@cosmicdrift/kumiko-bundled-features 0.270.0 → 0.274.0

package/src/ledger/__tests__/ledger.integration.test.ts

@@ -11,6 +11,7 @@
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createSystemUser } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -18,6 +19,7 @@ import {
   type TestStack,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { generateDeterministicId } from "@cosmicdrift/kumiko-framework/utils";
 import { type AccountType, LedgerHandlers, LedgerQueries } from "../constants";
 import { accountEntity, scheduleEntity, transactionEntity } from "../entity";
 import { createLedgerFeature } from "../feature";
@@ -544,6 +546,61 @@ describe("ledger integration — confirm-schedule-period (recurring)", () => {
   });
 });
 
+describe("ledger integration — createSchedule with a caller-chosen id (idempotent job creates)", () => {
+  // An event-triggered job derives the schedule id deterministically from
+  // its own contract line instead of matching on description text. It acts
+  // as createSystemUser(tenantId, extraRoles) — extraRoles clears the
+  // handler's normal TenantAdmin/TenantMember access gate while roles still
+  // carrying "system" is what lets the create handler honor the id at all.
+  const jobUser = createSystemUser(admin.tenantId, ["TenantAdmin"]);
+
+  test("the chosen id is honored; redelivering the same event is recognized, not duplicated", async () => {
+    const bank = await createAccount("Bank", "asset");
+    const rent = await createAccount("Mieterträge", "income");
+    const scheduleId = generateDeterministicId(`ledger:schedule:${admin.tenantId}`, "contract-42");
+    const payload = {
+      description: "Miete WE1",
+      startDate: "2026-01-01",
+      interval: "monthly",
+      amount: 50000,
+      debitAccountId: bank,
+      creditAccountId: rent,
+      id: scheduleId,
+    };
+
+    const created = await stack.http.writeOk<{ id: string }>(
+      LedgerHandlers.createSchedule,
+      payload,
+      jobUser,
+    );
+    expect(created.id).toBe(scheduleId);
+
+    const redelivered = await stack.http.writeErr(LedgerHandlers.createSchedule, payload, jobUser);
+    expect(redelivered.code).toBe("version_conflict");
+  });
+
+  test("an ordinary tenant user's chosen id is ignored — create still succeeds with a fresh id", async () => {
+    const bank = await createAccount("Bank", "asset");
+    const rent = await createAccount("Mieterträge", "income");
+    const chosenId = generateDeterministicId(`ledger:schedule:${admin.tenantId}`, "contract-99");
+
+    const created = await stack.http.writeOk<{ id: string }>(
+      LedgerHandlers.createSchedule,
+      {
+        description: "Miete WE2",
+        startDate: "2026-01-01",
+        interval: "monthly",
+        amount: 30000,
+        debitAccountId: bank,
+        creditAccountId: rent,
+        id: chosenId,
+      },
+      admin,
+    );
+    expect(created.id).not.toBe(chosenId);
+  });
+});
+
 describe("ledger integration — subject dimension (filterable business-object reference)", () => {
   test("a booking with subjectType/subjectId round-trips and is findable via an eq filter", async () => {
     const bank = await createAccount("Bank", "asset");

package/src/managed-pages/screens/branding-screen.ts

@@ -81,6 +81,9 @@ export function createBrandingSettingsScreen(opts: {
       ],
     },
     access: { roles: ADMIN_ROLES },
+    // See file header: nav placement is app-specific, so this opts out of
+    // the boot-validator's nav-area check.
+    dormant: true,
   };
   if (!opts.allowCustomCss) return base;
   return {

package/src/managed-pages/screens/page-screens.ts

@@ -52,6 +52,9 @@ export const pageListScreen: EntityListScreenDefinition = {
     },
   ],
   access: { roles: ADMIN_ROLES },
+  // Nav/placement is app-specific (see file header) — no nav area to
+  // resolve in isolation.
+  dormant: true,
 };
 
 export const pageEditScreen: EntityEditScreenDefinition = {

package/src/notes-history/__tests__/notes-section.test.tsx

@@ -127,6 +127,29 @@ function renderSection(): ReturnType<typeof render> {
   return render(<NotesSection entityName="contact" entityId="contact-1" />, { wrapper });
 }
 
