@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/auth-email-password/__tests__/magic-link-mail.test.ts

@@ -0,0 +1,38 @@
+import { beforeAll, describe, expect, test } from "bun:test";
+import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
+import { dispatchMagicLinkMail } from "../magic-link-mail";
+
+describe("dispatchMagicLinkMail appUrl locale negotiation", () => {
+  beforeAll(() => {
+    registerMailTranslations("de", { "test.unused": "x" });
+  });
+
+  test("negotiates de-AT down to de for language-in-path appUrl", async () => {
+    const seen: string[] = [];
+    await dispatchMagicLinkMail(
+      async () => {},
+      {
+        handlerName: "test",
+        notificationType: "test.mail",
+        renderContent: (args) => {
+          seen.push(args.url);
+          return {
+            subject: "s",
+            header: "h",
+            sections: [],
+            footer: "f",
+          };
+        },
+      },
+      {
+        email: "a@example.com",
+        appUrl: (locale) => `https://app.example.com/${locale}/activate`,
+        token: "tok",
+        expiresAt: "2099-01-01T00:00:00Z",
+        locale: "de-AT",
+      },
+    );
+    expect(seen[0]).toContain("https://app.example.com/de/activate");
+    expect(seen[0]).not.toContain("/de-AT/");
+  });
+});

package/src/auth-email-password/__tests__/multi-roles.integration.test.ts

@@ -173,7 +173,7 @@ describe("multi-roles: privilege-escalation blocked via field-level write-access
       {
         id: targetId,
         version: 1,
-        changes: { roles: JSON.stringify(["SystemAdmin"]) },
+        changes: { roles: ["SystemAdmin"] },
       },
       tenantAdminSession,
     );
@@ -201,7 +201,7 @@ describe("multi-roles: privilege-escalation blocked via field-level write-access
       {
         id: userId,
         version: 1,
-        changes: { roles: JSON.stringify(["SystemAdmin"]) },
+        changes: { roles: ["SystemAdmin"] },
       },
       userSession,
     );

package/src/auth-email-password/__tests__/password-reset.integration.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { randomBytes } from "node:crypto";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
+import { LOCALE_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { SYSTEM_TENANT_ID, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
 import { registerMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
@@ -41,11 +42,6 @@ import { signResetToken } from "../reset-token";
 // directly (no jobRunner in the test stack → inline send).
 const emailTransport = createInMemoryTransport();
 
-// Kept in sync with LOCALE_HEADER_NAME in api-constants.ts by hand — that
-// constant is a framework-internal implementation detail, not exported from
-// the public /api barrel (same as TENANT_HEADER_NAME).
-const LOCALE_HEADER_NAME = "X-Locale";
-
 registerMailTranslations("de", localeDeBundle);
 
 // Records the userId every time the sessions feature's auto-revoke hook

package/src/auth-email-password/__tests__/signup-flow.integration.test.ts

@@ -26,6 +26,7 @@
 //      zusammen).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { LOCALE_HEADER_NAME } from "@cosmicdrift/kumiko-framework/api";
 import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -98,11 +99,6 @@ const tenantMembershipHookVendorFeature = defineFeature(
 
 const APP_ACTIVATION_URL = "https://app.example.com/signup/complete";
 
-// Kept in sync with LOCALE_HEADER_NAME in api-constants.ts by hand — that
-// constant is a framework-internal implementation detail, not exported from
-// the public /api barrel (same as TENANT_HEADER_NAME).
-const LOCALE_HEADER_NAME = "X-Locale";
-
 registerMailTranslations("de", localeDeBundle);
 
