@cosmicdrift/kumiko-bundled-features 0.146.4 → 0.147.1

package/src/billing-foundation/tenant-destroy-hook.ts

@@ -6,12 +6,11 @@ import { subscriptionAggregateId } from "./aggregate-id";
 import { SUBSCRIPTION_AGGREGATE_TYPE } from "./events";
 import { subscriptionsProjectionTable } from "./projection";
 
-// No field-level encryption is wired up for `read_subscriptions` (see
-// entities.ts) — a crypto-shredding retention strategy would need that built
-// first (envelope-encrypt on write, decrypt on every read call site, backfill
-// existing rows). Redaction achieves the same GDPR outcome without it: HGB
-// needs the accounting facts (status/tier/period), not the Stripe/Mollie
-// subject identifiers.
+// providerCustomerId/providerSubscriptionId are `tenantOwned: true` on the
+// entity (envelope-encrypted with the tenant subject key, see entities.ts) —
+// eraseSubjectKeys crypto-shreds them for tenants that hard-delete. HGB
+// can not: it needs the accounting facts (status/tier/period) to survive, so
+// it redacts the projection row directly instead of relying on key erasure.
 const REDACTED_PII_VALUE = "[erased]";
 
 /** Tenant-destroy hook for billing PII (#800). HGB retains the accounting

package/src/cap-counter/__tests__/with-cap-enforcement.integration.test.ts

@@ -170,10 +170,11 @@ describe("withCapEnforcement — calendar", () => {
     const beforeBlocked = await readCounter(admin, "newsletter-cap", PERIOD);
     expect(beforeBlocked!["value"]).toBe(6);
 
-    // 7. send: pre-call sieht value=6 ≥ hard=6 → CapExceededError, der
-    // dispatcher wickelt's als internal_error mit causeName=CapExceededError.
+    // 7. send: pre-call sieht value=6 ≥ hard=6 → CapExceededError (extends
+    // KumikoError) → dispatcher mapped auto auf 429 + cap_exceeded.
     const error = await stack.http.writeErr(NEWSLETTER_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(error)).toMatch(/CapExceededError/);
+    expect(error.code).toBe("cap_exceeded");
+    expect(error.httpStatus).toBe(429);
 
     // Drift-Pin: handler darf NICHT gelaufen sein (sendCallCount unverändert)
     expect(sendCallCount).toBe(6);
@@ -231,7 +232,8 @@ describe("withRollingCapEnforcement — rolling", () => {
     expect(sendCallCount).toBe(6);
 
     const error = await stack.http.writeErr(NEWSLETTER_ROLLING_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(error)).toMatch(/CapExceededError/);
+    expect(error.code).toBe("cap_exceeded");
+    expect(error.httpStatus).toBe(429);
     expect(sendCallCount).toBe(6); // handler wurde NICHT erneut aufgerufen
   });
 
@@ -270,7 +272,8 @@ describe("withRollingCapEnforcement — rolling", () => {
     expect(sendCallCount).toBe(7);
 
     const blocked = await stack.http.writeErr(NEWSLETTER_ROLLING_QN, { to: "blocked@x.de" }, admin);
-    expect(JSON.stringify(blocked)).toMatch(/CapExceededError/);
+    expect(blocked.code).toBe("cap_exceeded");
+    expect(blocked.httpStatus).toBe(429);
     expect(sendCallCount).toBe(7); // wrapper hat den blockierten handler NICHT gerufen
   });
 });

package/src/cap-counter/enforce-cap.ts

@@ -1,4 +1,5 @@
 import { createEntityExecutor, type HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import { KumikoError } from "@cosmicdrift/kumiko-framework/errors";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import { rollingCapAggregateId } from "./aggregate-id";
 import {
@@ -81,8 +82,8 @@ export type EnforceCapResult =
  *
  * **Throws** `CapExceededError` when value ≥ hard-threshold. Pre-save
  * hooks call this BEFORE the actual write — the throw rolls back the
- * transaction, the dispatcher maps the error to HTTP 429 with the
- * upgrade-hint shape (see CapExceededError below).
+ * transaction; `CapExceededError` extends `KumikoError` so the dispatcher
+ * auto-maps it to HTTP 429 (see CapExceededError below).
  *
  * **Sync read implication:** the counter reflects the state at this
  * exact transaction. Two parallel writes can each see "value < hard"
@@ -222,30 +223,26 @@ export async function enforceRollingCap(
 // =============================================================================
 
