@cosmicdrift/kumiko-bundled-features 0.305.0 → 0.306.0

package/src/mail-transport-inmemory/feature.ts

@@ -26,9 +26,10 @@ import type {
   EmailTransport,
 } from "@cosmicdrift/kumiko-bundled-features/channel-email";
 import { createInMemoryTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
-import type {
-  MailTransportContext,
-  MailTransportPlugin,
+import {
+  MAIL_TRANSPORT_EXTENSION,
+  type MailTransportContext,
+  type MailTransportPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 
@@ -92,5 +93,5 @@ export const mailTransportInMemoryFeature = defineFeature(FEATURE_NAME, (r) => {
       return getOrCreateTransportForTenant(tenantId);
     }, // @wrapper-known semantic-alias
   };
-  r.useExtension("mailTransport", "inmemory", plugin);
+  r.useExtension(MAIL_TRANSPORT_EXTENSION, "inmemory", plugin);
 });

package/src/mail-transport-smtp/feature.ts

@@ -34,9 +34,10 @@ import {
   requireNonEmpty,
   requireSecretSet,
 } from "@cosmicdrift/kumiko-bundled-features/foundation-shared";
-import type {
-  MailTransportContext,
-  MailTransportPlugin,
+import {
+  MAIL_TRANSPORT_EXTENSION,
+  type MailTransportContext,
+  type MailTransportPlugin,
 } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import { requireSecretsContext } from "@cosmicdrift/kumiko-bundled-features/secrets";
 import { access, createTenantConfig, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
@@ -114,7 +115,7 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
   const plugin: MailTransportPlugin = {
     build: async (ctx: MailTransportContext, tenantId: string) => buildSmtpTransport(ctx, tenantId), // @wrapper-known semantic-alias
   };
-  r.useExtension("mailTransport", "smtp", plugin);
+  r.useExtension(MAIL_TRANSPORT_EXTENSION, "smtp", plugin);
 
   return {
     /** Config-key-handles — typed reads via `ctx.config(...)` in

package/src/renderer-foundation/__tests__/collect-plugins.integration.test.ts

@@ -3,6 +3,7 @@ import { defineFeature, type TenantId } from "@cosmicdrift/kumiko-framework/engi
 import { setupTestStack, type TestStack } from "@cosmicdrift/kumiko-framework/stack";
 import { createTemplateResolverFeature } from "../../template-resolver/feature";
 import { createRendererFoundationApi } from "../api";
+import { RENDERER_EXTENSION, type RenderKind } from "../constants";
 import { collectRendererPlugins, createRendererFoundationFeature } from "../feature";
 import type { RenderRequest, RenderResponse } from "../types";
 
@@ -12,10 +13,10 @@ let stack: TestStack;
 
 // Mini-Plugin via defineFeature + r.useExtension — wie ein echter
 // renderer-plugin (renderer-simple, renderer-mail-html) sich registriert.
-function createTestPluginFeature(name: string, kinds: ReadonlyArray<string>) {
+function createTestPluginFeature(name: string, kinds: ReadonlyArray<RenderKind>) {
   return defineFeature(`renderer-${name}`, (r) => {
     r.requires("renderer-foundation");
-    r.useExtension("renderer", name, {
+    r.useExtension(RENDERER_EXTENSION, name, {
       kinds,
       render: async (req: RenderRequest): Promise<RenderResponse> => {
         if (req.kind === "notification") return { kind: "notification", html: `via:${name}` };
@@ -85,6 +86,27 @@ describe("renderer-foundation :: Plugin-Pool aus Registry", () => {
     );
   });
 
+  test("collectRendererPlugins fails loud on a registration with invalid options", async () => {
+    const brokenStack = await setupTestStack({
+      features: [
+        createTemplateResolverFeature(),
+        createRendererFoundationFeature(),
+        defineFeature("renderer-broken", (r) => {
+          r.requires("renderer-foundation");
+          // @ts-expect-error kinds/render are required — proves the guard rejects an empty options bag instead of silently dropping the plugin
+          r.useExtension(RENDERER_EXTENSION, "broken", {});
+        }),
+      ],
+    });
+    try {
+      expect(() => collectRendererPlugins(brokenStack.registry)).toThrow(
+        `${RENDERER_EXTENSION} registration for "broken" has invalid options`,
+      );
+    } finally {
+      await brokenStack.cleanup();
+    }
+  });
+
   test("Plugin.render mit echtem Pool fließt end-to-end durch", async () => {
     const plugins = collectRendererPlugins(stack.registry);
     const api = createRendererFoundationApi(plugins);

