@cosmicdrift/kumiko-bundled-features 0.221.0 → 0.223.0

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -14,7 +14,7 @@ import {
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestDb,
@@ -26,8 +26,12 @@ import {
   TestUsers,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
-import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { JobQueries } from "../constants";
+import {
+  resetPiiSubjectKmsForTests,
+  resetTestTables,
+  sleep,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { JobHandlers, JobQueries } from "../constants";
 import { createJobsFeature } from "../feature";
 import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
@@ -432,3 +436,124 @@ describe("jobs:query:details decrypts log messages and error end-to-end (#2247,
     expect(listed?.error).toBe(SECRET_LIST_ERROR);
   });
 });
+
+// #2465: jobs:write:retry read run.payload straight off the row and
+// JSON.parse'd it without decrypting first — broken on main for any retry
+// of a run whose payload was encrypted under the triggering user's DEK
+// (#799). This dispatches the real jobs:write:retry HTTP handler so a
+// regression (missing decrypt, wrong AAD field name, sentinel mishandled)
+// fails a test instead of shipping a crash to the retry button.
+describe("jobs:write:retry decrypts payload before dispatch (#2465)", () => {
+  let retryStack: TestStack;
+  let retryLogger: ReturnType<typeof createJobRunLogger>;
+  let retryKms: InMemoryKmsAdapter;
+
+  const RETRY_USER_ID = "u-pii-retry-1";
+  const RETRY_JOB_NAME = "retryapp:job:capture-import";
+  const capturedPayloads: Record<string, unknown>[] = [];
+
+  const retryAppFeature = defineFeature("retryapp", (r) => {
+    r.job("captureImport", { trigger: { manual: true } }, async (payload) => {
+      capturedPayloads.push(payload);
+    });
+  });
+
+  beforeAll(async () => {
+    retryStack = await setupTestStack({
+      features: [retryAppFeature, createJobsFeature()],
+      jobs: {
+        consumerLane: "worker",
+        queueNamePrefix: `kumiko-jobs-retry-pii-test-${Date.now()}`,
+      },
+    });
+    await unsafePushTables(retryStack.db, { jobRunsTable, jobRunLogsTable });
+    retryLogger = createJobRunLogger({ db: retryStack.db, registry: retryStack.registry });
+  });
+
+  afterAll(async () => {
+    await retryStack.cleanup();
+  });
+
+  beforeEach(() => {
+    capturedPayloads.length = 0;
+    retryKms = new InMemoryKmsAdapter();
+    configurePiiSubjectKms(retryKms);
+  });
+
+  afterEach(() => {
+    resetPiiSubjectKmsForTests();
+  });
+
+  test("retry decrypts an encrypted run payload and dispatches the plaintext", async () => {
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-1", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryLogger.onJobFailed?.(RETRY_JOB_NAME, "bull-retry-1", "boom", []);
+
+    const row = await fetchOne(retryStack.db, jobRunsTable, { bullJobId: "bull-retry-1" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+    expect(row?.["status"]).toBe("failed");
+
+    const result = await retryStack.http.writeOk<{
+      jobName: string;
+      bullJobId: string;
+      retriedFromRunId: string;
+    }>(JobHandlers.retry, { runId: row?.["id"] }, TestUsers.systemAdmin);
+    expect(result.jobName).toBe(RETRY_JOB_NAME);
+
+    await sleep(1000);
+
+    expect(capturedPayloads).toHaveLength(1);
+    expect(capturedPayloads[0]).toEqual(JSON.parse(SECRET_PAYLOAD));
+  });
+
+  test("retry on a run whose payload key was erased is rejected instead of crashing", async () => {
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-2", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryLogger.onJobFailed?.(RETRY_JOB_NAME, "bull-retry-2", "boom", []);
+
+    const row = await fetchOne(retryStack.db, jobRunsTable, { bullJobId: "bull-retry-2" });
+    await retryKms.eraseKey({ kind: "user", userId: RETRY_USER_ID });
+
+    const errInfo = await retryStack.http.writeErr(
+      JobHandlers.retry,
+      { runId: row?.["id"] },
+      TestUsers.systemAdmin,
+    );
+    expect(errInfo.code).toBe("unprocessable");
+    expect(errInfo.details).toMatchObject({ reason: "job_payload_erased" });
+  });
+
+  // The other producer of PII_ERASED_SENTINEL: job-run-logger writes the
+  // literal "[[erased]]" string (not ciphertext) when the key is already
+  // gone at onJobStart time (see the mirrored case above this describe
+  // block). retry.write.ts's isPiiCiphertext/decrypt path must reject this
+  // stored sentinel the same way it rejects a decrypt-time one.
+  test("retry on a run whose payload was stored as the erased sentinel is rejected", async () => {
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-3", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryKms.eraseKey({ kind: "user", userId: RETRY_USER_ID });
+
+    await retryLogger.onJobStart?.(RETRY_JOB_NAME, "bull-retry-4", {
+      triggeredById: RETRY_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await retryLogger.onJobFailed?.(RETRY_JOB_NAME, "bull-retry-4", "boom", []);
+
+    const row = await fetchOne(retryStack.db, jobRunsTable, { bullJobId: "bull-retry-4" });
+    expect(row?.["payload"]).toBe(PII_ERASED_SENTINEL);
+
+    const errInfo = await retryStack.http.writeErr(
+      JobHandlers.retry,
+      { runId: row?.["id"] },
+      TestUsers.systemAdmin,
+    );
+    expect(errInfo.code).toBe("unprocessable");
+    expect(errInfo.details).toMatchObject({ reason: "job_payload_erased" });
+  });
+});