 /**
- * Thrown by enforceCap when value ≥ hard-threshold. Includes enough
- * context for the HTTP layer to render an actionable 429 — `code`
- * matches the framework's error-contract pattern (kebab + scope).
- *
- * Caller-side mapping example (in your dispatcher error-handler):
- *   if (err instanceof CapExceededError) {
- *     return c.json(
- *       { error: { code: err.code, message: err.message, capName: err.capName, ... } },
- *       429,
- *     );
- *   }
+ * Thrown by enforceCap/enforceRollingCap when value ≥ hard-threshold.
+ * Extends `KumikoError` — the dispatcher auto-maps this to HTTP 429
+ * with `code: "cap_exceeded"`, no caller-side catch needed.
  */
-export class CapExceededError extends Error {
+export class CapExceededError extends KumikoError {
   readonly code = "cap_exceeded" as const;
+  readonly httpStatus = 429;
+
   constructor(
     readonly capName: string,
     readonly limit: number,
     readonly currentValue: number,
     readonly tolerance: CapToleranceProfile,
   ) {
-    super(
-      `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
-    );
-    this.name = "CapExceededError";
+    super({
+      message: `Cap "${capName}" exceeded: current=${currentValue}, limit=${limit}, hard-threshold=${limit * tolerance.hard}. Upgrade tier or wait for next period reset.`,
+      i18nKey: "errors.cap.exceeded",
+      i18nParams: { capName, limit, currentValue },
+      details: { capName, limit, currentValue, tolerance },
+    });
   }
 }
 

package/src/cap-counter/with-cap-enforcement.ts

@@ -87,8 +87,8 @@ export function withCapEnforcement(
     handler: async (event, ctx) => {
       const cap = await capResolver(event, ctx);
 
-      // Pre-enforce. Hard-hit throws CapExceededError; the dispatcher
-      // maps it to HTTP 429 + cap_exceeded code. Soft-hit-crossing
+      // Pre-enforce. Hard-hit throws CapExceededError (extends KumikoError,
+      // dispatcher auto-maps to HTTP 429 + cap_exceeded). Soft-hit-crossing
       // notifies via the supplied notifier + flips lastSoftWarnedAt.
       await enforceCapAndMaybeNotify(ctx, {
         capName: cap.capName,

package/src/config/__tests__/deserialize-value.test.ts

@@ -29,8 +29,8 @@ describe("deserializeValue", () => {
       expect(deserializeValue("true", "number")).toBe(1);
     });
 
-    test("an uncoercible value yields NaN rather than throwing", () => {
-      expect(deserializeValue('"abc"', "number")).toBeNaN();
+    test("an uncoercible value throws instead of silently returning NaN", () => {
+      expect(() => deserializeValue('"abc"', "number")).toThrow(/does not deserialize to a number/);
     });
   });
 

package/src/config/resolver.ts

@@ -36,8 +36,13 @@ export function deserializeValue(
   if (raw === null || raw === undefined) return undefined;
   const parsed = parseJsonOrThrow<unknown>(raw, `config value (type=${type})`);
   switch (type) {
-    case "number":
-      return typeof parsed === "number" ? parsed : Number(parsed);
+    case "number": {
+      const n = typeof parsed === "number" ? parsed : Number(parsed);
+      if (!Number.isFinite(n)) {
+        throw new Error(`config value (type=number): "${raw}" does not deserialize to a number.`);
+      }
+      return n;
+    }
     case "boolean":
       return typeof parsed === "boolean" ? parsed : parsed === "true";
     case "text":

package/src/custom-fields/__tests__/field-access.integration.test.ts

@@ -324,4 +324,29 @@ describe("fail-closed on corrupt serialized_field", () => {
       fieldKey: "corruptField",
     });
   });
+
+  test("set: legacy `sensitive`-key definition (#972) → unprocessable field_definition_corrupt, not a 500", async () => {
+    const propertyId = "99999999-9999-4000-8000-000000000009";
+    await defineField("legacyPii", { type: "text" });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_custom_field_definitions SET serialized_field = '{"type":"text","sensitive":true}' WHERE field_key = 'legacyPii'`,
+    );
+    await stack.http.writeOk(
+      "property-t15b:write:property:create",
+      { id: propertyId, name: "LegacySensitive" },
+      tenantAdmin,
+    );
+
+    const err = await stack.http.writeErr(
+      "custom-fields:write:set-custom-field",
+      { entityName: "property", entityId: propertyId, fieldKey: "legacyPii", value: "X-42" },
+      tenantAdmin,
+    );
+
+    expect(err.code).toBe("unprocessable");
+    expect(err.details).toMatchObject({
+      reason: "field_definition_corrupt",
+      fieldKey: "legacyPii",
+    });
+  });
 });

