@cosmicdrift/kumiko-bundled-features 0.248.0 → 0.250.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.248.0",
+  "version": "0.250.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.248.0",
-    "@cosmicdrift/kumiko-framework": "0.248.0",
-    "@cosmicdrift/kumiko-headless": "0.248.0",
-    "@cosmicdrift/kumiko-renderer": "0.248.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.248.0",
-    "@cosmicdrift/kumiko-types": "0.248.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.250.0",
+    "@cosmicdrift/kumiko-framework": "0.250.0",
+    "@cosmicdrift/kumiko-headless": "0.250.0",
+    "@cosmicdrift/kumiko-renderer": "0.250.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.250.0",
+    "@cosmicdrift/kumiko-types": "0.250.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.248.0",
-    "@cosmicdrift/kumiko-locale-es": "0.248.0"
+    "@cosmicdrift/kumiko-locale-de": "0.250.0",
+    "@cosmicdrift/kumiko-locale-es": "0.250.0"
   }
 }

package/src/auth-email-password/__tests__/invite-accept-with-login-gates.integration.test.ts

@@ -353,3 +353,72 @@ describe("invite-accept-with-login: account-status gate", () => {
     expect(memberships).toHaveLength(0);
   });
 });
+
+describe("invite-accept-with-login: soft-deleted email predecessor (fw#2593)", () => {
+  // read_users_email_unique is now a partial index (WHERE is_deleted = false),
+  // so a soft-deleted row and a live row can share an email. The password
+  // lookup must resolve the live row, never the soft-deleted one.
+  test("logs in as the live user, not the soft-deleted predecessor with the same email", async () => {
+    const email = "reused-invitee@example.com";
+    const deletedUserId = crypto.randomUUID();
+    const liveUserId = crypto.randomUUID();
+    const deletedPassword = "deleted-predecessor-pw-1234";
+    const livePassword = "live-successor-pw-5678";
+
+    await seedRow(stack.db, userTable, {
+      id: deletedUserId,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(deletedPassword),
+      displayName: "Deleted Predecessor",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+    await asRawClient(stack.db).unsafe(
+      `UPDATE "${userTable.tableName}" SET is_deleted = true WHERE id = $1`,
+      [deletedUserId],
+    );
+
+    await seedRow(stack.db, userTable, {
+      id: liveUserId,
+      tenantId: TENANT_A_ID,
+      email,
+      passwordHash: await hashPassword(livePassword),
+      displayName: "Live Successor",
+      locale: "de",
+      emailVerified: true,
+      roles: "[]",
+      status: USER_STATUS.Active,
+    });
+
+    const token = await inviteEmail(email, "Editor");
+
+    // The deleted predecessor's password must never authenticate this
+    // invite, even though it shares the email — proves the lookup didn't
+    // just happen to land on the live row by insertion order. A failed
+    // password check unburns the token (see the handler's `finally`), so
+    // the same token is still usable for the real attempt below.
+    const deletedAttempt = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password: deletedPassword,
+    });
+    expect(deletedAttempt.status).not.toBe(200);
+
+    const res = await stack.http.raw("POST", "/api/auth/invite-accept-with-login", {
+      token,
+      email,
+      password: livePassword,
+    });
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as {
+      isSuccess: boolean;
+      user?: { id: string };
+    };
+    expect(body.isSuccess).toBe(true);
+    expect(body.user?.id).toBe(liveUserId);
+  });
+});

package/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -171,8 +171,11 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
 
         // Password check against userTable, through the same gates
         // login.write.ts runs (see login-gates.test.ts for the gate contracts).
+        // Email uniqueness is partial on live rows (framework#2593) — without
+        // this filter the lookup can resolve a soft-deleted row.
         const userRow = await fetchOne<UserAuthRow>(ctx.db.raw, userTable, {
           email: invitationEmail,
+          isDeleted: false,
         });
         if (!userRow?.passwordHash) return invalidInviteToken();
 

package/src/auth-email-password/handlers/invite-signup-complete.write.ts

@@ -129,8 +129,11 @@ export function createInviteSignupCompleteHandler() {
         // muss der User Branch 2 (acceptWithLogin) nutzen. Hier ist
         // explizit "neue Email" — sonst hätten wir zwei Wege ein
         // Password zu setzen für denselben User.
+        // Email uniqueness is partial on live rows (framework#2593) — without
+        // this filter the lookup can resolve a soft-deleted row.
         const existingUser = await fetchOne(ctx.db.raw, userTable, {
           email: invitationEmail,
+          isDeleted: false,
         });
         if (existingUser) return invalidInviteToken();
 

package/src/billing-foundation/__tests__/billing-foundation.integration.test.ts

@@ -68,6 +68,7 @@ const mockCheckoutCalls: Array<{
   successUrl: string;
   cancelUrl: string;
   providerCustomerId?: string;
+  mode?: "subscription" | "payment";
 }> = [];
 const mockPortalCalls: Array<{ providerCustomerId: string; returnUrl: string }> = [];
 
@@ -82,6 +83,7 @@ const mockProviderFeature = defineFeature("test-mock-provider", (r) => {
         successUrl: options.successUrl,
         cancelUrl: options.cancelUrl,
         ...(options.providerCustomerId && { providerCustomerId: options.providerCustomerId }),
+        ...(options.mode && { mode: options.mode }),
       });
       return { url: `https://mock.example/checkout/${options.priceId}` };
     },
@@ -513,6 +515,41 @@ describe("scenario 6: create-checkout-session — Plugin-routing", () => {
     );
     expect(mockCheckoutCalls[0]?.providerCustomerId).toBe("cus_existing_xyz");
   });
+
+  test("optional mode wird durchgereicht (One-off-Payment-Flow, fw#2755)", async () => {
+    mockCheckoutCalls.length = 0;
+    const admin = adminFor(3014);
+    await stack.http.writeOk(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_topup_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+        mode: "payment",
+      },
+      admin,
+    );
+    expect(mockCheckoutCalls).toHaveLength(1);
+    expect(mockCheckoutCalls[0]?.mode).toBe("payment");
+  });
+
+  test("mode omitted → plugin receives no mode field (Regression-Pin für bestehende Aufrufer)", async () => {
+    mockCheckoutCalls.length = 0;
+    const admin = adminFor(3015);
+    await stack.http.writeOk(
+      "billing-foundation:write:create-checkout-session",
+      {
+        providerName: "mock",
+        priceId: "price_pro_test",
+        successUrl: "https://example.com/s",
+        cancelUrl: "https://example.com/c",
+      },
+      admin,
+    );
+    expect(mockCheckoutCalls).toHaveLength(1);
+    expect(mockCheckoutCalls[0]?.mode).toBeUndefined();
+  });
 });
 
