@cosmicdrift/kumiko-bundled-features 0.234.0 → 0.235.1

package/src/legal-pages/README.md

@@ -110,8 +110,10 @@ routes.
 
 ## Boot check
 
-`r.job` with `runOnBoot: true` checks at app start whether the
-required blocks exist in SYSTEM_TENANT. **Default** (DACH):
+`r.job` with `bootGate: true` runs inline while the API job runner
+starts and checks whether the required blocks exist in SYSTEM_TENANT.
+A throw rejects the boot, so the process never reports ready.
+**Default** (DACH):
 
 | Slug + locale | What happens when missing |
 |---|---|

package/src/legal-pages/__tests__/legal-pages.integration.test.ts

@@ -12,7 +12,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/template-resolver";
 import { seedTextBlock } from "@cosmicdrift/kumiko-bundled-features/template-resolver/seeding";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
-import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   setupTestStack,
@@ -226,10 +226,21 @@ describe("markdown render helpers", () => {
   });
 });
 
-// Boot-Check direkt (ohne dev-server-Job-Runner-Path) — verifiziert
-// dass die Logik fehlende Blocks im SYSTEM_TENANT erkennt. Der eigentliche
-// runOnBoot-Trigger lebt im JobRunner und wird in jobs-feature integration-
-// tests separately exercised.
+describe("legal-pages :: boot gate wiring", () => {
+  // The abort behaviour itself is proven in the framework's job-runner
+  // integration tests ("boot gates"); this only pins that legal-pages is
+  // wired onto that path and not onto the fire-and-forget runOnBoot one.
+  test("boot check is declared as a bootGate, not as runOnBoot", () => {
+    const registry = createRegistry([textFeature, legalFeature]);
+    const job = registry.getJob("legal-pages:job:legal-pages-boot-check");
+    expect(job).toBeDefined();
+    expect(job?.bootGate).toBe(true);
+    expect(job?.runOnBoot).toBeUndefined();
+  });
+});
+
+// Boot check called directly (without the dev-server job-runner path) —
+// verifies that the logic detects blocks missing in SYSTEM_TENANT.
 describe("legal-pages :: SYSTEM_TENANT-routing (production-bug-regression)", () => {
   test("legal-pages serven SYSTEM_TENANT-Texte auch wenn tenantResolver einen anderen Tenant zurückgibt", async () => {
     // Simuliert publicstatus's Setup: host-basierter tenantResolver der

package/src/legal-pages/feature.ts

@@ -208,7 +208,10 @@ export function createLegalPagesFeature(opts: LegalPagesOptions = {}): FeatureDe
       "legal-pages-boot-check",
       {
         trigger: { manual: true },
-        runOnBoot: true,
+        // bootGate, not runOnBoot: only an inline gate can actually abort the
+        // boot. runOnBoot merely enqueues, so a missing imprint would fail a
+        // queue job while the pod goes ready anyway (fw#2590).
+        bootGate: true,
         runIn: "api",
       },
       async (_payload, ctx) => runLegalPagesBootCheck(ctx, requiredBlocks),

package/src/secrets/__tests__/settings-hub-i18n.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test";
+import { defineFeature, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { createConfigFeature } from "../../config/feature";
+import { createSecretsFeature } from "../feature";
+
+// `secrets` is a foundation feature auto-mounted even when `config` is not
+// (dev-server scaffold-app.ts FOUNDATION_FEATURES). A declared r.secret()
+// makes buildConfigFeatureSchema emit a secretsEdit screen + Settings-Hub
+// chrome navs, whose dot-form labels (config.settings.title, etc.) must
+// resolve at boot without the config feature present (fw#2577).
+function stripeSecret() {
+  return defineFeature("stripe", (r) => {
+    r.secret("apiKey", { label: { en: "Stripe API Key" }, scope: "tenant" });
+  });
+}
+
+describe("Settings-Hub chrome i18n keys — secrets without config", () => {
+  test("boots with only the secrets feature mounted (no config feature)", () => {
+    expect(() => validateBoot([createSecretsFeature(), stripeSecret()])).not.toThrow();
+  });
+
+  test("boots with both secrets and config mounted", () => {
+    expect(() =>
+      validateBoot([createSecretsFeature(), createConfigFeature(), stripeSecret()]),
+    ).not.toThrow();
+  });
+});

package/src/secrets/feature.ts

@@ -4,6 +4,7 @@ import {
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { SETTINGS_HUB_I18N } from "@cosmicdrift/kumiko-framework/i18n";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import { z } from "zod";
 import { DEFAULT_SECRETS_ACCESS } from "./constants";
@@ -129,6 +130,15 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     });
     r.envSchema(secretsEnvSchema);
 