package/src/jobs/constants.ts

@@ -21,6 +21,7 @@ export const JobErrors = {
   notFound: "not_found",
   onlyFailedCanRetry: "only_failed_jobs_can_be_retried",
   notManual: "job_not_manual",
+  payloadErased: "job_payload_erased",
 } as const;
 
 /** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */

package/src/jobs/handlers/retry.write.ts

@@ -1,4 +1,5 @@
 import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { PII_ERASED_SENTINEL } from "@cosmicdrift/kumiko-framework/crypto";
 import { defineWriteHandler } from "@cosmicdrift/kumiko-framework/engine";
 import {
   InternalError,
@@ -9,6 +10,7 @@ import {
 import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import { parseJsonOrThrow } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { JobErrors } from "../constants";
 import { jobRunsTable } from "../job-run-table";
 
@@ -53,12 +55,30 @@ export const retryWrite = defineWriteHandler({
       );
     }
 
-    const payload = run.payload
-      ? parseJsonOrThrow<Record<string, unknown>>(
-          run.payload,
-          `job run ${event.payload.runId} payload`,
-        )
-      : {};
+    // payload is stored encrypted under the triggering user's DEK (#799),
+    // same mechanism as detail.query.ts/list.query.ts — decrypt before
+    // parsing it as JSON. A key erased since the run finished decrypts to
+    // PII_ERASED_SENTINEL, which is not JSON; reject the retry rather than
+    // dispatch it with a silently emptied payload.
+    let payload: Record<string, unknown> = {};
+    if (run.payload) {
+      const decryptedPayload = await decryptStoredPii(
+        run.payload,
+        "payload",
+        `job run ${event.payload.runId} payload`,
+      );
+      if (decryptedPayload === PII_ERASED_SENTINEL) {
+        return writeFailure(
+          new UnprocessableError(JobErrors.payloadErased, {
+            i18nKey: "jobs.errors.payloadErased",
+          }),
+        );
+      }
+      payload = parseJsonOrThrow<Record<string, unknown>>(
+        decryptedPayload,
+        `job run ${event.payload.runId} payload`,
+      );
+    }
 
     const bullJobId = await jobRunner.dispatch(run.jobName, payload);
 

package/src/jobs/i18n.ts

@@ -61,4 +61,7 @@ export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
   "jobs.errors.onlyFailedCanRetry": {
     en: "Only failed runs can be retried.",
   },
+  "jobs.errors.payloadErased": {
+    en: "This run's payload can no longer be read — the triggering user's data was erased.",
+  },
 };

package/src/sessions/session-callbacks.ts

@@ -115,6 +115,7 @@ export function createSessionCallbacks(opts: SessionCallbacksOptions): SessionCa
       );
     },
 