 describe("scenario 7: create-portal-session — Plugin-routing", () => {

package/src/billing-foundation/feature.ts

@@ -86,11 +86,20 @@ export const billingFoundationFeature = defineFeature(BILLING_FOUNDATION_FEATURE
   // shape (= subscription-state-snapshot); der event-type taggt was
   // passiert ist. Future-consumer (billing-history, accounting)
   // listenen direkt auf den event-type ohne payload-discriminator.
-  r.defineEvent(SUBSCRIPTION_CREATED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(SUBSCRIPTION_UPDATED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(SUBSCRIPTION_CANCELED_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema);
-  r.defineEvent(INVOICE_PAYMENT_FAILED_EVENT_SHORT, subscriptionEventPayloadSchema);
+  // piiFields: "none" — provider ids are tenantOwned ciphertext, not plaintext personal data.
+  r.defineEvent(SUBSCRIPTION_CREATED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(SUBSCRIPTION_UPDATED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(SUBSCRIPTION_CANCELED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(INVOICE_PAID_EVENT_SHORT, subscriptionEventPayloadSchema, { piiFields: "none" });
+  r.defineEvent(INVOICE_PAYMENT_FAILED_EVENT_SHORT, subscriptionEventPayloadSchema, {
+    piiFields: "none",
+  });
 
   // Inline projection: materialized current state in `read_subscriptions`.
   // Apply läuft in derselben TX wie ctx.unsafeAppendEvent — read-your-

package/src/billing-foundation/handlers/create-checkout-session.write.ts

@@ -32,13 +32,16 @@ const createCheckoutSessionSchema = z.object({
   /** Optional: existierender provider-customer wenn der Tenant schon
    *  einen account beim Provider hat (= Plan-Wechsel statt Neuregistrierung). */
   providerCustomerId: z.string().max(200).optional(),
+  /** Optional: `"payment"` for a one-off checkout (e.g. credit top-up)
+   *  instead of a recurring subscription. Defaults to `"subscription"`. */
+  mode: z.enum(["subscription", "payment"]).optional(),
 });
 type CreateCheckoutSessionPayload = z.infer<typeof createCheckoutSessionSchema>;
 
 export const createCheckoutSessionHandler: WriteHandlerDef = {
   name: "create-checkout-session",
   description:
-    "Opens a hosted checkout page at the named subscription provider for the caller's tenant and returns its URL; use it when a tenant admin wants to subscribe or switch to a paid plan.",
+    'Opens a hosted checkout page at the named subscription provider for the caller\'s tenant and returns its URL; use it when a tenant admin wants to subscribe, switch plans, or make a one-off payment (mode: "payment").',
   schema: createCheckoutSessionSchema,
   // Tenant-Admin-only — der Tenant muss bewusst seine Subscription
   // konfigurieren. SystemAdmin als Fallback für Operator-Initiated-Flows.
@@ -71,6 +74,7 @@ export const createCheckoutSessionHandler: WriteHandlerDef = {
       successUrl: payload.successUrl,
       cancelUrl: payload.cancelUrl,
       ...(payload.providerCustomerId && { providerCustomerId: payload.providerCustomerId }),
+      ...(payload.mode && { mode: payload.mode }),
     });
 
     return {

package/src/billing-foundation/types.ts

@@ -129,6 +129,11 @@ export type SubscriptionProviderPlugin = {
        *  schon einen Account beim Provider hat. Sonst legt der Provider
        *  beim checkout einen neuen customer an. */
       readonly providerCustomerId?: string;
+      /** Checkout mode. `"subscription"` (default) starts a recurring
+       *  billing flow; `"payment"` a one-off checkout (e.g. pay-per-use
+       *  credit top-ups). Optional with default `"subscription"` — existing
+       *  callers are unaffected. */
+      readonly mode?: "subscription" | "payment";
     },
   ) => Promise<{ readonly url: string }>;
 

package/src/cap-counter/feature.ts

@@ -84,7 +84,7 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
   // dasselbe Schema für Append-Time-Validation. QN nach Prefixing:
   // "cap-counter:event:rolling-incremented" (siehe
   // ROLLING_INCREMENTED_EVENT_QN).
-  r.defineEvent(ROLLING_INCREMENTED_EVENT_SHORT, rollingIncrementedSchema);
+  r.defineEvent(ROLLING_INCREMENTED_EVENT_SHORT, rollingIncrementedSchema, { piiFields: "none" });
 
   // Custom write-handlers.
   // - increment: Calendar-Period (CRUD via projection-row).

package/src/cap-overview/__tests__/cap-overview-security.integration.test.ts

@@ -158,6 +158,55 @@ describe("cap-overview tenant isolation", () => {
   });
 });
 
