@cosmicdrift/kumiko-bundled-features 0.126.0 → 0.128.0

package/src/tenant/screens.ts

@@ -16,7 +16,7 @@ export const tenantListScreen: EntityListScreenDefinition = {
   id: "tenant-list",
   type: "entityList",
   entity: "tenant",
-  columns: ["key", "name", "isEnabled"],
+  columns: ["key", "name", "status", "isEnabled"],
   rowActions: [
     {
       kind: "navigate",
@@ -26,7 +26,8 @@ export const tenantListScreen: EntityListScreenDefinition = {
       entityId: "id",
     },
   ],
-  searchable: false,
+  defaultSort: { field: "name", dir: "asc" },
+  searchable: true,
   access: { roles: ["SystemAdmin"] },
 };
 

package/src/tenant/web/members-screen.tsx

@@ -12,6 +12,8 @@ type MemberRow = {
   readonly id: string;
   readonly userId: string;
   readonly tenantId: string;
+  readonly email: string | null;
+  readonly displayName: string | null;
   readonly roles: readonly string[];
 };
 
@@ -131,8 +133,8 @@ export function MembersScreen({
           testId="members-active-table"
           columns={[
             {
-              field: "userId",
-              label: t("tenant.members.col.userId"),
+              field: "email",
+              label: t("tenant.members.col.email"),
               type: "string",
               sortable: false,
             },
@@ -145,7 +147,10 @@ export function MembersScreen({
           ]}
           rows={state.members.map((m) => ({
             id: m.id,
-            values: { userId: m.userId, roles: m.roles.join(", ") },
+            values: {
+              email: m.email ?? `${m.userId.slice(0, 8)}…`,
+              roles: m.roles.join(", "),
+            },
           }))}
         />
       </Card>

package/src/tenant-lifecycle/__tests__/tenant-lifecycle.integration.test.ts

@@ -4,6 +4,7 @@ import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   defineFeature,
+  EXT_EXTERNAL_RESOURCE,
   EXT_TENANT_DATA,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
@@ -18,6 +19,7 @@ import {
   setupTestStack,
   type TestStack,
   TestUsers,
+  testTenantId,
   unsafeCreateEntityTable,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
@@ -26,6 +28,7 @@ import {
   resetTestTables,
   updateRows,
 } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import {
   createComplianceProfilesFeature,
   tenantComplianceProfileEntity,
@@ -36,9 +39,11 @@ import { createConfigResolver } from "../../config/resolver";
 import { configValuesTable } from "../../config/table";
 import { createSessionsFeature } from "../../sessions";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
+import { tenantMembershipEntity, tenantMembershipsTable } from "../../tenant";
 import { TenantHandlers, TenantQueries } from "../../tenant/constants";
 import { createTenantFeature } from "../../tenant/feature";
 import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { seedTenantMembership } from "../../tenant/testing";
 import { createUserFeature } from "../../user/feature";
 import {
   TENANT_AGGREGATE_TYPE,
@@ -50,7 +55,8 @@ import {
   resolveTenantLifecycleGate,
   TenantLifecycleHandlers,
 } from "../index";
-import { runNextDestructionStage } from "../run-tenant-destroy";
+import { resetTenantLifecycleGateCacheForTests } from "../lifecycle-gate";
+import { runNextDestructionStage, runTenantDestructionSweep } from "../run-tenant-destroy";
 
 const REQUEST = TenantLifecycleHandlers.requestDestruction;
 const CANCEL = TenantLifecycleHandlers.cancelDestruction;
@@ -86,6 +92,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(db, tenantEntity);
   await unsafeCreateEntityTable(db, userSessionEntity);
   await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, tenantMembershipEntity);
   await createEventsTable(db);
   await unsafePushTables(db, { configValuesTable });
 });
@@ -96,10 +103,15 @@ afterAll(async () => {
 
