@cosmicdrift/kumiko-bundled-features 0.192.0 → 0.193.0

package/src/form-draft/__tests__/cleanup.integration.test.ts

@@ -120,6 +120,14 @@ async function backdate(draftKey: string, daysAgo: number): Promise<void> {
   );
 }
 
+async function backdateFileRef(storageKey: string, daysAgo: number): Promise<void> {
+  await asRawClient(stack.db).unsafe(
+    `UPDATE "file_refs" SET "inserted_at" = now() - ($1::int * interval '1 day')
+     WHERE "storage_key" = $2`,
+    [daysAgo, storageKey],
+  );
+}
+
 async function draftExists(draftKey: string): Promise<boolean> {
   const rows = await asRawClient(stack.db).unsafe(
     "SELECT 1 FROM read_form_drafts WHERE draft_key = $1",
@@ -251,4 +259,26 @@ describe("form-draft cleanup job — FileRef release (#1915)", () => {
     });
     expect(providerA.keys()).toContain(forgedKey);
   });
+
+  test("does NOT release a storageKey whose file_refs row predates the draft (entity-prefilled edit-mode value, fw-review #5)", async () => {
+    const key = "tenant-a/vehicle/prefilled.jpg";
+    await providerA.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
+    await seedFileRef(key);
+    // The photo was uploaded when the domain entity was originally created —
+    // long before this editing session's draft. backdate() (below) also
+    // ages the draft row to 31 days, so the file must be aged further still
+    // to model "predates the draft" rather than "same moment".
+    await backdateFileRef(key, 60);
+
+    await saveDraft("wizard:stale-with-prefilled-photo", { photo: fileRefPointer(key) });
+    await backdate("wizard:stale-with-prefilled-photo", 31);
+
+    await dispatchCleanup();
+
+    await waitFor(async () => {
+      expect(await draftExists("wizard:stale-with-prefilled-photo")).toBe(false);
+    });
+    // The live domain entity this draft was editing still references `key`.
+    expect(providerA.keys()).toContain(key);
+  });
 });

package/src/form-draft/__tests__/discard-file-refs.integration.test.ts

@@ -14,6 +14,17 @@
 // file_refs row exists, a forged { storageKey: "<victim's key>" } would
 // reach the storage provider's delete() unchecked (see
 // db/queries/owned-file-refs.ts).
+//
+// Ordering matters for release-eligibility (fw-review #5): a storageKey is
+// only releasable if its file_refs row was inserted AFTER the draft row —
+// i.e. uploaded during THIS draft's own lifetime. Every "should release"
+// fixture below therefore creates the draft FIRST (an empty first save,
+// same as a wizard's initial autosave) and only then seeds the file_refs
+// row and saves the pointer into it — mirroring the real upload-during-an-
+// open-wizard order. A file_refs row seeded BEFORE the draft ever existed
+// models a domain entity's pre-existing photo pulled into an edit-mode
+// draft's initial values, which must NOT be releasable (see
+// db/queries/owned-file-refs.ts and handlers/cleanup.job.ts).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -91,9 +102,9 @@ async function seedFileRef(storageKey: string, ownerUser = owner): Promise<void>
 describe("form-draft discard — FileRef release", () => {
   test("discarding with releaseFiles: true and a single-file field releases its storage binary", async () => {
     const key = "tenant/vehicle/photo/one.jpg";
+    await saveDraft("wizard:one-photo", {}); // initial autosave, draft row created first
     await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
     await seedFileRef(key);
-
     await saveDraft("wizard:one-photo", { photo: fileRefPointer(key) });
     expect(provider.keys()).toContain(key);
 