+    // kumiko-lint-ignore complexity-budget session check + lastSeen refresh on hot path
     async sessionChecker(sid: string, expectedUserId: string): Promise<AuthSessionCheckResult> {
       const row = await fetchOne<{
         userId: string;

package/src/tags/__tests__/tag-screens.boot.test.ts

@@ -48,4 +48,17 @@ describe("tags catalog screens (entityList + entityEdit)", () => {
     expect(custom.screens[TAGS_EDIT_SCREEN_ID]?.access).toEqual({ roles: ["Admin"] });
     expect(custom.writeHandlers["tag:delete"]?.access).toEqual({ roles: ["Admin"] });
   });
+
+  test("convention write schemas accept entityEdit envelopes", () => {
+    const createSchema = feature.writeHandlers["tag:create"]?.schema;
+    const updateSchema = feature.writeHandlers["tag:update"]?.schema;
+    const deleteSchema = feature.writeHandlers["tag:delete"]?.schema;
+    expect(createSchema).toBeDefined();
+    expect(updateSchema).toBeDefined();
+    expect(deleteSchema).toBeDefined();
+    expect(createSchema!.safeParse({ name: "x" }).success).toBe(true);
+    const id = "00000000-0000-4000-8000-000000000001";
+    expect(updateSchema!.safeParse({ id, version: 0, changes: { name: "x" } }).success).toBe(true);
+    expect(deleteSchema!.safeParse({ id }).success).toBe(true);
+  });
 });

package/src/tenant/__tests__/tenant-timezone-boot.integration.test.ts

@@ -10,6 +10,7 @@ import {
   createTestUser,
   setupTestStack,
   type TestStack,
+  testTenantId,
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { z } from "zod";
@@ -28,6 +29,16 @@ const probeFeature = defineFeature("tz-probe", (r) => {
   );
 });
 
+// Query (not write) probe for the caching tests below: dispatcher.query()
+// never opens a transaction, which is the hot path fw#2462 targets and the
+// only path buildHandlerContext is allowed to populate the cache from.
+const queryProbeFeature = defineFeature("tz-cache-probe", (r) => {
+  r.requires("tenant");
+  r.queryHandler("read-tz", z.object({}), async (_query, ctx) => ({ tenant: ctx.tz.tenant }), {
+    access: { openToAll: true },
+  });
+});
+
 describe("ctx.tz.tenant against the real tenant feature (fw#1648)", () => {
   let stack: TestStack;
 