+describe("NotesSection — two-card layout", () => {
+  test("renders a 'new note' card and a 'history' card as two separate cards", async () => {
+    const view = renderSection();
+    await waitFor(() => expect(view.getByTestId("notes-section-history")).toBeTruthy());
+
+    const newNoteCard = view.getByTestId("notes-section-new");
+    const historyCard = view.getByTestId("notes-section-history");
+    expect(newNoteCard).not.toBe(historyCard);
+    expect(newNoteCard.textContent).toContain("New note");
+    expect(historyCard.textContent).toContain("History");
+  });
+
+  test("history entries are separated by dividers, not individual borders", async () => {
+    const view = renderSection();
+    await waitFor(() => expect(view.getByTestId("notes-section-row-note-1")).toBeTruthy());
+
+    const row = view.getByTestId("notes-section-row-note-1");
+    expect(row.className).not.toContain("border");
+    const historyCard = view.getByTestId("notes-section-history");
+    expect(historyCard.querySelector(".divide-y")).not.toBeNull();
+  });
+});
+
 describe("NotesSection — entry display", () => {
   test("note body and meta line render as two distinct nodes, not one run-on line", async () => {
     const view = renderSection();

package/src/notes-history/web/i18n.ts

@@ -15,5 +15,8 @@ export const defaultTranslations: TranslationsByLocale = {
     "notesHistory.section.add": "Add note",
     "notesHistory.section.meta": "{author} · {date}",
     "notesHistory.section.authorUnknown": "Unknown author",
+    "notesHistory.section.newNoteTitle": "New note",
+    "notesHistory.section.historyTitle": "History",
+    "notesHistory.section.shortcutHint": "Ctrl+Enter saves",
   },
 };

package/src/notes-history/web/notes-section.tsx

@@ -48,7 +48,7 @@ export function NotesSection({
   readonly entityName: string;
   readonly entityId: string | null;
 }): ReactNode {
-  const { Banner, Button, Text, Input } = usePrimitives();
+  const { Banner, Button, Card, Grid, Text, Input } = usePrimitives();
   const t = useTranslation();
   const dispatcher = useDispatcher();
   const enabled = entityId !== null;
@@ -118,57 +118,67 @@ export function NotesSection({
   };
 
   return (
-    <div data-testid="notes-section" className="flex flex-col gap-3">
-      <div className="flex flex-col gap-2">
-        <Input
-          kind="textarea"
-          id="notes-section-draft"
-          name="draft"
-          value={draft}
-          onChange={setDraft}
-          onSubmitShortcut={() => {
-            if (!busy && draft.trim() !== "") addNote();
-          }}
-        />
-        <div>
-          <Button
-            variant="primary"
-            disabled={busy || draft.trim() === ""}
-            onClick={() => addNote()}
-            testId="notes-section-add"
-          >
-            {busy ? t("notesHistory.section.working") : t("notesHistory.section.add")}
-          </Button>
-        </div>
-      </div>
-
-      {rows.length === 0 ? (
-        <Text variant="small">{t("notesHistory.section.empty")}</Text>
-      ) : (
-        <div className="flex flex-col gap-2">
-          {rows.map((n) => (
-            <div
-              key={n.id}
-              data-testid={`notes-section-row-${n.id}`}
-              className="flex flex-col gap-1 rounded-md border p-2"
+    <Grid columns={1} testId="notes-section">
+      <Card slots={{ title: t("notesHistory.section.newNoteTitle") }} testId="notes-section-new">
+        <Grid columns={1}>
+          <Input
+            kind="textarea"
+            id="notes-section-draft"
+            name="draft"
+            value={draft}
+            onChange={setDraft}
+            onSubmitShortcut={() => {
+              if (!busy && draft.trim() !== "") addNote();
+            }}
+          />
+          <div className="flex items-center justify-between gap-2">
+            <Text variant="small">{t("notesHistory.section.shortcutHint")}</Text>
+            <Button
+              variant="primary"
+              disabled={busy || draft.trim() === ""}
+              onClick={() => addNote()}
+              testId="notes-section-add"
             >
-              <Text testId={`notes-section-body-${n.id}`}>{n.body}</Text>
-              <Text variant="small" testId={`notes-section-meta-${n.id}`}>
-                {t("notesHistory.section.meta", {
-                  author: displayAuthorName(n.authorName, t("notesHistory.section.authorUnknown")),
-                  date: formatWhen(n.insertedAt),
-                })}
-              </Text>
-            </div>
-          ))}
-        </div>
-      )}
+              {busy ? t("notesHistory.section.working") : t("notesHistory.section.add")}
+            </Button>
+          </div>
+          {errorKey !== null && (
+            <Banner variant="error" testId="notes-section-action-error">
+              <Text>{t(errorKey)}</Text>
+            </Banner>
+          )}
+        </Grid>
+      </Card>
 