@@ -106,6 +117,7 @@ describe("form-draft discard — FileRef release", () => {
   test("discarding with releaseFiles: true and a multi-file field releases every storage binary", async () => {
     const keyA = "tenant/vehicle/photos/a.jpg";
     const keyB = "tenant/vehicle/photos/b.jpg";
+    await saveDraft("wizard:many-photos", {}); // initial autosave, draft row created first
     await provider.write(keyA, new Uint8Array([1]), "image/jpeg");
     await provider.write(keyB, new Uint8Array([2]), "image/jpeg");
     await seedFileRef(keyA);
@@ -121,6 +133,19 @@ describe("form-draft discard — FileRef release", () => {
     expect(provider.keys()).not.toContain(keyB);
   });
 
+  test("discarding with releaseFiles: true does NOT release a storageKey whose file_refs row predates the draft (entity-prefilled edit-mode value)", async () => {
+    const key = "tenant/vehicle/photo/prefilled.jpg";
+    await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");
+    await seedFileRef(key); // uploaded long before this editing session's draft existed
+    await saveDraft("wizard:edit-prefilled", { photo: fileRefPointer(key) });
+
+    await discardDraft("wizard:edit-prefilled", true);
+
+    // The live domain entity this draft was editing still points at `key` —
+    // releasing it here would orphan the entity's photo.
+    expect(provider.keys()).toContain(key);
+  });
+
   test("discarding without releaseFiles leaves the storage binary intact (successful-submit default)", async () => {
     const key = "tenant/vehicle/photo/kept.jpg";
     await provider.write(key, new Uint8Array([1, 2, 3]), "image/jpeg");

package/src/form-draft/__tests__/feature-optional-config.integration.test.ts

@@ -0,0 +1,90 @@
+// fw-review #6 — form-draft declared a hard r.requires("config"), so any
+// app mounting form-draft without the config feature failed at boot with
+// `Feature "form-draft" requires feature "config" which is not registered`
+// (registry-validate.ts). config is now r.optionalRequires: form-draft must
+// boot standalone, and its cleanup job must still run — falling back to
+// FORM_DRAFT_DEFAULT_RETENTION_DAYS since there's no configResolver to read
+// the `form-draft:config:retention-days` override from (see
+// handlers/cleanup.job.ts).
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { waitFor } from "@cosmicdrift/kumiko-framework/testing";
+import { FormDraftHandlers } from "../constants";
+import { formDraftEntity } from "../entity";
+import { formDraftFeature } from "../feature";
+
+let stack: TestStack;
+const owner = createTestUser({ id: 1, roles: ["TenantMember"] });
+
+beforeAll(async () => {
+  // No createConfigFeature() here — the whole point of this suite.
+  stack = await setupTestStack({
+    features: [formDraftFeature],
+    jobs: { consumerLane: "worker", queueNamePrefix: `kumiko-form-draft-no-config-${Date.now()}` },
+  });
+  await unsafeCreateEntityTable(stack.db, formDraftEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(stack.db).unsafe("DELETE FROM kumiko_events");
+  await asRawClient(stack.db).unsafe("DELETE FROM read_form_drafts");
+});
+
+async function draftExists(draftKey: string): Promise<boolean> {
+  const rows = await asRawClient(stack.db).unsafe(
+    "SELECT 1 FROM read_form_drafts WHERE draft_key = $1",
+    [draftKey],
+  );
+  return (rows as unknown[]).length > 0;
+}
+
+async function backdate(draftKey: string, daysAgo: number): Promise<void> {
+  await asRawClient(stack.db).unsafe(
+    `UPDATE "read_form_drafts"
+     SET "inserted_at" = now() - ($1::int * interval '1 day'),
+         "modified_at" = now() - ($1::int * interval '1 day')
+     WHERE "draft_key" = $2`,
+    [daysAgo, draftKey],
+  );
+}
+
+describe("form-draft mounted without the config feature", () => {
+  test("boots successfully (setupTestStack does not throw)", () => {
+    expect(stack).toBeDefined();
+  });
+
+  test("cleanup job still deletes drafts older than the 30-day default retention", async () => {
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:old-no-config", values: {}, stepIndex: 0 },
+      owner,
+    );
+    await backdate("wizard:old-no-config", 31);
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:fresh-no-config", values: {}, stepIndex: 0 },
+      owner,
+    );
+
+    if (!stack.jobRunner) throw new Error("jobRunner not wired");
+    await stack.jobRunner.dispatch("form-draft:job:cleanup", {});
+
+    await waitFor(async () => {
+      expect(await draftExists("wizard:old-no-config")).toBe(false);
+    });
+    expect(await draftExists("wizard:fresh-no-config")).toBe(true);
+  });
+});