 beforeEach(async () => {
   stack.events.reset();
+  // resetTestTables wipes rows via raw SQL, not through the write handlers
+  // that invalidate the lifecycle-gate cache — clear it too, or a later test
+  // reusing tenantAdmin.tenantId reads an earlier test's cached status.
+  resetTenantLifecycleGateCacheForTests();
   await resetTestTables(db, [
     tenantTable,
     tenantComplianceProfileTable,
     userSessionTable,
+    tenantMembershipsTable,
     eventsTable,
   ]);
 });
@@ -306,4 +318,152 @@ describe("tenant-lifecycle :: batch cancel exemption", () => {
     const rows = await selectMany(db, tenantTable, { id: tenantAdmin.tenantId });
     expect(rows[0]?.["status"]).toBe("active");
   });
+
+  test("batch mixing cancel with another command is NOT exempt (410)", async () => {
+    await seedTenant();
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+    const res = await stack.http.batch(
+      [
+        { type: CANCEL, payload: {} },
+        { type: SET_PROFILE, payload: { profileKey: "de-hr-dsgvo-hgb" } },
+      ],
+      tenantAdmin,
+    );
+    expect(res.status).toBe(410);
+
+    // Neither command ran — the tenant is still destroyRequested, not
+    // cancelled back to active.
+    const rows = await selectMany(db, tenantTable, { id: tenantAdmin.tenantId });
+    expect(rows[0]?.["status"]).toBe("destroyRequested");
+  });
+});
+
+describe("tenant-lifecycle :: full sweep pipeline", () => {
+  test("runTenantDestructionSweep drives destroyRequested -> destroyed, memberships forgotten", async () => {
+    await seedTenant();
+    const membership = await seedTenantMembership(db, {
+      userId: TestUsers.user.id,
+      tenantId: tenantAdmin.tenantId,
+      roles: ["User"],
+    });
+    await stack.http.writeOk(REQUEST, {}, tenantAdmin);
+
+    // Comfortably past any compliance profile's grace period, so the sweep's
+    // first loop flips destroyRequested -> destroying on the first tick.
+    const farFuture = getTemporal()
+      .Now.instant()
+      .add({ hours: 24 * 3650 });
+
+    let status = "";
+    for (let i = 0; i < 20; i++) {
+      await runTenantDestructionSweep({ db: stack.db, registry: stack.registry, now: farFuture });
+      const rows = await selectMany(db, tenantTable, { id: tenantAdmin.tenantId });
+      status = String(rows[0]?.["status"]);
+      if (status === "destroyed" || status === "destroyFailed") break;
+    }
+
+    expect(status).toBe("destroyed");
+
+    const memberships = await selectMany(db, tenantMembershipsTable, {
+      tenantId: tenantAdmin.tenantId,
+    });
+    expect(memberships).toHaveLength(0);
+
+    // Discriminates the fix from a raw deleteMany bypass — both empty the
+    // projection table, but only forget() through the executor leaves an
+    // event on the membership's own aggregate stream (rebuild-safe erasure).
+    const membershipEvents = await loadAggregate(db, membership.id, tenantAdmin.tenantId);
+    expect(membershipEvents.some((e) => e.type === "tenant-membership.forgotten")).toBe(true);
+
+    // Gate resolves the fresh status too — proves the cache was invalidated
+    // through every status transition, not just the final one.
+    const gate = await resolveTenantLifecycleGate(stack.db, tenantAdmin.tenantId);
+    expect(gate?.status).toBe("destroyed");
+  });
+});
+
+// One tenantId is set here per-test right before the sweep call — the hook
+// throws only for that tenant, letting a single stack exercise "one tenant's
+// destroy-hook fails, does that stall every OTHER destroying tenant's sweep
+// progress in the same tick?" without a second full stack.
+let selectivePoisonTargetTenantId: TenantId | null = null;
+
+function createSelectivePoisonTenantDataFeature() {
+  return defineFeature("test-selective-poison-tenant-data", (r) => {
+    r.requires("tenant-lifecycle");
+    // EXT_EXTERNAL_RESOURCE — the pipeline's FIRST stage — so the poison
+    // fires on the very first sweep tick instead of several stages in.
+    r.useExtension(EXT_EXTERNAL_RESOURCE, "selective-poison-pill", {
+      destroyTenant: async (tenantId: TenantId) => {
+        if (tenantId === selectivePoisonTargetTenantId) {
+          throw new Error("selective-poison");
+        }
+      },
+    });
+  });
+}
+
+describe("tenant-lifecycle :: sweep isolates one tenant's failure from another's progress", () => {
+  let isolationStack: TestStack;
+  const tenantA = tenantAdmin.tenantId; // poisoned
+  const tenantB = testTenantId(9002); // healthy
+
+  beforeAll(async () => {
+    const encryption = createTestEnvelopeCipher(randomBytes(32).toString("base64"));
+    const resolver = createConfigResolver({ cipher: encryption });
+    isolationStack = await setupTestStack({
+      features: [
+        createConfigFeature(),
+        createTenantFeature(),
+        createComplianceProfilesFeature(),
+        createTenantLifecycleFeature(),
+        createSelectivePoisonTenantDataFeature(),
+      ],
+      extraContext: { configResolver: resolver, configEncryption: encryption },
+    });
+    await unsafeCreateEntityTable(isolationStack.db, tenantEntity);
+    await unsafeCreateEntityTable(isolationStack.db, tenantComplianceProfileEntity);
+    await createEventsTable(isolationStack.db);
+    await unsafePushTables(isolationStack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await isolationStack.cleanup();
+  });
+
+  async function seedDestroyingTenant(id: TenantId): Promise<void> {
+    await isolationStack.http.writeOk(
+      TenantHandlers.create,
+      { id, key: `acme-${id.slice(-4)}`, name: "ACME Corp" },
+      TestUsers.systemAdmin,
+    );
+    await isolationStack.http.writeOk(
+      SET_PROFILE,
+      { profileKey: "eu-dsgvo" },
+      { ...tenantAdmin, tenantId: id },
+    );
+    await updateRows(isolationStack.db, tenantTable, { status: "destroying" }, { id });
+  }
+
+  test("tenant A's poisoned destroy-hook does not block tenant B's sweep progress", async () => {
+    selectivePoisonTargetTenantId = tenantA;
+    await seedDestroyingTenant(tenantA);
+    await seedDestroyingTenant(tenantB);
+
+    const result = await runTenantDestructionSweep({
+      db: isolationStack.db,
+      registry: isolationStack.registry,
+    });
+
+    // A's first stage ("external-resources") throws every attempt — not
+    // counted as advanced. B has no poison, so it does advance. If A's
+    // failure aborted the sweep loop (the pre-fix behavior), B would never
+    // be reached and this would be 0.
+    expect(result.advanced).toBe(1);
+
+    const rowB = await selectMany(isolationStack.db, tenantTable, { id: tenantB });
+    expect(rowB[0]?.["status"]).toBe("destroying"); // still mid-pipeline, but progressed
+    const eventsB = await loadAggregate(isolationStack.db, tenantB, tenantB);
+    expect(eventsB.some((e) => e.type.endsWith("tenant-destruction-stage-succeeded"))).toBe(true);
+  });
 });