package/src/renderer-foundation/changes.json

@@ -1 +1,8 @@
-[]
+[
+  {
+    "version": "0.306.0",
+    "type": "breaking",
+    "title": "Bundled extension points (renderer, deliveryChannel, mailTransport, inboundMailProvider, subscriptionProvider) are typed",
+    "migration": "r.useExtension options for renderer ({ kinds, render }), deliveryChannel ({ mode, resolve, render?, send, accept? }), mailTransport (MailTransportPlugin), inboundMailProvider (InboundMailProviderPlugin) and subscriptionProvider (SubscriptionProviderPlugin) are now type-checked and required; renderer and deliveryChannel registrations do not pass name (it comes from the entity name). Prefer the new constants RENDERER_EXTENSION, DELIVERY_CHANNEL_EXTENSION and MAIL_TRANSPORT_EXTENSION over string literals. A registration whose options do not match the plugin shape now throws with the entity name when channels or renderers are collected."
+  }
+]

package/src/renderer-foundation/constants.ts

@@ -4,6 +4,10 @@
 // über das Barrel (../template-resolver), nicht via deep-import.
 import type { RenderKind as RenderKindLocal } from "../template-resolver";
 
+// Extension-point name for renderer plugins (renderer-simple,
+// renderer-mail-html, renderer-puppeteer-client, ...).
+export const RENDERER_EXTENSION = "renderer" as const;
+
 export {
   CONTENT_FORMATS,
   type ContentFormat,

package/src/renderer-foundation/feature.ts

@@ -1,5 +1,6 @@
 import { defineFeature, type Registry } from "@cosmicdrift/kumiko-framework/engine";
-import type { RendererPlugin } from "./types";
+import { RENDERER_EXTENSION } from "./constants";
+import { isRendererRegistrationPlugin, type RendererPlugin } from "./types";
 
 // renderer-foundation — Plugin-Foundation für Renderer (Notification,
 // HTML-Mail, PDF, Image). Plan-Doc:
@@ -21,7 +22,7 @@ export function createRendererFoundationFeature() {
     });
     r.requires("template-resolver");
 
-    r.extendsRegistrar("renderer", {
+    r.extendsRegistrar(RENDERER_EXTENSION, {
       onRegister: () => {
         // Plugin-Konformitäts-Check könnte hier: shape-validation der
         // options (kinds, render-Funktion present). Aktuell kein
@@ -39,17 +40,13 @@ export function createRendererFoundationFeature() {
 //
 // Symmetrisch zu collectChannels / collectRenderers in delivery-service.
 export function collectRendererPlugins(registry: Registry): RendererPlugin[] {
-  const usages = registry.getExtensionUsages("renderer");
+  const usages = registry.getExtensionUsages(RENDERER_EXTENSION);
   return usages.map((usage) => {
-    // @cast-boundary engine-payload — extension-usage carries unknown options
-    const opts = usage.options as {
-      kinds: RendererPlugin["kinds"];
-      render: RendererPlugin["render"];
-    };
-    return {
-      name: usage.entityName,
-      kinds: opts.kinds,
-      render: opts.render,
-    };
+    if (!isRendererRegistrationPlugin(usage.options)) {
+      throw new Error(
+        `${RENDERER_EXTENSION} registration for "${usage.entityName}" has invalid options`,
+      );
+    }
+    return { name: usage.entityName, ...usage.options };
   });
 }

package/src/renderer-foundation/index.ts

@@ -8,18 +8,21 @@ export {
   type ContentFormat,
   DEFAULT_PLUGIN_BY_KIND,
   RENDER_KINDS,
+  RENDERER_EXTENSION,
   type RenderKind,
 } from "./constants";
 export { collectRendererPlugins, createRendererFoundationFeature } from "./feature";
 export {
   type DocumentPayload,
   type ImageOptions,
+  isRendererRegistrationPlugin,
   type MailHtmlPayload,
   type NotificationPayload,
   type PdfOptions,
   type RendererContext,
   RendererError,
   type RendererPlugin,
+  type RendererRegistrationPlugin,
   type RenderRequest,
   type RenderResponse,
 } from "./types";

package/src/renderer-foundation/types.ts

@@ -1,6 +1,6 @@
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
-import type { ContentFormat, RenderKind } from "./constants";
+import { type ContentFormat, RENDERER_EXTENSION, type RenderKind } from "./constants";
 
