@cosmicdrift/kumiko-bundled-features 0.165.0 → 0.165.2

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -10,13 +10,22 @@ import {
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
 import { z } from "zod";
-import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createSessionsFeature } from "../../sessions/feature";
 import { createTenantFeature } from "../../tenant/feature";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle/feature";
+
+function projectionProbeTable(name: string): SchemaTable {
+  return table(name, {
+    id: uuid("id").primaryKey(),
+    count: integer("count").notNull().default(0),
+  }) as unknown as SchemaTable; // @cast-boundary test-fixture — minimal probe shape, real schema-table irrelevant here
+}
+
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -30,18 +39,13 @@ import { createUserDataRightsFeature } from "../feature";
 // Unlike the old direct-function tests, these only run inside a real
 // validateBoot() pass — exercising the actual `r.bootCheck()` plumbing, not
 // just the guard logic.
-// Stub instead of the real auth-foundation — these boot-checks are about
-// GDPR-storage guards, not auth; only sessions' sessionStore registration
-// needs an owner present.
-const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
-  r.extendsRegistrar(EXT_SESSION_STORE, {});
-});
-
 function baseFeatures() {
   return [
     createConfigFeature(),
     createUserFeature(),
-    sessionStoreOwnerStub,
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),
@@ -84,10 +88,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   });
 
   test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
-    const projectionTable = table("crm_contact_summary", {
-      id: uuid("id").primaryKey(),
-      count: integer("count").notNull().default(0),
-    }) as unknown as SchemaTable;
+    const projectionTable = projectionProbeTable("crm_contact_summary");
     const bad = defineFeature("crm", (r) => {
       const contactCreated = r.defineEvent("contact-created", z.unknown());
       r.projection({
@@ -102,10 +103,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   });
 
   test("V3: projection-only pii entity WITH EXT_USER_DATA hook registered for its entity name → no throw", () => {
-    const projectionTable = table("crm_contact_summary_hooked", {
-      id: uuid("id").primaryKey(),
-      count: integer("count").notNull().default(0),
-    }) as unknown as SchemaTable;
+    const projectionTable = projectionProbeTable("crm_contact_summary_hooked");
     const hooked = defineFeature("crm-hooked", (r) => {
       r.requires("user-data-rights");
       const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());

package/src/user-data-rights/__tests__/download-by-token-resolver-trust.integration.test.ts

@@ -155,11 +155,15 @@ describe("download-by-token under resolverTrust: authoritative, no defaultTenant
     }
 
     const res = await stack.app.fetch(
-      new Request(`http://test/user-export/by-token?token=${plainToken}`, { method: "GET" }),
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: plainToken }),
+      }),
     );
-    expect(res.status).toBe(302);
-    const location = res.headers.get("location");
-    expect(location).toMatch(/^memory:\/\//);
-    expect(location).toContain(`${jobTenant}/exports/${jobId}.zip`);
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data?: { url?: string } };
+    expect(body.data?.url).toMatch(/^memory:\/\//);
+    expect(body.data?.url).toContain(`${jobTenant}/exports/${jobId}.zip`);
   });
 });

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -437,8 +437,8 @@ describe("download-by-job :: happy path", () => {
 });
 
 describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
-  test("happy: 302-Redirect mit Location-Header zur signed-URL", async () => {
-    const { plainToken } = await seedDoneJobWithToken();
+  test("`?token=` in query is ignored — serves interstitial HTML instead of resolving it (no access-log leak)", async () => {
+    const { jobId, plainToken } = await seedDoneJobWithToken();
 
     const res = await stack.app.fetch(
       new Request(`http://test/user-export/by-token?token=${plainToken}`, {
@@ -449,21 +449,15 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
         },
       }),
     );
-    expect(res.status).toBe(302);
-    const location = res.headers.get("location");
-    expect(location).toBeTruthy();
-    expect(location).toMatch(/^memory:\/\//);
-  });
+    expect(res.status).toBe(200);
+    expect(res.headers.get("content-type")).toContain("text/html");
+    const body = await res.text();
+    expect(body).toContain("/user-export/by-token.js");
 
