@cosmicdrift/kumiko-bundled-features 0.220.1 → 0.221.0

package/src/custom-fields/__tests__/feature.test.ts

@@ -203,12 +203,10 @@ describe("createCustomFieldsFeature access-options", () => {
     expect(writeAccess(feature, "delete-system-field")).toEqual(["SystemAdmin"]);
   });
 
-  test("fieldDefinitionWriteRoles feeds into the list-default (a definer can load what they defined)", () => {
+  test("fieldDefinitionWriteRoles feeds into list roles without keeping default TenantAdmin", () => {
     const feature = createCustomFieldsFeature({ fieldDefinitionWriteRoles: ["Admin", "Editor"] });
     const roles = listAccess(feature);
-    expect(roles).toContain("Admin");
-    expect(roles).toContain("Editor");
-    expect(roles).toContain("TenantAdmin");
+    expect(roles).toEqual(["Admin", "Editor"]);
   });
 
   test("fieldDefinitionWriteRoles and valueWriteRoles are independent — setting one leaves the other's default", () => {
@@ -219,23 +217,23 @@ describe("createCustomFieldsFeature access-options", () => {
 });
 
 describe("resolveFieldDefinitionListRoles", () => {
-  test("nichts gesetzt → reiner Default", () => {
+  test("nothing set → default only", () => {
     expect(resolveFieldDefinitionListRoles({})).toEqual(["TenantAdmin"]);
   });
 
-  test("valueWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+  test("valueWriteRoles set, list unset → union with default, deduped", () => {
     expect(resolveFieldDefinitionListRoles({ valueWriteRoles: ["Admin", "Editor"] })).toEqual([
       "Admin",
       "Editor",
       "TenantAdmin",
     ]);
-    // TenantAdmin schon in valueWriteRoles → keine Dublette.
+    // TenantAdmin already in valueWriteRoles → no duplicate.
     expect(resolveFieldDefinitionListRoles({ valueWriteRoles: ["TenantAdmin", "Editor"] })).toEqual(
       ["TenantAdmin", "Editor"],
     );
   });
 
-  test("explizite list-Rollen gewinnen immer (auch über valueWriteRoles)", () => {
+  test("explicit list roles always win (even over valueWriteRoles)", () => {
     expect(
       resolveFieldDefinitionListRoles({
         valueWriteRoles: ["Admin"],
@@ -244,18 +242,18 @@ describe("resolveFieldDefinitionListRoles", () => {
     ).toEqual(["Viewer"]);
   });
 
-  test("fieldDefinitionWriteRoles gesetzt, list ungesetzt → Union mit Default, dedupliziert", () => {
+  test("fieldDefinitionWriteRoles set, list unset → write roles only (no default TenantAdmin)", () => {
     expect(
       resolveFieldDefinitionListRoles({ fieldDefinitionWriteRoles: ["Admin", "Editor"] }),
-    ).toEqual(["Admin", "Editor", "TenantAdmin"]);
+    ).toEqual(["Admin", "Editor"]);
   });
 
-  test("valueWriteRoles UND fieldDefinitionWriteRoles gesetzt → Union aus beiden plus Default", () => {
+  test("valueWriteRoles AND fieldDefinitionWriteRoles → union of both, no default", () => {
     expect(
       resolveFieldDefinitionListRoles({
         valueWriteRoles: ["Member"],
         fieldDefinitionWriteRoles: ["Admin"],
       }),
-    ).toEqual(["Member", "Admin", "TenantAdmin"]);
+    ).toEqual(["Member", "Admin"]);
   });
 });

package/src/custom-fields/constants.ts

@@ -23,9 +23,10 @@ export const CustomFieldsQueries = {
   fieldDefinitionList: "custom-fields:query:field-definition:list",
 } as const;
 