 // RenderRequest — Plugins erhalten das. Resource-Mode wählt der Caller
 // (renderer-foundation api) je nach kind oder explizit. Plugin selbst
@@ -107,3 +107,25 @@ export class RendererError extends Error {
     this.name = "RendererError";
   }
 }
+
+// r.useExtension options-shape: `name` is NOT part of the registration
+// payload — collectRendererPlugins derives it from the usage's entityName.
+export type RendererRegistrationPlugin = Omit<RendererPlugin, "name">;
+
+export function isRendererRegistrationPlugin(o: unknown): o is RendererRegistrationPlugin {
+  return (
+    typeof o === "object" &&
+    o !== null &&
+    "kinds" in o &&
+    Array.isArray(o.kinds) &&
+    "render" in o &&
+    typeof o.render === "function"
+  );
+}
+
+// r.useExtension options-shape, co-located since the framework never imports upward.
+declare module "@cosmicdrift/kumiko-framework/engine" {
+  interface KumikoExtensionOptionsMap {
+    [RENDERER_EXTENSION]: RendererRegistrationPlugin;
+  }
+}

package/src/renderer-simple/feature.ts

@@ -1,5 +1,6 @@
 import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import {
+  RENDERER_EXTENSION,
   type RendererContext,
   RendererError,
   type RenderRequest,
@@ -48,7 +49,7 @@ export function createRendererSimpleFeature(): FeatureDefinition {
     r.requires("renderer-foundation");
     r.optionalRequires("template-resolver");
 
-    r.useExtension("renderer", "simple", {
+    r.useExtension(RENDERER_EXTENSION, "simple", {
       kinds: ["notification"] as const,
       render: adaptToFoundation,
     });

package/src/tenant/__tests__/multi-tenant.integration.test.ts

@@ -1,8 +1,8 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { buildServer, type JwtHelper } from "@cosmicdrift/kumiko-framework/api";
 import {
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
   type DbConnection,
 } from "@cosmicdrift/kumiko-framework/db";
 import {
@@ -102,7 +102,7 @@ beforeAll(async () => {
         {
           db: systemModeDb,
           dbOutsideTransaction: systemModeDb,
-          systemDb: createUncheckedSystemDb(systemModeDb),
+          systemDb: createSystemDbView(systemModeDb),
           registry,
           ...bridgeStub(),
         },

package/src/tenant-lifecycle/__tests__/stages.test.ts

@@ -1,7 +1,58 @@
 import { describe, expect, test } from "bun:test";
+import type { DbRunner } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createRegistry,
+  defineFeature,
+  EXT_STORAGE_PROVIDER,
+  EXT_TENANT_DATA,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { DESTRUCTION_STAGES, isDestructionPipelineComplete, pickNextStage } from "../stages";
 