package/src/form-draft/db/queries/cleanup.ts

@@ -1,6 +1,7 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { Temporal } from "temporal-polyfill";
 import type { FormDraftBlob } from "../../schemas";
 
 export type StaleDraftRow = {
@@ -8,6 +9,7 @@ export type StaleDraftRow = {
   readonly tenantId: TenantId;
   readonly ownerId: string;
   readonly draft: FormDraftBlob;
+  readonly insertedAt: Temporal.Instant;
 };
 
 // COALESCE(modified_at, inserted_at) — a draft's "last touched" timestamp is
@@ -17,34 +19,33 @@ export type StaleDraftRow = {
 //
 // Reads the blob + tenantId BEFORE anything is deleted (issue #1915) — the
 // caller (cleanup.job.ts) walks each row's blob for FileRefs and releases
-// them per-tenant via ctx._fileProviderResolver, then deletes the batch by
-// id via deleteDraftsByIds below. Ordered oldest-first so a batch is a
-// stable, deterministic slice across the two queries.
+// them per-tenant via ctx._fileProviderResolver, then deletes the batch
+// per-row via formDraftExecutor.delete (event-sourced, not raw SQL — a
+// rebuild must not resurrect a "deleted" draft). Ordered oldest-first so a
+// batch is a stable, deterministic slice across the two queries.
 export async function selectStaleDraftsBatch(
   db: DbConnection,
   olderThanDays: number,
   batchSize: number,
 ): Promise<readonly StaleDraftRow[]> {
   const rows = (await asRawClient(db).unsafe(
-    `SELECT "id", "tenant_id", "owner_id", "draft" FROM "read_form_drafts"
+    `SELECT "id", "tenant_id", "owner_id", "draft", "inserted_at" FROM "read_form_drafts"
      WHERE COALESCE("modified_at", "inserted_at") < now() - ($1::int * interval '1 day')
      ORDER BY COALESCE("modified_at", "inserted_at") ASC
      LIMIT $2`,
     [olderThanDays, batchSize],
-  )) as readonly { id: string; tenant_id: string; owner_id: string; draft: FormDraftBlob }[];
+  )) as readonly {
+    id: string;
+    tenant_id: string;
+    owner_id: string;
+    draft: FormDraftBlob;
+    inserted_at: Date;
+  }[];
   return rows.map((row) => ({
     id: row.id,
     tenantId: row.tenant_id as TenantId, // @cast-boundary db-row
     ownerId: row.owner_id,
     draft: row.draft,
+    insertedAt: Temporal.Instant.fromEpochMilliseconds(+row.inserted_at), // @cast-boundary db-row
   }));
 }
-
-export async function deleteDraftsByIds(db: DbConnection, ids: readonly string[]): Promise<number> {
-  if (ids.length === 0) return 0;
-  const rows = (await asRawClient(db).unsafe(
-    `DELETE FROM "read_form_drafts" WHERE "id" = ANY($1::uuid[]) RETURNING "id"`,
-    [ids],
-  )) as readonly { id: string }[];
-  return rows.length;
-}