package/src/tenant-lifecycle/feature.ts

@@ -89,6 +89,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           db: ctx.db as import("@cosmicdrift/kumiko-framework/db").DbConnection,
           registry: ctx.registry,
           now: T.Now.instant(),
+          log: (message) => ctx.log?.warn(message),
         });
       },
     );

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -6,6 +6,7 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_CANCELLED_EVENT_QN } from "../constants";
+import { invalidateTenantLifecycleGate } from "../lifecycle-gate";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
 
@@ -59,6 +60,7 @@ export const cancelDestructionWrite = defineWriteHandler({
       { skipOptimisticLock: true },
     );
     if (!update.isSuccess) return update;
+    invalidateTenantLifecycleGate(tenantId);
 
     await ctx.unsafeAppendEvent({
       aggregateId: tenantId,

package/src/tenant-lifecycle/handlers/request-destruction.write.ts

@@ -9,6 +9,7 @@ import { resolveProfileForTenant } from "../../compliance-profiles";
 import { type TenantLifecycleStatus, tenantEntity, tenantTable } from "../../tenant";
 import { DESTRUCTION_REQUESTED_EVENT_QN } from "../constants";
 import { revokeTenantSessions } from "../lib/revoke-tenant-sessions";
+import { invalidateTenantLifecycleGate } from "../lifecycle-gate";
 
 const crud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
 
@@ -54,6 +55,7 @@ export const requestDestructionWrite = defineWriteHandler({
       { skipOptimisticLock: true },
     );
     if (!update.isSuccess) return update;
+    invalidateTenantLifecycleGate(tenantId);
 