-// Name unter dem die web-component im ExtensionSectionsProvider
-// registriert wird — Apps referenzieren ihn im Screen-Schema via
-// `component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } }`.
+// Name the web component registers under in ExtensionSectionsProvider —
+// apps reference it in the screen schema via:
+// { kind: "extension", title, contributesToFormSubmit: true,
+//   component: { react: { __component: CUSTOM_FIELDS_FORM_EXTENSION_NAME } } }
 export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits

package/src/custom-fields/feature.ts

@@ -206,7 +206,7 @@ export type CustomFieldsFeatureOptions = {
    *  before #2296. Apps with their own role vocabulary (e.g. ["Admin","Editor"])
    *  MUST set this, else field-definition management is access_denied for every
    *  app-user without a "TenantAdmin" role. Only covers the tenant-scope triad —
-   *  define-/delete-system-field stay hard-wired to ["TenantAdmin"], since
+   *  define-/delete-system-field stay hard-wired to ["SystemAdmin"], since
    *  system-scope is a separate trust boundary that must not become reachable
    *  through a tenant role vocabulary. Also feeds into
    *  resolveFieldDefinitionListRoles (below) so a definer without an explicit
@@ -225,13 +225,12 @@ export function resolveFieldDefinitionListRoles(
   if (opts.valueWriteRoles === undefined && opts.fieldDefinitionWriteRoles === undefined) {
     return DEFAULT_FIELD_DEFINITION_LIST_ROLES;
   }
-  return [
-    ...new Set([
-      ...(opts.valueWriteRoles ?? []),
-      ...(opts.fieldDefinitionWriteRoles ?? []),
-      ...DEFAULT_FIELD_DEFINITION_LIST_ROLES,
-    ]),
-  ];
+  // Write-roles override replaces the default role vocab — don't keep unioning
+  // TenantAdmin onto list when the app opted into its own write roles.
+  if (opts.fieldDefinitionWriteRoles !== undefined) {
+    return [...new Set([...(opts.valueWriteRoles ?? []), ...opts.fieldDefinitionWriteRoles])];
+  }
+  return [...new Set([...(opts.valueWriteRoles ?? []), ...DEFAULT_FIELD_DEFINITION_LIST_ROLES])];
 }
 
 // Backwards-compat-wrapper. Bestehende Caller (z.B. integration-tests,

package/src/delivery/__tests__/delivery-log-query.integration.test.ts

@@ -17,6 +17,7 @@ import { deliveryAttemptsTable, notificationPreferencesTable } from "../tables";
 
 type LogRow = {
   readonly id: string;
+  readonly tenantId?: string;
   readonly type: string;
   readonly channel: string;
   readonly recipient: string | null;
@@ -25,7 +26,9 @@ type LogRow = {
 
 let stack: TestStack;
 const tenantId = testTenantId(701);
+const otherTenantId = testTenantId(702);
 const admin = createTestUser({ id: 701, roles: ["TenantAdmin"], tenantId });
+const systemAdmin = createTestUser({ id: 709, roles: ["SystemAdmin"], tenantId });
 
 beforeAll(async () => {
   stack = await setupTestStack({ features: [createDeliveryFeature()] });
@@ -55,6 +58,14 @@ beforeAll(async () => {
       recipientAddress: null,
       status: "queued",
     },
+    {
+      id: crypto.randomUUID(),
+      tenantId: otherTenantId,
+      notificationType: "logtest:other",
+      channel: "email",
+      recipientAddress: "other@example.com",
+      status: "sent",
+    },
   ]);
 });
 
@@ -115,6 +126,23 @@ describe("delivery:query:log — sort", () => {
     );
     expect(withInvalidSort.rows.map((r) => r.id)).toEqual(withNoSort.rows.map((r) => r.id));
   });
+
+  test("sort=tenantId is whitelisted and reverses for SystemAdmin cross-tenant", async () => {
+    const asc = await stack.http.queryOk<{ rows: readonly LogRow[] }>(
+      DeliveryQueries.log,
+      { sort: "tenantId", sortDirection: "asc" },
+      systemAdmin,
+    );
+    const desc = await stack.http.queryOk<{ rows: readonly LogRow[] }>(
+      DeliveryQueries.log,
+      { sort: "tenantId", sortDirection: "desc" },
+      systemAdmin,
+    );
+    const ascTenants = [...new Set(asc.rows.map((r) => r.tenantId))];
+    const descTenants = [...new Set(desc.rows.map((r) => r.tenantId))];
+    expect(new Set(ascTenants)).toEqual(new Set([tenantId, otherTenantId]));
+    expect(descTenants).toEqual([...ascTenants].reverse());
+  });
 });
 
