@cosmicdrift/kumiko-bundled-features 0.287.0 → 0.289.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.287.0",
+  "version": "0.289.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -82,6 +82,7 @@
     "./tenant/web": "./src/tenant/web/index.ts",
     "./tenant/seeding": "./src/tenant/seeding.ts",
     "./tenant-lifecycle": "./src/tenant-lifecycle/index.ts",
+    "./tenant-handover": "./src/tenant-handover/index.ts",
     "./tenant/testing": "./src/tenant/testing.ts",
     "./user": "./src/user/index.ts",
     "./user/seeding": "./src/user/seeding.ts",
@@ -132,12 +133,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.287.0",
-    "@cosmicdrift/kumiko-framework": "0.287.0",
-    "@cosmicdrift/kumiko-headless": "0.287.0",
-    "@cosmicdrift/kumiko-renderer": "0.287.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.287.0",
-    "@cosmicdrift/kumiko-types": "0.287.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.289.0",
+    "@cosmicdrift/kumiko-framework": "0.289.0",
+    "@cosmicdrift/kumiko-headless": "0.289.0",
+    "@cosmicdrift/kumiko-renderer": "0.289.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.289.0",
+    "@cosmicdrift/kumiko-types": "0.289.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -166,8 +167,8 @@
   ],
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
-    "@cosmicdrift/kumiko-locale-de": "0.287.0",
-    "@cosmicdrift/kumiko-locale-es": "0.287.0",
+    "@cosmicdrift/kumiko-locale-de": "0.289.0",
+    "@cosmicdrift/kumiko-locale-es": "0.289.0",
     "jsqr": "^1.4.0"
   }
 }

package/src/auth-email-password/__tests__/query-as-member.integration.test.ts

@@ -104,6 +104,9 @@ const TRIES_UNSAFE_RAW_WRITE_QN = "queryasmemberprobe:query:tries-unsafe-raw-wri
 const TRIES_READ_WRITE_RESET_QN = "queryasmemberprobe:query:tries-read-write-reset";
 const NESTED_DB_WRITE_QN = "queryasmemberprobe:query:nested-db-write";
 const TRIES_SELECT_FOR_UPDATE_QN = "queryasmemberprobe:query:tries-select-for-update";
+const TRIES_COMMIT_THEN_WRITE_QN = "queryasmemberprobe:query:tries-commit-then-write";
+const TRIES_RAW_SELECT_QN = "queryasmemberprobe:query:tries-raw-select";
+const NESTED_RAW_SELECT_QN = "queryasmemberprobe:query:nested-raw-select";
 const TRIES_QUERY_AS_QN = "queryasmemberprobe:query:tries-query-as";
 const READ_AS_MEMBER_QUERY_QN = "queryasmemberprobe:query:read-as-member-query";
 const SYSTEM_SCOPE_READ_AS_MEMBER_QN = "queryasmembersystemscope:write:read-as-member";
@@ -240,6 +243,42 @@ const probeFeature = defineFeature("queryasmemberprobe", (r) => {
       escapeHatch: { reason: "test: select-for-update probe" },
     },
   );
+  // Transaction control, not a write: COMMIT ends the read-only scope, the
+  // UPDATE afterwards runs in a fresh, writable implicit transaction.
+  r.queryHandler(
+    "tries-commit-then-write",
+    z.object({}),
+    async (_query, ctx) => {
+      const raw = asRawClient(ctx.db.unsafeRaw("test: commit-then-write probe"));
+      await raw.unsafe("COMMIT");
+      await raw.unsafe("UPDATE qam_notes SET body = 'tampered'");
+      return { ok: true };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: commit-then-write probe" },
+    },
+  );
+  r.queryHandler(
+    "tries-raw-select",
+    z.object({}),
+    async (_query, ctx) => {
+      const rows = await asRawClient(ctx.db.unsafeRaw("test: raw select probe")).unsafe(
+        "SELECT 1 AS one",
+      );
+      return { ok: true, count: Array.isArray(rows) ? rows.length : 0 };
+    },
+    {
+      access: { roles: ["Admin", "User"] },
+      escapeHatch: { reason: "test: raw select probe" },
+    },
+  );
+  r.queryHandler(
+    "nested-raw-select",
+    z.object({}),
+    async (_query, ctx) => ctx.query(TRIES_RAW_SELECT_QN, {}),
+    { access: { roles: ["Admin", "User"] } },
+  );
   r.queryHandler(
     "tries-query-as",
     z.object({}),
@@ -951,9 +990,10 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await addMembership(userId, TENANT_A);
     await createNote(userId, "note-1");
 
