@cosmicdrift/kumiko-bundled-features 0.305.0 → 0.306.0

package/src/delivery/__tests__/delivery-screens.boot.test.ts

@@ -1,9 +1,16 @@
 import { describe, expect, test } from "bun:test";
-import { access, isOpenToAllGranted, validateBoot } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  access,
+  createRegistry,
+  defineFeature,
+  isOpenToAllGranted,
+  validateBoot,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
 import { createConfigFeature } from "../../config/feature";
 import { createTenantFeature } from "../../tenant/feature";
-import { DELIVERY_LOG_SCREEN_ID } from "../constants";
+import { DELIVERY_CHANNEL_EXTENSION, DELIVERY_LOG_SCREEN_ID } from "../constants";
+import { collectChannels } from "../delivery-service";
 import { createDeliveryFeature } from "../feature";
 
 describe("delivery screens + handler access alignment", () => {
@@ -38,6 +45,17 @@ describe("delivery screens + handler access alignment", () => {
     expect(preferencesAccess !== undefined && isOpenToAllGranted(preferencesAccess)).toBe(true);
   });
 
+  test("collectChannels fails loud on a registration with invalid options", () => {
+    const broken = defineFeature("broken-channel", (r) => {
+      // @ts-expect-error resolve/send are required — proves the guard rejects a malformed options bag instead of silently dropping the channel
+      r.useExtension(DELIVERY_CHANNEL_EXTENSION, "bad-entity", { anything: 1 });
+    });
+    const registry = createRegistry([...features, broken]);
+    expect(() => collectChannels(registry)).toThrow(
+      `${DELIVERY_CHANNEL_EXTENSION} registration for "bad-entity" has invalid options`,
+    );
+  });
+
   test("boot-validates with a narrowed access option", () => {
     expect(() =>
       validateBoot([

package/src/delivery/__tests__/delivery.integration.test.ts

@@ -4,8 +4,8 @@ import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import {
   buildEntityTable,
   createEventStoreExecutor,
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
   createEntity,
@@ -251,6 +251,65 @@ const ticketFeature = defineFeature("tickets", (r) => {
   });
 });
 
+// A tenantUserIdsQuery handler NOT declared r.systemScope() must get the same
+// tenant-filtered ctx.db / no ctx.systemDb a real dispatch would give it —
+// captured here so the test can assert on it directly.
+let capturedNonSystemQueryCtx: { hasSystemDb: boolean; dbMode: string } | undefined;
+
+const nonSystemUserIdsQueryName = "test-non-system-broadcast:query:non-system-user-ids";
+
+const nonSystemBroadcastFeature = defineFeature("test-non-system-broadcast", (r) => {
+  r.queryHandler({
+    name: "nonSystemUserIds",
+    schema: z.object({ tenantId: z.string() }),
+    access: { roles: ["Admin"] },
+    handler: async (_query, ctx) => {
+      capturedNonSystemQueryCtx = { hasSystemDb: ctx.systemDb !== undefined, dbMode: ctx.db.mode };
+      const rows = await selectMany<{ userId: string }>(ctx.db, tenantMembershipsTable, {});
+      return rows.map((r2) => r2.userId);
+    },
+  });
+});
+
+// The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw ungated —
+// the grant comes from this feature's own r.systemScope() declaration, not from
+// the delivery service caller. ctx.db stays ungated even here.
+let capturedSystemQueryCtx:
+  | { systemDbUnsafeRawWorked: boolean; dbUnsafeRawThrew: boolean }
+  | undefined;
+
+const systemUserIdsQueryName = "test-system-broadcast:query:system-user-ids";
+
+const systemBroadcastFeature = defineFeature("test-system-broadcast", (r) => {
+  r.systemScope();
+  r.queryHandler({
+    name: "systemUserIds",
+    schema: z.object({ tenantId: z.string() }),
+    access: { roles: ["Admin"] },
+    handler: async (_query, ctx) => {
+      let dbUnsafeRawThrew = false;
+      try {
+        ctx.db.unsafeRaw("x");
+      } catch {
+        dbUnsafeRawThrew = true;
+      }
+      const runner = ctx.systemDb?.unsafeRaw(
+        "test: systemScope handler grants ctx.systemDb.unsafeRaw",
+      );
+      const rows = runner
+        ? await selectMany<{ userId: string }>(runner, tenantMembershipsTable, {
+            tenantId: _query.payload.tenantId,
+          })
+        : undefined;
+      capturedSystemQueryCtx = {
+        systemDbUnsafeRawWorked: rows !== undefined,
+        dbUnsafeRawThrew,
+      };
+      return (rows ?? []).map((r2) => r2.userId);
+    },
+  });
+});
+
 const configFeature = createConfigFeature();
 const tenantFeature = createTenantFeature();
 const templateResolverFeature = createTemplateResolverFeature();
@@ -279,6 +338,8 @@ const features = [
   channelPushFeature,
   appFeature,
   ticketFeature,
+  nonSystemBroadcastFeature,
+  systemBroadcastFeature,
 ] as const;
 