+describe("cap-overview my-caps for regular tenant members", () => {
+  test("a regular User(A) reads A's own usage, not a 403", async () => {
+    const memberA = createTestUser({ id: 90041, tenantId: TENANT_A, roles: ["User"] });
+    const result = await stack.http.queryOk<{
+      rows: readonly { id: string; used: number | null }[];
+    }>(CapOverviewQueries.capsUsage, {}, memberA);
+    const widgetsRow = result.rows.find((row) => row.id === testCap.id);
+    expect(widgetsRow?.used).toBe(USAGE_BY_TENANT[TENANT_A]);
+  });
+
+  test("an Editor(B) reads B's own usage, not A's", async () => {
+    const editorB = createTestUser({ id: 90042, tenantId: TENANT_B, roles: ["Editor"] });
+    const result = await stack.http.queryOk<{
+      rows: readonly { id: string; used: number | null }[];
+    }>(CapOverviewQueries.capsUsage, {}, editorB);
+    const widgetsRow = result.rows.find((row) => row.id === testCap.id);
+    expect(widgetsRow?.used).toBe(USAGE_BY_TENANT[TENANT_B]);
+    expect(widgetsRow?.used).not.toBe(USAGE_BY_TENANT[TENANT_A]);
+  });
+
+  test("a regular User(A) cannot read tenant B's usage via override", async () => {
+    const memberA = createTestUser({ id: 90043, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(
+      CapOverviewQueries.capsUsage,
+      { tenantId: TENANT_B },
+      memberA,
+    );
+    expect(res.status).toBe(403);
+  });
+
+  test("a regular User(A) cannot list all tenants", async () => {
+    const memberA = createTestUser({ id: 90044, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(CapOverviewQueries.tenantCapsList, {}, memberA);
+    expect(res.status).toBe(403);
+  });
+
+  test("a regular User(A) cannot enumerate tenant names via the platform picker", async () => {
+    const memberA = createTestUser({ id: 90045, tenantId: TENANT_A, roles: ["User"] });
+    const res = await stack.http.query(CapOverviewQueries.tenantOptions, {}, memberA);
+    expect(res.status).toBe(403);
+  });
+
+  test("an unranked app role still cannot reach my-caps", async () => {
+    const viewerA = createTestUser({ id: 90046, tenantId: TENANT_A, roles: ["Viewer"] });
+    const res = await stack.http.query(CapOverviewQueries.capsUsage, {}, viewerA);
+    expect(res.status).toBe(403);
+  });
+});
+
 describe("cap-overview tier filter operators", () => {
   test("op:ne excludes tenants matching the value, not just those matching it", async () => {
     const sysAdmin = createTestUser({ id: 90017, tenantId: TENANT_A, roles: ["SystemAdmin"] });

package/src/cap-overview/__tests__/cap-overview.boot.test.ts

@@ -1,11 +1,13 @@
 import { describe, expect, test } from "bun:test";
-import { validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { access, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { billingFoundationFeature } from "../../billing-foundation";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant";
 import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
 import { tierEngineFeature } from "../../tier-engine";
+import { MY_CAPS_ACCESS_ROLES } from "../access";
 import {
   MY_CAPS_SCREEN_ID,
   PLATFORM_TENANT_CAPS_SCREEN_ID,
@@ -58,6 +60,29 @@ describe("cap-overview boot", () => {
     expect(feature.screens[PLATFORM_TENANT_CAPS_SCREEN_ID]?.type).toBe("dashboard");
   });
 
+  test("my-caps screen and the query filling its cards carry the SAME rule", () => {
+    const feature = createCapOverviewFeature({ caps: [testCap] });
+    expect(rolesOf(feature.screens[MY_CAPS_SCREEN_ID]?.access)).toEqual([...MY_CAPS_ACCESS_ROLES]);
+    expect(rolesOf(feature.queryHandlers["caps:usage"]?.access)).toEqual([...MY_CAPS_ACCESS_ROLES]);
+  });
+
+  test("my-caps stays reachable for every role that reached it before", () => {
+    for (const role of access.admin) {
+      expect(MY_CAPS_ACCESS_ROLES).toContain(role);
+    }
+    expect(MY_CAPS_ACCESS_ROLES).toContain("User");
+  });
+
+  test("the platform-wide screens and their queries stay SystemAdmin-only", () => {
+    const feature = createCapOverviewFeature({ caps: [testCap] });
+    expect(rolesOf(feature.screens[TENANT_CAP_LIST_SCREEN_ID]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(feature.screens[PLATFORM_TENANT_CAPS_SCREEN_ID]?.access)).toEqual([
+      "SystemAdmin",
+    ]);
+    expect(rolesOf(feature.queryHandlers["tenant-caps:list"]?.access)).toEqual(["SystemAdmin"]);
+    expect(rolesOf(feature.queryHandlers["tenant-options"]?.access)).toEqual(["SystemAdmin"]);
+  });
+
   test("tenant-cap-list facet field is a declared column and the list handler schema accepts filters", () => {
     const feature = createCapOverviewFeature({ caps: [testCap], tiers: ["free", "pro"] });
     const screen = feature.screens[TENANT_CAP_LIST_SCREEN_ID];

package/src/cap-overview/access.ts

@@ -0,0 +1,9 @@
+import { access } from "@cosmicdrift/kumiko-framework/engine";
+
+// Every built-in membership rank (role-assignment.ts: User < Editor < Admin <
+// TenantAdmin < SystemAdmin), so a regular team member can see their own
+// tenant's usage. Deliberately not `access.authenticated` — that preset omits
+// TenantAdmin and would revoke the access TenantAdmins already have. The
+// screen and the query that fills its cards must carry the SAME rule, or the
+// dashboard renders and every card 403s.
+export const MY_CAPS_ACCESS_ROLES = access.roles("User", "Editor", ...access.admin);

package/src/cap-overview/feature.ts

@@ -5,8 +5,8 @@
 //      platform-wide table of every tenant's tier, billing status, and
 //      usage against a configurable set of caps.
 //   2. caps:usage query + my-caps / platform-tenant-caps dashboards —
-//      per-tenant usage cards. TenantAdmin sees their own tenant;
-//      SystemAdmin can additionally view any tenant via `tenantId`.
+//      per-tenant usage cards. Every member of a tenant sees their own
+//      tenant; SystemAdmin can additionally view any tenant via `tenantId`.
 //
 // **What this feature does NOT do:**
 //   - No writes. Reads tier-engine's read_tier_assignments, billing-
@@ -52,7 +52,7 @@ export function createCapOverviewFeature(opts: CreateCapOverviewOptions): Featur
 
   return defineFeature(CAP_OVERVIEW_FEATURE, (r) => {
     r.describe(
-      "Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; TenantAdmin gets their own usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.",
+      "Read-only visibility into per-tenant tier assignment and cap usage. SystemAdmin gets a platform-wide tenant list with usage bars; every member of a tenant gets their own tenant's usage as dashboard cards. Reads tier-engine, billing-foundation, and tenant data plus app-owned usage tables via caller-supplied CapSpec callbacks — never writes.",
     );
     r.uiHints({
       displayLabel: "Cap Overview · Tier & Usage Visibility",

package/src/cap-overview/handlers/caps-usage.query.ts

@@ -1,7 +1,6 @@
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { buildEntityTable } from "@cosmicdrift/kumiko-framework/db";
 import {
-  access,
   crossTenantOverrideDenied,
   defineQueryHandler,
   type QueryHandlerDefinition,
@@ -9,6 +8,7 @@ import {
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { tierAssignmentEntity } from "../../tier-engine";
+import { MY_CAPS_ACCESS_ROLES } from "../access";
 import type { CapSpec, CapUsageWithMeta } from "../types";
 import { computeFraction, computeTone, computeUnclampedFraction } from "../usage-math";
 