 // Activation mails now go through delivery (ctx.notify → channel-email). The

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -39,6 +39,11 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
+// kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
+import {
+  findForbiddenMembershipRole,
+  reservedMembershipRoleError,
+} from "../../tenant/membership-roles";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper for a privileged cross-tenant add
 import { seedTenantMembership } from "../../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import login-style password-check
@@ -204,6 +209,10 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
         const dbConn = ctx.db.raw;
 
         if (!alreadyMember) {
+          const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
+          if (forbiddenInviteRole !== undefined) {
+            return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
+          }
           await seedTenantMembership(dbConn, {
             userId,
             tenantId: invitationTenantId,

package/src/auth-email-password/handlers/invite-accept.write.ts

@@ -31,6 +31,11 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
+// kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
+import {
+  findForbiddenMembershipRole,
+  reservedMembershipRoleError,
+} from "../../tenant/membership-roles";
 // kumiko-lint-ignore cross-feature-import direkter membership-Lookup (ungefiltert, s. alreadyMember-Kommentar)
 import { tenantMembershipsTable } from "../../tenant/membership-table";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add (analog provisionSignupAccount)
@@ -70,6 +75,7 @@ export function createInviteAcceptHandler() {
     // nutzen `roles: ["all"]` weil dort GUEST_USER mit ["all"]-role
     // dispatched wird.
     access: { openToAll: true },
+    // kumiko-lint-ignore complexity-budget invite branches (auth/anon/burn) stay in one handler
     handler: async (event, ctx) => {
       if (!ctx.redis) {
         return writeFailure(
@@ -142,6 +148,10 @@ export function createInviteAcceptHandler() {
           // ["SystemAdmin"]-Role akzeptiert; createSystemUser produziert
           // "system"-Role die NICHT matcht. Direkt-via-Executor bypassed
           // den Access-Check für privilegierte Cross-Tenant-Operationen.
+          const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
+          if (forbiddenInviteRole !== undefined) {
+            return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
+          }
           await seedTenantMembership(dbConn, {
             userId: event.user.id,
             tenantId: invitationTenantId,

package/src/auth-email-password/handlers/invite-create.write.ts

@@ -17,7 +17,7 @@
 // erlaubt new-user-signup mit dem Token. Keine Enumeration durchs
 // invite-create.
 
-import { generateToken, requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
 import { createEventStoreExecutor } from "@cosmicdrift/kumiko-framework/db";
 import { access, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
@@ -41,7 +41,7 @@ import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants";
 import type { AuthMailLocale } from "../email-templates";
 import { renderInviteEmail } from "../email-templates";
 import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token-store";
-import { dispatchMagicLinkMail } from "../magic-link-mail";
+import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail";
 
 const INVITE_NOTIFICATION_TYPE = "auth-email-password:invite";
 
@@ -103,9 +103,11 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
         return writeFailure(reservedMembershipRoleError(forbiddenRole));
       }
 
-      const elevationForbidden = findForbiddenRoleAssignment(event.user.roles, [
-        event.payload.role,
-      ]);
+      const elevationForbidden = findForbiddenRoleAssignment(
+        event.user.roles,
+        [event.payload.role],
+        [],
+      );
       if (elevationForbidden !== undefined) {
         return writeFailure(unassignableMembershipRoleError(elevationForbidden));
       }
@@ -168,10 +170,7 @@ export function createInviteCreateHandler(opts: InviteCreateOptions) {
 
       await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
 
-      // Same precedence as signup/reset/verify: the inviting admin's active
-      // browser language wins when the request carries one, else the
-      // handler's static opts.locale, else ctx.locale's own default.
-      const locale = requestContext.get()?.locale ?? opts.locale ?? ctx.locale;
+      const locale = resolveHandlerMailLocale(ctx, opts.locale);
 