package/src/custom-fields/__tests__/retention.integration.test.ts

@@ -337,4 +337,44 @@ describe("T1.5d: per-field retention sweep", () => {
     expect(cf).not.toHaveProperty("temp");
     expect(cf["liveEdit"]).toBe("written-mid-sweep");
   });
+
+  test("#975: a legacy field with the removed `sensitive` key is skipped, not fatal to the sweep", async () => {
+    const propertyId = "88888888-8888-4000-8000-000000000008";
+    await defineField("temp", {
+      type: "text",
+      retention: { keepFor: "30d", strategy: "delete" },
+    });
+    // Pre-#972 legacy definition — parseSerializedField throws on `sensitive`.
+    // Simulate a pre-#972 legacy definition: define normally (valid shape),
+    // then rewrite the stored column directly — write-time validation would
+    // reject `sensitive` today, but legacy rows written before #972 exist.
+    await defineField("legacyPii", { type: "text" });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_custom_field_definitions SET serialized_field = '{"type":"text","sensitive":true}' WHERE field_key = 'legacyPii' AND entity_name = 'property'`,
+    );
+    await createProperty(propertyId, "LegacyMix");
+    await setField(propertyId, "temp", "expired-value");
+    // setField would now be denied (fail-closed on the corrupt/legacy
+    // definition) — write the value directly to simulate data that was
+    // already stored before #972 removed `sensitive` support.
+    await asRawClient(stack.db).unsafe(
+      `UPDATE read_t15d_properties SET custom_fields = custom_fields || '{"legacyPii":"untouched-value"}'::jsonb WHERE id = $1`,
+      [propertyId],
+    );
+    await stack.eventDispatcher?.runOnce();
+    await backdateRow(propertyId, "2026-04-22T10:00:00Z");
+
+    const report = await runCustomFieldsRetention({
+      db: stack.db,
+      tenantId: admin.tenantId,
+      entityName: "property",
+      entityTable: propertyTable,
+      now: NOW,
+    });
+
+    expect(report.rowsUpdated).toBe(1);
+    const cf = (await readRow(propertyId))?.["custom_fields"] as Record<string, unknown>;
+    expect(cf).not.toHaveProperty("temp");
+    expect(cf["legacyPii"]).toBe("untouched-value");
+  });
 });

package/src/custom-fields/lib/field-access.ts

@@ -29,7 +29,14 @@ export async function loadFieldDefinition(
 ): Promise<LoadedFieldDefinition> {
   const serialized = await selectSerializedFieldDefinition(db, tenantId, entityName, fieldKey);
   if (serialized === null) return { found: false };
-  return { found: true, field: parseSerializedField(serialized) };
+  // parseSerializedField throws on a #972 legacy `sensitive` definition —
+  // that's a corrupt/unprocessable row from this write-gate's perspective,
+  // same fail-closed treatment as a shape that fails isShape().
+  try {
+    return { found: true, field: parseSerializedField(serialized) };
+  } catch {
+    return { found: true, field: null };
+  }
 }
 
 // Pure access-check on an already-loaded definition. Returns the required

package/src/custom-fields/run-retention.ts

@@ -158,7 +158,15 @@ async function loadRetentionPolicies(
   for (const raw of rows) {
     // skip: see asHostRow rationale.
     if (!isFieldDefinitionRow(raw)) continue;
-    const parsed = parseSerializedField(raw.serialized_field);
+    // parseSerializedField throws on a #972 legacy `sensitive` definition —
+    // one unmigrated field must not abort the whole tenant's retention sweep
+    // for every other field; skip it (no retention policy to apply anyway).
+    let parsed: ReturnType<typeof parseSerializedField>;
+    try {
+      parsed = parseSerializedField(raw.serialized_field);
+    } catch {
+      continue;
+    }
     if (parsed?.retention) {
       out.set(raw.field_key, parsed.retention);
     }

package/src/data-retention/__tests__/parse-override.test.ts

@@ -50,6 +50,7 @@ describe("parseRetentionOverrideOrNull", () => {
   test("each dropped value surfaces exactly one operator warning", () => {
     const warn = spyOn(console, "warn").mockImplementation(() => {});
     parse("{not json");
+    expect(warn).toHaveBeenCalledTimes(1);
     parse('{"strategy":"delete"}');
     expect(warn).toHaveBeenCalledTimes(2);
   });

package/src/inbound-mail-foundation/__tests__/inbound-mail-foundation.integration.test.ts