-  test("invalid token → 404 passthrough mit i18nKey", async () => {
-    const res = await stack.app.fetch(
-      new Request("http://test/user-export/by-token?token=fake-xxxxx", {
-        method: "GET",
-      }),
-    );
-    expect(res.status).toBe(404);
-    const body = (await res.json()) as { error?: { i18nKey?: string } };
-    expect(body.error?.i18nKey).toBe("userDataRights.errors.download.notFound");
+    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
+      useCount: number;
+    }>;
+    expect(row?.useCount).toBe(0);
   });
 
   test("no query token (fragment-Pfad) → serviert Interstitial-HTML statt 400", async () => {
@@ -487,29 +481,6 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     expect(body).toContain("/user-export/by-token");
   });
 
-  test("Audit-Update: useCount + IP/UA aus httpRoute-Headers (nicht aus payload)", async () => {
-    const { jobId, plainToken } = await seedDoneJobWithToken();
-    await stack.app.fetch(
-      new Request(`http://test/user-export/by-token?token=${plainToken}`, {
-        method: "GET",
-        headers: {
-          "user-agent": "e2e-test/2.0",
-          "x-forwarded-for": "198.51.100.7, 10.0.0.1",
-        },
-      }),
-    );
-
-    const [row] = (await selectMany(stack.db, exportDownloadTokensTable, { jobId })) as Array<{
-      useCount: number;
-      lastUsedFromIp: string | null;
-      lastUsedUserAgent: string | null;
-    }>;
-    expect(row?.useCount).toBe(1);
-    // X-Forwarded-For: erster Wert, comma-trimmed
-    expect(row?.lastUsedFromIp).toBe("198.51.100.7");
-    expect(row?.lastUsedUserAgent).toBe("e2e-test/2.0");
-  });
-
   test("POST-Exchange (Fragment-Pfad): happy-path + IP/UA-Audit aus httpRoute-Headers", async () => {
     const { jobId, plainToken } = await seedDoneJobWithToken();
 
@@ -550,6 +521,19 @@ describe("r.httpRoute :: /user-export/by-token (Magic-Link e2e)", () => {
     const body = (await res.json()) as { error?: string };
     expect(body.error).toBe("missing_token");
   });
+
+  test("POST-Exchange: invalid token → 404 + download.notFound i18nKey", async () => {
+    const res = await stack.app.fetch(
+      new Request("http://test/user-export/by-token", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ token: "fake-xxxxx" }),
+      }),
+    );
+    expect(res.status).toBe(404);
+    const body = (await res.json()) as { error: { i18nKey: string } };
+    expect(body.error.i18nKey).toBe("userDataRights.errors.download.notFound");
+  });
 });
 
 describe("download-by-job :: cross-user + cross-tenant", () => {
@@ -569,8 +553,8 @@ describe("download-by-job :: cross-user + cross-tenant", () => {
   });
 
   test("provider ohne getSignedUrl → 422 unprocessable signedUrlNotSupported (job-Pfad)", async () => {
-    // Symmetrisch zum token-Pfad: derselbe Operator-Konfig-Bug muss auch
-    // beim UI-Klick-Pfad als 422 raus, nicht 404.
+    // Same as the token path: the operator misconfig must also surface as
+    // 422 on the UI click path, not 404.
     const { jobId } = await seedDoneJobWithToken();
     await stack.http.writeOk(
       ConfigHandlers.set,

package/src/user-data-rights/__tests__/inspector-screens.boot.test.ts

@@ -1,11 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { access, defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
 import { createFilesFeature } from "@cosmicdrift/kumiko-framework/files";
-import { EXT_SESSION_STORE } from "../../auth-foundation";
+import { authFoundationFeature } from "../../auth-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles/feature";
 import { createConfigFeature } from "../../config/feature";
 import { createDataRetentionFeature } from "../../data-retention/feature";
+import { createPersonalAccessTokensFeature } from "../../personal-access-tokens";
 import { createSessionsFeature } from "../../sessions/feature";
+import { createTenantFeature } from "../../tenant/feature";
 import { createUserFeature } from "../../user/feature";
 import { createUserDataRightsDefaultsFeature } from "../../user-data-rights-defaults/feature";
 import { createUserDataRightsFeature } from "../feature";
@@ -18,13 +20,6 @@ import { createUserDataRightsFeature } from "../feature";
 // entities (export-job, download-attempt) are r.entity, not direct-write stores,
 // so an entityList binding is rebuild-safe (unlike jobs/sessions read-models).
 