 beforeAll(async () => {
@@ -1327,6 +1388,76 @@ describe("flow 15b: escape-hatch audit for tenant broadcast", () => {
   });
 });
 
+// --- Flow 15c: tenantUserIdsQuery that is NOT r.systemScope() ---
+
+describe("flow 15c: tenantUserIdsQuery handler without r.systemScope()", () => {
+  test("gets a tenant-mode db and no systemDb, and the broadcast still resolves recipients", async () => {
+    const nonSystemService = createDeliveryService({
+      db,
+      registry: stack.registry,
+      channels: collectChannels(stack.registry),
+      tenantUserIdsQuery: nonSystemUserIdsQueryName,
+    });
+
+    // Unique title — flow 8 already broadcasts app:notify:tenant-alert to the same
+    // admin/user1/user2, so a plain notificationType filter would pass even if this
+    // service delivered nothing new. Filtering by this test's own title isolates it.
+    const nonSystemBroadcastTitle = "non-system-broadcast-flow-15c";
+    await nonSystemService.notify(
+      "app:notify:tenant-alert",
+      { to: { tenant: admin.tenantId }, data: { title: nonSystemBroadcastTitle, body: "X" } },
+      admin,
+      admin.tenantId,
+    );
+
+    expect(capturedNonSystemQueryCtx).toEqual({ hasSystemDb: false, dbMode: "tenant" });
+
+    const messages = await selectMany(db, inAppMessagesTable, {
+      notificationType: "app:notify:tenant-alert",
+      title: nonSystemBroadcastTitle,
+    });
+    const recipientIds = messages.map((m) => m["userId"]);
+    expect(recipientIds).toContain(admin.id);
+    expect(recipientIds).toContain(user1.id);
+    expect(recipientIds).toContain(user2.id);
+  });
+});
+
+// --- Flow 15d: tenantUserIdsQuery that IS r.systemScope() ---
+
+describe("flow 15d: tenantUserIdsQuery handler with r.systemScope()", () => {
+  test("ctx.systemDb.unsafeRaw works, ctx.db.unsafeRaw is denied, broadcast still resolves recipients", async () => {
+    const systemService = createDeliveryService({
+      db,
+      registry: stack.registry,
+      channels: collectChannels(stack.registry),
+      tenantUserIdsQuery: systemUserIdsQueryName,
+    });
+
+    const systemBroadcastTitle = "system-broadcast-flow-15d";
+    await systemService.notify(
+      "app:notify:tenant-alert",
+      { to: { tenant: admin.tenantId }, data: { title: systemBroadcastTitle, body: "X" } },
+      admin,
+      admin.tenantId,
+    );
+
+    expect(capturedSystemQueryCtx).toEqual({
+      systemDbUnsafeRawWorked: true,
+      dbUnsafeRawThrew: true,
+    });
+
+    const messages = await selectMany(db, inAppMessagesTable, {
+      notificationType: "app:notify:tenant-alert",
+      title: systemBroadcastTitle,
+    });
+    const recipientIds = messages.map((m) => m["userId"]);
+    expect(recipientIds).toContain(admin.id);
+    expect(recipientIds).toContain(user1.id);
+    expect(recipientIds).toContain(user2.id);
+  });
+});
+
 // --- Flow 16: Unsubscribe race — ON CONFLICT makes repeated clicks safe ---
 
 describe("flow 16: repeated unsubscribe clicks are idempotent", () => {
@@ -1545,10 +1676,16 @@ describe("flow 17: async render→send pipeline", () => {
 