-      {errorKey !== null && (
-        <Banner variant="error" testId="notes-section-action-error">
-          <Text>{t(errorKey)}</Text>
-        </Banner>
-      )}
-    </div>
+      <Card
+        slots={{ title: t("notesHistory.section.historyTitle") }}
+        testId="notes-section-history"
+      >
+        {rows.length === 0 ? (
+          <Text variant="small">{t("notesHistory.section.empty")}</Text>
+        ) : (
+          <div className="flex flex-col divide-y">
+            {rows.map((n) => (
+              <div
+                key={n.id}
+                data-testid={`notes-section-row-${n.id}`}
+                className="flex flex-col gap-1 py-3 first:pt-0 last:pb-0"
+              >
+                <Text testId={`notes-section-body-${n.id}`}>{n.body}</Text>
+                <Text variant="small" testId={`notes-section-meta-${n.id}`}>
+                  {t("notesHistory.section.meta", {
+                    author: displayAuthorName(
+                      n.authorName,
+                      t("notesHistory.section.authorUnknown"),
+                    ),
+                    date: formatWhen(n.insertedAt),
+                  })}
+                </Text>
+              </div>
+            ))}
+          </div>
+        )}
+      </Card>
+    </Grid>
   );
 }

package/src/personal-access-tokens/screens.ts

@@ -6,11 +6,6 @@ import {
 import { PAT_MINT_SCREEN_ID, PAT_SCREEN_ID, PatHandlers, PatQueries } from "./constants";
 import type { PatScopeConfig } from "./scopes";
 
-const PAT_LIST_OPEN_REASON =
-  "each signed-in user views only their own personal access tokens, mirroring the list handler";
-const PAT_MINT_OPEN_REASON =
-  "each signed-in user mints a token for their own account only, mirroring the create handler";
-
 export const patListScreen: ProjectionListScreenDefinition = {
   id: PAT_SCREEN_ID,
   type: "projectionList",
@@ -54,9 +49,13 @@ export const patListScreen: ProjectionListScreenDefinition = {
   ],
   access: {
     openToAll: {
-      reason: PAT_LIST_OPEN_REASON,
+      reason:
+        "each signed-in user views only their own personal access tokens, mirroring the list handler",
     },
   },
+  // Self-service settings-area screen, placed by the consuming app's own
+  // r.nav() — no nav area to resolve in isolation.
+  dormant: true,
 };
 