       await dispatchMagicLinkMail(
         ctx.notify,

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -39,6 +39,11 @@ import {
   tenantInvitationEntity,
   tenantInvitationsTable,
 } from "../../tenant/invitation-table";
+// kumiko-lint-ignore cross-feature-import reserved-role check owned by tenant-feature
+import {
+  findForbiddenMembershipRole,
+  reservedMembershipRoleError,
+} from "../../tenant/membership-roles";
 // kumiko-lint-ignore cross-feature-import membership-seed-helper für privilegierten cross-tenant-add
 import { seedTenantMembership } from "../../tenant/seeding";
 // kumiko-lint-ignore cross-feature-import existence-check
@@ -143,6 +148,10 @@ export function createInviteSignupCompleteHandler() {
         // Membership-Add via seed-helper (gleiches Pattern wie
         // provisionSignupAccount — bypassed addMember access-check
         // weil createSystemUser nicht ["SystemAdmin"] matcht).
+        const forbiddenInviteRole = findForbiddenMembershipRole([invitationRole]);
+        if (forbiddenInviteRole !== undefined) {
+          return writeFailure(reservedMembershipRoleError(forbiddenInviteRole));
+        }
         await seedTenantMembership(dbConn, {
           userId,
           tenantId: invitationTenantId,

package/src/auth-email-password/handlers/signup-request.write.ts

@@ -21,7 +21,7 @@
 // suppressing the link on the request side would be defense-in-depth, but
 // with an enumeration risk of its own (separate concern).
 
-import { generateToken, requestContext } from "@cosmicdrift/kumiko-framework/api";
+import { generateToken } from "@cosmicdrift/kumiko-framework/api";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { Temporal } from "temporal-polyfill";
@@ -29,7 +29,7 @@ import { z } from "zod";
 import { AUTH_SIGNUP_DEFAULT_TTL_MINUTES } from "../constants";
 import type { AuthMailLocale } from "../email-templates";
 import { renderActivationEmail } from "../email-templates";
-import { dispatchMagicLinkMail } from "../magic-link-mail";
+import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail";
 import { AUTH_SELF_REGISTRATION_FEATURE } from "../self-registration-toggle";
 import {
   invalidateExistingSignupToken,
@@ -133,15 +133,7 @@ export function createSignupRequestHandler(opts: SignupRequestOptions) {
       // get the same format.
       const normalizedEmail = normalizeEmail(email);
 
-      // ctx.locale always resolves to something (falls back to the app's
-      // boot default, then "en" — dispatch-shared.ts), so it can't tell us
-      // whether THIS request actually carried a locale signal. Read the raw
-      // request-layer value instead: present → the browser's active
-      // language wins over opts.locale (this handler's static config);
-      // absent → opts.locale is the real, still-relevant fallback
-      // (backwards compatibility for callers that configured it and never
-      // send X-Locale), then ctx.locale's own resolved default.
-      const locale = requestContext.get()?.locale ?? opts.locale ?? ctx.locale;
+      const locale = resolveHandlerMailLocale(ctx, opts.locale);
 
       await dispatchMagicLinkMail(
         ctx.notify,

package/src/auth-email-password/handlers/token-request-handler.ts

@@ -12,7 +12,6 @@
 // default TTL, extra skip condition) + two error codes — encoded on the
 // spec rather than duplicated across two near-identical handler bodies.
 
-import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import { createSystemUser, defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "temporal-polyfill";
@@ -20,7 +19,7 @@ import { z } from "zod";
 import { UserQueries } from "../../user";
 import { type AuthUserRow, parseAuthUserRow } from "../auth-user-row";
 import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "../email-templates";
-import { dispatchMagicLinkMail } from "../magic-link-mail";
+import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail";
 
 const RequestTokenSchema = z.object({
   email: z.email(),
@@ -124,14 +123,7 @@ export function createTokenRequestHandler<TName extends string, TSuccessKind ext
 
       const { token, expiresAt } = spec.sign(user.id, ttl, opts.hmacSecret);
 