   // Mirrors what job-runner.ts's handleJob really builds for a
   // r.systemScope()'d job (framework#2105) — a real TenantDb wrapped by
-  // createUncheckedSystemDb, not a mock, so requireTenantScopedDeps'
+  // createSystemDbView, not a mock, so requireTenantScopedDeps'
   // assertTenantMatch() call exercises the actual production code path.
+  // The unsafeRaw grant mirrors the systemScope() grant that job-runner.ts's
+  // real ctx.systemDb carries in production.
   function makeSystemDb(tenantId: TenantId) {
-    return createUncheckedSystemDb(createTenantDb(db, tenantId, "system"));
+    return createSystemDbView(
+      createTenantDb(db, tenantId, "system", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "test: job context mirrors systemScope() grant" },
+      }),
+    );
   }
 
   test("delivery.render on a channel without a render step records failed and does not dispatch send", async () => {

package/src/delivery/constants.ts

@@ -2,6 +2,10 @@ import type { NotifyPriority } from "@cosmicdrift/kumiko-framework/engine";
 import { QnTypes, qn } from "@cosmicdrift/kumiko-framework/engine";
 import { DELIVERY_FEATURE, DeliveryJobNames } from "./public-names";
 
+// Extension-point name for delivery-channel plugins (channel-email,
+// channel-in-app, channel-push, ...).
+export const DELIVERY_CHANNEL_EXTENSION = "deliveryChannel" as const;
+
 export {
   DELIVERY_ATTEMPT_EVENT,
   DELIVERY_FEATURE,

package/src/delivery/delivery-service.ts

@@ -1,6 +1,6 @@
 import type { SseBroker } from "@cosmicdrift/kumiko-framework/api";
 import type { DbConnection, DbRow } from "@cosmicdrift/kumiko-framework/db";
-import { createTenantDb, createUncheckedSystemDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemDbView, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
 import type {
   EscapeHatchAuditSink,
   NotifyPriority,
@@ -16,14 +16,15 @@ import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import type { Redis } from "ioredis";
 import { appendAttemptEvent, logAttempt } from "./attempt-log";
 import { buildChannelContext } from "./channel-context";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants";
+import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants";
 import { selectNotificationPreferences } from "./db/queries/preferences";
-import type {
-  ChannelContext,
-  ChannelMessage,
-  DeliveryChannel,
-  DeliveryLogEntry,
-  DeliveryService,
+import {
+  type ChannelContext,
+  type ChannelMessage,
+  type DeliveryChannel,
+  type DeliveryLogEntry,
+  type DeliveryService,
+  isDeliveryChannelPlugin,
 } from "./types";
 
 export type RateLimitConfig = {
@@ -58,22 +59,14 @@ export type DeliveryServiceOptions = {
 
 // Build channel list from registry extension usages
 export function collectChannels(registry: Registry): DeliveryChannel[] {
-  const usages = registry.getExtensionUsages("deliveryChannel");
+  const usages = registry.getExtensionUsages(DELIVERY_CHANNEL_EXTENSION);
   return usages.map((usage) => {
-    // @cast-boundary engine-payload — extension-usage carries unknown options
-    const opts = usage.options as {
-      mode: DeliveryChannel["mode"];
-      resolve: DeliveryChannel["resolve"];
-      render?: DeliveryChannel["render"];
-      send: DeliveryChannel["send"];
-    };
-    return {
-      name: usage.entityName,
-      mode: opts.mode,
-      resolve: opts.resolve,
-      render: opts.render,
-      send: opts.send,
-    };
+    if (!isDeliveryChannelPlugin(usage.options)) {
+      throw new Error(
+        `${DELIVERY_CHANNEL_EXTENSION} registration for "${usage.entityName}" has invalid options`,
+      );
+    }
+    return { name: usage.entityName, ...usage.options };
   });
 }
 