     await ctx.unsafeAppendEvent({
       aggregateId: tenantId,

package/src/tenant-lifecycle/lifecycle-gate.ts

@@ -0,0 +1,58 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { tenantTable } from "../tenant";
+
+export type TenantLifecycleGate = {
+  readonly status: string;
+  readonly gracePeriodEnd: string | null;
+};
+
+// Every authenticated + anonymous request consults this (via auth-middleware's
+// resolveTenantLifecycleStatus) — a per-request DB round-trip otherwise. No
+// TTL: status must be observable the instant it changes (a stale "active"
+// read after tombstoning would let a request slip through the 410 gate), so
+// this is invalidated explicitly by every status-changing write —
+// request/cancel-destruction, the sweep, and tombstoneTenantRow all call
+// invalidateTenantLifecycleGate(tenantId) right after their update succeeds.
+// Split into its own module (not run-tenant-destroy.ts) so stages.ts can
+// invalidate too without a stages.ts <-> run-tenant-destroy.ts import cycle.
+// ponytail: unbounded Map — fine while tenant counts stay in the thousands (a
+// few bytes/entry); swap for a bounded LRU if that ever changes.
+const gateCache = new Map<TenantId, TenantLifecycleGate | null>();
+
+export function invalidateTenantLifecycleGate(tenantId: TenantId): void {
+  gateCache.delete(tenantId);
+}
+
+/** @internal test-only — resetTestTables/resetTestTable wipe rows directly
+ *  via SQL, bypassing the write handlers that invalidate normally. Tests
+ *  that reset tenantTable (and reuse a fixed tenantId across cases) must
+ *  call this in beforeEach or a later test can read an earlier test's
+ *  cached status for the same tenantId. */
+export function resetTenantLifecycleGateCacheForTests(): void {
+  gateCache.clear();
+}
+
+export async function resolveTenantLifecycleGate(
+  db: DbRunner,
+  tenantId: TenantId,
+): Promise<TenantLifecycleGate | null> {
+  if (gateCache.has(tenantId)) return gateCache.get(tenantId) ?? null;
+  const rows = await selectMany<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
+    db,
+    tenantTable,
+    { id: tenantId },
+  );
+  const row = rows[0];
+  if (!row) {
+    gateCache.set(tenantId, null);
+    return null;
+  }
+  const gate: TenantLifecycleGate = {
+    status: row.status,
+    gracePeriodEnd: row.gracePeriodEnd?.toString() ?? null,
+  };
+  gateCache.set(tenantId, gate);
+  return gate;
+}

package/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -23,6 +23,7 @@ import {
   TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
   TENANT_DESTRUCTION_STARTED_EVENT_SHORT,
 } from "./constants";
+import { invalidateTenantLifecycleGate } from "./lifecycle-gate";
 import { type DestructionStageCtx, isDestructionPipelineComplete, pickNextStage } from "./stages";
 
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
@@ -148,6 +149,7 @@ async function markTenantDestroyFailed(db: DbRunner, tenantId: TenantId): Promis
     scopedDb,
     { skipOptimisticLock: true },
   );
+  invalidateTenantLifecycleGate(tenantId);
 }
 
 async function haltPipelineOnAbandon(args: {
@@ -156,16 +158,20 @@ async function haltPipelineOnAbandon(args: {
   readonly stage: string;
   readonly attempts: number;
   readonly error: string;
-  readonly expectedVersion: number;
 }): Promise<void> {
   const T = getTemporal();
   const failedAt = T.Now.instant();
+  // Reload fresh instead of trusting a caller-supplied version: the failed
+  // stage's own run() may have appended to this same aggregate (e.g.
+  // tombstoneTenantRow's tenantCrud.update) before throwing, so any version
+  // captured earlier in the pipeline is stale and would VersionConflict here.
+  const eventsBeforeAbandon = await loadAggregate(args.db, args.tenantId, args.tenantId);
   await appendTenantStageEvent(
     args.db,
     args.tenantId,
     qualified(TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT),
     { stage: args.stage, attempts: args.attempts, error: args.error },
-    args.expectedVersion,
+    lastEventVersion(eventsBeforeAbandon),
   );
   const eventsAfterAbandon = await loadAggregate(args.db, args.tenantId, args.tenantId);
   const versionAfterAbandon = lastEventVersion(eventsAfterAbandon);
@@ -243,14 +249,19 @@ export async function runNextDestructionStage(args: {
 