+// Minimal declaring feature: real tenant-lifecycle feature drags in "tenant" +
+// "compliance-profiles" requires, unrelated to what these guard tests exercise.
+function declares(extensionName: string) {
+  return defineFeature(`declares-${extensionName}`, (r) => {
+    r.extendsRegistrar(extensionName, {});
+  });
+}
+
+const fakeDb = {} as DbRunner; // @cast-boundary test fixture — invalid-options guard throws before ctx.db is ever touched
+const fakeTenantId = "00000000-0000-4000-8000-00000000000c" as TenantId;
+
+function stageNamed(name: string) {
+  const stage = DESTRUCTION_STAGES.find((s) => s.name === name);
+  if (!stage) throw new Error(`stage "${name}" not found in DESTRUCTION_STAGES`);
+  return stage;
+}
+
 describe("tenant-lifecycle stages", () => {
+  test("app-data stage fails loud when a tenantData registration has no destroy function", async () => {
+    const broken = defineFeature("broken-tenant-data", (r) => {
+      r.useExtension(EXT_TENANT_DATA, "bad-entity", {
+        // @ts-expect-error destroy must be a function — proves the guard rejects a non-function value instead of silently skipping it
+        destroy: "x",
+      });
+    });
+    const registry = createRegistry([declares(EXT_TENANT_DATA), broken]);
+    await expect(
+      stageNamed("app-data").run({ db: fakeDb, registry, tenantId: fakeTenantId }),
+    ).rejects.toThrow(`${EXT_TENANT_DATA} registration for "bad-entity" has no destroy function`);
+  });
+
+  test("files stage fails loud when a storageProvider registration has no destroyTenant function", async () => {
+    const broken = defineFeature("broken-storage-provider", (r) => {
+      // @ts-expect-error destroyTenant is required — proves the guard rejects an empty options bag instead of silently skipping it
+      r.useExtension(EXT_STORAGE_PROVIDER, "bad-entity", {});
+    });
+    const registry = createRegistry([declares(EXT_STORAGE_PROVIDER), broken]);
+    await expect(
+      stageNamed("files").run({ db: fakeDb, registry, tenantId: fakeTenantId }),
+    ).rejects.toThrow(
+      `${EXT_STORAGE_PROVIDER} registration for "bad-entity" has no destroy function`,
+    );
+  });
+
   test("pickNextStage halts when any stage was abandoned", () => {
     const completed = new Set(["external-resources", "search-indices"]);
     const abandoned = new Set(["app-data"]);

package/src/tenant-lifecycle/stages.ts

@@ -14,9 +14,12 @@ import {
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
   extensionUsageEscapeHatchReason,
+  isTenantDataExtensionHooks,
+  isTenantResourceExtensionHooks,
   type Registry,
   type TenantDataHookCtx,
   type TenantId,
+  type TenantResourceExtensionName,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { FileProviderResolver } from "@cosmicdrift/kumiko-framework/files";
 import { createEscapeHatchReporter } from "@cosmicdrift/kumiko-framework/pipeline";
@@ -63,28 +66,29 @@ const tenantMembershipCrud = createEventStoreExecutor(
 
 async function runExtensionDestroyHooks(
   registry: Registry,
-  extensionName: string,
-  hookKey: "destroyTenant",
+  extensionName: TenantResourceExtensionName,
   ctx: DestructionStageCtx,
 ): Promise<void> {
   const usages = registry.getExtensionUsages(extensionName);
   for (const usage of usages) {
-    const hook = usage.options?.[hookKey];
-    if (typeof hook !== "function") continue;
-    await (hook as (tenantId: TenantId, hookCtx: DestructionStageCtx) => Promise<void>)(
-      ctx.tenantId,
-      ctx,
-    );
+    if (!isTenantResourceExtensionHooks(usage.options)) {
+      throw new Error(
+        `${extensionName} registration for "${usage.entityName}" has no destroy function`,
+      );
+    }
+    await usage.options.destroyTenant(ctx.tenantId, ctx);
   }
 }
 
 async function runTenantDataHooks(ctx: DestructionStageCtx): Promise<void> {
   const usages = ctx.registry.getExtensionUsages(EXT_TENANT_DATA);
   for (const usage of usages) {
-    const destroy = usage.options?.["destroy"] as
-      | ((hookCtx: TenantDataHookCtx) => Promise<void>)
-      | undefined;
-    if (!destroy) continue;
+    if (!isTenantDataExtensionHooks(usage.options)) {
+      throw new Error(
+        `${EXT_TENANT_DATA} registration for "${usage.entityName}" has no destroy function`,
+      );
+    }
+    const destroy = usage.options.destroy;
     const reason = extensionUsageEscapeHatchReason(usage);
     const report = createEscapeHatchReporter({
       handler: `${EXT_TENANT_DATA}:${usage.entityName}`,
@@ -179,13 +183,12 @@ export const DESTRUCTION_STAGES: readonly DestructionStage[] = [
   {
     name: "external-resources",
     maxAttempts: 3,
-    run: (ctx) =>
-      runExtensionDestroyHooks(ctx.registry, EXT_EXTERNAL_RESOURCE, "destroyTenant", ctx),
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_EXTERNAL_RESOURCE, ctx),
   },
   {
     name: "search-indices",
     maxAttempts: 3,
-    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_SEARCH_ADAPTER, "destroyTenant", ctx),
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_SEARCH_ADAPTER, ctx),
   },
   {
     name: "cache",
@@ -205,13 +208,12 @@ export const DESTRUCTION_STAGES: readonly DestructionStage[] = [
   {
     name: "files",
     maxAttempts: 3,
-    run: (ctx) =>
-      runExtensionDestroyHooks(ctx.registry, EXT_STORAGE_PROVIDER, "destroyTenant", ctx),
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_STORAGE_PROVIDER, ctx),
   },
   {
     name: "infra-resources",
     maxAttempts: 3,
-    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_INFRA_RESOURCE, "destroyTenant", ctx),
+    run: (ctx) => runExtensionDestroyHooks(ctx.registry, EXT_INFRA_RESOURCE, ctx),
   },
   {
     name: "tenant-row",