+    // `secrets` is a foundation feature auto-mounted even when `config` is
+    // not (see FOUNDATION_FEATURES, dev-server scaffold-app.ts), so it must
+    // ship the Settings-Hub chrome keys itself — server-authored
+    // r.translations are projected into FeatureSchema.translations and used
+    // as a client fallback bundle (create-app.tsx schemaTranslations),
+    // covering both boot-time validation and rendering without a web
+    // client-plugin for this feature.
+    r.translations({ keys: SETTINGS_HUB_I18N });
+
     // ES entity: set/delete go through the executor, `tenantSecret.created/
     // .updated/.deleted` events land on the aggregate stream. Reads fire a
     // separate `tenantSecretRead` event per call (see secrets-context.get

package/src/tenant/__tests__/members-screens.boot.test.ts

@@ -4,10 +4,10 @@ import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { AuthHandlers } from "../../auth-email-password/constants";
 import { createConfigFeature } from "../../config/feature";
 import {
-  DEFAULT_INVITE_ROLE_OPTIONS,
   INVITE_CREATE_SCREEN_ID,
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBERS_SCREEN_ID,
+  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "../constants";
@@ -106,7 +106,7 @@ describe("tenant members screen + handler access alignment", () => {
     expect(section.fields).toEqual([{ field: "userId", readOnly: true }, "roles"]);
     expect(screen.fields["roles"]).toEqual({
       type: "multiSelect",
-      options: DEFAULT_INVITE_ROLE_OPTIONS,
+      options: OWNER_INVITE_ROLE_OPTIONS,
       required: true,
     });
     if (screen && "access" in screen && screen.access && "roles" in screen.access) {
@@ -116,6 +116,34 @@ describe("tenant members screen + handler access alignment", () => {
     }
   });
 
+  // fw-2452 regression: the roles-edit multiSelect is prefilled with a
+  // member's current roles, so it must list every rank updateMemberRoles can
+  // actually assign (incl. TenantAdmin) — while the invite picker stays a
+  // closed allowlist without TenantAdmin (fw#2414), since inviting always
+  // starts a brand-new membership rather than editing an existing one.
+  test("member-roles-edit options can represent every assignable rank; invite picker stays TenantAdmin-free", () => {
+    const tenant = createTenantFeature({ inviteScreen: true });
+    const rolesEditScreen = tenant.screens[MEMBER_ROLES_EDIT_SCREEN_ID];
+    if (rolesEditScreen?.type !== "actionForm") {
+      throw new Error("expected member-roles-edit screen to be actionForm");
+    }
+    const rolesField = rolesEditScreen.fields["roles"];
+    if (rolesField?.type !== "multiSelect") {
+      throw new Error("expected roles field to be multiSelect");
+    }
+    expect(rolesField.options).toContain("TenantAdmin");
+
+    const inviteScreen = tenant.screens[INVITE_CREATE_SCREEN_ID];
+    if (inviteScreen?.type !== "actionForm") {
+      throw new Error("expected invite-create screen to be actionForm");
+    }
+    const roleField = inviteScreen.fields["role"];
+    if (roleField?.type !== "select") {
+      throw new Error("expected role field to be select");
+    }
+    expect(roleField.options).not.toContain("TenantAdmin");
+  });
+
   // The generic drawer-open/submit/close/refetch mechanics for kind:"drawer"
   // toolbar actions are already covered end-to-end with a synthetic screen in
   // renderer-web's projection-list-actions.test.tsx — this only proves OUR

package/src/tenant/constants.ts

@@ -23,10 +23,12 @@ export const MEMBER_STATUS_CELL_COMPONENT = "MemberStatusCell" as const;
 export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 
 /** Closed allowlist for invite-role picker — never free text (escalation guard). */
-// Admin (rank 2) shares these screens with TenantAdmin — TenantAdmin must not
-// appear here or Admin sees an unassignable option (fw#2414). Apps that need
-// owner invites compose OWNER_INVITE_ROLE_OPTIONS into a custom screen.
+// Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
+// must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
+// Full assignable rank list, used by memberRolesEditScreen: that screen is
+// prefilled with a member's *current* roles, so it must be able to represent
+// every rank a membership can actually hold, including TenantAdmin (fw#2452).
 export const OWNER_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin", "TenantAdmin"] as const;
 
