@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/subscription-stripe/__tests__/verify-webhook.test.ts

@@ -255,6 +255,26 @@ describe("verifyAndParseStripeWebhook — tenant-resolution + price-to-tier", ()
   });
 });
 
+describe("verifyAndParseStripeWebhook — kumiko-framework#1525: no ambient Temporal global", () => {
+  test("computes currentPeriodEnd without relying on globalThis.Temporal", async () => {
+    const verify = verifyAndParseStripeWebhook(webhookRuntime(), {
+      priceToTier: { price_pro_monthly: "pro" },
+    });
+    const payload = JSON.stringify(buildSubscriptionEvent({ currentPeriodEndUnix: 1_780_000_000 }));
+    const sig = await signEvent(payload);
+
+    const savedGlobal = (globalThis as { Temporal?: unknown }).Temporal;
+    delete (globalThis as { Temporal?: unknown }).Temporal;
+    try {
+      const event = await verify(payload, { "stripe-signature": sig });
+      expect(event?.currentPeriodEnd).toBe("2026-05-28T20:26:40Z");
+    } finally {
+      if (savedGlobal === undefined) delete (globalThis as { Temporal?: unknown }).Temporal;
+      else (globalThis as { Temporal?: unknown }).Temporal = savedGlobal;
+    }
+  });
+});
+
 // =============================================================================
 // Mapping-helpers (pure functions, kein Stripe-mock nötig)
 // =============================================================================

package/src/subscription-stripe/feature.ts

@@ -172,6 +172,8 @@ export function createSubscriptionStripeFeature(
           de: "Stripe Billing live",
           en: "Stripe Billing Live",
         },
+        "subscription-stripe.settings": { de: "Stripe", en: "Stripe" },
+        "screen:subscription-stripe-system.title": { de: "Stripe", en: "Stripe" },
       },
     });
 

package/src/subscription-stripe/verify-webhook.ts

@@ -40,6 +40,7 @@ import {
 } from "@cosmicdrift/kumiko-bundled-features/billing-foundation";
 import type { SecretsContext } from "@cosmicdrift/kumiko-framework/secrets";
 import type Stripe from "stripe";
+import { Temporal } from "temporal-polyfill";
 import { STRIPE_PROVIDER_NAME, StripeEventTypes } from "./constants";
 import type { StripeWebhookRuntime } from "./runtime";
 
@@ -138,8 +139,8 @@ export function verifyAndParseStripeWebhook(
     const status = mapStripeStatus(sub.status);
     const periodEndUnixSec = sub.items.data[0]?.current_period_end ?? 0;
     // Stripe returns Unix-seconds; Temporal.Instant.fromEpochMilliseconds
-    // expects ms. Multiply, then ISO. (No-Date-API-Guard verbietet
-    // `new Date()` — Temporal ist global verfügbar via polyfill.)
+    // expects ms. Multiply, then ISO. (No-Date-API-Guard forbids
+    // `new Date()` — static import above, not the ambient global, see #1490.)
     const currentPeriodEnd = Temporal.Instant.fromEpochMilliseconds(
       periodEndUnixSec * 1000,
     ).toString();

package/src/tags/__tests__/schemas.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from "bun:test";
+import { assignTagPayloadSchema } from "../schemas";
+
+// 456/3: tagAssignmentAggregateId joins tenantId/tagId/entityType/entityId
+// with "|" to derive the stream id — a literal "|" in entityType/entityId
+// could shift tuple boundaries and collide with an unrelated combination.
+describe("assignTagPayloadSchema — no pipe in entityType/entityId", () => {
+  test("accepts normal values", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit",
+      entityId: "entity-1",
+    });
+    expect(parsed.success).toBe(true);
+  });
+
+  test("rejects a pipe in entityType", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit|forged",
+      entityId: "entity-1",
+    });
+    expect(parsed.success).toBe(false);
+  });
+
+  test("rejects a pipe in entityId", () => {
+    const parsed = assignTagPayloadSchema.safeParse({
+      tagId: "tag-1",
+      entityType: "credit",
+      entityId: "entity|forged",
+    });
+    expect(parsed.success).toBe(false);
+  });
+});