 // Grant-string vocabulary for a scope config's multiSelect field — a
@@ -113,7 +112,8 @@ export function createPatMintScreen(scopes: PatScopeConfig): SecretMintScreenDef
     cancelTarget: PAT_SCREEN_ID,
     access: {
       openToAll: {
-        reason: PAT_MINT_OPEN_REASON,
+        reason:
+          "each signed-in user mints a token for their own account only, mirroring the create handler",
       },
     },
   };

package/src/sessions/screens.ts

@@ -13,8 +13,6 @@ import {
 } from "./constants";
 
 const listAccess = { roles: access.admin };
-const SESSION_MINE_OPEN_REASON =
-  "each signed-in user views and revokes only their own sessions, mirroring the mine/revoke handlers";
 
 export const sessionListScreen: ProjectionListScreenDefinition = {
   id: SESSION_LIST_SCREEN_ID,
@@ -144,7 +142,11 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
   ],
   access: {
     openToAll: {
-      reason: SESSION_MINE_OPEN_REASON,
+      reason:
+        "each signed-in user views and revokes only their own sessions, mirroring the mine/revoke handlers",
     },
   },
+  // Self-service settings-area screen, placed by the consuming app's own
+  // r.nav() — no nav area to resolve in isolation.
+  dormant: true,
 };

package/src/tags/screens.ts

@@ -40,6 +40,9 @@ export function createTagListScreen(
       },
     ],
     access,
+    // App navs via r.nav("tags:screen:tag-list") — no nav area to resolve
+    // in isolation.
+    dormant: true,
   };
 }
 

package/src/tenant/__tests__/members-facet-i18n.test.ts

@@ -16,11 +16,11 @@ function membersFacetLabelKeys(): readonly string[] {
   if (screen?.type !== "projectionList") {
     throw new Error("expected members screen to be projectionList");
   }
-  return (screen.facets ?? []).flatMap((facet) =>
-    facet.type === "select"
-      ? [facet.label, ...facet.options.map((option) => option.label)]
-      : [facet.label, facet.trueLabel, facet.falseLabel],
-  );
+  return (screen.facets ?? []).flatMap((facet) => {
+    if (facet.type === "select") return [facet.label, ...facet.options.map((o) => o.label)];
+    if (facet.type === "boolean") return [facet.label, facet.trueLabel, facet.falseLabel];
+    return [facet.label];
+  });
 }
 
 // Column labels of the members screen itself — deliberately scoped to this

package/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "systemScope handlers get a default per-tenant+handler rate limit; tenant:me opts out (fw#2861).",
+    "detail": "`tenant` mounts under `r.systemScope()`, so its write/query handlers without their own `rateLimit` now default to `{ per: \"tenant+handler\", limit: 600, windowSeconds: 60 }` once an app has a `RateLimitResolver` configured (framework change, see kumiko-framework changes.json 0.271.0). `tenant:query:me` (`tenant:me.query.ts`) declares `rateLimit: { disabled: true, reason: \"...\" }` — it is a self-scoped read of the caller's own active tenant, hit on every page load, and a per-tenant bucket would throttle the whole tenant's page loads instead of just that one handler's traffic."
+  },
   {
     "version": "0.219.0",
     "type": "improvement",

package/src/tenant/handlers/me.query.ts

@@ -16,6 +16,12 @@ export const meQuery = defineQueryHandler({
         "to the caller's own tenantId",
     },
   },
+  rateLimit: {
+    disabled: true,
+    reason:
+      "self-scoped read of the caller's own active tenant, hit on every page load; per-tenant " +
+      "bucket would throttle the whole tenant, L1 IP limit still applies",
+  },
   description:
     "Returns the record of the tenant the caller is currently signed in to, or null if it is gone; use it whenever the active tenant's own name, key or settings are needed.",
   handler: async (query, ctx) => {

package/src/tenant/handlers/update-member-roles.write.ts

@@ -122,7 +122,16 @@ export const updateMemberRolesWrite = defineWriteHandler({
     const willBeTenantAdmin = event.payload.roles.includes("TenantAdmin");
 