 // Qualified write handler names (QN format: scope:type:name)

package/src/tenant/screens.ts

@@ -12,6 +12,7 @@ import {
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBER_STATUS_CELL_COMPONENT,
   MEMBERS_SCREEN_ID,
+  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "./constants";
@@ -179,7 +180,11 @@ export const memberRolesEditScreen = {
   cancelTarget: MEMBERS_SCREEN_ID,
   fields: {
     userId: { type: "text", required: true },
-    roles: { type: "multiSelect", options: DEFAULT_INVITE_ROLE_OPTIONS, required: true },
+    // Prefilled with the member's current roles, so the option list must be
+    // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
+    // omits TenantAdmin and would silently strip it on submit. Escalation
+    // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+    roles: { type: "multiSelect", options: OWNER_INVITE_ROLE_OPTIONS, required: true },
   },
   layout: {
     // Prefill userId from rowAction; readOnly so the operator cannot retarget.

package/src/user/handlers/create.write.ts

@@ -54,8 +54,10 @@ export const createWrite = defineWriteHandler({
       "user rows are tenant-agnostic identity records; uniqueness check and create need no tenant filter",
     );
 
+    // Pre-flight must match the partial bidx unique index, which only covers live rows.
     const existing = await fetchOne<{ id: string }>(db, userTable, {
       email: event.payload.email,
+      isDeleted: false,
     });
 
     if (existing) {

package/src/user/handlers/find-for-auth.query.ts

@@ -29,9 +29,13 @@ export const findForAuthQuery = defineQueryHandler({
     ),
   access: { roles: access.system },
   handler: async (query, ctx) => {
-    const where: { email: string } | { id: string } =
+    // Soft-deleted rows can now share an email with a live row (the partial
+    // bidx unique index covers live rows only), so the email arm must resolve
+    // the live identity; every email-arm caller already rejects isDeleted
+    // rows after the fetch, so this only removes rows that would be discarded anyway.
+    const where: { email: string; isDeleted: false } | { id: string } =
       query.payload.email !== undefined
-        ? { email: query.payload.email }
+        ? { email: query.payload.email, isDeleted: false }
         : { id: query.payload.id as string }; // @cast-boundary engine-payload
 
     if (!ctx.systemDb) {

package/src/workflow-runner/__tests__/resume-loop.integration.test.ts

@@ -83,9 +83,30 @@ const retryWorkflow: WorkflowDefinition = defineWorkflow({
   ]),
 });
 
+// Counts real side-effect executions of the step AFTER the suspension point
+// — distinct from the recorded event log, so a double-resume that somehow
+// wrote a deduplicated event log but still re-ran the pipeline would still
+// be caught (framework#2552/1).
+let sideEffectCount = 0;
+
+const idempotentResumeWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "rl-idempotent-resume",
+  trigger: { kind: "event", eventType: "rl-test.idempotent-resume" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.wait({ for: (ctx) => (ctx.event.payload as { forIso: string }).forIso }),
+    r.step.compute("sideEffect", () => {
+      sideEffectCount += 1;
+      return sideEffectCount;
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
 const testTriggersFeature = defineFeature("workflow-runner-resume-loop-test-triggers", (r) => {
   registerEventTrigger(r, waitWorkflow);
   registerEventTrigger(r, retryWorkflow);
+  registerEventTrigger(r, idempotentResumeWorkflow);
 });
 