@@ -58,3 +69,157 @@ describe("ctx.tz.tenant against the real tenant feature (fw#1648)", () => {
     expect(res.tenant).toBe("Asia/Tokyo");
   });
 });
+
+// fw#2462: dispatch-shared.ts now caches the resolved tenant:config:timezone
+// value per tenant instead of resolving it on every dispatch. These tests
+// prove the cache is actually consulted (config() isn't re-invoked on a
+// repeat read) and that config:write:set/reset correctly invalidate it —
+// own stack per describe so cache state never leaks across test files.
+describe("tenant:config:timezone dispatch cache (fw#2462)", () => {
+  let stack: TestStack;
+  let configCallCount: number;
+
+  beforeAll(async () => {
+    const resolver = createConfigResolver();
+    stack = await setupTestStack({
+      features: [createConfigFeature(), createTenantFeature(), queryProbeFeature],
+      extraContext: ({ registry }) => {
+        const realFactory = createConfigAccessorFactory(registry, resolver);
+        // Counts calls through the config accessor — a cache hit in
+        // dispatch-shared.ts's buildHandlerContext never reaches this
+        // wrapper, so the count is a direct proxy for "did we re-resolve
+        // tenant:config:timezone instead of serving it from cache".
+        const countingFactory: typeof realFactory = (args) => {
+          const accessor = realFactory(args);
+          // Probe only ever calls the qualified-string-key overload — the
+          // cast sidesteps re-declaring ConfigAccessor's generic handle
+          // overload for a test-only wrapper.
+          return ((key: string) => {
+            configCallCount++;
+            return accessor(key);
+          }) as typeof accessor; // @cast-boundary test-helper
+        };
+        return {
+          configResolver: resolver,
+          _configAccessorFactory: countingFactory,
+        };
+      },
+    });
+    await unsafePushTables(stack.db, { configValuesTable });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("repeat reads for the same tenant are served from cache, not re-resolved", async () => {
+    configCallCount = 0;
+    const tenantId = testTenantId(101);
+    const admin = createTestUser({ id: 21, tenantId, roles: ["Admin"] });
+
+    await stack.http.queryOk("tz-cache-probe:query:read-tz", {}, admin);
+    expect(configCallCount).toBe(1);
+
+    await stack.http.queryOk("tz-cache-probe:query:read-tz", {}, admin);
+    await stack.http.queryOk("tz-cache-probe:query:read-tz", {}, admin);
+    expect(configCallCount).toBe(1);
+  });
+
+  test("config:write:set invalidates the cache for the written tenant", async () => {
+    configCallCount = 0;
+    const tenantId = testTenantId(102);
+    const admin = createTestUser({ id: 22, tenantId, roles: ["Admin"] });
+
+    const before = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      admin,
+    );
+    expect(configCallCount).toBe(1);
+
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Asia/Tokyo" },
+      admin,
+    );
+    expect(before.tenant).not.toBe("Asia/Tokyo");
+
+    const after = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      admin,
+    );
+    expect(after.tenant).toBe("Asia/Tokyo");
+    // The cache entry was dropped by the write, so the read after it is a
+    // fresh resolve — a second config() call, not a stale cache hit.
+    expect(configCallCount).toBe(2);
+  });
+
+  test("config:write:reset invalidates the cache for the written tenant", async () => {
+    configCallCount = 0;
+    const tenantId = testTenantId(103);
+    const admin = createTestUser({ id: 23, tenantId, roles: ["Admin"] });
+
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Asia/Singapore" },
+      admin,
+    );
+    const before = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      admin,
+    );
+    expect(before.tenant).toBe("Asia/Singapore");
+
+    await stack.http.writeOk("config:write:reset", { key: "tenant:config:timezone" }, admin);
+
+    const after = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      admin,
+    );
+    expect(after.tenant).not.toBe("Asia/Singapore");
+  });
+
+  test("a system-scope write invalidates every tenant's cached entry, not just the writer's", async () => {
+    const tenantA = testTenantId(104);
+    const tenantB = testTenantId(105);
+    const userA = createTestUser({ id: 24, tenantId: tenantA, roles: ["Admin"] });
+    const userB = createTestUser({ id: 25, tenantId: tenantB, roles: ["Admin"] });
+    const systemAdmin = createTestUser({ id: 26, tenantId: tenantA, roles: ["SystemAdmin"] });
+
+    // Warm both tenants' cache entries with neither having its own override.
+    const beforeA = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      userA,
+    );
+    const beforeB = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      userB,
+    );
+    expect(beforeA.tenant).not.toBe("Australia/Sydney");
+    expect(beforeB.tenant).not.toBe("Australia/Sydney");
+
+    await stack.http.writeOk(
+      "config:write:set",
+      { key: "tenant:config:timezone", value: "Australia/Sydney", scope: "system" },
+      systemAdmin,
+    );
+
+    const afterA = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      userA,
+    );
+    const afterB = await stack.http.queryOk<{ tenant: string }>(
+      "tz-cache-probe:query:read-tz",
+      {},
+      userB,
+    );
+    expect(afterA.tenant).toBe("Australia/Sydney");
+    expect(afterB.tenant).toBe("Australia/Sydney");
+  });
+});

package/src/tenant/changes.json

@@ -3,7 +3,7 @@
     "version": "0.219.0",
     "type": "improvement",
     "title": "Invite/member-roles pickers include TenantAdmin",
-    "detail": "DEFAULT_INVITE_ROLE_OPTIONS adds TenantAdmin so SystemAdmin/TenantAdmin can invite owners. SystemAdmin stays global-only (user.roles), never a membership invite option."
+    "detail": "DEFAULT_INVITE_ROLE_OPTIONS stays User/Editor/Admin so Admin actors never see an unassignable TenantAdmin option (fw#2414). OWNER_INVITE_ROLE_OPTIONS adds TenantAdmin for custom screens used by TenantAdmin/SystemAdmin. SystemAdmin stays global-only (user.roles), never a membership invite option."
   },
   {
     "version": "0.209.0",

package/src/tenant/constants.ts

@@ -23,7 +23,11 @@ export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
 export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
-export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
+// Admin (rank 2) shares these screens with TenantAdmin — TenantAdmin must not
+// appear here or Admin sees an unassignable option (fw#2414). Apps that need
+// owner invites compose OWNER_INVITE_ROLE_OPTIONS into a custom screen.
+export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
+export const OWNER_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
 
 // Qualified write handler names (QN format: scope:type:name)
 export const TenantHandlers = {

package/src/tenant/handlers/remove-member.write.ts

@@ -6,7 +6,9 @@ import {
   withResponseData,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError, NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
+import { assertNotLastTenantAdmin } from "../last-tenant-admin";
 import { tenantMembershipEntity, tenantMembershipsTable } from "../membership-table";
 
 const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembershipEntity, {
@@ -45,6 +47,16 @@ export const removeMemberWrite = defineWriteHandler({
       );
     }
 