package/src/form-draft/db/queries/owned-file-refs.ts

@@ -1,6 +1,7 @@
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 
 // Narrows a draft blob's raw FileRef-shaped storageKeys (collectDraftFileRefKeys
 // output — extracted from free-form, client-supplied JSON, issue #1889) down to
@@ -9,18 +10,28 @@ import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 // { storageKey: "<someone-else's-real-key>" } would reach the storage
 // provider's delete() unchecked — the same ownership boundary file-routes.ts
 // enforces (loadFileForTenant + FileAccessGuard) before every read/delete.
+//
+// `draftInsertedAt` additionally excludes FileRefs that existed BEFORE the
+// draft row was created. In edit-mode the draft blob carries the full form
+// values, including FileRef pointers the domain entity pre-filled — those
+// storageKeys are owned by the caller (uploaded by them, on an earlier
+// entity) but must survive a discard/cleanup sweep because the live entity
+// still references them. Only uploads that happened during THIS draft's
+// lifetime (inserted after the draft row) are release-eligible.
 export async function filterOwnedStorageKeys(
   db: DbRunner,
   tenantId: TenantId,
   ownerId: string,
   candidateKeys: readonly string[],
+  draftInsertedAt: Temporal.Instant,
 ): Promise<readonly string[]> {
   if (candidateKeys.length === 0) return [];
   const rows = (await asRawClient(db).unsafe(
     `SELECT "storage_key" FROM "file_refs"
      WHERE "tenant_id" = $1 AND "inserted_by_id" = $2
-       AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false`,
-    [tenantId, ownerId, candidateKeys],
+       AND "storage_key" = ANY($3::text[]) AND "is_deleted" = false
+       AND "inserted_at" > $4::timestamptz`,
+    [tenantId, ownerId, candidateKeys, draftInsertedAt.toString()],
   )) as readonly { storage_key: string }[];
   return rows.map((row) => row.storage_key);
 }

package/src/form-draft/feature.ts

@@ -25,7 +25,13 @@ function registerFormDraft(r: FeatureRegistrar<typeof FORM_DRAFT_FEATURE_NAME>):
     recommended: false,
   });
 
-  r.requires("config");
+  // config is optional: the retention-days key only resolves when the
+  // config feature is mounted (ctx.configResolver present) — the cleanup
+  // job already falls back to FORM_DRAFT_DEFAULT_RETENTION_DAYS otherwise
+  // (see handlers/cleanup.job.ts). A hard r.requires("config") would break
+  // every app that mounts form-draft without config, which is a breaking
+  // change no minor/patch release should introduce silently.
+  r.optionalRequires("config");
   r.entity("form-draft", formDraftEntity);
 
   r.writeHandler(saveDraftWrite);

package/src/form-draft/handlers/__tests__/cleanup.job.test.ts

@@ -0,0 +1,55 @@
+// groupStaleDraftIdsByTenant — the raw-SQL cross-tenant DELETE it replaced
+// (deleteDraftsByIds) never distinguished tenants; formDraftExecutor.delete
+// needs a tenant-scoped db + a per-tenant SessionUser, so this grouping is
+// the load-bearing step between "batch of stale rows across N tenants" and
+// "N per-tenant delete loops". Pure logic, no DB — DB-gated coverage of the
+// actual delete path lives in __tests__/cleanup.integration.test.ts.
+
+import { describe, expect, test } from "bun:test";
+import { testTenantId } from "@cosmicdrift/kumiko-framework/stack";
+import { Temporal } from "temporal-polyfill";
+import type { StaleDraftRow } from "../../db/queries/cleanup";
+import { groupStaleDraftIdsByTenant } from "../cleanup.job";
+
+const TENANT_A = testTenantId(101);
+const TENANT_B = testTenantId(102);
+
+function row(id: string, tenantId = TENANT_A): StaleDraftRow {
+  return {
+    id,
+    tenantId,
+    ownerId: "owner-1",
+    draft: { values: {}, stepIndex: 0, savedAt: "" },
+    insertedAt: Temporal.Instant.fromEpochMilliseconds(0),
+  };
+}
+
+describe("groupStaleDraftIdsByTenant", () => {
+  test("groups ids under their own tenant, preserves per-tenant order", () => {
+    const batch = [
+      row("id-a1", TENANT_A),
+      row("id-b1", TENANT_B),
+      row("id-a2", TENANT_A),
+      row("id-b2", TENANT_B),
+    ];
+
+    const grouped = groupStaleDraftIdsByTenant(batch);
+
+    expect(grouped.size).toBe(2);
+    expect(grouped.get(TENANT_A)).toEqual(["id-a1", "id-a2"]);
+    expect(grouped.get(TENANT_B)).toEqual(["id-b1", "id-b2"]);
+  });
+
+  test("a single-tenant batch produces exactly one group", () => {
+    const batch = [row("id-1"), row("id-2"), row("id-3")];
+
+    const grouped = groupStaleDraftIdsByTenant(batch);
+
+    expect(grouped.size).toBe(1);
+    expect(grouped.get(TENANT_A)).toEqual(["id-1", "id-2", "id-3"]);
+  });
+
+  test("an empty batch produces an empty map", () => {
+    expect(groupStaleDraftIdsByTenant([]).size).toBe(0);
+  });
+});