   try {
     await next.run(ctx);
+    // next.run() may itself have appended events to this aggregate (e.g.
+    // tombstoneTenantRow updates the tenant row on the same stream) — reload
+    // the version fresh instead of trusting the pre-run `version`, or this
+    // append throws VersionConflictError on every stage whose run() writes.
+    const eventsAfterRun = await loadAggregate(args.db, args.tenantId, args.tenantId);
     version = await appendTenantStageEventIdempotent(
       args.db,
       args.tenantId,
       qualified(TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT),
       { stage: next.name, attempts: attempt },
-      version,
+      lastEventVersion(eventsAfterRun),
       stageOutcomeRecorded(
-        await loadAggregate(args.db, args.tenantId, args.tenantId),
+        eventsAfterRun,
         next.name,
         TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
       ),
@@ -269,7 +280,6 @@ export async function runNextDestructionStage(args: {
         stage: next.name,
         attempts: attempt,
         error: message,
-        expectedVersion: version,
       });
       return { done: false, error: message, halted: true };
     }
@@ -289,6 +299,7 @@ export async function runTenantDestructionSweep(args: {
   readonly db: DbRunner;
   readonly registry: Registry;
   readonly now?: Temporal.Instant;
+  readonly log?: (message: string) => void;
 }): Promise<{ readonly triggered: number; readonly advanced: number }> {
   const T = getTemporal();
   const now = args.now ?? T.Now.instant();
@@ -302,23 +313,26 @@ export async function runTenantDestructionSweep(args: {
     const tenantId = row.id as TenantId;
     const events = await loadAggregate(args.db, tenantId, tenantId);
     const version = lastEventVersion(events);
+    const user = createSystemUser(tenantId);
+    const scopedDb = createTenantDb(args.db, tenantId, "system");
+    // Version-guarded (no skipOptimisticLock): a concurrent cancel-destruction
+    // between the `due` select above and this write also appends to the same
+    // tenant stream, so an unguarded overwrite here would silently revert the
+    // cancellation. A version conflict means we lost that race — skip, the
+    // tenant is no longer due and the next tick re-evaluates it.
+    const result = await tenantCrud.update(
+      { id: tenantId, version, changes: { status: "destroying", destroyStartedAt: now } },
+      user,
+      scopedDb,
+    );
+    if (!result.isSuccess) continue;
+    invalidateTenantLifecycleGate(tenantId);
     await appendTenantStageEvent(
       args.db,
       tenantId,
       qualified(TENANT_DESTRUCTION_STARTED_EVENT_SHORT),
       { startedAt: now.toString() },
-      version,
-    );
-    const user = createSystemUser(tenantId);
-    const scopedDb = createTenantDb(args.db, tenantId, "system");
-    await tenantCrud.update(
-      {
-        id: tenantId,
-        changes: { status: "destroying", destroyStartedAt: now },
-      },
-      user,
-      scopedDb,
-      { skipOptimisticLock: true },
+      version + 1,
     );
     triggered++;
   }
@@ -328,30 +342,27 @@ export async function runTenantDestructionSweep(args: {
     status: "destroying",
   });
   for (const row of destroying) {
-    const result = await runNextDestructionStage({
-      db: args.db,
-      registry: args.registry,
-      tenantId: row.id as TenantId,
-    });
-    if (!result.error && !result.halted) advanced++;
+    try {
+      const result = await runNextDestructionStage({
+        db: args.db,
+        registry: args.registry,
+        tenantId: row.id as TenantId,
+        log: args.log,
+      });
+      if (!result.error && !result.halted) advanced++;
+    } catch (err) {
+      // Isolate the failure to this tenant — an uncaught throw here must not
+      // abort the whole sweep tick and starve every other "destroying" tenant
+      // of progress. The tenant stays "destroying" and the next tick retries.
+      args.log?.(
+        `[tenant-lifecycle] sweep: unexpected error advancing tenant ${row.id}: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
   }
 
   return { triggered, advanced };
 }
 
-export async function resolveTenantLifecycleGate(
-  db: DbRunner,
-  tenantId: TenantId,
-): Promise<{ status: string; gracePeriodEnd: string | null } | null> {
-  const rows = await selectMany<{ status: string; gracePeriodEnd: Temporal.Instant | null }>(
-    db,
-    tenantTable,
-    { id: tenantId },
-  );
-  const row = rows[0];
-  if (!row) return null;
-  return {
-    status: row.status,
-    gracePeriodEnd: row.gracePeriodEnd?.toString() ?? null,
-  };
-}
+export { invalidateTenantLifecycleGate, resolveTenantLifecycleGate } from "./lifecycle-gate";

package/src/tenant-lifecycle/stages.ts

@@ -4,8 +4,6 @@ import {
   createEventStoreExecutor,
   createTenantDb,
   type DbRunner,
-  deleteMany,
-  type EntityTableMeta,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createSystemUser,
@@ -18,8 +16,14 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
-import { tenantEntity, tenantMembershipsTable, tenantTable } from "../tenant";
+import {
+  tenantEntity,
+  tenantMembershipEntity,
+  tenantMembershipsTable,
+  tenantTable,
+} from "../tenant";
 import type { TenantDestructionStageName } from "./constants";
+import { invalidateTenantLifecycleGate } from "./lifecycle-gate";
 
 export type DestructionStageCtx = {
   readonly db: DbRunner;
@@ -35,6 +39,13 @@ export type DestructionStage = {
 };
 