+    const currentRoles = parseRoles((existing as DbRow)["roles"]);
+    if (currentRoles.includes("TenantAdmin")) {
+      const lastAdmin = await assertNotLastTenantAdmin(
+        db,
+        event.payload.tenantId,
+        event.payload.userId,
+      );
+      if (lastAdmin !== undefined) return lastAdmin;
+    }
+
     // Revoke THIS tenant's sessions BEFORE the delete — a removed member must
     // not keep a valid session for the window between the delete and a
     // post-delete revoke. Best-effort cross-feature call: sessions may not be

package/src/tenant/handlers/update-member-roles.write.ts

@@ -1,9 +1,5 @@
-import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  acquireNamespacedAdvisoryLock,
-  createEventStoreExecutor,
-  type DbRow,
-} from "@cosmicdrift/kumiko-framework/db";
+import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, type DbRow } from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   createSystemUser,
@@ -12,7 +8,6 @@ import {
   withResponseData,
 } from "@cosmicdrift/kumiko-framework/engine";
 import {
-  ConflictError,
   InternalError,
   NotFoundError,
   ValidationError,
@@ -20,7 +15,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/errors";
 import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
 import { z } from "zod";
-import { TenantErrors } from "../constants";
+import { assertNotLastTenantAdmin } from "../last-tenant-admin";
 import {
   findForbiddenMembershipRole,
   reservedMembershipRoleError,
@@ -37,10 +32,6 @@ const executor = createEventStoreExecutor(tenantMembershipsTable, tenantMembersh
 // r.usesApi here, unlike user-data-rights:restrict-account's hard dep).
 const REVOKE_ALL_SESSIONS_QN = "sessions:write:user-session:revoke-all-for-user";
 
-// Serializes last-TenantAdmin demotion checks per tenant inside the write TX
-// (dispatcher batch wraps handlers in transaction — xact lock holds through update).
-const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 0x7461646d; // 'tadm'
-
 /** SystemAdmin may pass payload.tenantId (cross-tenant); the members actionForm
  *  only sends userId+roles, so fall back to the active session tenant. */
 function resolveTargetTenantId(
@@ -60,8 +51,8 @@ export const updateMemberRolesWrite = defineWriteHandler({
   }),
   // "system" + access.admin ("TenantAdmin", "Admin", "SystemAdmin").
   // The system user (createSystemUser, roles=["system"]) and SystemAdmin
-  // manage memberships cross-tenant (payload.tenantId). TenantAdmin is strictly
-  // session-scoped (event.user.tenantId).
+  // manage memberships cross-tenant (payload.tenantId). TenantAdmin and Admin
+  // are session-scoped (event.user.tenantId).
   access: { roles: ["system", ...access.admin] },
   handler: async (event, ctx) => {
     if (!ctx.systemDb) {
@@ -129,28 +120,8 @@ export const updateMemberRolesWrite = defineWriteHandler({
     const willBeTenantAdmin = event.payload.roles.includes("TenantAdmin");
 
     if (targetIsTenantAdmin && !willBeTenantAdmin) {
-      // Lock before count+update so two concurrent demotions cannot both
-      // observe adminCount === 2 and leave the tenant with zero TenantAdmins.
-      await acquireNamespacedAdvisoryLock(db, LAST_TENANT_ADMIN_LOCK_NAMESPACE, targetTenantId);
-      const allMemberships = await selectMany(db, tenantMembershipsTable, {
-        tenantId: targetTenantId,
-      });
-      const adminCount = allMemberships.filter((m) =>
-        parseRoles(m["roles"]).includes("TenantAdmin"),
-      ).length;
-      if (adminCount <= 1) {
-        return writeFailure(
-          new ConflictError({
-            message: "cannot demote the last tenant admin",
-            i18nKey: "tenant.errors.cannotDemoteLastTenantAdmin",
-            details: {
-              reason: TenantErrors.lastTenantAdmin,
-              userId: event.payload.userId,
-              tenantId: targetTenantId,
-            },
-          }),
-        );
-      }
+      const lastAdmin = await assertNotLastTenantAdmin(db, targetTenantId, event.payload.userId);
+      if (lastAdmin !== undefined) return lastAdmin;
     }
 