-// Stub instead of the real auth-foundation — this test is about screen
-// wiring, not auth; only sessions' sessionStore registration needs an owner
-// present.
-const sessionStoreOwnerStub = defineFeature("auth-foundation", (r) => {
-  r.extendsRegistrar(EXT_SESSION_STORE, {});
-});
-
 describe("user-data-rights read-only inspector screens", () => {
   // A realistic assembly: mounting user-data-rights without its default hooks
   // now fails the V3 boot gate (the framework `user` entity holds PII with no
@@ -33,7 +28,9 @@ describe("user-data-rights read-only inspector screens", () => {
   const features = [
     createConfigFeature(),
     createUserFeature(),
-    sessionStoreOwnerStub,
+    createTenantFeature(),
+    authFoundationFeature,
+    createPersonalAccessTokensFeature({ scopes: {} }),
     createSessionsFeature(),
     createDataRetentionFeature(),
     createComplianceProfilesFeature(),

package/src/user-data-rights/__tests__/mail-default-bridge.integration.test.ts

@@ -123,7 +123,21 @@ describe("C6 default mail bridge :: forget cron sends deletion-executed without
     expect(job).toBeDefined();
 
     // EXAKT der prod-Job-Kontext: configResolver gesetzt, config undefined.
-    const jobCtx = { db: stack.db, registry: stack.registry, configResolver };
+    // log required since #1572 persists incomplete[] via ctx.log.warn.
+    const jobCtx = {
+      db: stack.db,
+      registry: stack.registry,
+      configResolver,
+      log: {
+        info() {},
+        warn() {},
+        error() {},
+        debug() {},
+        child() {
+          return this;
+        },
+      },
+    };
     await job?.handler({}, jobCtx as never);
 
     // Loeschung lief autonom durch.

package/src/user-data-rights/__tests__/restriction-flow.integration.test.ts

@@ -45,6 +45,10 @@ import { createSessionsFeature } from "../../sessions";
 import { SessionHandlers } from "../../sessions/constants";
 import { userSessionEntity, userSessionTable } from "../../sessions/schema/user-session";
 import { createSessionCallbacks, type SessionCallbacks } from "../../sessions/session-callbacks";
+import {
+  SESSION_REVOKED_EVENT_QN,
+  sessionRevokedSchema,
+} from "../../sessions/session-revoked-event";
 import { sessionCallbacksFromLateBound, withMintedSession } from "../../sessions/testing";
 import { hashPassword } from "../../shared";
 import { createTenantFeature, tenantMembershipsTable } from "../../tenant";
@@ -211,6 +215,36 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     expect(userRow[0]?.status).toBe(USER_STATUS.Active);
   });
 
+  // kumiko-framework#1545: mirrors the lift-restriction cross-tenant guard
+  // below — an isAdminActor check alone lets an Admin/TenantAdmin from a
+  // DIFFERENT tenant restrict (and force-revoke the sessions of) a user
+  // who was never a member of the admin's tenant.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(RESTRICT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Restricted);
+  });
+
   test("Restricted → Restricted (Idempotenz-Guard): 422 already_restricted", async () => {
     const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
     // Alice's own session is blocked while Restricted — an admin targets
@@ -227,6 +261,51 @@ describe("S2.U6 :: restrict-account state-transitions", () => {
     const err = await stack.http.writeErr(RESTRICT, {}, aliceUser);
     expect(reasonOf(err)).toBe("user_not_in_active_state");
   });
+
+  // kumiko-framework#1540: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the isAdminActor gate and flip the target's
+  // status. Mirrors the sibling lift-restriction fix (kumiko-framework#1342).
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Active", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(RESTRICT, { userId: targetId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: targetId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Active);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend restricten (platform-weiter Operator) + revoked Sessions", async () => {
+    const { userId: targetId } = await seedAliceWithMembership();
+    const loginRes = await login(ALICE_EMAIL, ALICE_PW);
+    expect(loginRes.status).toBe(200);
+
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ userId: string; status: string }>(
+      RESTRICT,
+      { userId: targetId },
+      systemAdmin,
+    );
+    expect(result.status).toBe(USER_STATUS.Restricted);
+
+    const sessionsAfter = (await selectMany(stack.db, userSessionTable, {
+      userId: targetId,
+    })) as Array<{ revokedAt: unknown }>;
+    expect(sessionsAfter.length).toBeGreaterThanOrEqual(1);
+    expect(sessionsAfter.every((s) => s.revokedAt !== null)).toBe(true);
+  });
 });
 