 describe("delivery:query:log — field mapping", () => {

package/src/delivery/__tests__/delivery-security.integration.test.ts

@@ -169,7 +169,7 @@ describe("delivery log SystemAdmin cross-tenant scope", () => {
         status: string;
         error: string | null;
       }[];
-    }>(DeliveryQueries.log, {}, systemAdmin);
+    }>(DeliveryQueries.log, { limit: 100 }, systemAdmin);
 
     const byId = new Map(res.rows.map((r) => [r.id, r]));
     expect(byId.get(systemConfirmationId)?.tenantId).toBe(SYSTEM_TENANT_ID);
@@ -189,6 +189,97 @@ describe("delivery log SystemAdmin cross-tenant scope", () => {
     );
   });
 
+  test("SystemAdmin cursor-paginates the unfiltered cross-tenant result set, seeing every row exactly once", async () => {
+    const pagingTenant = testTenantId(53);
+    const seededRows = Array.from({ length: 7 }, (_, i) => ({
+      id: crypto.randomUUID(),
+      tenantId: i % 2 === 0 ? SYSTEM_TENANT_ID : pagingTenant,
+      // unique per row so we can sort on it — the default sort (createdAt)
+      // ties across rows inserted in the same insertMany statement, and the
+      // cursor WHERE only excludes strictly-equal sort values (see
+      // log.query.ts), so equal timestamps would silently drop rows.
+      notificationType: `paging-test:${i}`,
+      channel: "email",
+      recipientAddress: null,
+      status: "sent",
+    }));
+    await insertMany(stack.db, deliveryAttemptsTable, seededRows);
+
+    const systemAdmin = createTestUser({
+      id: 52,
+      roles: ["SystemAdmin"],
+      tenantId: pagingTenant,
+    });
+
+    const seenCounts = new Map<string, number>();
+    let cursor: string | undefined;
+    let pageCount = 0;
+    do {
+      const page = await stack.http.queryOk<{
+        rows: readonly { id: string }[];
+        nextCursor: string | null;
+      }>(
+        DeliveryQueries.log,
+        { limit: 3, sort: "type", sortDirection: "asc", cursor },
+        systemAdmin,
+      );
+      for (const row of page.rows) {
+        seenCounts.set(row.id, (seenCounts.get(row.id) ?? 0) + 1);
+      }
+      cursor = page.nextCursor ?? undefined;
+      pageCount += 1;
+      expect(pageCount).toBeLessThan(50);
+    } while (cursor);
+
+    expect(pageCount).toBeGreaterThan(1);
+    for (const row of seededRows) {
+      expect(seenCounts.get(row.id)).toBe(1);
+    }
+    expect([...seenCounts.values()].every((count) => count === 1)).toBe(true);
+  });
+
+  test("SystemAdmin with no demo-tenant session (session tenantId is SYSTEM_TENANT_ID itself) still sees cross-tenant rows", async () => {
+    const otherTenant = testTenantId(54);
+    const systemScopedId = crypto.randomUUID();
+    const otherTenantRowId = crypto.randomUUID();
+
+    await insertMany(stack.db, deliveryAttemptsTable, [
+      {
+        id: systemScopedId,
+        tenantId: SYSTEM_TENANT_ID,
+        notificationType: "no-session-tenant-test:system",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+      {
+        id: otherTenantRowId,
+        tenantId: otherTenant,
+        notificationType: "no-session-tenant-test:other",
+        channel: "email",
+        recipientAddress: null,
+        status: "sent",
+      },
+    ]);
+
+    // Mirrors a platform-level caller (e.g. an API key) that has no demo
+    // tenant on its session at all, as opposed to the other SystemAdmin
+    // tests above which browse from a demo tenant panel.
+    const systemAdmin = createTestUser({
+      id: 53,
+      roles: ["SystemAdmin"],
+      tenantId: SYSTEM_TENANT_ID,
+    });
+
+    const res = await stack.http.queryOk<{
+      rows: readonly { id: string; tenantId: string }[];
+    }>(DeliveryQueries.log, { limit: 100 }, systemAdmin);
+
+    const byId = new Map(res.rows.map((r) => [r.id, r]));
+    expect(byId.get(systemScopedId)?.tenantId).toBe(SYSTEM_TENANT_ID);
+    expect(byId.get(otherTenantRowId)?.tenantId).toBe(otherTenant);
+  });
+
   test("TenantAdmin cannot read SYSTEM_TENANT_ID or foreign-tenant delivery attempts", async () => {
     const demoTenant = testTenantId(61);
     const otherTenant = testTenantId(62);