 const noopLogger: JobContext["log"] = {
@@ -274,4 +295,45 @@ describe("workflow-runner resume loop", () => {
       rowsAfterResume.filter((row) => row["type"] === WORKFLOW_RETRY_SCHEDULED_TYPE),
     ).toHaveLength(1);
   });
+
+  test("a second resume-due-runs tick landing before pending-projection deletes the row resumes exactly once (fw#2552/1)", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(idempotentResumeWorkflow.name, runKey);
+    const pastIso = T.Now.instant().subtract({ hours: 1 }).toString();
+    sideEffectCount = 0;
+
+    await fireTrigger("rl-test.idempotent-resume", { runKey, forIso: pastIso });
+    expect(await pendingRowExists(runId, 0)).toBe(true);
+
+    await runResumeDueRunsJob();
+
+    const rowsAfterFirstResume = await loadRunEvents(runId);
+    expect(rowsAfterFirstResume.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_WAITING_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+    expect(sideEffectCount).toBe(1);
+
+    // pending-projection.ts only deletes this row on a LATER dispatcher pass
+    // reacting to WORKFLOW_RESUMED — deliberately not run here, reproducing
+    // the framework#2552/1 race window where a second resume-due-runs tick
+    // lands inside that async-delete gap and still finds the row.
+    expect(await pendingRowExists(runId, 0)).toBe(true);
+
+    await runResumeDueRunsJob();
+
+    const rowsAfterSecondDispatch = await loadRunEvents(runId);
+    expect(rowsAfterSecondDispatch).toHaveLength(4);
+    expect(
+      rowsAfterSecondDispatch.filter((row) => row["type"] === WORKFLOW_RESUMED_TYPE),
+    ).toHaveLength(1);
+    expect(
+      rowsAfterSecondDispatch.filter((row) => row["type"] === WORKFLOW_RUN_COMPLETED_TYPE),
+    ).toHaveLength(1);
+    // Not just the recorded event log — the step's own side effect (which a
+    // buggy second pipeline re-entry would double-run) executed exactly once.
+    expect(sideEffectCount).toBe(1);
+  });
 });

package/src/workflow-runner/__tests__/workflow-runner.integration.test.ts

@@ -9,9 +9,12 @@ import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { insertOne, selectMany } from "@cosmicdrift/kumiko-framework/db";
 import {
   computeDefinitionFingerprint,
+  createSystemUser,
   defineFeature,
   defineWorkflow,
   stepsPipeline,
+  WORKFLOW_RESUMED_TYPE,
+  WORKFLOW_RETRY_SCHEDULED_TYPE,
   WORKFLOW_RUN_COMPLETED_TYPE,
   WORKFLOW_RUN_FAILED_TYPE,
   WORKFLOW_RUN_STARTED_TYPE,
@@ -19,6 +22,7 @@ import {
   type WorkflowDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import { getConsumerState } from "@cosmicdrift/kumiko-framework/pipeline";
 import { setupTestStack, type TestStack, TestUsers } from "@cosmicdrift/kumiko-framework/stack";
 import { workflowRunAggregateId } from "../aggregate-id";
 import { registerEventTrigger } from "../event-trigger";
@@ -59,10 +63,56 @@ const suspendingWorkflow: WorkflowDefinition = defineWorkflow({
   ]),
 });
 
+// fw#2552/1 regression fixture — counts how often the step AFTER the wait
+// actually runs, keyed by runKey, so a double resume-run call can prove the
+// step executed exactly once instead of just inferring it from event counts.
+const doubleResumeStepRuns = new Map<string, number>();
+
+const doubleResumeWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "wr-integration-double-resume",
+  trigger: { kind: "event", eventType: "wr-test.double-resume" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.wait({ for: "PT1H" }),
+    r.step.compute("afterResume", (ctx) => {
+      const runKey = (ctx.event.payload as { runKey: string }).runKey;
+      doubleResumeStepRuns.set(runKey, (doubleResumeStepRuns.get(runKey) ?? 0) + 1);
+      return doubleResumeStepRuns.get(runKey);
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
+// fw#2552/1 regression fixture (Aufgabe 1 bug) — times: 3 forces TWO
+// retry-scheduled suspensions (attempt 1 and 2 both fail, attempt 3
+// succeeds), so resuming both must each thread a distinct retryAttempt
+// instead of the second resume being swallowed as already-resumed.
+const doubleRetryWorkflow: WorkflowDefinition = defineWorkflow({
+  name: "wr-integration-double-retry",
+  trigger: { kind: "event", eventType: "wr-test.double-retry" },
+  idempotencyKey: ({ payload }) => (payload as { runKey: string }).runKey,
+  steps: stepsPipeline(({ r }) => [
+    r.step.retry({
+      times: 3,
+      backoff: "linear",
+      do: [
+        r.step.compute("gate", (ctx) => {
+          const attempt = ctx.workflow?.retryAttempt ?? 1;
+          if (attempt < 3) throw new Error(`attempt-${attempt}-fails`);
+          return attempt;
+        }),
+      ],
+    }),
+    r.step.return({ isSuccess: true, data: undefined }),
+  ]),
+});
+
 const testTriggersFeature = defineFeature("workflow-runner-integration-test-triggers", (r) => {
   registerEventTrigger(r, happyWorkflow);
   registerEventTrigger(r, failingWorkflow);
   registerEventTrigger(r, suspendingWorkflow);
+  registerEventTrigger(r, doubleResumeWorkflow);
+  registerEventTrigger(r, doubleRetryWorkflow);
 });
 