 describe("S2.U6 :: lift-restriction state-transitions", () => {
@@ -258,6 +337,37 @@ describe("S2.U6 :: lift-restriction state-transitions", () => {
     const err = await stack.http.writeErr(LIFT, { userId }, admin);
     expect(reasonOf(err)).toBe("not_restricted");
   });
+
+  // kumiko-framework#1342: access.admin includes TenantAdmin/Admin, which
+  // are tenant-scoped roles, but the User-entity lookup uses ctx.db.raw
+  // (no auto-tenant-filter — User status is intentionally global). Without
+  // a membership check, an Admin from a DIFFERENT tenant than the target
+  // user could still pass the access-gate and flip the target's status.
+  test("Admin aus fremdem Tenant: 403 target_user_not_in_admin_tenant, Status bleibt Restricted", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const otherTenantAdmin = await mintActor(TestUsers.otherTenant);
+
+    const err = await stack.http.writeErr(LIFT, { userId }, otherTenantAdmin);
+    expect(err.httpStatus).toBe(403);
+    expect(reasonOf(err)).toBe("target_user_not_in_admin_tenant");
+
+    const userRow = (await selectMany(stack.db, userTable, { id: userId })) as Array<{
+      status: string;
+    }>;
+    expect(userRow[0]?.status).toBe(USER_STATUS.Restricted);
+  });
+
+  test("SystemAdmin darf tenant-übergreifend liften (platform-weiter Operator)", async () => {
+    const { userId } = await seedAliceWithMembership(USER_STATUS.Restricted);
+    const systemAdmin = await mintActor({
+      id: crypto.randomUUID(),
+      tenantId: testTenantId(2),
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ status: string }>(LIFT, { userId }, systemAdmin);
+    expect(result.status).toBe(USER_STATUS.Active);
+  });
 });
 
 describe("S2.U6 :: Login-Block fuer Restricted/DeletionRequested/Deleted", () => {
@@ -305,6 +415,26 @@ describe("S2.U6 :: Login-Block fuer Restricted/DeletionRequested/Deleted", () =>
 });
 
 describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
+  test("Privileged revoke-all-for-user with no live sessions emits no event", async () => {
+    const { userId } = await seedAliceWithMembership();
+    const systemUser = await mintActor({
+      id: "00000000-0000-4000-8000-000000000000",
+      tenantId: TENANT,
+      roles: ["SystemAdmin"],
+    });
+
+    const result = await stack.http.writeOk<{ count: number; userId: string }>(
+      SessionHandlers.revokeAllForUser,
+      { userId },
+      systemUser,
+    );
+    expect(result.count).toBe(0);
+    expect(result.userId).toBe(userId);
+
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(0);
+  });
+
   test("Privileged-Caller revoked alle live sessions eines Users", async () => {
     const { userId } = await seedAliceWithMembership();
     // 2 Sessions erzeugen via Login + zweiter Login.
@@ -337,5 +467,15 @@ describe("S2.U6 :: Cross-Feature sessions.revokeAllForUser direct", () => {
       revokedAt: unknown;
     }>;
     expect(revoked.every((s) => s.revokedAt !== null)).toBe(true);
+
+    // #1559 — cross-tenant privileged revoke uses the low-level append(),
+    // not ctx.unsafeAppendEvent (see revoke-all-for-user.write.ts for why:
+    // the SystemAdmin caller's own tenantId has no relationship to the
+    // target user's session tenant). One event, both sids listed.
+    const events = await selectMany(stack.db, eventsTable, { type: SESSION_REVOKED_EVENT_QN });
+    expect(events).toHaveLength(1);
+    const payload = sessionRevokedSchema.parse(events[0]?.["payload"]);
+    expect(payload.userId).toBe(userId);
+    expect(new Set(payload.sessionIds)).toEqual(new Set(liveBefore.map((s) => s.id)));
   });
 });