@@ -177,18 +170,41 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
       sink: escapeHatchAuditSink,
       log,
     });
-    const tenantDb = createTenantDb(db, tenantId, "system", undefined, undefined, undefined, {
-      report,
-    });
-    // Hand-built context, not routed through the dispatcher — tenantUserIdsQuery is
-    // typically an r.systemScope() handler, fail-closed on ctx.db, so this needs both.
+    // Mirrors buildHandlerContext (pipeline/dispatch-shared.ts): a non-systemScope
+    // tenantUserIdsQuery must get the same tenant-filtered db/no-systemDb context
+    // the real dispatcher would give it — handing it "system" mode + a systemDb
+    // view regardless would grant cross-tenant reach the dispatcher never would.
+    const isSystem = registry.isHandlerSystemScoped(tenantUserIdsQuery);
+    const tenantDb = createTenantDb(
+      db,
+      tenantId,
+      isSystem ? "system" : "tenant",
+      undefined,
+      undefined,
+      undefined,
+      { report },
+    );
+    // The dispatcher grants a systemScope handler's ctx.systemDb.unsafeRaw() ungated —
+    // the grant comes from the handler's own r.systemScope() registration, not from this
+    // caller. ctx.db/dbOutsideTransaction stay on the grant-less tenantDb above; only the
+    // systemDb view's own source TenantDb carries the grant, so it can't leak onto ctx.db.
+    const systemDbSourceTenantDb = isSystem
+      ? createTenantDb(db, tenantId, "system", undefined, undefined, undefined, {
+          report,
+          unsafeRaw: { reason: `r.systemScope() handler "${tenantUserIdsQuery}"` },
+        })
+      : undefined;
+    // Hand-built context, not routed through the dispatcher — this needs both
+    // db and dbOutsideTransaction wired directly.
     // @cast-boundary engine-payload — generic query-handler return for typed convention
     return (await handler.handler(
       { type: tenantUserIdsQuery, payload: { tenantId }, user: systemUser },
       {
         db: tenantDb,
         dbOutsideTransaction: tenantDb,
-        systemDb: createUncheckedSystemDb(tenantDb, undefined, report),
+        systemDb: systemDbSourceTenantDb
+          ? createSystemDbView(systemDbSourceTenantDb, undefined, report)
+          : undefined,
         registry,
         ...bridgeStub(),
       },

package/src/delivery/feature.ts

@@ -8,6 +8,7 @@ import {
 import type { z } from "zod";
 import {
   DELIVERY_ATTEMPT_EVENT,
+  DELIVERY_CHANNEL_EXTENSION,
   DELIVERY_LOG_SCREEN_ID,
   DELIVERY_STATUS_CELL_COMPONENT,
   DeliveryJobNames,
@@ -118,7 +119,7 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
     // eigenen mehr — channel-email nimmt renderer als direkte
     // Konstruktor-Option (siehe email-channel.ts), nicht via Extension-
     // Usage. Migration 2026-05-19.
-    r.extendsRegistrar("deliveryChannel", {
+    r.extendsRegistrar(DELIVERY_CHANNEL_EXTENSION, {
       onRegister: () => {},
     });
 

package/src/delivery/index.ts

@@ -1,5 +1,6 @@
 export type { DeliveryStatusValue } from "./constants";
 export {
+  DELIVERY_CHANNEL_EXTENSION,
   DELIVERY_FEATURE,
   DELIVERY_LOG_SCREEN_ID,
   DeliveryErrors,
@@ -22,17 +23,19 @@ export {
   notificationPreferencesTable,
 } from "./tables";
 export { type CreateDeliveryTestContextOptions, createDeliveryTestContext } from "./testing";
-export type {
-  ChannelContext,
-  ChannelMessage,
-  ChannelResult,
-  DeliveryChannel,
-  DeliveryChannelMode,
-  DeliveryLogEntry,
-  DeliveryService,
-  NotificationRenderer,
-  RenderedMessage,
-  RendererInput,
+export {
+  type ChannelContext,
+  type ChannelMessage,
+  type ChannelResult,
+  type DeliveryChannel,
+  type DeliveryChannelMode,
+  type DeliveryChannelPlugin,
+  type DeliveryLogEntry,
+  type DeliveryService,
+  isDeliveryChannelPlugin,
+  type NotificationRenderer,
+  type RenderedMessage,
+  type RendererInput,
 } from "./types";
 export {
   createUnsubscribeRoute,

package/src/delivery/types.ts

@@ -7,6 +7,7 @@ import type {
   SessionUser,
   TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { DELIVERY_CHANNEL_EXTENSION } from "./constants";
 
 // --- Channel Interface ---
 
@@ -92,3 +93,26 @@ export type DeliveryService = {
     tenantId: TenantId,
   ): Promise<void>;
 };
+
+// r.useExtension options-shape: `name` is NOT part of the registration
+// payload — collectChannels derives it from the usage's entityName instead.
+export type DeliveryChannelPlugin = Omit<DeliveryChannel, "name">;
+
+export function isDeliveryChannelPlugin(o: unknown): o is DeliveryChannelPlugin {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "mode" in o &&
+    "resolve" in o &&
+    typeof o.resolve === "function" &&
+    "send" in o &&
+    typeof o.send === "function"
+  );
+}
+
+// r.useExtension options-shape, co-located since the framework never imports upward.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [DELIVERY_CHANNEL_EXTENSION]: DeliveryChannelPlugin;
+  }
+}

package/src/document-ingest-foundation/__tests__/pages-crypto-shredding.integration.test.ts