@@ -20,9 +20,9 @@ export function createCapsUsageQuery(caps: readonly CapSpec[]): QueryHandlerDefi
   return defineQueryHandler({
     name: "caps:usage",
     description:
-      "Returns one tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (SystemAdmin may target another tenant via tenantId).",
+      "Returns the calling user's own tenant's configured caps with used amount, tier limit and utilisation fraction; use it to answer how close a tenant is to its quota (only SystemAdmin may target another tenant via tenantId).",
     schema: z.object({ tenantId: z.string().min(1).optional() }),
-    access: { roles: access.admin },
+    access: { roles: MY_CAPS_ACCESS_ROLES },
     handler: async (query, ctx) => {
       if (!ctx.systemDb) {
         throw new InternalError({

package/src/cap-overview/index.ts

@@ -1,5 +1,6 @@
 // Public API of the cap-overview bundled-feature.
 
+export { MY_CAPS_ACCESS_ROLES } from "./access";
 export {
   CAP_CARDS_PANEL_COMPONENT,
   CAP_OVERVIEW_FEATURE,

package/src/cap-overview/screens.ts

@@ -1,4 +1,5 @@
-import { access, type ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import type { ScreenDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import { MY_CAPS_ACCESS_ROLES } from "./access";
 import {
   CAP_CARDS_PANEL_COMPONENT,
   CAP_USAGE_CELL_COMPONENT,
@@ -78,7 +79,7 @@ export const myCapsScreen: ScreenDefinition = {
       component: { react: { __component: CAP_CARDS_PANEL_COMPONENT } },
     },
   ],
-  access: { roles: access.admin },
+  access: { roles: MY_CAPS_ACCESS_ROLES },
 };
 
 export const platformTenantCapsScreen: ScreenDefinition = {

package/src/crypto-shredding/feature.ts

@@ -16,8 +16,10 @@ export function createCryptoShreddingFeature(): FeatureDefinition {
       category: "compliance",
     });
 
-    r.defineEvent("subject-forgotten", subjectForgottenSchema);
-    r.defineEvent("forget-denied", subjectForgetDeniedSchema);
+    // `reason` is operator free text and may name the subject; encrypting it under
+    // the subject key is pointless (that key is being erased) — see #2776.
+    r.defineEvent("subject-forgotten", subjectForgottenSchema, { piiFields: "none" });
+    r.defineEvent("forget-denied", subjectForgetDeniedSchema, { piiFields: "none" });
     r.writeHandler(forgetSubjectWrite);
   });
 }

package/src/custom-fields/feature.ts

@@ -128,11 +128,18 @@ function registerCustomFields(
   // Event-types — qualified als "custom-fields:event:<short-name>".
   // Returned EventDefs liefern .name als compile-time literal-typed string,
   // den Handler + MSP-keys konsumieren statt Template-Literal-Konstruktion.
-  const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema);
-  const clearedEvent = r.defineEvent(CUSTOM_FIELD_CLEARED_EVENT, customFieldClearedSchema);
+  // `value: z.unknown()` has no field-level schema to catalog under piiFields;
+  // "no PII" is a naming convention (#972), not an enforced guarantee — see #2776.
+  const setEvent = r.defineEvent(CUSTOM_FIELD_SET_EVENT, customFieldSetSchema, {
+    piiFields: "none",
+  });
+  const clearedEvent = r.defineEvent(CUSTOM_FIELD_CLEARED_EVENT, customFieldClearedSchema, {
+    piiFields: "none",
+  });
   const fieldDefinitionDeletedEvent = r.defineEvent(
     FIELD_DEFINITION_DELETED_EVENT,
     fieldDefinitionDeletedSchema,
+    { piiFields: "none" },
   );
 
   // Extension-Registrar — registriert dass diese Extension existiert.

package/src/document-ingest-foundation/feature.ts

@@ -102,8 +102,14 @@ export const documentIngestFoundationFeature = defineFeature(FEATURE_NAME, (r) =
     }),
   );
 
-  r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema);
-  r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema);
+  // "fileName" can carry a real person's name; the payload has no user-subject
+  // field to encrypt it under, so piiFields stays "none" pending #2776.
+  r.defineEvent(DOCUMENT_INGEST_REQUESTED_EVENT_SHORT, documentIngestRequestedPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(DOCUMENT_INGEST_SKIPPED_EVENT_SHORT, documentIngestSkippedPayloadSchema, {
+    piiFields: "none",
+  });
 
   r.multiStreamProjection({
     name: "request-ingest",

package/src/feature-toggles/feature.ts

@@ -61,7 +61,7 @@ export function createFeatureTogglesFeature(
     // alongside every other write — audit.list picks it up automatically,
     // no dedicated projection needed. Qualified name after prefixing:
     // "feature-toggles:event:toggle-set" (see constants.FEATURE_TOGGLE_SET_EVENT_NAME).
-    r.defineEvent("toggle-set", featureToggleSetSchema);
+    r.defineEvent("toggle-set", featureToggleSetSchema, { piiFields: "none" });
 
     const handlers = {
       set: r.writeHandler(createSetWriteHandler(options.getRuntime)),

package/src/inbound-mail-foundation/feature.ts

@@ -109,11 +109,25 @@ export const inboundMailFoundationFeature = defineFeature(INBOUND_MAIL_FOUNDATIO
   r.requires("tenant-lifecycle");
 
   // 5 fine-grained domain-events (Payload-Schemas: events.ts).
-  r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema);
-  r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema);
-  r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema);
+  // piiFields: "none" — address/subject/snippet are already ciphertext under the tenant subject key before append (see events.ts).
+  // "displayName" stays plaintext (often the mailbox owner's real name for
+  // personal accounts); encrypting it would break the entity-projection read
+  // path that carries it as `personal: false` (#2776).
+  r.defineEvent(MAIL_ACCOUNT_CONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_ACCOUNT_UPDATED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_ACCOUNT_DISCONNECTED_EVENT_SHORT, mailAccountEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(INBOUND_MESSAGE_RECEIVED_EVENT_SHORT, inboundMessageEventPayloadSchema, {
+    piiFields: "none",
+  });
+  r.defineEvent(MAIL_THREAD_UPDATED_EVENT_SHORT, mailThreadEventPayloadSchema, {
+    piiFields: "none",
+  });
 