 async function fireTrigger(eventType: string, payload: Record<string, unknown>): Promise<void> {
@@ -89,6 +139,17 @@ async function loadRunEvents(runId: string) {
   );
 }
 
+// Dispatches resume-run directly (SYSTEM_ROLE-gated) instead of going
+// through the resume-due-runs job — resume-run never checks wakeAt, so this
+// resumes a suspended step immediately regardless of its backoff/wait length.
+async function resumeRun(runId: string, stepIndex: number) {
+  return stack.dispatcher.write(
+    "workflow-runner:write:resume-run",
+    { runId, stepIndex },
+    createSystemUser(admin.tenantId),
+  );
+}
+
 describe("workflow-runner event-trigger", () => {
   beforeAll(async () => {
     stack = await setupTestStack({ features: [workflowRunnerFeature, testTriggersFeature] });
@@ -123,8 +184,28 @@ describe("workflow-runner event-trigger", () => {
   test("error path: a throwing step writes run-failed with the error text, no run-completed", async () => {
     const runKey = crypto.randomUUID();
     const runId = workflowRunAggregateId(failingWorkflow.name, runKey);
+    // The registrar namespaces every MSP as `<feature>:projection:<name>`.
+    const consumerName = `workflow-runner-integration-test-triggers:projection:workflow-${failingWorkflow.name}`;
+
+    await insertOne(stack.db, eventsTable, {
+      aggregateId: crypto.randomUUID(),
+      aggregateType: "wr-test-source",
+      tenantId: admin.tenantId,
+      version: 1,
+      type: "wr-test.failure",
+      eventVersion: 1,
+      payload: { runKey },
+      metadata: { userId: admin.id },
+      createdBy: admin.id,
+    });
 
-    await fireTrigger("wr-test.failure", { runKey });
+    // fw#2482/2: run-failed is durably recorded, so the dispatcher must count
+    // the trigger event as delivered — not as a poison event to keep
+    // retrying (which would re-run every side-effect step until dead-letter).
+    const firstPass = await stack.eventDispatcher?.runOnce();
+    expect(firstPass?.byConsumer[consumerName]).toEqual({ processed: 1, failed: 0 });
+    const stateAfterFirstPass = await getConsumerState(stack.db, consumerName);
+    expect(stateAfterFirstPass?.status).toBe("idle");
 
     const rows = await loadRunEvents(runId);
     expect(rows.map((row) => row["type"])).toEqual([
@@ -133,6 +214,16 @@ describe("workflow-runner event-trigger", () => {
     ]);
     expect(rows[1]!["payload"]).toMatchObject({ workflowName: failingWorkflow.name, stepIndex: 0 });
     expect(String(rows[1]!["payload"]["error"])).toContain("boom-explicit-failure");
+
+    // Second pass has nothing left to redeliver — the same trigger event
+    // never spawns a second run-started for this runId. `processed` counts
+    // every event the cursor walks past (the run-started/run-failed rows the
+    // first pass appended included), so the redelivery invariant is asserted
+    // on the run stream itself plus a still-clean failure count.
+    const secondPass = await stack.eventDispatcher?.runOnce();
+    expect(secondPass?.byConsumer[consumerName]?.failed).toBe(0);
+    expect(await loadRunEvents(runId)).toHaveLength(2);
+    expect(await getConsumerState(stack.db, consumerName)).toMatchObject({ status: "idle" });
   });
 