-      // ctx.locale always resolves to something (falls back to the app's
-      // boot default, then "en"), so it can't tell us whether THIS request
-      // actually carried a locale signal. Read the raw request-layer value
-      // instead: present → the requester's active language wins over
-      // opts.locale (this handler's static config); absent → opts.locale
-      // is the real, still-relevant fallback, then ctx.locale's own
-      // resolved default.
-      const locale = requestContext.get()?.locale ?? opts.locale ?? ctx.locale;
+      const locale = resolveHandlerMailLocale(ctx, opts.locale);
 
       await dispatchMagicLinkMail(
         ctx.notify,

package/src/auth-email-password/i18n.ts

@@ -115,6 +115,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "auth.signupComplete.submitting": "…",
     "auth.signupComplete.missingToken":
       "Activation link is missing a token. Please request a new one.",
+    "auth.signupComplete.activatedTitle": "Account activated",
     "auth.signupComplete.activated": "Your account is active and you're signed in.",
     "auth.signupComplete.continue": "Continue",
     "auth.inviteAccept.title": "Accept invitation",

package/src/auth-email-password/magic-link-mail.ts

@@ -6,8 +6,10 @@
 // non-unsubscribable). No r.notification is declared; buildMessage falls back
 // to the structured `data` for the renderer.
 
+import { requestContext } from "@cosmicdrift/kumiko-framework/api";
 import type { NotifyFn } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { resolveMailLocale } from "@cosmicdrift/kumiko-framework/i18n";
 import type { AuthMailContent, AuthMailLocale, RenderTokenContentArgs } from "./email-templates";
 
 // Per-flow constants: which notification type to dispatch and how to render the
@@ -43,6 +45,17 @@ function appendToken(appUrl: string, token: string): string {
   return `${appUrl}${sep}token=${encodeURIComponent(token)}`;
 }
 
+// X-Locale on the request wins over the handler's static opts.locale, then
+// ctx.locale's resolved default (always set — boot default / "en"). Reading
+// requestContext is load-bearing: ctx.locale alone cannot tell whether THIS
+// request carried a locale signal.
+export function resolveHandlerMailLocale(
+  ctx: { readonly locale?: string },
+  optsLocale: string | undefined,
+): string | undefined {
+  return requestContext.get()?.locale ?? optsLocale ?? ctx.locale;
+}
+
 export async function dispatchMagicLinkMail(
   notify: NotifyFn | undefined,
   spec: MagicLinkMailSpec,
@@ -57,8 +70,11 @@ export async function dispatchMagicLinkMail(
     });
   }
   const locale = params.locale ?? "en";
+  // mailT already root-falls-back; appUrl must use the same negotiated tag
+  // or language-in-path apps 404 on e.g. /de-AT/activate.
+  const urlLocale = resolveMailLocale(locale);
   const content = spec.renderContent({
-    url: appendToken(resolveAppUrl(params.appUrl, locale), params.token),
+    url: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
     expiresAt: params.expiresAt,
     ...(params.locale !== undefined && { locale: params.locale }),
     ...(params.appName !== undefined && { appName: params.appName }),

package/src/auth-email-password/web/__tests__/signup-complete-screen.test.tsx

@@ -100,7 +100,7 @@ describe("SignupCompleteScreen", () => {
 
       // Continue button targets exactly what resolveLoggedInHref computes from
       // the response's tenantKey, via the app-supplied function-form prop.
-      const continueLink = screen.getByRole("link", { name: "Continue" }) as HTMLAnchorElement;
+      const continueLink = screen.getByRole("link", { name: "Continue" });
       expect(continueLink.getAttribute("href")).toBe("/acme/");
     } finally {
       window.location.assign = assignOrig;

package/src/auth-email-password/web/auth-client.ts

@@ -411,12 +411,6 @@ export async function fetchCurrentUser(): Promise<CurrentUserProfile | null> {
     email: body.data.email,
     displayName: body.data.displayName,
     ...(body.data.locale !== undefined && { locale: body.data.locale }),
-    globalRoles: parseGlobalRoles(body.data.roles),
+    globalRoles: parseRoles(body.data.roles),
   };
 }
-
-// Defensive parse — roles may be jsonb string[] (0.217+) or a legacy
-// JSON-encoded string; malformed → [] so SessionProvider mount never throws.
-function parseGlobalRoles(raw: unknown): readonly string[] {
-  return parseRoles(raw);
-}