package/src/delivery/db/queries/preferences.ts

@@ -1,4 +1,4 @@
-import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { unsafeReadRetrying } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { TenantId } from "@cosmicdrift/kumiko-framework/engine";
 
@@ -15,7 +15,8 @@ export async function selectNotificationPreferences(
   notificationType: string,
   channelName: string,
 ): Promise<readonly NotificationPreferenceRow[]> {
-  return asRawClient(db).unsafe<NotificationPreferenceRow>(
+  return unsafeReadRetrying<NotificationPreferenceRow>(
+    db,
     `SELECT notification_type AS "notificationType", channel, enabled
      FROM read_notification_preferences
      WHERE tenant_id = $1

package/src/delivery/handlers/log.query.ts

@@ -34,6 +34,7 @@ type DeliveryLogRow = {
 // application code, so there is no column to ORDER BY in SQL for it.
 const DELIVERY_LOG_SORT_COLUMNS = {
   createdAt: "createdAt",
+  tenantId: "tenantId",
   type: "notificationType",
   channel: "channel",
   status: "status",

package/src/file-derivatives/__tests__/public-variant-query-validation.integration.test.ts

@@ -8,7 +8,7 @@
 // fetchOne(), throwing a Postgres 22P02 (malformed uuid literal) that
 // poisons the pooled Bun.SQL connection, an unauth DoS primitive.
 
-import { describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import {
   createFilesFeature,
@@ -21,8 +21,10 @@ import { createFileDerivativesFeature } from "../feature";
 import { PUBLIC_VARIANT_QN } from "../handlers/public-variant.query";
 
 describe("file-derivatives :: publicVariant query fileRefId validation", () => {
-  test("non-UUID fileRefId via /api/query → 400 validation_error, never reaches the DB", async () => {
-    const stack: TestStack = await setupTestStack({
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
       features: [
         createConfigFeature(),
         fileFoundationFeature,
@@ -32,44 +34,31 @@ describe("file-derivatives :: publicVariant query fileRefId validation", () => {
       anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
       files: { storageProvider: createInMemoryFileProvider() },
     });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
 
-    try {
-      const res = await stack.http.raw("POST", "/api/query", {
-        type: PUBLIC_VARIANT_QN,
-        payload: { fileRefId: "not-a-uuid; DROP TABLE file_refs;--", variant: "thumb" },
-      });
+  test("non-UUID fileRefId via /api/query → 400 validation_error, never reaches the DB", async () => {
+    const res = await stack.http.raw("POST", "/api/query", {
+      type: PUBLIC_VARIANT_QN,
+      payload: { fileRefId: "not-a-uuid; DROP TABLE file_refs;--", variant: "thumb" },
+    });
 
-      expect(res.status).toBe(400);
-      const body = (await res.json()) as { error?: { code?: string } };
-      expect(body.error?.code).toBe("validation_error");
-    } finally {
-      await stack.cleanup();
-    }
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error?: { code?: string } };
+    expect(body.error?.code).toBe("validation_error");
   });
 
   test("well-formed but unknown UUID fileRefId via /api/query → 200 with null (schema passes, DB lookup just finds nothing)", async () => {
-    const stack: TestStack = await setupTestStack({
-      features: [
-        createConfigFeature(),
-        fileFoundationFeature,
-        createFilesFeature(),
-        createFileDerivativesFeature({ resolveApexTenant: () => SYSTEM_TENANT_ID }),
-      ],
-      anonymousAccess: { defaultTenantId: SYSTEM_TENANT_ID },
-      files: { storageProvider: createInMemoryFileProvider() },
+    const res = await stack.http.raw("POST", "/api/query", {
+      type: PUBLIC_VARIANT_QN,
+      payload: { fileRefId: "00000000-0000-4000-8000-000000000000", variant: "thumb" },
     });
 