-    // SQLSTATE 25001, not 25006 — surfaces as internal_error rather than member_resolution_read_only.
+    // Denied at ctx.db.unsafeRaw, before the SET TRANSACTION READ WRITE reaches Postgres.
     const err = await readAsMemberErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -964,7 +1004,8 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     await createNote(userId, "note-1");
 
     const err = await readAsMemberViaQueryErr(userId, TRIES_READ_WRITE_RESET_QN);
-    expect(err.code).toBe("internal_error");
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
 
@@ -1047,4 +1088,70 @@ describe("ctx.queryAsMember — database-level read-only (READ ONLY transaction)
     expect(errorReason(err.details)).toBe("member_resolution_read_only");
     expect(await readNoteBodies()).toEqual(["note-1"]);
   });
+
+  test("j1) tries-commit-then-write via a write-caller (savepoint path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-write@example.com", "pw-long-enough-36");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("j2) tries-commit-then-write via a query-caller (pool path) is denied, notes unchanged", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("committhenwrite-query@example.com", "pw-long-enough-37");
+    await addMembership(userId, TENANT_A);
+    await createNote(userId, "note-1");
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_COMMIT_THEN_WRITE_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+    expect(await readNoteBodies()).toEqual(["note-1"]);
+  });
+
+  test("k1) tries-raw-select via a write-caller is denied — no raw handle, not even for reads", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-write@example.com", "pw-long-enough-38");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("k2) tries-raw-select via a query-caller (pool path) is denied", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("rawselect-query@example.com", "pw-long-enough-39");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberViaQueryErr(userId, TRIES_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("l) nested-raw-select: a ctx.query hop inside a member read stays without a raw handle", async () => {
+    await createTenant(TENANT_A);
+    const userId = await createUser("nestedrawselect@example.com", "pw-long-enough-40");
+    await addMembership(userId, TENANT_A);
+
+    const err = await readAsMemberErr(userId, NESTED_RAW_SELECT_QN);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("member_resolution_read_only");
+  });
+
+  test("m) tries-raw-select via the normal dispatch path (no queryAsMember) still works", async () => {
+    await createTenant(TENANT_A);
+
+    const result = await stack.http.queryOk<{ ok: boolean; count: number }>(
+      TRIES_RAW_SELECT_QN,
+      {},
+      admin,
+    );
+    expect(result.ok).toBe(true);
+    expect(result.count).toBe(1);
+  });
 });

package/src/auth-email-password/handlers/self-registration-status.query.ts

@@ -14,6 +14,7 @@ export const selfRegistrationStatusQuery = defineQueryHandler({
   name: "signup-registration-status",
   schema: z.object({}),
   access: { roles: ["anonymous", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Reports whether self-registration is currently switched on, readable without signing in, so a signup page can hide its own form instead of collecting an address that would be silently ignored.",
   handler: async (_query, ctx) => {

package/src/billing-foundation/__tests__/subscription-tier-sync.integration.test.ts