     if (targetIsTenantAdmin && !willBeTenantAdmin) {
-      const lastAdmin = await assertNotLastTenantAdmin(db, targetTenantId, event.payload.userId);
+      // assertNotLastTenantAdmin issues raw SQL, so it needs the raw runner, not
+      // `db` — the count is already filtered by the explicit targetTenantId.
+      const lockRunner = ctx.systemDb.unsafeRaw(
+        "tenant:write:updateMemberRoles last-TenantAdmin advisory lock + membership count",
+      );
+      const lastAdmin = await assertNotLastTenantAdmin(
+        lockRunner,
+        targetTenantId,
+        event.payload.userId,
+      );
       if (lastAdmin !== undefined) return lastAdmin;
     }
 

package/src/tenant/screens.ts

@@ -44,6 +44,9 @@ export const tenantListScreen: EntityListScreenDefinition = {
   defaultSort: { field: "name", dir: "asc" },
   searchable: true,
   access: { roles: ["SystemAdmin"] },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
 };
 
 export const tenantEditScreen: EntityEditScreenDefinition = {

package/src/tenant/seeding.ts

@@ -117,19 +117,22 @@ export type SeedTenantHooks = {
 // (HandlerContext from a live write), afterCommit hooks are queued onto the
 // dispatcher's sink and flush post-commit. Without a sink (fixture / plain
 // Connection) they still fire immediately — there is no outer TX to wait for.
-function resolveRawDb(db: AppContext["db"]): DbRunner | undefined {
-  if (!db) return undefined;
-  if (typeof db === "object" && "raw" in db) {
-    return (db as { raw: DbRunner }).raw;
-  }
-  return db as DbRunner;
-}
-
-function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): AppContext {
-  const raw = resolveRawDb(context.db);
-  const db = raw
-    ? createTenantDb(raw, targetTenantId, "system", context.tracer, context.meter, context.signal)
-    : context.db;
+//
+// `runner` comes from the caller, which already holds a declared DbRunner —
+// a TenantDb exposes no runner back out to feature code.
+function scopeSeedHookContext(
+  context: AppContext,
+  targetTenantId: TenantId,
+  runner: DbRunner,
+): AppContext {
+  const db = createTenantDb(
+    runner,
+    targetTenantId,
+    "system",
+    context.tracer,
+    context.meter,
+    context.signal,
+  );
 
   // HandlerContext carries `user`; AppContext only `systemUser`. Prefer the
   // live handler user when present so notify/hasFeature keep a real SessionUser.
@@ -163,7 +166,7 @@ function scopeSeedHookContext(context: AppContext, targetTenantId: TenantId): Ap
   return {
     ...context,
     _tenantId: targetTenantId,
-    ...(db !== undefined ? { db } : {}),
+    db,
     ...(notify !== undefined ? { notify } : {}),
     ...(scopedUser && "user" in context ? { user: scopedUser } : {}),
     ...(hasFeature ? { hasFeature } : {}),
@@ -176,16 +179,16 @@ export async function fireEntityPostSave(
   entityData: SaveContext,
   // Undefined for tenant-agnostic entities (user has no tenant_id column at
   // seed time) — keeps hooks.context._tenantId as the caller passed it.
-  targetTenantId?: TenantId,
+  target?: { readonly tenantId: TenantId; readonly db: DbRunner },
 ): Promise<void> {
   // skip: caller opted out of hooks (existing fixture/test call-sites that
   // don't pass them keep today's hook-less behavior, see seedTenant's doc).
   if (!hooks) return;
   const lifecycle = createLifecycleHooks(hooks.registry);
   const scopedContext =
-    targetTenantId === undefined
+    target === undefined
       ? hooks.context
-      : scopeSeedHookContext(hooks.context, targetTenantId);
+      : scopeSeedHookContext(hooks.context, target.tenantId, target.db);
   await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
   const runAfterCommit = () =>
     lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.afterCommit);
@@ -239,7 +242,7 @@ export async function seedTenant(
   // "tenant:seed" matches no handler-scoped hook, only entity-scoped ones
   // (keyed by result.entityName === "tenant") — that's exactly what
   // tier-engine's `r.hook("postSave", { allOf: "tenant" }, ...)` needs.
-  await fireEntityPostSave(hooks, "tenant:seed", result.data, options.id);
+  await fireEntityPostSave(hooks, "tenant:seed", result.data, { tenantId: options.id, db });
 