   // Inline projections — apply in derselben TX wie der Append.
   r.projection({

package/src/secrets/feature.ts

@@ -153,7 +153,7 @@ export function createSecretsFeature(opts: SecretsFeatureOptions = {}): FeatureD
     // discover the type; secrets-context.get parses payloads against
     // `secretReadSchema` at write time because the low-level append() path
     // skips ctx.appendEvent's schema-validation guard.
-    r.defineEvent("read", secretReadSchema);
+    r.defineEvent("read", secretReadSchema, { piiFields: "none" });
 
     // Per-tenant handlers (set/delete/list) run in the default tenant-scope,
     // giving them the automatic ctx.db tenant-filter as extra defense.

package/src/sessions/feature.ts

@@ -146,7 +146,7 @@ export function createSessionsFeature(options?: SessionsFeatureOptions): Feature
     // sessionRevokedSchema explicitly, same guarantee via a different path.
     // No projection: the payload IS the read, consumed directly off the
     // event-store NOTIFY (#1560).
-    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema);
+    r.defineEvent(SESSION_REVOKED_EVENT_SHORT, sessionRevokedSchema, { piiFields: "none" });
 
     const handlers = {
       revoke: r.writeHandler(revokeWrite),

package/src/subscription-mollie/__tests__/plugin-methods.test.ts

@@ -0,0 +1,86 @@
+// Unit tests for the Mollie plugin methods (createCheckoutSession only —
+// createPortalSession/cancelSubscription are not implemented, see
+// plugin-methods.ts). Mollie-SDK calls are mocked via spyOn — we test our
+// sequenceType/metadata mapping, NOT Mollie itself.
+
+import { describe, expect, spyOn, test } from "bun:test";
+import type { HandlerContext } from "@cosmicdrift/kumiko-framework/engine";
+import type { MollieClient } from "@mollie/api-client";
+import { createMollieCheckoutSession, type MolliePriceConfig } from "../plugin-methods";
+
+const PRICE_CONFIG: Readonly<Record<string, MolliePriceConfig>> = {
+  plan_pro: {
+    amountValue: "9.99",
+    amountCurrency: "EUR",
+    interval: "1 month",
+    description: "Pro Plan",
+  },
+};
+
+const WEBHOOK_URL = "https://app.example.com/api/subscription/webhook/mollie";
+const stubCtx = {} as HandlerContext;
+
+// No `: MollieClient` return-type annotation — keeping the inferred narrow
+// shape lets spyOn resolve a non-overloaded signature for `payments.create`
+// (MollieClient's real signature is Promise|void-overloaded, which makes
+// spyOn(...).mockResolvedValue infer `never`, see plugin-methods.ts's own
+// `@cast-boundary` comment on the same overload).
+function buildClient() {
+  return {
+    customers: {
+      create: async () => ({ id: "cus_mock" }),
+    },
+    payments: {
+      create: async () => ({ getCheckoutUrl: () => "https://www.mollie.com/checkout/mock" }),
+    },
+  };
+}
+
+describe("createMollieCheckoutSession", () => {
+  test("mode omitted defaults to sequenceType 'first' (mandate-setup, Regression-Pin für bestehende Aufrufer)", async () => {
+    const client = buildClient();
+    const createMock = spyOn(client.payments, "create").mockResolvedValue({
+      getCheckoutUrl: () => "https://www.mollie.com/checkout/mock",
+    });
+
+    const checkout = createMollieCheckoutSession(
+      client as unknown as MollieClient,
+      PRICE_CONFIG,
+      WEBHOOK_URL,
+    );
+    const result = await checkout(stubCtx, {
+      priceId: "plan_pro",
+      tenantId: "tenant-001",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      providerCustomerId: "cus_existing",
+    });
+
+    expect(result).toEqual({ url: "https://www.mollie.com/checkout/mock" });
+    expect(createMock).toHaveBeenCalledWith(expect.objectContaining({ sequenceType: "first" }));
+  });
+
+  test("mode='payment': sequenceType wird zu 'oneoff' (One-off-Top-up, kein Mandate-setup)", async () => {
+    const client = buildClient();
+    const createMock = spyOn(client.payments, "create").mockResolvedValue({
+      getCheckoutUrl: () => "https://www.mollie.com/checkout/topup",
+    });
+
+    const checkout = createMollieCheckoutSession(
+      client as unknown as MollieClient,
+      PRICE_CONFIG,
+      WEBHOOK_URL,
+    );
+    const result = await checkout(stubCtx, {
+      priceId: "plan_pro",
+      tenantId: "tenant-002",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      providerCustomerId: "cus_existing",
+      mode: "payment",
+    });
+
+    expect(result).toEqual({ url: "https://www.mollie.com/checkout/topup" });
+    expect(createMock).toHaveBeenCalledWith(expect.objectContaining({ sequenceType: "oneoff" }));
+  });
+});

package/src/subscription-mollie/plugin-methods.ts

@@ -52,12 +52,20 @@ export function createMollieCheckoutSession(
       customerId = customer.id;
     }
 
+    // mode "payment" (one-off top-up) → sequenceType.oneoff, no mandate
+    // setup. verify-webhook.ts's ensureSubscriptionForMandate already
+    // gates on sequenceType === "first" — a oneoff payment falls into
+    // its "not our domain" branch and creates NO Mollie subscription.
+    // Webhook resolution for oneoff payments is separate follow-up
+    // work (offlot#109), not part of this contract.
+    const sequenceType = options.mode === "payment" ? SequenceType.oneoff : SequenceType.first;
+
     // payments.create ist overloaded (Promise OR void mit callback);
     // explicit cast auf Promise<Payment>-overload.
     const payment = (await (client.payments.create({
       amount: { currency: priceCfg.amountCurrency, value: priceCfg.amountValue },
       description: priceCfg.description,
-      sequenceType: SequenceType.first,
+      sequenceType,
       customerId,
       redirectUrl: options.successUrl,
       cancelUrl: options.cancelUrl,

package/src/subscription-stripe/__tests__/plugin-methods.test.ts

@@ -116,6 +116,55 @@ describe("createStripeCheckoutSession", () => {
     );
   });
 