@@ -0,0 +1,186 @@
+// Integration test for createSubscriptionTierSync()'s onSyncError option
+// (#3027). Forces a sync failure via a dispatchSystemWrite stub that fails
+// only the tier-engine handlers (the primary billing-foundation writes run
+// for real against the test DB) — proving that "log" (default) still
+// answers the webhook successfully, while "fail-webhook" surfaces the sync
+// error all the way into the HTTP response.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { configurePiiSubjectKms, InMemoryKmsAdapter } from "@cosmicdrift/kumiko-framework/crypto";
+import { buildEntityTable, type EntityTable } from "@cosmicdrift/kumiko-framework/db";
+import {
+  defineFeature,
+  type EntityDefinition,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  testTenantId,
+  unsafeCreateEntityTable,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testing";
+import { Hono } from "hono";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { createTenantFeature } from "../../tenant/feature";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import type { TierMap } from "../../tier-engine/compose-app";
+import { TierEngineHandlers } from "../../tier-engine/constants";
+import { tierAssignmentEntity } from "../../tier-engine/entity";
+import { createTierEngineFeature } from "../../tier-engine/feature";
+import { SubscriptionEventTypes, SubscriptionStatuses } from "../constants";
+import { billingFoundationFeature } from "../feature";
+import {
+  createSubscriptionTierSync,
+  SUBSCRIPTION_WEBHOOK_PATH,
+  type SystemWriteResult,
+} from "../subscription-tier-sync";
+import type { SubscriptionEvent, SubscriptionProviderPlugin } from "../types";
+
+type TestTier = "free" | "pro";
+const isTierName = (v: string): v is TestTier => v === "free" || v === "pro";
+const TEST_TIER_MAP: TierMap<{ readonly maxItems: number }> = {
+  free: { features: [], caps: { maxItems: 1 } },
+  pro: { features: [], caps: { maxItems: 100 } },
+};
+
+const mockProviderFeature = defineFeature("test-mock-tier-sync-provider", (r) => {
+  r.requires("billing-foundation");
+  const plugin: SubscriptionProviderPlugin = {
+    verifyAndParseWebhook: async (rawBody) => JSON.parse(rawBody) as SubscriptionEvent,
+  };
+  r.useExtension("subscriptionProvider", "mock", plugin);
+});
+
+// Boundary-cast: SubscriptionTierSyncDeps deliberately erases the entity's
+// concrete field types to EntityDefinition (generic factory), which TS
+// can't structurally widen to on its own.
+const tierAssignmentTable = buildEntityTable(
+  "tier-assignment",
+  tierAssignmentEntity,
+) as unknown as EntityTable<EntityDefinition>;
+
+let stack: TestStack;
+let forceTierSyncFailure = false;
+
+async function dispatchSystemWrite(args: {
+  readonly handlerQn: string;
+  readonly payload: unknown;
+  readonly tenantId: TenantId;
+}): Promise<SystemWriteResult> {
+  if (
+    forceTierSyncFailure &&
+    (args.handlerQn === TierEngineHandlers.create || args.handlerQn === TierEngineHandlers.update)
+  ) {
+    return {
+      isSuccess: false,
+      error: { code: "test_forced_failure", message: "forced tier-sync failure" },
+    };
+  }
+  const systemUser = createTestUser({ id: 1, tenantId: args.tenantId, roles: ["SystemAdmin"] });
+  const res = await stack.http.write(args.handlerQn, args.payload, systemUser);
+  const body = (await res.json()) as {
+    isSuccess: boolean;
+    data?: unknown;
+    error?: { readonly code?: string; readonly message?: string };
+  };
+  return body.isSuccess
+    ? { isSuccess: true, data: body.data }
+    : { isSuccess: false, error: body.error };
+}
+
+let logApp: Hono;
+let failApp: Hono;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      billingFoundationFeature,
+      createTierEngineFeature({ defaultTier: "free", tierMap: TEST_TIER_MAP }),
+      mockProviderFeature,
+    ],
+  });
+  await createEventsTable(stack.db);
+  await unsafeCreateEntityTable(stack.db, tenantComplianceProfileEntity);
+  await unsafePushTables(stack.db, { tier_assignments: tierAssignmentTable });
+  configurePiiSubjectKms(new InMemoryKmsAdapter());
+
+  const sharedDeps = {
+    db: stack.db,
+    registry: stack.registry,
+    dispatchSystemWrite,
+    tierAssignmentTable,
+    isTierName,
+    defaultTier: "free" as const,
+  };
+
+  logApp = new Hono();
+  createSubscriptionTierSync<TestTier>(sharedDeps).wireSubscriptionWebhookRoute(logApp);
+
+  failApp = new Hono();
+  createSubscriptionTierSync<TestTier>({
+    ...sharedDeps,
+    onSyncError: "fail-webhook",
+  }).wireSubscriptionWebhookRoute(failApp);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+  resetPiiSubjectKmsForTests();
+});
+
+const webhookPath = SUBSCRIPTION_WEBHOOK_PATH.replace(":providerName", "mock");
+
+function buildEvent(tenantId: string, providerEventId: string): SubscriptionEvent {
+  return {
+    providerEventId,
+    providerName: "mock",
+    type: SubscriptionEventTypes.created,
+    tenantId,
+    providerCustomerId: `cus_${providerEventId}`,
+    providerSubscriptionId: `sub_${providerEventId}`,
+    status: SubscriptionStatuses.active,
+    tier: "pro",
+    currentPeriodEnd: "2026-06-01T00:00:00Z",
+    rawPayload: "{}",
+  };
+}
+
+describe("createSubscriptionTierSync onSyncError", () => {
+  test("default ('log'): a tier-sync failure still returns a successful webhook response", async () => {
+    forceTierSyncFailure = true;
+    const tenantId = testTenantId(9001);
+    const res = await logApp.request(webhookPath, {
+      method: "POST",
+      body: JSON.stringify(buildEvent(tenantId, "evt_log_1")),
+    });
+    forceTierSyncFailure = false;
+
+    expect(res.status).toBe(200);
+  });
+
+  test("'fail-webhook': a tier-sync failure also fails the webhook response", async () => {
+    forceTierSyncFailure = true;
+    const tenantId = testTenantId(9002);
+    const res = await failApp.request(webhookPath, {
+      method: "POST",
+      body: JSON.stringify(buildEvent(tenantId, "evt_fail_1")),
+    });
+    forceTierSyncFailure = false;
+
+    expect(res.status).toBe(500);
+    const body = (await res.json()) as { error: { code: string } };
+    expect(body.error.code).toBe("subscription_webhook_processing_failed");
+  });
+});

