-email-submit">
+        <Button type="submit" disabled={submitting} testId="profile-email-submit">
           {t("profile.email.submit")}
         </Button>
       }
@@ -231,7 +233,7 @@ function ChangeEmailSection({
         />
       </Field>
       <StatusBanner status={status} />
-    </Section>
+    </Form>
   );
 }
 

package/src/auth-email-password/stream-tenant.ts

@@ -1,31 +0,0 @@
-// user-feature runs with r.systemScope() but events land on a concrete
-// tenant stream. The row.version tracks whichever stream the user's last
-// modification wrote to — and that tenant is NOT discoverable from the
-// row alone.
-//
-// Strategy: prioritize lastActiveTenantId (most likely holds the latest
-// event), fall through to the remaining memberships in insertion order,
-// and let the caller try each one in sequence. The first stream whose
-// version matches row.version wins; the rest are bypassed.
-//
-// This is pragmatic — the real fix is to scope user events to
-// SYSTEM_TENANT_ID when the feature is r.systemScope(), which is a
-// framework-level change tracked separately. Until then, "try each
-// tenant the user belongs to" is robust against non-deterministic
-// memberships-query ordering (tenant:query:memberships has no ORDER BY).
-
-import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
-
-export function orderTenantsByPreference(
-  memberships: readonly { readonly tenantId: TenantId }[],
-  lastActiveTenantId: string | null | undefined,
-): TenantId[] {
-  if (memberships.length === 0) return [];
-  const ids = memberships.map((m) => m.tenantId);
-  if (!lastActiveTenantId) return ids;
-  // Move lastActiveTenantId to the front; preserve relative order of rest.
-  const preferred = ids.find((id) => id === lastActiveTenantId);
-  if (!preferred) return ids;
-  const rest = ids.filter((id) => id !== preferred);
-  return [preferred, ...rest];
-}

package/src/user-data-rights-defaults/db/queries/user-hook.ts

@@ -1,17 +0,0 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
-
-export async function anonymizeDeletedUser(
-  db: DbRunner,
-  params: {
-    readonly email: string;
-    readonly displayName: string;
-    readonly status: string;
-    readonly userId: string;
-  },
-): Promise<void> {
-  await asRawClient(db).unsafe(
-    'UPDATE "read_users" SET email = $1, display_name = $2, password_hash = $3, status = $4, deleted_at = now() WHERE id = $5',
-    [params.email, params.displayName, null, params.status, params.userId],
-  );
-}