package/src/auth-email-password/web/signup-complete-screen.tsx

@@ -23,17 +23,11 @@ import { AuthCard, useUrlToken } from "./auth-form-primitives";
 
 export type SignupCompleteScreenProps = {
   readonly title?: string;
-  /** Override für den Token aus der URL — Apps die per server-side-
-   *  Render einen Token reinreichen, brauchen das. Default: parsed aus
-   *  `?token=...` in der URL. */
+  /** Override for the URL token — server-rendered apps can pass it. Default: `?token=...`. */
   readonly token?: string;
-  /** Where to send the user after successful activation. Default "/" —
-   *  Apps mit Multi-Tenant-Routing ersetzen das durch
-   *  `(data) => "/" + data.tenantKey + "/"`. Function-form, weil nur
-   *  nach success bekannt welcher tenantKey zugeteilt wurde. */
+  /** Where to send the user after activation. Function-form receives the tenantKey. Default "/". */
   readonly loggedInHref?: string | ((args: { tenantKey: string }) => string);
-  /** href für "Schon einen Account?"-Link bei missing-token-Fall.
-   *  Default "/login". */
+  /** Href for the "already have an account?" link when the token is missing. Default "/login". */
   readonly loginHref?: string;
 };
 
@@ -89,7 +83,11 @@ export function SignupCompleteScreen({
     void doSubmit();
   };
 
-  const effectiveTitle = title ?? t("auth.signupComplete.title");
+  const effectiveTitle =
+    title ??
+    (continueHref !== null
+      ? t("auth.signupComplete.activatedTitle")
+      : t("auth.signupComplete.title"));
 
   // Kein Token in der URL → klare Message statt Form ohne Token
   // (würde nur invalidSignupToken zeigen, verwirrend).
@@ -110,7 +108,9 @@ export function SignupCompleteScreen({
     return (
       <AuthCard title={effectiveTitle}>
         <div className="p-6 pt-0 flex flex-col gap-4">
-          <p className="text-sm text-muted-foreground">{t("auth.signupComplete.activated")}</p>
+          <p className="text-sm text-muted-foreground" role="status">
+            {t("auth.signupComplete.activated")}
+          </p>
           <Link href={continueHref} variant="button">
             {t("auth.signupComplete.continue")}
           </Link>

package/src/config/db/queries/__tests__/resolver.test.ts

@@ -1,10 +1,3 @@
-// #1163: config:query:readiness read config rows via asRawClient(db).unsafe()
-// directly, bypassing the #1358 closed-connection retry that only covered
-// bun-db/query.ts's own selectMany/countWhere. Routed through the exported
-// unsafeReadRetrying helper instead — this test mirrors
-// bun-db/__tests__/select-many-retry.test.ts's fake-client pattern to prove
-// the retry now actually fires for this call site.
-
 import { describe, expect, test } from "bun:test";
 import { selectConfigRowsForKeys, selectConfigRowsForScope } from "../resolver";
 
@@ -28,9 +21,7 @@ function fakeClient(failures: Error[]): FakeClient {
       if (err) throw err;
       return [{ id: "r1", key: "k", value: "v", tenantId: "t1", userId: null }];
     },
-    // Top-level pool client — matches what dispatch-query.ts hands buildHandlerContext
-    // for a standalone query.execute() call (no tx passed, resolveDbSource falls back
-    // to the pool connection, which has .begin()).
+    // begin() present => pool client => retry path
     begin: () => {
       throw new Error("not used in test");
     },
@@ -61,4 +52,21 @@ describe("config db/queries/resolver — closed-connection retry (#1163)", () =>
     );
     expect(db.calls).toBe(2);
   });
+
+  test("does not retry when the client has no begin()", async () => {
+    let calls = 0;
+    const db = {
+      unsafe: async () => {
+        calls++;
+        throw closedConnectionError();
+      },
+      savepoint: () => {
+        throw new Error("not used");
+      },
+    };
+    await expect(selectConfigRowsForScope(db as never, "system", "t1", "u1")).rejects.toThrow(
+      "connection was closed",
+    );
+    expect(calls).toBe(1);
+  });
 });