package/src/user-data-rights/__tests__/run-export-jobs.integration.test.ts

@@ -12,7 +12,7 @@
 //      downloadStorageKey wird genullt + storage-key geloescht
 //   6. Idempotency: 2× run → kein Re-Processing von done/failed-Jobs
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { spawn } from "node:child_process";
 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
@@ -818,7 +818,10 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     const calls: string[] = [];
     // Should not throw despite job A's callback throwing — the try/catch
     // around fireExportFailedCallback swallows it (operator-visibility
-    // via console.warn only) and the loop continues to job B.
+    // via console.warn only) and the loop continues to job B. A regress to
+    // a fully silent swallow (no log call at all) would still pass every
+    // assertion below unless the warn itself is pinned.
+    const warnSpy = spyOn(console, "warn").mockImplementation(() => {});
     const result = await runExportJobs({
       db: stack.db,
       registry: stack.registry,
@@ -833,6 +836,8 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     });
     expect(result.failedJobIds).toEqual(expect.arrayContaining([jobAId, jobBId]));
     expect(calls.sort()).toEqual([jobAId, jobBId].sort());
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
   });
 
   test("failed-Job, user ohne email → sendExportFailedEmail skipped (kein Throw)", async () => {
@@ -840,7 +845,7 @@ describe("runExportJobs :: Atom 4a download-tokens", () => {
     await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
-      email: "" as string,
+      email: "", // empty string — lookupUserEmail returns null
       passwordHash: "hashed",
       displayName: "Alice",
       locale: "de",
@@ -1270,7 +1275,7 @@ describe("runExportJobs :: Atom 5 notification-callbacks", () => {
     await seedRow(stack.db, userTable, {
       id: String(aliceUser.id),
       tenantId: tenantA,
-      email: "" as string, // empty string — lookupUserEmail returnt null
+      email: "" as string, // empty string — lookupUserEmail returns null
       passwordHash: "h",
       displayName: "Alice",
       locale: "de",

package/src/user-data-rights/__tests__/run-forget-cleanup.integration.test.ts

@@ -282,6 +282,22 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
   // getJob undefined und die Loeschung laeuft nach Grace-Ablauf NIE. Wir
   // treiben den ECHTEN registrierten Job durch den echten JobContext (db +
   // registry, kein config) — nicht den inneren runForgetCleanup-Helper.
+  function capturingJobLog() {
+    const warns: string[] = [];
+    const log: JobContext["log"] = {
+      info() {},
+      warn(message: string) {
+        warns.push(message);
+      },
+      error() {},
+      debug() {},
+      child(): JobContext["log"] {
+        return this;
+      },
+    };
+    return { log, warns };
+  }
+
   test("registered job exists + erases through the real JobContext", async () => {
     const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
     expect(job).toBeTruthy();
@@ -295,10 +311,8 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     });
     await seedMembership(CRON_USER, TENANT_A);
 
-    const jobCtx = { db: stack.db, registry: stack.registry };
-    // jobCtx is a deliberately minimal prod-context replica (missing
-    // systemUser/log/triggeredBy) — double-cast at this test boundary since
-    // the handler under test never touches those fields.
+    const { log } = capturingJobLog();
+    const jobCtx = { db: stack.db, registry: stack.registry, log };
     await job?.handler({}, jobCtx as unknown as JobContext);
 