package/src/billing-foundation/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.288.0",
+    "type": "improvement",
+    "title": "add onSyncError option to createSubscriptionTierSync",
+    "detail": "`SubscriptionTierSyncDeps<TTier>` gets an optional `onSyncError?: \"log\" | \"fail-webhook\"`\n(default `\"log\"`, matching prior behavior exactly). `\"fail-webhook\"` makes a tier-sync\nfailure also fail the webhook response, so an idempotent-retry caller (whose retry\nno-ops the already-committed primary write) gets another attempt at the sync step."
+  },
   {
     "version": "0.286.0",
     "type": "improvement",

package/src/billing-foundation/subscription-tier-sync.ts

@@ -35,6 +35,12 @@ export type SubscriptionTierSyncDeps<TTier extends string> = {
   readonly tierAssignmentTable: EntityTable<EntityDefinition>;
   readonly isTierName: (value: string) => value is TTier;
   readonly defaultTier: TTier;
+  // "log" (default): sync failure only warns, the webhook still reports
+  // success — right when the caller has no idempotent retry to lean on.
+  // "fail-webhook": sync failure fails the webhook response too, so an
+  // idempotent caller (e.g. Stripe, whose retry re-runs the already-committed
+  // primary write as a no-op) gets a second attempt at the sync step itself.
+  readonly onSyncError?: "log" | "fail-webhook";
 };
 
 export function effectiveTierFromSubscription<TTier extends string>(
@@ -116,16 +122,15 @@ export function createSubscriptionTierSync<TTier extends string>(
           tenantId: targetTenantId,
         });
         if (!result.isSuccess) return result;
-        // The primary write already committed — a webhook caller (Stripe/
-        // PayPal) that sees isSuccess:false here retries the whole event,
-        // re-running an already-succeeded side effect. Log the tier-sync
-        // failure instead of masking the primary write's success.
         const syncError = await syncTierFromSubscription(targetTenantId);
         if (syncError) {
           // biome-ignore lint/suspicious/noConsole: operator visibility for a post-commit sync failure
           console.warn(
             `[subscription-tier-sync] tier sync failed for tenant ${targetTenantId} after successful webhook write: ${syncError.code} ${syncError.message}`,
           );
+          if (deps.onSyncError === "fail-webhook") {
+            return { isSuccess: false, error: syncError };
+          }
         }
         return result;
       },