package/src/crypto-shredding/__tests__/forget-subject.integration.test.ts

@@ -19,9 +19,11 @@ import {
   createEntity,
   createTextField,
   defineFeature,
+  SYSTEM_TENANT_ID,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { reindexEntity } from "@cosmicdrift/kumiko-framework/search";
 import {
   setupTestStack,
   type TestStack,
@@ -158,6 +160,7 @@ describe("crypto-shredding :: forget-subject", () => {
       TestUsers.systemAdmin,
     );
     expect(result.subjectKey).toBe(`tenant:${TARGET_TENANT_ID}`);
+    await expect(kms.getKey(subject)).rejects.toThrow("Subject key erased");
   });
 
   test("repeat forget: erase is a no-op but each attempt is audited", async () => {
@@ -170,6 +173,25 @@ describe("crypto-shredding :: forget-subject", () => {
     expect(await forgottenEvents()).toHaveLength(2);
   });
 
+  // mh#349 continued: resolveTenantScopeDenial's `!features.has("tenant")`
+  // branch is a deliberate fail-open for single-/no-tenant apps — this
+  // block's stack (top of file) only mounts crypto-shredding, so there is no
+  // membership table to check a "user" subject against. Every "user"-kind
+  // test above already exercises this path implicitly; this test names and
+  // locks the behavior explicitly so a future refactor that tries to add a
+  // membership check here doesn't silently start 500ing/denying instead.
+  test("fail-open: user subject forget allowed when tenant feature isn't mounted", async () => {
+    const subject = { kind: "user", userId: TARGET_USER_ID } as const;
+    await kms.createKey(subject);
+
+    const result = await stack.http.writeOk<{ subjectKey: string }>(
+      FORGET,
+      { subject, reason: REASON },
+      dpoUser,
+    );
+    expect(result.subjectKey).toBe(`user:${TARGET_USER_ID}`);
+  });
+
   test("no KMS configured → 500 with boot hint", async () => {
     resetPiiSubjectKmsForTests();
 
@@ -489,6 +511,9 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
       dpoUser,
     );
     expect(result.subjectKey).toBe(`user:${subjectId}`);
+    await expect(kms.getKey({ kind: "user", userId: subjectId })).rejects.toThrow(
+      "Subject key erased",
+    );
   });
 