     const row = await fetchUser(CRON_USER);
@@ -306,6 +320,52 @@ describe("run-forget-cleanup :: registered cron (autonomous Art.17)", () => {
     expect(row?.email).not.toContain("cron-delete@example.com");
     expect(row?.email).toContain("anonymized.invalid");
   });
+
+  test("incomplete hooks are written to ctx.log (job-run audit trail, #1572)", async () => {
+    const job = stack.registry.getJob("user-data-rights:job:run-forget-cleanup");
+    expect(job).toBeTruthy();
+
+    await seedUser(ALICE_ID, {
+      status: USER_STATUS.DeletionRequested,
+      gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
+    });
+    await seedMembership(ALICE_ID, TENANT_A);
+
+    const usages = stack.registry.getExtensionUsages("userData");
+    const userUsage = usages.find((u) => u.entityName === "user");
+    if (!userUsage?.options) throw new Error("user usage not found");
+    type DeleteHook = (
+      ctx: { userId: string; tenantId: string; db: unknown },
+      strategy: string,
+    ) => Promise<undefined | { status: "ok" } | { status: "incomplete"; reason: string }>;
+    const originalUserDelete = (userUsage.options as { delete: DeleteHook }).delete;
+    (userUsage.options as { delete: DeleteHook }).delete = async (ctx, strategy) => {
+      if (ctx.userId === ALICE_ID) {
+        return { status: "incomplete", reason: "synthetic partial cleanup for alice" };
+      }
+      return originalUserDelete(ctx, strategy);
+    };
+
+    const { log, warns } = capturingJobLog();
+    try {
+      await job?.handler({}, {
+        db: stack.db,
+        registry: stack.registry,
+        log,
+      } as unknown as JobContext);
+    } finally {
+      (userUsage.options as { delete: DeleteHook }).delete = originalUserDelete;
+    }
+
+    const hit = warns.find((w) => w.includes("incomplete hook") && w.includes(ALICE_ID));
+    expect(hit).toBeDefined();
+    expect(hit).toContain("entityName=user");
+    expect(hit).toContain("rolledBack=false");
+    expect(hit).toContain("reason=synthetic partial cleanup for alice");
+
+    const aliceRow = await fetchUser(ALICE_ID);
+    expect(aliceRow?.status).toBe(USER_STATUS.Deleted);
+  });
 });
 
 describe("runForgetCleanup :: time-window guards", () => {
@@ -798,6 +858,7 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
       expect(aliceIncomplete?.reason).toBe("synthetic partial cleanup for alice");
       expect(aliceIncomplete?.tenantId).toBe(TENANT_A);
       expect(aliceIncomplete?.entityName).toBe("user");
+      expect(aliceIncomplete?.rolledBack).toBe(false);
 
       // Status flip proceeded despite the incomplete report.
       const aliceRow = await fetchUser(ALICE_ID);
@@ -814,7 +875,7 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
     }
   });
 
-  test("hook incomplete on one tenant, then throws on a later tenant → the incomplete report is discarded by the rollback", async () => {
+  test("hook incomplete on one tenant, then throws on a later tenant → the incomplete report survives, flagged rolledBack (#1489)", async () => {
     await seedUser(ALICE_ID, {
       status: USER_STATUS.DeletionRequested,
       gracePeriodEnd: instantFromOffsetMs(-60 * 1000),
@@ -857,9 +918,14 @@ describe("runForgetCleanup :: per-User-Sub-Tx-Isolation (advisor-pinned Architek
         now: NOW(),
       });
 
-      // The whole per-user sub-tx rolled back — no incomplete entry from
-      // tenant A survives, and the failure surfaces as a hard error instead.
-      expect(result.incomplete.some((i) => i.userId === ALICE_ID)).toBe(false);
+      // The whole per-user sub-tx rolled back — the DB rows (including the
+      // status flip) are undone, and the failure surfaces as a hard error
+      // too. But tenant A's "incomplete" report describes an external,
+      // non-transactional side effect (already ran, not rolled back by a
+      // DB rollback) — it must still reach the operator, just marked
+      // rolledBack so they know the user itself is still DeletionRequested.
+      const aliceIncomplete = result.incomplete.find((i) => i.userId === ALICE_ID);
+      expect(aliceIncomplete?.rolledBack).toBe(true);
       expect(result.errors.some((e) => e.userId === ALICE_ID)).toBe(true);
       expect(result.processedUserIds).not.toContain(ALICE_ID);