@@ -25,7 +25,6 @@ import { resetPiiSubjectKmsForTests } from "@cosmicdrift/kumiko-framework/testin
 import { createConfigFeature } from "../../config";
 import { documentExtractEntity, documentExtractsTable } from "../entity";
 import { readIngestPages, writeIngestPages } from "../pages";
-import { documentExtractTenantDestroyHook } from "../tenant-destroy-hook";
 
 let stack: TestStack;
 let kms: InMemoryKmsAdapter;
@@ -110,29 +109,3 @@ describe("documentExtract.pages — tenant-subject encryption (#1621)", () => {
     expect(readIngestPages(row?.["pages"])).toEqual([]);
   });
 });
-
-describe("documentExtractTenantDestroyHook (#1621)", () => {
-  test("drops the tenant's extract rows and leaves other tenants alone", async () => {
-    const mine = await createExtract("file-mine");
-    const otherTenantId = testTenantId(2);
-    const otherResult = await executor.create(
-      {
-        fileRefId: "file-theirs",
-        storageKey: "s3://bucket/file-theirs",
-        pages: writeIngestPages(pages),
-        meta: {},
-      },
-      createSystemUser(otherTenantId),
-      createTenantDb(stack.db, otherTenantId),
-    );
-    if (!otherResult.isSuccess) throw new Error("setup create failed");
-
-    await documentExtractTenantDestroyHook({ db: stack.db, tenantId });
-
-    const remaining = (await asRawClient(stack.db).unsafe(
-      `SELECT id FROM read_document_extracts`,
-    )) as ReadonlyArray<{ id: string }>;
-    expect(remaining.map((row) => row.id)).not.toContain(mine);
-    expect(remaining).toHaveLength(1);
-  });
-});

package/src/document-ingest-foundation/__tests__/tenant-destroy.integration.test.ts