package/src/compliance-profiles/handlers/sub-processors.query.ts

@@ -25,6 +25,7 @@ export const subProcessorsQuery = defineQueryHandler({
   name: "sub-processors",
   schema: z.object({}),
   access: { roles: ["anonymous", "Member", "User", "TenantAdmin", "SystemAdmin"] },
+  rateLimit: { per: "ip", limit: 30, windowSeconds: 60 },
   description:
     "Returns the publicly readable Kumiko sub-processor list split into active and planned entries, for the GDPR Art. 28(2) disclosure a privacy policy or data-processing agreement links to.",
   handler: async (): Promise<SubProcessorListResponse> => {

package/src/files-tenant-data/__tests__/hooks.integration.test.ts

@@ -12,7 +12,11 @@ import { randomBytes } from "node:crypto";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
-import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createSystemUser,
+  type EntityId,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   append,
   createEventsTable,
@@ -133,6 +137,12 @@ async function seedFileRef(tenantId: TenantId, storageKey: string) {
   return { id: result.data.id };
 }
 
+// Stands in for a tenant-handover claim (kumiko-framework#3035): the row's
+// tenantId moves, the storageKey — and the bytes behind it — do not.
+async function handOverFileRef(fileRefId: EntityId, toTenantId: TenantId): Promise<void> {
+  await updateRows(db, fileRefsTable, { tenantId: toTenantId }, { id: String(fileRefId) });
+}
+
 // Sidesteps the `request-destruction` write handler (needs user/auth/sessions
 // features wired) by seeding the same "destroying" state it would produce —
 // same pattern as tenant-lifecycle's own poison-pill destroy tests.
@@ -279,4 +289,81 @@ describe("files-tenant-data :: tenant destroy", () => {
     // forget hook's resolution-failure stance.
     expect(await provider.exists(originalKeyA)).toBe(true);
   });
+
+  // kumiko-framework#3035 — tenant-handover leaves a fileRef row's tenantId
+  // pointing at a NEW tenant while its storageKey (and the bytes behind it)
+  // stay under the tenant that originally uploaded it.
+  describe("after a tenant-handover", () => {
+    test("the destination tenant's destroy deletes the handed-over binary even though it lives outside its own prefix", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const handedOverKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, handedOverKey);
+      await provider.write(handedOverKey, new Uint8Array([1]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantB.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantB.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(0);
+      expect(await provider.exists(handedOverKey)).toBe(false);
+    });
+
+    test("the SOURCE tenant's destroy does not delete a file — or its derivative — a foreign tenant claimed, but still sweeps a true orphan", async () => {
+      await seedTenant(tenantA);
+      await seedTenant(tenantB);
+
+      const originalKey = buildStorageKey(
+        tenantA.tenantId,
+        "fileRef",
+        1,
+        "attachment",
+        "photo.jpg",
+        "u1",
+      );
+      const derivativeKey = `${originalKey.replace(/\.jpg$/, "")}.medium.jpg`;
+      const orphanKey = `${tenantA.tenantId}/some-other-file.bin`;
+      const { id: fileRefId } = await seedFileRef(tenantA.tenantId, originalKey);
+      await provider.write(originalKey, new Uint8Array([1]));
+      await provider.write(derivativeKey, new Uint8Array([2]));
+      await provider.write(orphanKey, new Uint8Array([3]));
+
+      await handOverFileRef(fileRefId, tenantB.tenantId);
+
+      await seedDestroyingTenant(tenantA.tenantId);
+      const finalStatus = await driveDestructionToCompletion(
+        tenantA.tenantId,
+        async () => provider,
+      );
+      expect(finalStatus).toBe("destroyed");
+
+      // A's own app-data stage never even sees this row — by the time it ran,
+      // the handover had already moved it to B.
+      const rowsB = await selectMany(db, fileRefsTable, { tenantId: tenantB.tenantId });
+      expect(rowsB).toHaveLength(1);
+
+      // The silent-data-loss case the whole handover design exists to
+      // prevent: A's storage-prefix sweep must not delete bytes a foreign
+      // tenant's surviving row still references — original AND derivative.
+      expect(await provider.exists(originalKey)).toBe(true);
+      expect(await provider.exists(derivativeKey)).toBe(true);
+      // A true orphan (no fileRef row anywhere) is still swept — the
+      // exception above is narrow, not a general retreat from the sweep.
+      expect(await provider.exists(orphanKey)).toBe(false);
+    });
+  });
 });