+  test("mode='payment': ruft stripe.checkout.sessions.create mit mode=payment + payment_intent_data.metadata (KEIN subscription_data)", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://checkout.stripe.com/c/pay/topup" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe));
+    const result = await checkout(stubCtx, {
+      priceId: "price_credits_topup",
+      tenantId: "tenant-003",
+      successUrl: "https://example.com/success",
+      cancelUrl: "https://example.com/cancel",
+      mode: "payment",
+    });
+
+    expect(result).toEqual({ url: "https://checkout.stripe.com/c/pay/topup" });
+    expect(createMock).toHaveBeenCalledWith({
+      mode: "payment",
+      line_items: [{ price: "price_credits_topup", quantity: 1 }],
+      success_url: "https://example.com/success",
+      cancel_url: "https://example.com/cancel",
+      // Drift-Pin: payment-mode carries tenantId via payment_intent_data,
+      // NOT subscription_data — Stripe rejects subscription_data outside
+      // subscription-mode.
+      payment_intent_data: {
+        metadata: { tenantId: "tenant-003" },
+      },
+    });
+  });
+
+  test("mode omitted defaults to 'subscription' (Regression-Pin für bestehende Aufrufer)", async () => {
+    const stripe = buildStripe();
+    const createMock = spyOn(stripe.checkout.sessions, "create")
+      // biome-ignore lint/suspicious/noExplicitAny: Stripe-SDK-typed mock-return
+      .mockResolvedValue({ url: "https://x" } as any);
+
+    const checkout = createStripeCheckoutSession(ctxRuntime(stripe));
+    await checkout(stubCtx, {
+      priceId: "price_x",
+      tenantId: "tenant-004",
+      successUrl: "https://x/s",
+      cancelUrl: "https://x/c",
+    });
+
+    expect(createMock).toHaveBeenCalledWith(
+      expect.objectContaining({ mode: "subscription", subscription_data: expect.anything() }),
+    );
+  });
+
   test("throws wenn Stripe keine url returnt (defensive — sollte nie passieren bei mode=subscription)", async () => {
     const stripe = buildStripe();
     spyOn(stripe.checkout.sessions, "create")

package/src/subscription-stripe/plugin-methods.ts

@@ -41,24 +41,26 @@ export function createStripeCheckoutSession(runtime: StripeCtxRuntime) {
     // billing-live-config-key write-side.
     await runtime.assertBillingLive(ctx);
     const stripe = await runtime.clientForCtx(ctx);
+    const mode = options.mode ?? "subscription";
 
     const session = await stripe.checkout.sessions.create({
-      mode: "subscription",
+      mode,
       line_items: [{ price: options.priceId, quantity: 1 }],
       success_url: options.successUrl,
       cancel_url: options.cancelUrl,
-      // metadata.tenantId landet auf der subscription die durch diese
-      // checkout-session entsteht — beim subsequent webhook lesen wir's
-      // aus subscription.metadata.tenantId zurück.
-      subscription_data: {
-        metadata: { tenantId: options.tenantId },
-      },
+      // subscription_data is subscription-mode-only (Stripe rejects it in
+      // payment-mode) — the subsequent webhook reads metadata.tenantId off
+      // the subscription it creates. payment-mode has no subscription, so
+      // tenantId travels via payment_intent_data.metadata instead.
+      ...(mode === "subscription"
+        ? { subscription_data: { metadata: { tenantId: options.tenantId } } }
+        : { payment_intent_data: { metadata: { tenantId: options.tenantId } } }),
       ...(options.providerCustomerId && { customer: options.providerCustomerId }),
     });
 
     if (!session.url) {
-      // Stripe garantiert url für mode: subscription. Defensive für
-      // zukünftige API-Drift.
+      // Defensive: Stripe returns a hosted url for both modes today —
+      // guards against future API drift.
       throw new Error("subscription-stripe: checkout.sessions.create returned no url");
     }
     return { url: session.url };

package/src/tenant-lifecycle/feature.ts

@@ -60,24 +60,41 @@ export function createTenantLifecycleFeature(): FeatureDefinition {
     // guard's "tenant-lifecycle mounted" gate exactly.
     r.bootCheck(({ features }) => validateTenantDataHookCoverage(features));
 
-    r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema);
-    r.defineEvent(DESTRUCTION_CANCELLED_EVENT_SHORT, destructionCancelledSchema);
-    r.defineEvent(TENANT_DESTRUCTION_STARTED_EVENT_SHORT, tenantDestructionStartedSchema);
+    r.defineEvent(DESTRUCTION_REQUESTED_EVENT_SHORT, destructionRequestedSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(DESTRUCTION_CANCELLED_EVENT_SHORT, destructionCancelledSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(TENANT_DESTRUCTION_STARTED_EVENT_SHORT, tenantDestructionStartedSchema, {
+      piiFields: "none",
+    });
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_STARTED_EVENT_SHORT,
       tenantDestructionStageStartedSchema,
+      {
+        piiFields: "none",
+      },
     );
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_SUCCEEDED_EVENT_SHORT,
       tenantDestructionStageSucceededSchema,
+      { piiFields: "none" },
     );
-    r.defineEvent(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, tenantDestructionStageFailedSchema);
+    r.defineEvent(TENANT_DESTRUCTION_STAGE_FAILED_EVENT_SHORT, tenantDestructionStageFailedSchema, {
+      piiFields: "none",
+    });
     r.defineEvent(
       TENANT_DESTRUCTION_STAGE_ABANDONED_EVENT_SHORT,
       tenantDestructionStageAbandonedSchema,
+      { piiFields: "none" },
     );
-    r.defineEvent(TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, tenantDestructionCompletedSchema);
-    r.defineEvent(TENANT_DESTRUCTION_FAILED_EVENT_SHORT, tenantDestructionFailedSchema);
+    r.defineEvent(TENANT_DESTRUCTION_COMPLETED_EVENT_SHORT, tenantDestructionCompletedSchema, {
+      piiFields: "none",
+    });
+    r.defineEvent(TENANT_DESTRUCTION_FAILED_EVENT_SHORT, tenantDestructionFailedSchema, {
+      piiFields: "none",
+    });
 
     r.writeHandler(requestDestructionWrite);
     r.writeHandler(cancelDestructionWrite);

package/src/user/__tests__/email-unique-plaintext-soft-delete.integration.test.ts