-    try {
-      const res = await stack.http.raw("POST", "/api/query", {
-        type: PUBLIC_VARIANT_QN,
-        payload: { fileRefId: "00000000-0000-4000-8000-000000000000", variant: "thumb" },
-      });
-
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { data: unknown };
-      expect(body.data).toBeNull();
-    } finally {
-      await stack.cleanup();
-    }
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { data: unknown };
+    expect(body.data).toBeNull();
   });
 });

package/src/file-derivatives/__tests__/public-variant-route.integration.test.ts

@@ -279,8 +279,8 @@ describe("GET /media/:fileRefId/:variant (anonymous, default-deny)", () => {
   test("a preset name the field doesn't declare in its variants → 404", async () => {
     const fileId = await uploadFile(userA, { entityType: "widget", entityId: PUBLIC_WIDGET_ID });
 
-    // widgetEntity's "img" field declares only thumb/full — "card" and
-    // "hero" aren't in its variants map.
+    // widgetEntity's "img" field declares thumb/full/plan/heroWide/raw —
+    // "card" and "hero" aren't in its variants map.
     const res = await stack.app.request(`http://${HOST_A}/media/${fileId}/card`);
 
     expect(res.status).toBe(404);

package/src/file-derivatives/feature.ts

@@ -33,6 +33,10 @@ const FEATURE_NAME = "file-derivatives";
 // a name list here "for safety" — see #1985.
 const VARIANT_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 
+/** Host → tenantId for the anonymous media route.
+ *  MUST be cheap/synchronous (in-memory map or cached lookup): it runs
+ *  *before* the query-handler rate limit, so a DB round-trip here is an
+ *  unthrottled DoS surface for anonymous callers rotating Host headers (#1977). */
 export type PublicVariantResolveApexTenant = (
   host: string,
 ) => Promise<TenantId | null> | TenantId | null;
@@ -42,7 +46,8 @@ export type FileDerivativesOptions = {
    *  Without this option, neither the httpRoute NOR the `publicVariant`
    *  query is registered — it is unreachable via the httpRoute path and via
    *  the generic `/api` query dispatch. Existing consumers that only need
-   *  `ctx.derivatives` are unaffected. */
+   *  `ctx.derivatives` are unaffected. See {@link PublicVariantResolveApexTenant}
+   *  for the in-memory/sync contract. */
   readonly resolveApexTenant?: PublicVariantResolveApexTenant;
   /** Base path of the public variant route. Default "/media". */
   readonly basePath?: string;

package/src/file-provider-s3/feature.ts

@@ -52,9 +52,8 @@ export const fileProviderS3Feature = defineFeature(FEATURE_NAME, (r) => {
   r.requires("file-foundation");
 
   const secretAccessKey = r.secret("s3.secretAccessKey", {
-    label: { de: "S3 Secret Access Key", en: "S3 Secret Access Key" },
+    label: { en: "S3 Secret Access Key" },
     hint: {
-      de: "Privater Teil des S3-Schlüsselpaares. Bei Hetzner Object Storage 'Secret Key', bei AWS S3 'Secret Access Key'.",
       en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
     },
     redact: (plaintext) => {

package/src/form-draft/__tests__/cleanup.integration.test.ts

@@ -165,15 +165,14 @@ async function dispatchCleanup(): Promise<void> {
 
 describe("form-draft cleanup job", () => {
   // FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY (cleanup.job.ts) is a hardcoded
-  // literal that must match the qualified name r.config({ keys: {
-  // retentionDays: ... } }) derives internally in feature.ts — nothing
-  // else ties the two together, so a rename of the `retentionDays` config
-  // key there would silently desync them. This recomputes the derivation
-  // and fails loudly if that ever happens.
-  test("FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY matches the qualified name feature.ts derives for retentionDays", () => {
-    expect(FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY).toBe(
-      qn(toKebab(FORM_DRAFT_FEATURE_NAME), "config", toKebab("retentionDays")),
+  // literal that must match a key actually registered by formDraftFeature.
+  // Assert against the feature's configKeys (not a hand-rebuilt qn string),
+  // so renaming the key in feature.ts without updating the constant fails.
+  test("FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY is among formDraftFeature registered config keys", () => {
+    const registered = Object.keys(formDraftFeature.configKeys ?? {}).map((key) =>
+      qn(toKebab(FORM_DRAFT_FEATURE_NAME), "config", toKebab(key)),
     );
+    expect(registered).toContain(FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY);
   });
 