package/src/form-draft/handlers/cleanup.job.ts

@@ -6,23 +6,22 @@
 // Chunked DELETE (default 1000/batch) keeps lock durations bounded, mirror
 // of sessions/handlers/cleanup.job.ts.
 
-import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   type AppContext,
   access,
   type ConfigKeyDefinition,
   createSystemConfig,
+  createSystemUser,
   type JobHandlerFn,
   SYSTEM_TENANT_ID,
   SYSTEM_USER_ID,
+  type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
-import {
-  deleteDraftsByIds,
-  type StaleDraftRow,
-  selectStaleDraftsBatch,
-} from "../db/queries/cleanup";
+import { type StaleDraftRow, selectStaleDraftsBatch } from "../db/queries/cleanup";
 import { filterOwnedStorageKeys } from "../db/queries/owned-file-refs";
+import { formDraftExecutor } from "../executor";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs";
 
 export const FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY = "form-draft:config:retention-days";
@@ -63,7 +62,13 @@ async function releaseRowFileRefs(
     // draft owner are releasable — `draft.values` is free-form JSON the
     // owning user controls, so an unverified key could target someone
     // else's file (see db/queries/owned-file-refs.ts).
-    const ownedKeys = await filterOwnedStorageKeys(db, row.tenantId, row.ownerId, keys);
+    const ownedKeys = await filterOwnedStorageKeys(
+      db,
+      row.tenantId,
+      row.ownerId,
+      keys,
+      row.insertedAt,
+    );
     const provider = await fileProviderResolver(row.tenantId);
     await releaseDraftFileRefs(ownedKeys, (key) => provider.delete(key), log);
   } catch (err) {
@@ -73,6 +78,50 @@ async function releaseRowFileRefs(
   }
 }
 
+// A stale-drafts batch spans arbitrary tenants (this job sweeps the whole
+// table under SYSTEM_TENANT_ID, not per-tenant) — group by tenant so each
+// tenant's rows get deleted through a tenant-scoped db + system user, one
+// event-store delete per row rather than a raw cross-tenant DELETE.
+export function groupStaleDraftIdsByTenant(
+  batch: readonly StaleDraftRow[],
+): ReadonlyMap<TenantId, readonly string[]> {
+  const grouped = new Map<TenantId, string[]>();
+  for (const row of batch) {
+    const ids = grouped.get(row.tenantId);
+    if (ids) ids.push(row.id);
+    else grouped.set(row.tenantId, [row.id]);
+  }
+  return grouped;
+}
+
+// Raw `DELETE FROM read_form_drafts` would bypass the event store entirely
+// — a projection rebuild/replay has no `deleted` event to apply and the row
+// resurrects, PII included. formDraftExecutor.delete() is the event-sourced
+// path; it needs a tenant-scoped db + a SessionUser, so rows are grouped by
+// tenant first (see groupStaleDraftIdsByTenant above).
+async function deleteStaleDraftsBatch(
+  batch: readonly StaleDraftRow[],
+  db: DbConnection,
+  log: AppContext["log"],
+): Promise<number> {
+  let deleted = 0;
+  for (const [tenantId, ids] of groupStaleDraftIdsByTenant(batch)) {
+    const systemUser = createSystemUser(tenantId);
+    const tenantDb = createTenantDb(db, tenantId, "system");
+    for (const id of ids) {
+      const result = await formDraftExecutor.delete({ id }, systemUser, tenantDb);
+      if (result.isSuccess) {
+        deleted++;
+      } else {
+        log?.warn?.(
+          `[form-draft:cleanup] failed to delete stale draft id=${id} tenant=${tenantId}: ${result.error.message}`,
+        );
+      }
+    }
+  }
+  return deleted;
+}
+
 export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
   if (!ctx.db || !ctx.registry) {
     throw new InternalError({
@@ -109,10 +158,7 @@ export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
       await releaseRowFileRefs(row, db, fileProviderResolver, ctx.log);
     }
 