@@ -0,0 +1,139 @@
+// fw#2593 — the plaintext `read_users_email_unique` index used to be a full
+// unique index regardless of softDelete: a soft-deleted user permanently
+// blocked reuse of its email whenever PII/blind-index wasn't configured
+// (the *_bidx partial index from fw#2464 only helps once a blind-index key
+// is actually configured). buildEntityTable / deriveEntityTableMeta now
+// attach `WHERE "is_deleted" = false` to any explicitly declared unique
+// index on a softDelete entity that doesn't carry an author-provided
+// `where` of its own — this proves the plaintext path directly, with no
+// blind-index key configured at all.
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestDb,
+  type TestDb,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import {
+  resetBlindIndexKeyForTests,
+  resetPiiSubjectKmsForTests,
+} from "@cosmicdrift/kumiko-framework/testing";
+import { userEntity, userTable } from "../schema/user";
+
+let testDb: TestDb;
+const executor = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+
+beforeAll(async () => {
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, read_users RESTART IDENTITY CASCADE`,
+  );
+  // The premise of this file is "nothing configured" — global crypto state
+  // from another test file running first in the same process must not leak
+  // in and accidentally exercise the bidx path instead of the plaintext one.
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+afterEach(() => {
+  resetPiiSubjectKmsForTests();
+  resetBlindIndexKeyForTests();
+});
+
+describe("fw#2593 — email unique constraint on the plaintext column (no blind index configured)", () => {
+  test("a soft-deleted user's email is reusable when no blind index is configured", async () => {
+    const email = "plaintext-soft-deleted@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const created = await executor.create(
+      { email, displayName: "Departing Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("expected create to succeed");
+
+    const deleted = await executor.delete({ id: created.data.id }, systemUser, tdb);
+    if (!deleted.isSuccess) throw new Error("expected soft-delete to succeed");
+
+    const reCreated = await executor.create(
+      { email, displayName: "Plaintext Squatter" },
+      systemUser,
+      tdb,
+    );
+    if (!reCreated.isSuccess) {
+      throw new Error(
+        "expected re-create with the same email to succeed once the original row is soft-deleted",
+      );
+    }
+    expect(reCreated.data.id).not.toBe(created.data.id);
+
+    // DB-proof: both rows survive under the plaintext email — the
+    // soft-deleted original stays untouched, the new live row now also
+    // carries the email, since the partial index only enforces uniqueness
+    // among non-deleted rows.
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT "id", "is_deleted" FROM "read_users" WHERE "email" = $1 ORDER BY "is_deleted"`,
+      [email],
+    )) as ReadonlyArray<{ id: string; is_deleted: boolean }>;
+    expect(rows).toHaveLength(2);
+    expect(rows[0]).toEqual({ id: String(reCreated.data.id), is_deleted: false });
+    expect(rows[1]).toEqual({ id: String(created.data.id), is_deleted: true });
+
+    // Proves the plaintext path was actually exercised, not the bidx one:
+    // no blind-index key is configured in this file, so email_bidx stays NULL.
+    const plaintextRows = (await asRawClient(testDb.db).unsafe(
+      `SELECT "email", "email_bidx" FROM "read_users" WHERE "id" = $1::uuid`,
+      [reCreated.data.id],
+    )) as ReadonlyArray<{ email: string; email_bidx: string | null }>;
+    expect(plaintextRows[0]?.email).toBe(email);
+    expect(plaintextRows[0]?.email_bidx).toBeNull();
+  });
+
+  test("a second live user with the same email is still rejected", async () => {
+    const email = "plaintext-live-collision@example.com";
+    const tdb = createTenantDb(testDb.db, SYSTEM_TENANT_ID, "system");
+    const systemUser = createSystemUser(SYSTEM_TENANT_ID);
+
+    const first = await executor.create(
+      { email, displayName: "First Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (!first.isSuccess) throw new Error("expected first create to succeed");
+
+    const second = await executor.create(
+      { email, displayName: "Second Plaintext User" },
+      systemUser,
+      tdb,
+    );
+    if (second.isSuccess) {
+      throw new Error("expected second create with the same live email to fail");
+    }
+
+    expect(second.error.code).toBe("unique_violation");
+    expect(second.error.httpStatus).toBe(409);
+    const details = second.error.details as { constraintName?: string };
+    expect(details.constraintName).toBe("read_users_email_unique");
+
+    // DB-proof: only the first row survives under that email.
+    const rows = (await asRawClient(testDb.db).unsafe(
+      `SELECT count(*)::int AS n FROM "read_users" WHERE "email" = $1`,
+      [email],
+    )) as ReadonlyArray<{ n: number }>;
+    expect(rows[0]?.n).toBe(1);
+  });
+});

package/src/user/seeding.ts

@@ -66,7 +66,7 @@ export async function seedUser(
   // Interface braucht den Wrap.
   const tdb = createTenantDb(db, by.tenantId, "system");
 
-  const existing = await fetchOne(db, userTable, { email: options.email });
+  const existing = await fetchOne(db, userTable, { email: options.email, isDeleted: false });
   // @cast-boundary db-row: users.id ist uuid-Spalte (string), fetchOne
   // liefert die Projection-Row als Record<string, unknown>.
   if (existing) {

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -114,7 +114,7 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
   test("V3: pii field on a projection-only entity (no r.entity) is still caught", () => {
     const projectionTable = projectionProbeTable("crm_contact_summary");
     const bad = defineFeature("crm", (r) => {
-      const contactCreated = r.defineEvent("contact-created", z.unknown());
+      const contactCreated = r.defineEvent("contact-created", z.unknown(), { piiFields: "none" });
       r.projection({
         name: "contact-summary",
         source: "contact",
@@ -171,7 +171,9 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     const projectionTable = projectionProbeTable("crm_contact_summary_hooked");
     const hooked = defineFeature("crm-hooked", (r) => {
       r.requires("user-data-rights");
-      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown());
+      const contactCreated = r.defineEvent("contact-hooked-created", z.unknown(), {
+        piiFields: "none",
+      });
       r.projection({
         name: "contact-summary",
         source: "contact",