   test("deletes a draft older than the default retention window, leaves a fresh one alone", async () => {

package/src/form-draft/handlers/cleanup.job.ts

@@ -6,7 +6,11 @@
 // Chunked DELETE (default 1000/batch) keeps lock durations bounded, mirror
 // of sessions/handlers/cleanup.job.ts.
 
-import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbConnection,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   type AppContext,
   access,
@@ -19,11 +23,16 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { type StaleDraftRow, selectStaleDraftsBatch } from "../db/queries/cleanup";
-import { filterOwnedStorageKeys } from "../db/queries/owned-file-refs";
+import { filterOwnedFileRefs } from "../db/queries/owned-file-refs";
 import { formDraftExecutor } from "../executor";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs";
 
+const fileRefExecutor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
+  entityName: "fileRef",
+});
+
 export const FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY = "form-draft:config:retention-days";
 export const FORM_DRAFT_DEFAULT_RETENTION_DAYS = 30;
 const DEFAULT_BATCH_SIZE = 1000;
@@ -48,27 +57,15 @@ async function releaseRowFileRefs(
   // skip: no FileRefs in this row's blob — nothing to release.
   if (keys.length === 0) return;
   if (!fileProviderResolver) {
-    // skip: no resolver wired (files feature not mounted) — row still
-    // gets deleted below, but its FileRefs leak as storage orphans.
     log?.warn?.(
       `[form-draft:cleanup] tenant=${row.tenantId} has ${keys.length} FileRef(s) but no _fileProviderResolver is wired — row will be deleted without releasing storage`,
     );
-    // skip: warning already logged above — nothing more to do for this row.
+    // skip: no provider wired — cannot release storage; row deletion proceeds anyway.
     return;
   }
 
-  // Only storageKeys with a real file_refs row owned by this row's draft
-  // owner are releasable — `draft.values` is free-form JSON the owning user
-  // controls, so an unverified key could target someone else's file (see
-  // db/queries/owned-file-refs.ts). Not wrapped in try/catch: a query
-  // failure here (pool exhaustion, missing table) is a real error, not the
-  // "no provider resolvable" case below — let it propagate so the job retries.
-  //
-  // Create-mode draftKey (`${screenId}:new:${draftId}`) mints its draftId
-  // lazily on the first step-change — a file uploaded before that exists
-  // predates the draft row, so the insertedAt filter must not apply.
   const isCreateMode = row.draftKey.includes(":new:");
-  const ownedKeys = await filterOwnedStorageKeys(
+  const ownedRefs = await filterOwnedFileRefs(
     db,
     row.tenantId,
     row.ownerId,
@@ -76,10 +73,23 @@ async function releaseRowFileRefs(
     row.insertedAt,
     isCreateMode,
   );
-
+  const systemUser = createSystemUser(row.tenantId);
+  const tenantDb = createTenantDb(db, row.tenantId, "system");
+  for (const ref of ownedRefs) {
+    const forgetResult = await fileRefExecutor.forget({ id: ref.id }, systemUser, tenantDb);
+    if (!forgetResult.isSuccess) {
+      log?.warn?.(
+        `[form-draft:cleanup] fileRef.forget failed for id=${ref.id} tenant=${row.tenantId}`,
+      );
+    }
+  }
   try {
     const provider = await fileProviderResolver(row.tenantId);
-    await releaseDraftFileRefs(ownedKeys, (key) => provider.delete(key), log);
+    await releaseDraftFileRefs(
+      ownedRefs.map((ref) => ref.storageKey),
+      (key) => provider.delete(key),
+      log,
+    );
   } catch (err) {
     log?.warn?.(
       `[form-draft:cleanup] no file provider resolvable for tenant=${row.tenantId} — FileRefs NOT released (row still deleted): ${err instanceof Error ? err.message : String(err)}`,
@@ -132,9 +142,9 @@ async function deleteStaleDraftsBatch(
 }
 