@@ -12,7 +12,7 @@
 //   - Crypto-Shredding: Subject-Key-Erase macht Payload unlesbar (#800)
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   configurePiiSubjectKms,
@@ -23,7 +23,12 @@ import {
   resetPiiSubjectKmsForTests,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { createEventsTable, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  append,
+  createEventsTable,
+  getStreamVersion,
+  loadAggregate,
+} from "@cosmicdrift/kumiko-framework/event-store";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
@@ -43,6 +48,11 @@ import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { inboundMessageAggregateId, mailThreadAggregateId } from "../aggregate-id";
 import { InboundMailFoundationHandlers, InboundMailFoundationQueries } from "../constants";
 import { seenMessageEntity, syncCursorEntity } from "../entities";
+import {
+  MAIL_THREAD_AGGREGATE_TYPE,
+  MAIL_THREAD_UPDATED_EVENT_QN,
+  type MailThreadEventPayload,
+} from "../events";
 import { inboundMailFoundationFeature } from "../feature";
 import {
   inboundMessagesProjectionTable,
@@ -240,6 +250,75 @@ describe("scenario 2: ingest-message — Dedup + Thread-Rollup", () => {
   });
 });
 
+describe("scenario 2b: ingest-message — Thread-Rollup selbstkorrigierend statt kumulativ", () => {
+  test("nach einem Race-verzerrten (zu niedrigen) messageCount-Event korrigiert der naechste ingest auf den echten Row-Count", async () => {
+    const admin = adminFor(4021);
+    const accountId = await connectSharedAccount(admin);
+
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "self-heal-root",
+        messageIdHeader: "self-heal-root@example.com",
+      }),
+      admin,
+    );
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "self-heal-reply-1",
+        messageIdHeader: "self-heal-reply-1@example.com",
+        references: ["self-heal-root@example.com"],
+      }),
+      admin,
+    );
+    const threadAggId = mailThreadAggregateId(admin.tenantId, "mid:self-heal-root@example.com");
+
+    // Simuliert exakt den Drift, den ein Race auf getStreamVersion (siehe
+    // Handler-Kommentar Schritt 5) verursachen kann: 2 Message-Rows liegen
+    // vor, aber der ZULETZT geschriebene Thread-Event traegt einen zu
+    // niedrigen Snapshot (previousCount+1 aus einer stale-Read). Das Event
+    // ist die Quelle, die previousCount+1 (alter Code) liest — der Live-
+    // COUNT (neuer Code) ignoriert es und liest read_inbound_messages neu.
+    const expectedVersion = await getStreamVersion(db, threadAggId, admin.tenantId);
+    const corruptedPayload: MailThreadEventPayload = {
+      threadKey: "mid:self-heal-root@example.com",
+      subject: "corrupted-by-race",
+      lastMessageAtIso: "2026-07-01T10:00:00Z",
+      messageCount: 1,
+    };
+    await append(db, {
+      aggregateId: threadAggId,
+      aggregateType: MAIL_THREAD_AGGREGATE_TYPE,
+      tenantId: admin.tenantId,
+      expectedVersion,
+      type: MAIL_THREAD_UPDATED_EVENT_QN,
+      payload: corruptedPayload,
+      metadata: { userId: admin.id },
+    });
+    // mailThreadsProjectionTable ist executor-only (WritableTable-Typecheck
+    // lehnt raw updateMany ab) — die Test-Korruption geht bewusst am
+    // Type-Guard vorbei, genau wie die Race-Situation die sie simuliert.
+    await asRawClient(db).unsafe(`UPDATE "read_mail_threads" SET message_count = 1 WHERE id = $1`, [
+      threadAggId,
+    ]);
+
+    await stack.http.writeOk(
+      InboundMailFoundationHandlers.ingestMessage,
+      ingestPayload(accountId, {
+        providerMessageId: "self-heal-reply-2",
+        messageIdHeader: "self-heal-reply-2@example.com",
+        references: ["self-heal-root@example.com"],
+      }),
+      admin,
+    );
+
+    const healed = await selectMany(db, mailThreadsProjectionTable, { id: threadAggId });
+    expect(healed).toHaveLength(1);
+    expect(healed[0]?.["messageCount"]).toBe(3);
+  });
+});
+
 describe("scenario 3: Scope-Sichtbarkeit (persönliches Postfach)", () => {
   test("Messages eines user-scoped Accounts sieht nur der Owner (+ TenantAdmin)", async () => {
     const tenantNumber = 4003;