package/src/tags/__tests__/tags.integration.test.ts

@@ -358,6 +358,11 @@ describe("tags integration — multi-tenant isolation", () => {
 // "Admin", not "TenantAdmin"). Default-mounted tags deny that same user.
 describe("tags integration — openToAll access model", () => {
   let openStack: TestStack;
+  // Dedicated stack (477/1), not the outer file's `stack` — a describe-level
+  // `--test-name-pattern` run of just this block would otherwise crash on an
+  // undefined outer `stack` instead of failing cleanly, and this block
+  // shouldn't depend on describe-execution order for its setup to exist.
+  let defaultStack: TestStack;
   // role deliberately not in DEFAULT_TAG_ROLES nor "Admin" — proves openToAll,
   // not an accidental role match.
   const unprivileged = createTestUser({ roles: ["Viewer"] });
@@ -369,10 +374,16 @@ describe("tags integration — openToAll access model", () => {
     await unsafeCreateEntityTable(openStack.db, tagEntity);
     await unsafeCreateEntityTable(openStack.db, tagAssignmentEntity);
     await createEventsTable(openStack.db);
+
+    defaultStack = await setupTestStack({ features: [tagsFeature] });
+    await unsafeCreateEntityTable(defaultStack.db, tagEntity);
+    await unsafeCreateEntityTable(defaultStack.db, tagAssignmentEntity);
+    await createEventsTable(defaultStack.db);
   });
 
   afterAll(async () => {
     await openStack.cleanup();
+    await defaultStack.cleanup();
   });
 
   test("a non-tag-role user can create, assign, list and remove", async () => {
@@ -409,7 +420,7 @@ describe("tags integration — openToAll access model", () => {
   });
 
   test("the SAME user is denied on a default-role-mounted feature", async () => {
-    const denied = await stack.http.writeErr(
+    const denied = await defaultStack.http.writeErr(
       TagsHandlers.createTag,
       { name: "nope" },
       unprivileged,

package/src/tags/entity.ts

@@ -6,7 +6,12 @@ import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/eng
 export const tagEntity = createEntity({
   table: "read_tags",
   fields: {
-    name: createTextField({ required: true, maxLength: 64 }),
+    // Catalog labels ("urgent", "billing"), not user-identifying content —
+    // allowPlaintext silences the user-content heuristic (456/5). A tenant
+    // COULD name a tag after a person; if that becomes a real requirement,
+    // this needs a userOwned annotation + forget/export hooks in the
+    // user-data-rights pipeline (none exist for tags today).
+    name: createTextField({ required: true, maxLength: 64, allowPlaintext: "catalog-label" }),
     // Optional UI hint (hex or token). No enforcement — purely for rendering.
     color: createTextField({ maxLength: 32 }),
     // Optional entity-type scope (GitLab project-vs-group labels): empty = global

package/src/tags/feature.ts

@@ -29,6 +29,7 @@ import { createCreateTagHandler } from "./handlers/create-tag.write";
 import { createDeleteTagHandler } from "./handlers/delete-tag.write";
 import { createRemoveTagHandler } from "./handlers/remove-tag.write";
 import { createUpdateTagHandler } from "./handlers/update-tag.write";
+import { TAGS_FEATURE_I18N } from "./i18n";
 
 // Opt-in tier-gating: when set, the feature declares itself r.toggleable so the
 // dispatcher gate + feature-toggles + tier-engine can switch the WHOLE feature
@@ -76,6 +77,7 @@ function registerTags(
     renderer: { react: { __component: "TagsScreen" } },
     access,
   });
+  r.translations({ keys: TAGS_FEATURE_I18N });
 }
 
 export const tagsFeature = defineFeature(TAGS_FEATURE_NAME, (r) =>

package/src/tags/i18n.ts

@@ -0,0 +1,5 @@
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const TAGS_FEATURE_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:tag-list.title": { de: "Tags", en: "Tags" },
+};

package/src/tags/schemas.ts

@@ -41,10 +41,17 @@ export const deleteTagPayloadSchema = z.object({
 export type DeleteTagPayload = z.infer<typeof deleteTagPayloadSchema>;
 