@@ -0,0 +1,166 @@
+// Drives the real tenant-lifecycle destruction sweep: a direct hook call with a raw DbRunner
+// hides the TenantDb shape the "app-data" stage actually passes.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { createEventStoreExecutor, createTenantDb } from "@cosmicdrift/kumiko-framework/db";
+import { createSystemUser, type TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { append, loadAggregate } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { resetTestTables, updateRows } from "@cosmicdrift/kumiko-framework/testing";
+import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
+import {
+  createComplianceProfilesFeature,
+  tenantComplianceProfileEntity,
+  tenantComplianceProfileTable,
+} from "../../compliance-profiles";
+import { createConfigFeature } from "../../config";
+import { tenantMembershipEntity } from "../../tenant";
+import { TenantHandlers } from "../../tenant/constants";
+import { createTenantFeature } from "../../tenant/feature";
+import { tenantEntity, tenantTable } from "../../tenant/schema/tenant";
+import { createTenantLifecycleFeature } from "../../tenant-lifecycle";
+import {
+  TENANT_AGGREGATE_TYPE,
+  TENANT_DESTRUCTION_STARTED_EVENT_QN,
+} from "../../tenant-lifecycle/constants";
+import { runTenantDestructionSweep } from "../../tenant-lifecycle/run-tenant-destroy";
+import { documentExtractEntity, documentExtractsTable } from "../entity";
+import { documentIngestFoundationFeature } from "../feature";
+import { writeIngestPages } from "../pages";
+
+const SET_PROFILE = "compliance-profiles:write:set-profile";
+
+const documentExtractCrud = createEventStoreExecutor(documentExtractsTable, documentExtractEntity, {
+  entityName: "document-extract",
+});
+
+let stack: TestStack;
+let db: DbConnection;
+
+const tenantA = TestUsers.admin;
+const tenantB = TestUsers.otherTenant;
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [
+      createConfigFeature(),
+      createTenantFeature(),
+      createComplianceProfilesFeature(),
+      createTenantLifecycleFeature(),
+      documentIngestFoundationFeature,
+    ],
+  });
+  db = stack.db;
+
+  await unsafeCreateEntityTable(db, tenantEntity);
+  await unsafeCreateEntityTable(db, tenantComplianceProfileEntity);
+  await unsafeCreateEntityTable(db, tenantMembershipEntity);
+  await unsafeCreateEntityTable(db, documentExtractEntity);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+beforeEach(async () => {
+  stack.events.reset();
+  await resetTestTables(db, [tenantTable, tenantComplianceProfileTable]);
+  await stack.db.unsafe?.(
+    `TRUNCATE kumiko_events, read_document_extracts RESTART IDENTITY CASCADE`,
+  );
+});
+
+async function seedTenant(user: typeof tenantA): Promise<void> {
+  await stack.http.writeOk(
+    TenantHandlers.create,
+    { id: user.tenantId, key: `t-${user.tenantId}`, name: "Tenant" },
+    TestUsers.systemAdmin,
+  );
+  await stack.http.writeOk(SET_PROFILE, { profileKey: "eu-dsgvo" }, user);
+}
+
+async function seedDocumentExtract(tenantId: TenantId, fileRefId: string): Promise<string> {
+  const user = createSystemUser(tenantId);
+  const tdb = createTenantDb(db, tenantId);
+  const result = await documentExtractCrud.create(
+    {
+      fileRefId,
+      storageKey: `s3://bucket/${fileRefId}`,
+      pages: writeIngestPages([{ pageNumber: 1, text: "invoice text" }]),
+      meta: { provider: "test", ms: 1, needsOcr: false, pagesParsed: 1, totalPages: 1 },
+    },
+    user,
+    tdb,
+  );
+  if (!result.isSuccess) throw new Error(`seed failed: ${result.error.message}`);
+  return String(result.data.id);
+}
+
+// Sidesteps the `request-destruction` write handler (needs user/auth/sessions
+// features wired) by seeding the same "destroying" state it would produce —
+// same pattern as files-tenant-data's hooks.integration.test.ts.
+async function seedDestroyingTenant(tenantId: TenantId): Promise<void> {
+  const now = getTemporal().Now.instant();
+  await updateRows(
+    db,
+    tenantTable,
+    { status: "destroying", destroyStartedAt: now },
+    { id: tenantId },
+  );
+  await append(db, {
+    aggregateId: tenantId,
+    aggregateType: TENANT_AGGREGATE_TYPE,
+    tenantId,
+    expectedVersion: (await loadAggregate(db, tenantId, tenantId)).at(-1)?.version ?? 0,
+    type: TENANT_DESTRUCTION_STARTED_EVENT_QN,
+    payload: { startedAt: now.toString() },
+    metadata: { userId: "system", requestId: "test:destruction-started" },
+  });
+}
+
+async function driveDestructionToCompletion(tenantId: TenantId): Promise<string> {
+  const farFuture = getTemporal()
+    .Now.instant()
+    .add({ hours: 24 * 3650 });
+  let status = "";
+  for (let i = 0; i < 20; i++) {
+    await runTenantDestructionSweep({ db: stack.db, registry: stack.registry, now: farFuture });
+    const rows = await selectMany(db, tenantTable, { id: tenantId });
+    status = String(rows[0]?.["status"]);
+    if (status === "destroyed" || status === "destroyFailed") break;
+  }
+  return status;
+}
+
+describe("document-ingest-foundation :: tenant destroy (#3196)", () => {
+  test("purges documentExtract rows for the destroyed tenant, leaving another tenant's row untouched", async () => {
+    await seedTenant(tenantA);
+    await seedTenant(tenantB);
+
+    const idA = await seedDocumentExtract(tenantA.tenantId, "file-a");
+    await seedDocumentExtract(tenantB.tenantId, "file-b");
+
+    await seedDestroyingTenant(tenantA.tenantId);
+
+    const finalStatus = await driveDestructionToCompletion(tenantA.tenantId);
+    expect(finalStatus).toBe("destroyed");
+
+    const rowsA = await selectMany(db, documentExtractsTable, { tenantId: tenantA.tenantId });
+    expect(rowsA).toHaveLength(0);
+
+    const rowsB = await selectMany(db, documentExtractsTable, { tenantId: tenantB.tenantId });
+    expect(rowsB).toHaveLength(1);
+
+    // Proves this went through the executor (rebuild-safe forget), not a raw
+    // deleteMany — the forgotten row's aggregate carries a `.forgotten` event.
+    const events = await loadAggregate(db, idA, tenantA.tenantId);
+    expect(events.some((e) => e.type === "document-extract.forgotten")).toBe(true);
+  });
+});

package/src/document-ingest-foundation/changes.json

@@ -1,4 +1,9 @@
 [
+  {
+    "version": "0.306.0",
+    "type": "fix",
+    "title": "Tenant destroy no longer fails on documentExtract rows"
+  },
   {
     "version": "0.166.0",
     "type": "breaking",