   test("suspension: a wait step suspends the run instead of failing it — resumable by framework#2513 Phase 2, no run-completed yet", async () => {
@@ -147,4 +238,57 @@ describe("workflow-runner event-trigger", () => {
       WORKFLOW_WAITING_TYPE,
     ]);
   });
+
+  test("fw#2552/1: a second resume-run for the same (runId, stepIndex) before pending-projection deletes the row reports already-resumed and never re-runs the step", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(doubleResumeWorkflow.name, runKey);
+
+    await fireTrigger("wr-test.double-resume", { runKey });
+    // pending-projection observes the suspension on a pass after it exists.
+    await stack.eventDispatcher?.runOnce();
+
+    const first = await resumeRun(runId, 0);
+    // No runOnce() in between — pending-projection has not yet deleted the
+    // pending row, so the second call still finds it (the race window).
+    const second = await resumeRun(runId, 0);
+
+    expect(first).toMatchObject({ isSuccess: true, data: { outcome: "completed" } });
+    expect(second).toMatchObject({ isSuccess: true, data: { outcome: "already-resumed" } });
+    expect(doubleResumeStepRuns.get(runKey)).toBe(1);
+
+    const rows = await loadRunEvents(runId);
+    expect(rows.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_WAITING_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+  });
+
+  test("fw#2552/1 regression: a step retried twice gets both retry attempts, the second resume is not swallowed as already-resumed", async () => {
+    const runKey = crypto.randomUUID();
+    const runId = workflowRunAggregateId(doubleRetryWorkflow.name, runKey);
+
+    await fireTrigger("wr-test.double-retry", { runKey });
+    await stack.eventDispatcher?.runOnce(); // pending-projection materialises attempt 1's row
+
+    const firstResume = await resumeRun(runId, 0);
+    expect(firstResume).toMatchObject({ isSuccess: true, data: { outcome: "suspended" } });
+
+    await stack.eventDispatcher?.runOnce(); // pending-projection materialises attempt 2's row
+
+    const secondResume = await resumeRun(runId, 0);
+    expect(secondResume).toMatchObject({ isSuccess: true, data: { outcome: "completed" } });
+
+    const rows = await loadRunEvents(runId);
+    expect(rows.map((row) => row["type"])).toEqual([
+      WORKFLOW_RUN_STARTED_TYPE,
+      WORKFLOW_RETRY_SCHEDULED_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RETRY_SCHEDULED_TYPE,
+      WORKFLOW_RESUMED_TYPE,
+      WORKFLOW_RUN_COMPLETED_TYPE,
+    ]);
+    expect(rows.filter((row) => row["type"] === WORKFLOW_RESUMED_TYPE)).toHaveLength(2);
+  });
 });

package/src/workflow-runner/event-trigger.ts

@@ -4,10 +4,10 @@
 // Registration pattern:
 //   registerEventTrigger(r, myWorkflow)
 //
-// The MSP apply-fn runs in the dispatcher's own tx, so `workflow.run-started`
-// plus the synchronous portion of the pipeline land atomically. Any throw
-// from startAndRunWorkflow is recorded as `workflow.run-failed` and
-// rethrown so the dispatcher's retry/dead-letter handling still applies.
+// The apply-fn does NOT run in the dispatcher's cursor tx (the server's MSP
+// wiring uses the unbound pool), so `workflow.run-started` and the rest of
+// the pipeline are not atomic. A throw from startAndRunWorkflow is recorded
+// as `workflow.run-failed` and swallowed, so the dispatcher moves on.
 
 import type {
   FeatureRegistrar,
@@ -43,6 +43,9 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
 
   r.multiStreamProjection({
     name: `workflow-${workflow.name}`,
+    // Mounting an event-triggered workflow into an existing app must not
+    // replay the historical log and fire every side-effect step retroactively.
+    startFrom: "now",
     apply: {
       [eventType]: async (event, _tx, ctx) => {
         // skip: unreachable — the guard above already established this, but the
@@ -97,7 +100,10 @@ export function registerEventTrigger(r: FeatureRegistrar, workflow: WorkflowDefi
             type: WORKFLOW_RUN_FAILED_TYPE,
             payload: failedPayload,
           });
-          throw error;
+          // No rethrow: the failure is now durably recorded as
+          // workflow.run-failed. Rethrowing would make the dispatcher
+          // redeliver the same trigger event up to maxAttempts, re-running
+          // every side-effect step and eventually killing the consumer.
         }
       },
     },