package/src/inbound-mail-foundation/__tests__/retention.integration.test.ts

@@ -93,6 +93,7 @@ async function ingest(
   admin: ReturnType<typeof adminFor>,
   providerMessageId: string,
   receivedAtIso: string,
+  bodyRef = "",
 ): Promise<void> {
   await stack.http.writeOk(
     InboundMailFoundationHandlers.ingestMessage,
@@ -110,7 +111,7 @@ async function ingest(
       subject: "Hello",
       snippet: "Hello world …",
       receivedAtIso,
-      bodyRef: "",
+      bodyRef,
       scope: "inbox",
       providerCursor: '{"offset":1}',
     },
@@ -160,6 +161,43 @@ describe("retention: inbound messages", () => {
   });
 });
 
+describe("retention: body-delete failure keeps the row (no orphaned storage object)", () => {
+  test("deleteBodyObject throws → row + stream survive this sweep, bodyObjectErrors=1", async () => {
+    const admin = adminFor(5002);
+    const accountId = await connectSharedAccount(admin);
+    await ingest(accountId, admin, "uid-body-fail", "2024-01-01T10:00:00Z", "body-ref-1");
+
+    const now = getTemporal().Instant.from("2026-07-13T00:00:00Z");
+    const report = await runInboundMailRetention({
+      db,
+      tenantId: admin.tenantId,
+      now,
+      seenRetentionDays: 100000,
+      deleteBodyObject: async () => {
+        throw new Error("storage unavailable");
+      },
+    });
+    expect(report.messagesPurged).toBe(0);
+    expect(report.bodyObjectErrors).toBe(1);
+
+    const failId = inboundMessageAggregateId(accountId, "uid-body-fail");
+    const rows = await selectMany(db, inboundMessagesProjectionTable, { accountId });
+    expect(rows.map((r) => r["id"])).toContain(failId);
+
+    // Naechster Lauf (deleteBodyObject funktioniert jetzt) holt die Row nach.
+    const retry = await runInboundMailRetention({
+      db,
+      tenantId: admin.tenantId,
+      now,
+      seenRetentionDays: 100000,
+      deleteBodyObject: async () => {},
+    });
+    expect(retry.messagesPurged).toBe(1);
+    expect(retry.bodyObjectsDeleted).toBe(1);
+    expect(await selectMany(db, inboundMessagesProjectionTable, { accountId })).toHaveLength(0);
+  });
+});
+
 describe("retention: seen anchors", () => {
   test("past-cutoff anchor purged, in-window anchor stays (dedup window intact)", async () => {
     const admin = adminFor(5002);

package/src/inbound-mail-foundation/handlers/ingest-message.write.ts

@@ -18,7 +18,7 @@
 // SystemAdmin-only: Aufrufer ist der Watch/Sync-Supervisor bzw. der
 // Poll-Cron mit programmatic SystemUser — nie ein Tenant-Request.
 
-import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { countWhere, insertOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configuredPiiSubjectKms,
   encryptPiiFieldValues,
@@ -43,6 +43,7 @@ import {
   MAIL_THREAD_UPDATED_EVENT_QN,
   type MailThreadEventPayload,
 } from "../events";
+import { inboundMessagesProjectionTable } from "../projection";
 
 // =============================================================================
 // Input-Schema — der normalisierte Provider-Output (RawInboundMessage,
@@ -208,24 +209,44 @@ export const ingestMessageHandler: WriteHandlerDef = {
 