   test("DPO cannot forget another tenant's self-owned PII subject → 403", async () => {
@@ -516,3 +541,143 @@ describe("crypto-shredding :: forget-subject closes the login door (user feature
     expect(err.httpStatus).toBe(403);
   });
 });
+
+// mh#349 continued: subjectRowExistsInTenant prefills via to_regclass and
+// skips missing tables (fail-closed deny, not 500). Unexpected query errors
+// propagate. Deliberately never creates this stack's probe table so the
+// existence probe returns null and that entity is skipped.
+describe("crypto-shredding :: forget-subject subjectRowExistsInTenant missing table", () => {
+  const missingTableProbeEntity = createEntity({
+    table: "read_forget_subject_missing_table_probe",
+    fields: {
+      recipientName: createTextField({
+        required: true,
+        maxLength: 100,
+        personal: "self",
+        find: "exact",
+      }),
+    },
+  });
+  const missingTableProbeFeature = defineFeature("forget-subject-missing-table-probe", (r) => {
+    r.entity("probe", missingTableProbeEntity);
+  });
+
+  let missingTableStack: TestStack;
+  let missingTableKms: InMemoryKmsAdapter;
+
+  beforeAll(async () => {
+    missingTableStack = await setupTestStack({
+      features: [
+        createCryptoShreddingFeature(),
+        createConfigFeature(),
+        createTenantFeature(),
+        missingTableProbeFeature,
+      ],
+    });
+    await unsafePushTables(missingTableStack.db, { tenantMembershipsTable });
+    await createEventsTable(missingTableStack.db);
+    // No unsafeCreateEntityTable for missingTableProbeEntity — that's the point.
+  });
+
+  afterAll(async () => {
+    await missingTableStack.cleanup();
+  });
+
+  beforeEach(() => {
+    missingTableKms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(missingTableKms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("missing self-PII probe table denies (403), doesn't 500", async () => {
+    const err = await missingTableStack.http.writeErr(
+      FORGET,
+      { subject: { kind: "user", userId: TARGET_USER_ID }, reason: REASON },
+      dpoUser,
+    );
+    expect(err.httpStatus).toBe(403);
+  });
+});
+
+// PR#2412: user.email is `personal: "self"` (→ pii: true) + `searchable: true`,
+// so it is decrypted into the derived search index by design (screens.ts:30
+// documents that the *stored* column is ciphertext, not that search never
+// sees plaintext). The guarantee that actually protects that comment is
+// crypto-shredding purging the search doc on erasure — regression-lock it
+// against the real production field (not just the framework's synthetic pii
+// probe in reindex-entity.integration.test.ts), including across a search
+// index rebuild.
+describe("crypto-shredding :: forget-subject purges user.email from the search index", () => {
+  let emailSearchStack: TestStack;
+  let emailSearchKms: InMemoryKmsAdapter;
+
+  beforeAll(async () => {
+    emailSearchStack = await setupTestStack({
+      features: [createCryptoShreddingFeature(), createUserFeature()],
+    });
+    await unsafeCreateEntityTable(emailSearchStack.db, userEntity);
+    await createEventsTable(emailSearchStack.db);
+  });
+
+  afterAll(async () => {
+    await emailSearchStack.cleanup();
+  });
+
+  beforeEach(async () => {
+    await resetTestTables(emailSearchStack.db, [userTable, eventsTable]);
+    emailSearchKms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(emailSearchKms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("erased email is unfindable, including after a search-index rebuild", async () => {
+    const email = "erase-me-1611@example.com";
+    const { id: userId } = await seedUser(emailSearchStack.db, {
+      email,
+      displayName: "Erase Me",
+      emailVerified: true,
+    });
+
+    // user is systemStream — its events (and the derived search doc) live on
+    // SYSTEM_TENANT_ID, not a regular tenant (see screens.ts:30 comment).
+    await emailSearchStack.eventDispatcher?.runOnce();
+    const before = await emailSearchStack.search.search(SYSTEM_TENANT_ID, email, {
+      filterType: "user",
+    });
+    expect(before.some((h) => String(h.entityId) === userId)).toBe(true);
+
+    await emailSearchStack.http.writeOk(
+      FORGET,
+      { subject: { kind: "user", userId }, reason: REASON },
+      TestUsers.systemAdmin,
+    );
+
+    const after = await emailSearchStack.search.search(SYSTEM_TENANT_ID, email, {
+      filterType: "user",
+    });
+    expect(after.some((h) => String(h.entityId) === userId)).toBe(false);
+
+    // A rebuild must not resurrect the erased subject's email — reindexEntity's
+    // hasErasedSearchableSubjectField skip has to hold for this real
+    // production field, not only for the framework's synthetic pii probe.
+    const rebuild = await reindexEntity(
+      emailSearchStack.db,
+      emailSearchStack.registry,
+      emailSearchStack.search,
+      "user",
+      SYSTEM_TENANT_ID,
+    );
+    expect(rebuild.failures).toHaveLength(0);
+
+    const afterRebuild = await emailSearchStack.search.search(SYSTEM_TENANT_ID, email, {
+      filterType: "user",
+    });
+    expect(afterRebuild.some((h) => String(h.entityId) === userId)).toBe(false);
+  });
+});