package/src/user-data-rights/__tests__/tenant-model-erasure.integration.test.ts

@@ -15,7 +15,11 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { authFoundationFeature } from "@cosmicdrift/kumiko-bundled-features/auth-foundation";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  entityEventName,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
   createSystemUser,
@@ -337,6 +341,112 @@ describe("forget pipeline honours the effective tenant model", () => {
     // Payload-tenant latch must still see 2 historical members.
     expect(await rowCount()).toBe(1);
   });
+
+  test("single-user, sole member removed and re-added → rows still erased (#2608)", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c7");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+
+    // Remove + re-add of the SAME person: removeMemberWrite only drops the
+    // projection row, so two `tenant-membership.created` events survive for a
+    // tenant that never had a co-member. Counting rows instead of identities
+    // latched such a tenant to multi-user forever, and every tenantScopedOnly
+    // erase hook skipped on the "co-members keep shared data" grounds.
+    const first = await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+    const deleteResult = await membershipExecutor.delete(
+      { id: first.id },
+      createSystemUser(TENANT),
+      createTenantDb(stack.db, TENANT, "system"),
+    );
+    if (!deleteResult.isSuccess) {
+      throw new Error(`test setup: member removal failed: ${deleteResult.error.code}`);
+    }
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+
+    // Pins the premise: 2 created-events, 1 distinct userId, 1 live member.
+    const createdEvents = await asRawClient(stack.db).unsafe(
+      `SELECT payload->>'userId' AS user_id FROM kumiko_events
+        WHERE aggregate_type = 'tenant-membership' AND type = $1 AND payload->>'tenantId' = $2`,
+      [entityEventName("tenant-membership", "created"), TENANT],
+    );
+    expect(createdEvents.length).toBe(2);
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("single-user, sole member, but a created-event with unreadable userId → rows preserved", async () => {
+    await seedScopedRow("dddddddd-dddd-4ddd-8ddd-0000000000c8");
+    await seed(stack.db).seedForgetUser(FORGET_USER);
+    await seedTenantMembership(stack.db, {
+      userId: FORGET_USER,
+      tenantId: TENANT,
+      roles: ["Member"],
+    });
+
+    // A created-event whose userId payload cannot be read may name a second
+    // member — the fail-safe branch must survive the #2608 fix.
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO kumiko_events
+         (aggregate_id, aggregate_type, tenant_id, version, type, payload, metadata, created_by)
+       VALUES ($1, 'tenant-membership', $2, 1, $3, $4, '{}'::jsonb, 'system')`,
+      [
+        "eeeeeeee-eeee-4eee-8eee-0000000000c8",
+        TENANT,
+        entityEventName("tenant-membership", "created"),
+        // Object, not JSON.stringify: a string param into a jsonb column is
+        // encoded a second time and lands as a JSON scalar, which no
+        // payload->>'...' lookup would ever match.
+        { tenantId: TENANT },
+      ],
+    );
+
+    const createdEvents = await asRawClient(stack.db).unsafe(
+      `SELECT payload->>'userId' AS user_id FROM kumiko_events
+        WHERE aggregate_type = 'tenant-membership' AND type = $1 AND payload->>'tenantId' = $2`,
+      [entityEventName("tenant-membership", "created"), TENANT],
+    );
+    expect(createdEvents.length).toBe(2);
+
+    // Without exactly one live member the live gate would answer multi-user
+    // before the history latch runs, and this test would prove nothing.
+    const liveMemberships = await asRawClient(stack.db).unsafe(
+      "SELECT id FROM read_tenant_memberships WHERE tenant_id = $1",
+      [TENANT],
+    );
+    expect(liveMemberships.length).toBe(1);
+
+    const result = await runForgetCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      now: nowInstant(),
+      tenantModel: "single-user",
+    });
+
+    expect(result.errors).toHaveLength(0);
+    expect(result.processedUserIds).toContain(FORGET_USER);
+    expect(await rowCount()).toBe(1);
+  });
 });
 
 describe("run-forget-cleanup job — real glue-code, not a hand-set tenantModel", () => {

package/src/user-data-rights/handlers/request-deletion-by-email.write.ts

@@ -76,7 +76,7 @@ export function createRequestDeletionByEmailHandler(opts: RequestDeletionByEmail
       const userRow = await fetchOne<{ id: string; status: string; email: string }>(
         ctx.db.raw,
         userTable,
-        { email: event.payload.email },
+        { email: event.payload.email, isDeleted: false },
       );
       if (!userRow || userRow["status"] !== USER_STATUS.Active || !userRow["email"]) {
         return success;

package/src/user-data-rights/run-forget-cleanup.ts

@@ -573,19 +573,26 @@ async function resolveEffectiveTenantModel(
 // rows.
 //
 // Filter by payload->>'tenantId' (not the event column tenant_id): cross-
-// tenant SystemAdmin adds land under the actor's tenant_id (#2347). SQL
-// aggregation stays fail-safe when userId payloads are unreadable: more
-// created-rows than distinct userIds ⇒ treat as multi-user.
+// tenant SystemAdmin adds land under the actor's tenant_id (#2347).
+//
+// Counting created-ROWS against distinct userIds latched a tenant to
+// multi-user as soon as its sole member was removed and re-added (#2608) —
+// two created-events, one identity, no co-member ever. The fail-safe only
+// needs to cover payloads whose userId cannot be READ, so the unreadable
+// remainder is measured directly instead of inferred from the row count.
+// NULLIF folds an empty-string userId into that remainder (it names nobody).
 async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise<boolean> {
   const eventType = entityEventName("tenant-membership", "created");
   const rows = await executeRawQuery<{
     event_count: number;
+    readable_users: number;
     distinct_users: number;
   }>(
     db,
     `SELECT
        COUNT(*)::int AS event_count,
-       COUNT(DISTINCT payload->>'userId')::int AS distinct_users
+       COUNT(NULLIF(payload->>'userId', ''))::int AS readable_users,
+       COUNT(DISTINCT NULLIF(payload->>'userId', ''))::int AS distinct_users
      FROM kumiko_events
      WHERE aggregate_type = 'tenant-membership'
        AND type = $1
@@ -595,11 +602,9 @@ async function everHadMultipleMembers(db: DbRunner, tenantId: TenantId): Promise
   const row = rows[0];
   if (!row) return false;
   if (row.distinct_users > 1) return true;
-  // Unreadable / missing userId payloads: fail-safe to multi-user
-  // (including a lone created-event with no readable userId).
-  if (row.event_count >= 1 && row.distinct_users < 1) return true;
-  if (row.event_count > 1 && row.distinct_users <= 1) return true;
-  return false;
+  // Unreadable / missing userId payloads: fail-safe to multi-user, each one
+  // could name a second member.
+  return row.event_count > row.readable_users;
 }
 
 // Mapping retention.strategy → user-data-rights.UserDataDeleteStrategy.