 const tenantCrud = createEventStoreExecutor(tenantTable, tenantEntity, { entityName: "tenant" });
+const tenantMembershipCrud = createEventStoreExecutor(
+  tenantMembershipsTable,
+  tenantMembershipEntity,
+  {
+    entityName: "tenant-membership",
+  },
+);
 
 async function runExtensionDestroyHooks(
   registry: Registry,
@@ -96,6 +107,27 @@ async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<void> {
   const now = getTemporal().Now.instant();
   const user = createSystemUser(ctx.tenantId);
   const db = createTenantDb(ctx.db, ctx.tenantId, "system");
+  // Per-row forget() through the executor, not a bulk deleteMany: memberships
+  // are an ES-managed projection (add/remove/update-roles all go through
+  // tenantMembershipCrud), so a raw table write here is eventless — a future
+  // projection rebuild would replay the historical add-member events and
+  // resurrect rows this stage removed. forget() (Art.17 hard-purge) keeps the
+  // erasure rebuild-safe and gives each membership its own audit event.
+  const memberships = await selectMany<{ id: string }>(ctx.db, tenantMembershipsTable, {
+    tenantId: ctx.tenantId,
+  });
+  for (const membership of memberships) {
+    const result = await tenantMembershipCrud.forget({ id: membership.id }, user, db);
+    // executor writes return {isSuccess:false} on failure, they don't throw —
+    // a silently-discarded result here would report this stage "succeeded"
+    // while membership PII survives. Throw so the pipeline's retry/abandon
+    // handling (runNextDestructionStage) sees it instead.
+    if (!result.isSuccess) {
+      throw new Error(
+        `tenant-lifecycle: failed to forget membership ${membership.id} for tenant ${ctx.tenantId}: ${result.error.message}`,
+      );
+    }
+  }
   await tenantCrud.update(
     {
       id: ctx.tenantId,
@@ -109,9 +141,7 @@ async function tombstoneTenantRow(ctx: DestructionStageCtx): Promise<void> {
     db,
     { skipOptimisticLock: true },
   );
-  await deleteMany(ctx.db, tenantMembershipsTable as EntityTableMeta, {
-    tenantId: ctx.tenantId,
-  });
+  invalidateTenantLifecycleGate(ctx.tenantId);
 }
 
 export const DESTRUCTION_STAGES: readonly DestructionStage[] = [

package/src/tier-engine/feature.ts

@@ -73,6 +73,7 @@ import { tierAssignmentEntity } from "./entity";
 import { getActiveTierQuery } from "./handlers/active-tier.query";
 import { getTenantTierQuery } from "./handlers/get-tenant-tier.query";
 import { createSetTenantTierWrite } from "./handlers/set-tenant-tier.write";
+import { TIER_ENGINE_I18N } from "./i18n";
 import { isTrialActive, type TrialPolicy } from "./trial";
 
 // Drizzle-table for the tier-assignment-entity. Built once at module-load
@@ -234,6 +235,7 @@ export function createTierEngineFeature<
     // verdrahtet (Platform-Admin-Hoheit, nicht App-konfigurierbar). App
     // platziert ihn nur via r.nav("tier-engine:screen:tier-admin"); die
     // Komponente liefert tierEngineClient() aus dem ./web-subpath.
+    r.translations({ keys: TIER_ENGINE_I18N });
     r.screen({
       id: TIER_ADMIN_SCREEN_ID,
       type: "custom",

package/src/tier-engine/i18n.ts

@@ -5,8 +5,15 @@
 
 import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TIER_ENGINE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tier-admin.title": { de: "Tier manuell zuweisen", en: "Assign tier manually" },
+};
+
 export const defaultTranslations: TranslationsByLocale = {
   de: {
+    "screen:tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.title": "Tier manuell zuweisen",
     "tier-admin.explainer":
       "Weise einem Tenant ein Tier ohne Kauf zu. Der Grant wird als „manuell“ markiert und von einem späteren Billing-Sync nicht überschrieben.",
@@ -22,6 +29,7 @@ export const defaultTranslations: TranslationsByLocale = {
       "Diese App hat keine TierMap konfiguriert — es gibt keine zuweisbaren Tiers.",
   },
   en: {
+    "screen:tier-admin.title": "Assign tier manually",
     "tier-admin.title": "Assign tier manually",
     "tier-admin.explainer":
       "Grant a tenant a tier without a purchase. The grant is marked as “manual” and a later billing sync won't overwrite it.",