     // ---------------------------------------------------------------
     // 5. Thread-Rollup. Der Handler berechnet den NEUEN Snapshot
-    //    (count+1, max(lastMessageAt)) — die apply ist ein dummer
-    //    UPSERT und bleibt replay-idempotent. lastMessageAtIso ist
+    //    (count via Live-COUNT, max(lastMessageAt)) — die apply ist ein
+    //    dummer UPSERT und bleibt replay-idempotent. lastMessageAtIso ist
     //    kein PII (Zeitpunkt), damit plaintext-vergleichbar; subject
     //    wird frisch encrypted (jede Thread-Version trägt das Subject
     //    der jüngsten Mail).
     //
-    //    **Kein Lost-Update-Fenster:** loadAggregate + append laufen in
-    //    derselben TX; zwei parallele ingests auf denselben Thread
-    //    serialisiert der event-store über die Stream-Version.
+    //    messageCount kommt bewusst NICHT aus einem frueher gelesenen
+    //    threadEvents-Snapshot (previousCount+1): getStreamVersion in
+    //    unsafeAppendEvent liest die Stream-Version FRISCH zum
+    //    Append-Zeitpunkt, unabhaengig vom Read hier — zwei parallele
+    //    ingests auf denselben Thread (Watch-Push + Poll-Reconciliation)
+    //    koennten beide denselben previousCount sehen und der Append der
+    //    zweiten TX wuerde trotzdem gelingen (kein VersionConflictError,
+    //    da der Version-Check nur die Stream-Version prueft), sodass
+    //    previousCount+1 dauerhaft nach unten drieftet.
+    //
+    //    Ein COUNT gegen read_inbound_messages SCHLIESST das Race-Fenster
+    //    NICHT (COUNT und Append sind weiterhin zwei getrennte Statements —
+    //    zwischen COUNT und Append kann die andere TX committen und derselbe
+    //    Drift theoretisch weiterhin auftreten). Was der COUNT aendert: er
+    //    macht den Fehler SELBSTKORRIGIEREND statt kumulativ — jeder
+    //    nachfolgende ingest liest den echten Row-Count neu, statt einen
+    //    frueher falsch geschriebenen previousCount fortzuschreiben. Eine
+    //    echte Race-freie Loesung braucht ein atomares Read+Append (z.B.
+    //    SELECT ... FOR UPDATE oder eine Advisory-Lock auf threadAggId) —
+    //    das ist bewusst nicht Teil dieses Fixes (siehe PR-Beschreibung).
     // ---------------------------------------------------------------
     const threadEvents = await ctx.loadAggregate(threadAggId);
     const lastThreadEvent = threadEvents[threadEvents.length - 1];
     // @cast-boundary engine-payload — eigene events, shape via defineEvent
     const previousThread = lastThreadEvent?.payload as MailThreadEventPayload | undefined;
-    const previousCount = previousThread?.messageCount ?? 0;
     const previousLastAt = previousThread?.lastMessageAtIso ?? "";
     const newLastAt =
       payload.receivedAtIso > previousLastAt ? payload.receivedAtIso : previousLastAt;
+    const messageCount = await countWhere(ctx.db.raw, inboundMessagesProjectionTable, {
+      tenantId,
+      threadKey,
+    });
 
     const threadPlainPii = { tenantId, subject: payload.subject };
     const encryptedThreadFields = piiKms
@@ -245,7 +266,7 @@ export const ingestMessageHandler: WriteHandlerDef = {
       threadKey,
       subject: encryptedThreadFields["subject"] as string,
       lastMessageAtIso: newLastAt,
-      messageCount: previousCount + 1,
+      messageCount,
     };
     await ctx.unsafeAppendEvent({
       aggregateId: threadAggId,