     // fetchOne already gave us the stream version — hand it to the executor
@@ -176,13 +147,15 @@ export const updateMemberRolesWrite = defineWriteHandler({
     // Stream tenant follows the actor via streamTenantFor — use the
     // membership tenant so SystemAdmin/cross-tenant and TenantAdmin paths
     // hit the same stream seedTenantMembership/invite-accept wrote.
+    // Keep the real actor for audit metadata; only override tenantId so
+    // streamTenantFor writes into the membership tenant (#2401).
     const result = await executor.update(
       {
         id: row["id"] as string, // @cast-boundary db-row
         version: row["version"] as number, // @cast-boundary db-row
         changes: { roles: JSON.stringify(event.payload.roles) },
       },
-      createSystemUser(targetTenantId),
+      { ...event.user, tenantId: targetTenantId },
       db,
     );
 

package/src/tenant/last-tenant-admin.ts

@@ -0,0 +1,39 @@
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import { ConflictError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
+import { parseRoles } from "@cosmicdrift/kumiko-framework/utils";
+import { TenantErrors } from "./constants";
+import { tenantMembershipsTable } from "./membership-table";
+
+// Serializes last-TenantAdmin demotion/removal checks per tenant inside the write TX
+// (dispatcher batch wraps handlers in transaction — xact lock holds through update).
+export const LAST_TENANT_ADMIN_LOCK_NAMESPACE = 0x7461646d; // 'tadm'
+
+type TenantDb = Parameters<typeof acquireNamespacedAdvisoryLock>[0];
+
+/** Refuse demoting/removing the last TenantAdmin for `tenantId`. */
+export async function assertNotLastTenantAdmin(
+  db: TenantDb,
+  tenantId: string,
+  userId: string,
+): Promise<ReturnType<typeof writeFailure> | undefined> {
+  await acquireNamespacedAdvisoryLock(db, LAST_TENANT_ADMIN_LOCK_NAMESPACE, tenantId);
+  const allMemberships = await selectMany(db, tenantMembershipsTable, { tenantId });
+  const adminCount = allMemberships.filter((m) =>
+    parseRoles(m["roles"]).includes("TenantAdmin"),
+  ).length;
+  if (adminCount <= 1) {
+    return writeFailure(
+      new ConflictError({
+        message: "cannot demote the last tenant admin",
+        i18nKey: "tenant.errors.cannotDemoteLastTenantAdmin",
+        details: {
+          reason: TenantErrors.lastTenantAdmin,
+          userId,
+          tenantId,
+        },
+      }),
+    );
+  }
+  return undefined;
+}

package/src/tenant/screens.ts

@@ -167,6 +167,8 @@ export const memberRolesEditScreen = {
   id: MEMBER_ROLES_EDIT_SCREEN_ID,
   type: "actionForm",
   handler: TenantHandlers.updateMemberRoles,
+  redirect: MEMBERS_SCREEN_ID,
+  cancelTarget: MEMBERS_SCREEN_ID,
   fields: {
     userId: { type: "text", required: true },
     roles: { type: "multiSelect", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },

package/src/tenant/seeding.ts

@@ -285,13 +285,15 @@ export async function seedTenantMembership(
     return { id: extractMembershipId(existing) };
   }
 
+  // Keep by.id as audit actor, but force stream tenant to the membership tenant
+  // so a cross-tenant `by` override cannot diverge row tenant vs event stream.
   const result = await executor.create(
     {
       userId: options.userId,
       tenantId: options.tenantId,
       roles: JSON.stringify(options.roles),
     },
-    by,
+    { ...by, tenantId: options.tenantId },
     tdb,
   );
   if (!result.isSuccess) {

package/src/tenant-lifecycle/feature.ts

@@ -97,6 +97,7 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
           registry: ctx.registry,
           now: T.Now.instant(),
           log: (message) => ctx.log?.warn(message),
+          fileProviderResolver: ctx._fileProviderResolver,
         });
       },
     );

package/src/tenant-lifecycle/handlers/cancel-destruction.write.ts

@@ -34,11 +34,7 @@ export const cancelDestructionWrite = defineWriteHandler({
     }
 
     if (!isWithinGracePeriod(row.gracePeriodEnd)) {
-      return writeFailure(
-        new UnprocessableError("grace_period_expired", {
-          details: { reason: "grace_period_expired" },
-        }),
-      );
+      return writeFailure(new UnprocessableError("grace_period_expired"));
     }
 
     const update = await crud.update(