-    const batchDeleted = await deleteDraftsByIds(
-      db,
-      batch.map((row) => row.id),
-    );
+    const batchDeleted = await deleteStaleDraftsBatch(batch, db, ctx.log);
     deleted += batchDeleted;
     if (batchDeleted === 0 || batch.length < DEFAULT_BATCH_SIZE) break;
   }

package/src/form-draft/handlers/discard.write.ts

@@ -47,6 +47,7 @@ export const discardDraftWrite = defineWriteHandler({
         event.user.tenantId,
         ownerId,
         candidateKeys,
+        existing.insertedAt,
       );
       await releaseDraftFileRefs(ownedKeys, (key) => files.ref(key).delete(), ctx.log);
     }

package/src/form-draft/lookup.ts

@@ -1,6 +1,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import type { Temporal } from "temporal-polyfill";
 import { formDraftTable } from "./executor";
 import type { FormDraftBlob } from "./schemas";
 
@@ -8,6 +9,7 @@ export type FormDraftRow = {
   readonly id: string;
   readonly version: number;
   readonly draft: FormDraftBlob;
+  readonly insertedAt: Temporal.Instant;
 };
 
 // Shared by save (upsert lookup + race re-lookup), discard, and get — always

package/src/form-draft-user-data/__tests__/hooks-delete-failure.integration.test.ts

@@ -0,0 +1,60 @@
+// formDraftDeleteHook must not silently succeed when a forget run deletes
+// every draft row for a user — an Art.17 forget run that reports success
+// while PII is still there is a compliance bug, not a display bug.
+// The partial-failure case (one delete among several fails) is covered
+// mock-free in run-forget-cleanup.integration.test.ts:877; a mock-free way
+// to trigger it here would need an optimistic-lock race too fragile to rely on.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { createConfigFeature } from "../../config";
+import { FormDraftHandlers, formDraftEntity, formDraftFeature } from "../../form-draft";
+import { formDraftDeleteHook } from "../hooks";
+
+async function countDraftRows(stack: TestStack, ownerId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe(
+    "SELECT count(*)::int AS n FROM read_form_drafts WHERE owner_id = $1",
+    [ownerId],
+  );
+  return (rows as Array<{ n: number }>)[0]?.n ?? 0;
+}
+
+let stack: TestStack;
+const alice = createTestUser({ id: 31, roles: ["TenantMember"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [formDraftFeature, createConfigFeature()] });
+  await unsafeCreateEntityTable(stack.db, formDraftEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("formDraftDeleteHook — delete failure handling (#review-batch-fw-1)", () => {
+  test("does not throw when every delete succeeds", async () => {
+    const bob = createTestUser({ id: 32, roles: ["TenantMember"], tenantId: alice.tenantId });
+    await stack.http.writeOk(
+      FormDraftHandlers.save,
+      { draftKey: "wizard:bob-ok", values: {}, stepIndex: 0 },
+      bob,
+    );
+
+    await expect(
+      formDraftDeleteHook(
+        { db: stack.db, registry: stack.registry, tenantId: bob.tenantId, userId: bob.id },
+        "delete",
+      ),
+    ).resolves.toBeUndefined();
+
+    expect(await countDraftRows(stack, String(bob.id))).toBe(0);
+  });
+});