package/src/inbound-mail-foundation/retention-sweep.ts

@@ -15,8 +15,8 @@
 //
 //   read_mail_seen_messages (unmanaged, direct-write, nicht event-sourced):
 //     Dedup-Anker braucht nur das Backfill-/Replay-Fenster → seenAt-cutoff
-//     via plain deleteMany, kein Stream/Archiv. Gescoped auf die accountIds
-//     dieses Tenants (die Tabelle traegt keine tenantId-Spalte).
+//     via plain deleteMany, kein Stream/Archiv. Gescoped direkt über die
+//     tenant_id-Spalte der Tabelle (table-builder-Konvention), kein Account-Join.
 //
 // GRENZE (#957 Teil 2, Plan §3.4): die PII in den Message-Events bleibt
 // unter dem TENANT-Subject-Key entschluesselbar — per-Row-Retention
@@ -96,13 +96,22 @@ async function purgeExpiredMessages(
   // archivierten ids, nie per cutoff-WHERE — sonst koennte eine zwischen
   // select und delete eingegangene Alt-Mail unarchiviert geloescht werden
   // und beim Rebuild resurrecten.
+  //
+  // Ein Row deren deleteBodyObject fehlschlaegt wird NICHT geloescht — sonst
+  // ginge die einzige Referenz auf das (dann verwaiste) File-Objekt verloren
+  // (kein Retry, kein Dead-Letter). Die Row bleibt fuer den naechsten Sweep
+  // stehen (archiveStream ist idempotent). failedIds verhindert, dass so ein
+  // Row innerhalb DIESES Laufs endlos re-selektiert wird.
+  const failedIds = new Set<string>();
   for (;;) {
-    const rows = await selectMany<ExpiredMessageRow>(
-      args.db,
-      inboundMessagesProjectionTable,
-      { receivedAt: { lt: cutoff }, tenantId: args.tenantId },
-      { limit: BATCH_LIMIT },
-    );
+    const rows = (
+      await selectMany<ExpiredMessageRow>(
+        args.db,
+        inboundMessagesProjectionTable,
+        { receivedAt: { lt: cutoff }, tenantId: args.tenantId },
+        { limit: BATCH_LIMIT },
+      )
+    ).filter((row) => !failedIds.has(row.id));
     if (rows.length === 0) break;
 
     const ids: string[] = [];
@@ -120,14 +129,18 @@ async function purgeExpiredMessages(
           bodyObjectsDeleted++;
         } catch {
           bodyObjectErrors++;
+          failedIds.add(row.id);
+          continue;
         }
       }
       ids.push(row.id);
     }
-    await deleteMany(args.db, inboundMessagesProjectionTable as EntityTableMeta, {
-      id: { in: ids },
-    });
-    messagesPurged += ids.length;
+    if (ids.length > 0) {
+      await deleteMany(args.db, inboundMessagesProjectionTable as EntityTableMeta, {
+        id: { in: ids },
+      });
+      messagesPurged += ids.length;
+    }
 
     if (rows.length < BATCH_LIMIT) break;
   }

package/src/inbound-provider-imap/feature.ts

@@ -89,14 +89,10 @@ async function fetchMessages(
 ): Promise<InboundFetchResult> {
   const doc = await readCredentialDocument(ctx, account);
   const client = createImapClient(doc);
+  let lock: Awaited<ReturnType<typeof client.getMailboxLock>> | undefined;
   try {
     await client.connect();
-  } catch (err) {
-    throw mapImapError(err, doc.host);
-  }
-
-  const lock = await client.getMailboxLock(IMAP_MAILBOX);
-  try {
+    lock = await client.getMailboxLock(IMAP_MAILBOX);
     const mailbox = client.mailbox as MailboxObject;
     const serverUidValidity = String(mailbox.uidValidity);
     const parsedCursor = parseImapCursor(cursor);
@@ -149,7 +145,7 @@ async function fetchMessages(
   } catch (err) {
     throw err instanceof Error && "kind" in err ? err : mapImapError(err, doc.host);
   } finally {
-    lock.release();
+    lock?.release();
     await client.logout().catch(() => {});
   }
 }

package/src/jobs/web/job-run-detail-screen.tsx

@@ -1,7 +1,13 @@
 // @runtime client
 // Single job-run detail + logs. Route entityId = run uuid.
 
-import { useDispatcher, useNav, usePrimitives, useTranslation } from "@cosmicdrift/kumiko-renderer";
+import {
+  formatWhen,
+  useDispatcher,
+  useNav,
+  usePrimitives,
+  useTranslation,
+} from "@cosmicdrift/kumiko-renderer";
 import { FormScreenShell } from "@cosmicdrift/kumiko-renderer-web";
 import { type ReactNode, useCallback, useEffect, useState } from "react";
 import { JOB_RUNS_SCREEN_ID, JobHandlers, JobQueries } from "../constants";
@@ -172,11 +178,3 @@ export function JobRunDetailScreen(): ReactNode {
     </FormScreenShell>
   );
 }
-
-function formatWhen(value: string): string {
-  try {
-    return new Date(value).toLocaleString();
-  } catch {
-    return value;
-  }
-}