 export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
-  if (!ctx.db || !ctx.registry) {
+  if (!ctx.db) {
     throw new InternalError({
-      message: "[form-draft:cleanup] ctx.db + ctx.registry required (JobContext incomplete)",
+      message: "[form-draft:cleanup] ctx.db required (JobContext incomplete)",
     });
   }
   const db = ctx.db as DbConnection;
@@ -163,6 +173,7 @@ export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
 
   let deleted = 0;
   while (true) {
+    if (ctx.signal?.aborted) break;
     const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE);
     if (batch.length === 0) break;
 

package/src/form-draft/handlers/discard.write.ts

@@ -66,17 +66,17 @@ export const discardDraftWrite = defineWriteHandler({
         existing.insertedAt,
         isCreateMode,
       );
-      const refsByStorageKey = new Map(ownedRefs.map((ref) => [ref.storageKey, ref]));
+      // Fail-closed erase of file_refs rows FIRST (outside the best-effort
+      // storage-hygiene loop). releaseDraftFileRefs swallows per-key errors
+      // by design — routing forget through it would report discarded:true
+      // while leaving the row behind (#1922 / review #2009).
+      for (const ref of ownedRefs) {
+        const forgetResult = await fileRefExecutor.forget({ id: ref.id }, event.user, ctx.db);
+        if (!forgetResult.isSuccess) return forgetResult;
+      }
       await releaseDraftFileRefs(
         ownedRefs.map((ref) => ref.storageKey),
         async (key) => {
-          // Hard-erase via the executor first (fileRef.forgotten — row +
-          // event, rebuild-safe), then the binary. A raw provider.delete()
-          // alone left the file_refs row behind forever (kumiko-framework
-          // review #1922): no event, no projection update, the row just
-          // pointed at a storage key that no longer existed.
-          const ref = refsByStorageKey.get(key);
-          if (ref !== undefined) await fileRefExecutor.forget({ id: ref.id }, event.user, ctx.db);
           await files.ref(key).delete();
         },
         ctx.log,

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -569,4 +569,64 @@ describe("watch-supervisor — multi-worker watch coordination (#1719)", () => {
       await supervisorB.stop();
     }
   });
+
+  test("losing the lease (renew fails) tears down the local watcher and lets the peer take over", async () => {
+    const admin = adminFor(4202);
+    const accountId = await connectSharedAccount(admin);
+    const lock = createDistributedLock(stack.redis.redis, "test-watch-lease-lost:");
+    const a = makeWatchIngestCounter();
+    const b = makeWatchIngestCounter();
+    const supervisorA = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: a.dispatchWrite,
+      lock,
+      watchLeaseTtlSeconds: 1,
+      pollIntervalMs: 60_000,
+    });
+    const supervisorB = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: b.dispatchWrite,
+      lock,
+      watchLeaseTtlSeconds: 1,
+      pollIntervalMs: 60_000,
+    });
+
+    try {
+      await supervisorA.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      // B's own start() polls too but must not claim the watch lease — A
+      // already holds it. Priming `running` here (rather than only calling
+      // pollOnce() later) mirrors the "peer takes over" test above.
+      await supervisorB.start();
+
+      // Simulate the lease expiring behind A's back (Redis TTL lapse, or an
+      // operator flushing the key) by deleting it directly. A's next renew
+      // heartbeat (`lock.renew`, every ttl/3) then finds a token mismatch,
+      // reports failure, and must tear down A's local IDLE connection.
+      await stack.redis.redis.del(`test-watch-lease-lost:${accountId}`);
+
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(false);
+      });
+
+      await supervisorB.pollOnce();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      await seedInboundMessage(accountId, rawMsg({ providerMessageId: "mw-lost-1" }));
+      await waitFor(() => {
+        expect(b.watchIngestCount()).toBe(1);
+      });
+      expect(a.watchIngestCount()).toBe(0);
+    } finally {
+      await supervisorA.stop();
+      await supervisorB.stop();
+    }
+  });
 });