package/src/user/db/queries/__tests__/unsafe-read-retrying.integration.test.ts

@@ -0,0 +1,54 @@
+// backfillUserStreamTenants's candidate scan runs through unsafeReadRetrying;
+// this proves the retry fires using a real captured driver error.
+// migrateAggregate's SELECT ... FOR UPDATE stays out of scope — it runs
+// inside transaction(), where the retry guard is a no-op on a tx handle.
+
+import { beforeAll, describe, expect, test } from "bun:test";
+import { captureClosedConnectionError } from "@cosmicdrift/kumiko-framework/testing";
+import { backfillUserStreamTenants } from "../stream-tenant-backfill";
+
+let closedConnectionError: unknown;
+
+beforeAll(async () => {
+  closedConnectionError = await captureClosedConnectionError();
+});
+
+type FakeClient = {
+  unsafe: (sql: string, params?: readonly unknown[]) => Promise<readonly unknown[]>;
+  begin: () => never;
+  options: { max: number };
+  calls: number;
+};
+
+function fakeClient(failures: unknown[]): FakeClient {
+  const remaining = [...failures];
+  const client: FakeClient = {
+    calls: 0,
+    options: { max: 1 },
+    unsafe: async () => {
+      client.calls++;
+      const err = remaining.shift();
+      if (err) throw err;
+      return [];
+    },
+    begin: () => {
+      throw new Error("not used in test");
+    },
+  };
+  return client;
+}
+
+describe("user db/queries — closed-connection retry", () => {
+  test("backfillUserStreamTenants retries the candidate scan once and completes with no candidates", async () => {
+    const db = fakeClient([closedConnectionError]);
+    const result = await backfillUserStreamTenants(db as never);
+    expect(result).toEqual({ aggregatesMigrated: 0, eventsMigrated: 0, failed: [] });
+    expect(db.calls).toBe(2);
+  });
+
+  test("gives up after exhausting pool-bounded retries (max: 1 → 3 total calls)", async () => {
+    const db = fakeClient([closedConnectionError, closedConnectionError, closedConnectionError]);
+    await expect(backfillUserStreamTenants(db as never)).rejects.toBe(closedConnectionError);
+    expect(db.calls).toBe(3);
+  });
+});

package/src/user-data-rights/__tests__/download.integration.test.ts

@@ -98,6 +98,9 @@ const noSignedUrlProviderFeature = defineFeature("test-no-signed-url-provider",
       async exists() {
         return true;
       },
+      async list() {
+        return [];
+      },
       // **kein** getSignedUrl — pinst den 422-Pfad
     }),
   });

package/src/user-data-rights/lib/default-mailers.ts

@@ -10,6 +10,7 @@
 // createTransportForTenant(ctx, ...).
 