   return { id: options.id };
 }
@@ -301,7 +304,10 @@ export async function seedTenantMembership(
       `seedTenantMembership failed: ${result.error.code} — ${JSON.stringify(result.error.details ?? {})}`,
     );
   }
-  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, options.tenantId);
+  await fireEntityPostSave(hooks, "tenant-membership:seed", result.data, {
+    tenantId: options.tenantId,
+    db,
+  });
   return { id: extractMembershipId(result.data) };
 }
 

package/src/tier-engine/feature.ts

@@ -290,6 +290,9 @@ export function createTierEngineFeature<
       description:
         "Operator form that assigns a tier to any tenant as a manual grant without a billing purchase.",
       access: { roles: ["SystemAdmin"] },
+      // Apps place it via r.nav() (see above) — no nav area to resolve in
+      // isolation.
+      dormant: true,
     });
 
     // ───────────────────────────────────────────────────────────────────

package/src/user/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "systemScope handlers get a default per-tenant+handler rate limit; user:me opts out (fw#2861).",
+    "detail": "`user` mounts under `r.systemScope()`, so its write/query handlers without their own `rateLimit` now default to `{ per: \"tenant+handler\", limit: 600, windowSeconds: 60 }` once an app has a `RateLimitResolver` configured (framework change, see kumiko-framework changes.json 0.271.0). `user:query:user:me` (`user:me.query.ts`) declares `rateLimit: { disabled: true, reason: \"...\" }` — it is a self-scoped read of the caller's own identity record, hit on every page load, and a per-tenant bucket would throttle the whole tenant's page loads instead of just that one handler's traffic."
+  },
   {
     "version": "0.218.1",
     "type": "improvement",

package/src/user/handlers/me.query.ts

@@ -18,6 +18,12 @@ export const meQuery = defineQueryHandler({
         "is by the caller's own id",
     },
   },
+  rateLimit: {
+    disabled: true,
+    reason:
+      "self-scoped read of the caller's own user record, hit on every page load; per-tenant " +
+      "bucket would throttle the whole tenant, L1 IP limit still applies",
+  },
   description:
     "Returns the signed-in caller's own identity record, with the password hash stripped by field-level read access; use it whenever the current user's own profile data is needed.",
   handler: async (query, ctx) => {

package/src/user/handlers/update-roles.ts

@@ -126,14 +126,17 @@ export async function applyUserRolesUpdate(
   const willBeSystemAdmin = newRoles.includes("SystemAdmin");
 
   if (wasActiveSystemAdmin && !willBeSystemAdmin) {
-    // Lock before count+update so two concurrent demotions cannot both
-    // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
-    await acquireNamespacedAdvisoryLock(db, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
-    // user is r.systemScope() — the count spans every tenant's SystemAdmins,
-    // so it needs the raw runner, not the (still tenant-shaped) `db` above.
+    // user is r.systemScope() — the lock + count span every tenant's SystemAdmins,
+    // so both need the raw runner, not the tenant-shaped `db` above.
     if (!ctx.systemDb) {
       throw new InternalError({ message: "user:update-roles requires ctx.systemDb" });
     }
+    const lockRunner = ctx.systemDb.unsafeRaw(
+      "advisory lock serializing concurrent last-SystemAdmin demotions",
+    );
+    // Lock before count+update so two concurrent demotions cannot both
+    // observe otherActiveSystemAdmins >= 1 and leave zero active SystemAdmins.
+    await acquireNamespacedAdvisoryLock(lockRunner, LAST_SYSTEM_ADMIN_LOCK_NAMESPACE, "global");
     const otherActiveSystemAdmins = await countOtherActiveSystemAdmins(
       ctx.systemDb.unsafeRaw(
         "jsonb @> prefilter over the global users table to count remaining active SystemAdmins",