package/src/form-draft-user-data/hooks.ts

@@ -43,7 +43,18 @@ export const formDraftDeleteHook: UserDataDeleteHook = async (ctx) => {
   });
   const systemUser = createSystemUser(ctx.tenantId);
   const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
+  const failures: string[] = [];
   for (const row of rows) {
-    await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+    const result = await formDraftExecutor.delete({ id: row.id }, systemUser, tdb);
+    if (!result.isSuccess) {
+      failures.push(`${row.id}: ${result.error.message}`);
+    }
+  }
+  // A silently-ignored delete failure would let the forget pipeline flip the
+  // user to Deleted (Art. 17 "done") while the row — and its PII — is still
+  // there. Throwing rolls back this user's sub-tx (runForgetCleanup) so the
+  // status stays DeletionRequested and the next run retries.
+  if (failures.length > 0) {
+    throw new Error(`[form-draft-user-data] failed to delete draft(s): ${failures.join(", ")}`);
   }
 };

package/src/template-resolver/handlers/by-slug.query.ts

@@ -50,6 +50,7 @@ export const bySlugQuery = defineQueryHandler({
       locale: row.locale,
       title: row.title,
       content: row.content,
+      contentFormat: row.contentFormat,
       folder: row.folder,
       updatedAt: row.updatedAt,
     };

package/src/template-resolver/handlers/collection-shared.ts

@@ -34,6 +34,7 @@ export type CollectionEntryRow = {
   readonly locale: string;
   readonly title: string | null;
   readonly content: string | null;
+  readonly contentFormat: string;
   readonly folder: string | null;
   readonly updatedAt: Date;
 };
@@ -81,6 +82,7 @@ export function toCollectionEntry(row: CollectionEntryRow) {
     locale: row.locale,
     title: row.title,
     content: row.content,
+    contentFormat: row.contentFormat,
     folder: row.folder,
     updatedAt: row.updatedAt,
   };

package/src/template-resolver/web/__tests__/editor-read-only.test.tsx

@@ -28,6 +28,7 @@ mock.module("@cosmicdrift/kumiko-renderer", () => ({
       locale: "de",
       title: "Impressum",
       content: "Inhalt",
+      contentFormat: "plain",
       folder: "legal",
     },
     loading: false,
@@ -160,4 +161,28 @@ describe("TextContentEditor — handleSave", () => {
     const [, payload] = write.mock.calls[0] as unknown as [unknown, { folder: string | null }];
     expect(payload.folder).toBe("legal");
   });
+
+  // TARGET has no collectionId, so the collection's declared contentFormat is
+  // always undefined here — the write payload must fall back to the loaded
+  // entry's own contentFormat ("plain") instead of silently defaulting to
+  // "markdown" via the write schema's contentFormatSchema.default("markdown").
+  test("sendet das geladene contentFormat unverändert mit, statt es auf markdown zu defaulten", async () => {
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useShellUser as any).mockReturnValue({ id: "u1", roles: ["TenantAdmin"] });
+    const write = mock(() => Promise.resolve({ isSuccess: true, data: { isNew: false } }));
+    // biome-ignore lint/suspicious/noExplicitAny: Bun mock function
+    (useDispatcher as any).mockReturnValue({ write, query: mock() });
+
+    const Editor = getEditor();
+    render(<Editor target={TARGET} onClose={() => {}} />, { wrapper: Wrapper });
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole("button", { name: /speichern/i }));
+      await Promise.resolve();
+    });
+
+    expect(write).toHaveBeenCalledTimes(1);
+    const [, payload] = write.mock.calls[0] as unknown as [unknown, { contentFormat?: string }];
+    expect(payload.contentFormat).toBe("plain");
+  });
 });