 import type { EmailTransport } from "@cosmicdrift/kumiko-bundled-features/channel-email";
+import { MAIL_TRANSPORT_EXTENSION } from "@cosmicdrift/kumiko-bundled-features/mail-foundation";
 import type { Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { hasMailTranslations } from "@cosmicdrift/kumiko-framework/i18n";
 import {
@@ -34,7 +35,7 @@ export type GdprMailDefaults = {
 // kann ohnehin nichts versendet werden und die App bleibt beim bisherigen
 // "kein Callback → keine Email"-Verhalten.
 export function isMailTransportAvailable(registry: Registry): boolean {
-  return registry.getExtensionUsages("mailTransport").length > 0;
+  return registry.getExtensionUsages(MAIL_TRANSPORT_EXTENSION).length > 0;
 }
 
 type TransportResolver = (tenantId: string) => Promise<EmailTransport>;

package/src/workflow-runner/__tests__/event-wakeup.integration.test.ts

@@ -25,8 +25,8 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
   insertOne,
   selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
@@ -205,7 +205,11 @@ async function runResumeDueRunsJob(tenantId: string): Promise<void> {
   const systemUser = createSystemUser(tenantId);
   const ctx: JobContext = {
     db: createTenantDb(stack.db, tenantId),
-    systemDb: createUncheckedSystemDb(createTenantDb(stack.db, tenantId, "system")),
+    systemDb: createSystemDbView(
+      createTenantDb(stack.db, tenantId, "system", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "test: job context mirrors systemScope() grant" },
+      }),
+    ),
     registry: stack.registry,
     systemUser,
     log: noopLogger,

package/src/workflow-runner/__tests__/resume-loop.integration.test.ts

@@ -24,8 +24,8 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
+  createSystemDbView,
   createTenantDb,
-  createUncheckedSystemDb,
   insertOne,
   selectMany,
 } from "@cosmicdrift/kumiko-framework/db";
@@ -183,7 +183,11 @@ async function runResumeDueRunsJob(): Promise<void> {
   const systemUser = createSystemUser(admin.tenantId);
   const ctx: JobContext = {
     db: createTenantDb(stack.db, admin.tenantId),
-    systemDb: createUncheckedSystemDb(createTenantDb(stack.db, admin.tenantId, "system")),
+    systemDb: createSystemDbView(
+      createTenantDb(stack.db, admin.tenantId, "system", undefined, undefined, undefined, {
+        unsafeRaw: { reason: "test: job context mirrors systemScope() grant" },
+      }),
+    ),
     registry: stack.registry,
     systemUser,
     log: noopLogger,

package/src/user/db/queries/__tests__/unsafe-read-retrying.test.ts

@@ -1,52 +0,0 @@
-// #2323: stream-tenant-backfill.ts's candidate scan (a plain, non-transactional
-// SELECT) read via asRawClient(db).unsafe() directly, bypassing the #1163
-// closed-connection retry. Routed it through unsafeReadRetrying instead — this
-// test mirrors bun-db/__tests__/select-many-retry.test.ts's fake-client
-// pattern to prove the retry now fires. migrateAggregate's per-aggregate
-// SELECT ... FOR UPDATE stays out of scope: it runs inside transaction(),
-// where the retry guard (no begin() on a tx handle) is a no-op by design.
-
-import { describe, expect, test } from "bun:test";
-import { backfillUserStreamTenants } from "../stream-tenant-backfill";
-
-function closedConnectionError(): Error {
-  return Object.assign(new Error("The connection was closed."), { name: "AbortError" });
-}
-
-type FakeClient = {
-  unsafe: (sql: string, params?: readonly unknown[]) => Promise<readonly unknown[]>;
-  begin: () => never;
-  calls: number;
-};
-
-function fakeClient(failures: Error[]): FakeClient {
-  const remaining = [...failures];
-  const client: FakeClient = {
-    calls: 0,
-    unsafe: async () => {
-      client.calls++;
-      const err = remaining.shift();
-      if (err) throw err;
-      return [];
-    },
-    begin: () => {
-      throw new Error("not used in test");
-    },
-  };
-  return client;
-}
-
-describe("user db/queries — closed-connection retry (#2323)", () => {
-  test("backfillUserStreamTenants retries the candidate scan once and completes with no candidates", async () => {
-    const db = fakeClient([closedConnectionError()]);
-    const result = await backfillUserStreamTenants(db as never);
-    expect(result).toEqual({ aggregatesMigrated: 0, eventsMigrated: 0, failed: [] });
-    expect(db.calls).toBe(2);
-  });
-
-  test("gives up after the single retry when the connection stays closed", async () => {
-    const db = fakeClient([closedConnectionError(), closedConnectionError()]);
-    await expect(backfillUserStreamTenants(db as never)).rejects.toThrow("connection was closed");
-    expect(db.calls).toBe(2);
-  });
-});