package/src/user/screens.ts

@@ -32,6 +32,9 @@ export const userListScreen: EntityListScreenDefinition = {
   // Apps must boot a user search index on that tenant (offlot: bootWaitlistSearch).
   searchable: true,
   access: { roles: ["SystemAdmin"] },
+  // Inert until an app navs it (see file header) — no nav area to resolve
+  // in isolation.
+  dormant: true,
 };
 
 export const userEditScreen: EntityEditScreenDefinition = {

package/src/user-data-rights/__tests__/boot-checks.test.ts

@@ -270,3 +270,19 @@ describe("GDPR-storage boot guards V2-V4 (via r.bootCheck)", () => {
     expect(() => validateBoot([...minimalTenantLifecycleFeatures(), hooked])).not.toThrow();
   });
 });
+
+describe("nav-area boot check — bundled dormant screens survive a real app nav", () => {
+  test("baseFeatures() (privacy-center included) boots clean once the app registers its own nav area", () => {
+    const appShell = defineFeature("app-shell", (r) => {
+      r.screen({ id: "home", type: "custom", renderer: { react: "Home" } });
+      r.nav({ id: "home", label: "app-shell:nav.home", screen: "app-shell:screen:home" });
+      r.translations({
+        keys: {
+          "app-shell:nav.home": { de: "Start", en: "Home" },
+          "screen:home.title": { de: "Start", en: "Home" },
+        },
+      });
+    });
+    expect(() => validateBoot([...baseFeatures(), appShell])).not.toThrow();
+  });
+});

package/src/user-data-rights/__tests__/export-job-list-cross-tenant.integration.test.ts

@@ -2,7 +2,7 @@
 //
 // Regression: the changeset describes these as "a platform-operator
 // inspector over the GDPR read-models" (i.e. cross-tenant), but the handlers
-// registered no crossTenant/systemScope override — a SystemAdmin acting in
+// registered no escapeHatch/systemScope override — a SystemAdmin acting in
 // tenant A saw only tenant A's export jobs, never tenant B's.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";

package/src/user-data-rights/feature.ts

@@ -325,11 +325,8 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
 
     // Self-service screen (Art. 15/17/18/20): export, restriction, deletion
     // in one projectionDetail screen bound to the user's own `me` row. No
-    // r.nav — the app places it in its logged-in area (createKumikoApp's
-    // missing-client-plugin boot diagnostic (#2025/#2034) only scans
-    // type: "custom" screens, so a non-navved projectionDetail never
-    // triggers it — no `dormant` flag needed, that field doesn't exist on
-    // this screen type). access is openToAll because no app role name is
+    // r.nav — the app places it in its logged-in area; `dormant: true` opts
+    // it out of the nav-area boot check. access is openToAll because no app role name is
     // portable; the per-user handlers enforce auth server-side.
     //
     // Restriction/Deletion are declarative fields + actions; Export stays a
@@ -352,6 +349,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
             "operate on the caller's own userId, and no app role name is portable enough to gate this",
         },
       },
+      dormant: true,
       description:
         "Logged-in GDPR self-service page where a user requests and downloads a data export (Art. 20), restricts processing of their account (Art. 18) and requests its deletion (Art. 17).",
       fieldLabels: {

package/src/user-data-rights/handlers/download-attempt-list.query.ts

@@ -9,7 +9,10 @@ export const downloadAttemptListQuery = defineEntityListHandler(
   downloadAttemptEntity,
   {
     access: { roles: access.systemAdmin },
-    crossTenant: true,
+    escapeHatch: {
+      reason:
+        "SystemAdmin DPO triage of invalid export-download attempts needs every tenant's rows to spot brute-force patterns across tenants",
+    },
     description:
       "Lists invalid export-download attempts across every tenant for the system-admin inspector screen; list-download-attempts is the filterable view scoped to a single tenant.",
   },