 // assign + remove share the (tag, entity) reference shape.
+// entityType/entityId are app-supplied, unlike tagId (always a real tag's
+// UUID) — tagAssignmentAggregateId joins all four with "|" to derive the
+// stream id, so a literal "|" in either could shift tuple boundaries and
+// collide with an unrelated (tenant, tag, entity) combination (456/3).
+// Rejecting it here is cheaper and non-breaking compared to changing the
+// derivation's separator, which would re-key every existing stream.
+const NO_PIPE = /^[^|]*$/;
 const entityTagRef = {
   tagId: z.string().min(1).max(64),
-  entityType: z.string().min(1).max(64),
-  entityId: z.string().min(1).max(128),
+  entityType: z.string().min(1).max(64).regex(NO_PIPE, 'entityType must not contain "|"'),
+  entityId: z.string().min(1).max(128).regex(NO_PIPE, 'entityId must not contain "|"'),
 } as const;
 
 export const assignTagPayloadSchema = z.object(entityTagRef);

package/src/tags/web/__tests__/tag-manager.test.tsx

@@ -0,0 +1,333 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+import {
+  createStaticLocaleResolver,
+  LocaleProvider,
+  PrimitivesProvider,
+} from "@cosmicdrift/kumiko-renderer";
+import { defaultPrimitives } from "@cosmicdrift/kumiko-renderer-web";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { TagsHandlers, TagsQueries } from "../../constants";
+import { defaultTranslations } from "../i18n";
+import { TagManager } from "../tag-manager";
+
+type TagRow = { id: string; name: string; color?: string; scope?: string; version: number };
+type AssignmentRow = { tagId: string };
+
+let catalogRows: readonly TagRow[] = [];
+let assignmentRows: readonly AssignmentRow[] = [];
+let catalogLoading = false;
+let catalogData: { rows: readonly TagRow[] } | null = { rows: catalogRows };
+let catalogError: { i18nKey: string; i18nParams?: Record<string, unknown> } | null = null;
+let assignmentError: { i18nKey: string; i18nParams?: Record<string, unknown> } | null = null;
+
+beforeEach(() => {
+  catalogRows = [{ id: "t1", name: "urgent", color: "#ef4444", version: 1 }];
+  assignmentRows = [{ tagId: "t1" }, { tagId: "t1" }];
+  catalogLoading = false;
+  catalogData = { rows: catalogRows };
+  catalogError = null;
+  assignmentError = null;
+  dispatchSpy.mockClear();
+  catalogRefetch.mockClear();
+  assignmentsRefetch.mockClear();
+});
+
+const dispatchSpy = mock(async (type: string) =>
+  type === TagsHandlers.createTag
+    ? { isSuccess: true, data: { id: "tag-new" } }
+    : { isSuccess: true, data: undefined },
+);
+
+const catalogRefetch = mock(async () => {});
+const assignmentsRefetch = mock(async () => {});
+
+const useQuerySpy = mock((type: string) => {
+  if (type === TagsQueries.tagList) {
+    return {
+      data: catalogData,
+      loading: catalogLoading,
+      error: catalogError,
+      refetch: catalogRefetch,
+    };
+  }
+  return {
+    data: { rows: assignmentRows },
+    loading: false,
+    error: assignmentError,
+    refetch: assignmentsRefetch,
+  };
+});
+
+const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
+mock.module("@cosmicdrift/kumiko-renderer", () => ({
+  ...actual_renderer,
+  useDispatcher: mock(() => ({ write: dispatchSpy, query: mock(), batch: mock() })),
+  useQuery: useQuerySpy,
+}));
+
+function Wrapper({ children }: { readonly children: ReactNode }): ReactNode {
+  return (
+    <LocaleProvider resolver={createStaticLocaleResolver()} fallbackBundles={[defaultTranslations]}>
+      <PrimitivesProvider value={defaultPrimitives}>{children}</PrimitivesProvider>
+    </LocaleProvider>
+  );
+}
+
+describe("TagManager — loading and errors", () => {
+  test("shows loading banner while catalog is loading with no data yet", () => {
+    catalogLoading = true;
+    catalogData = null;
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-loading")).toBeTruthy();
+  });
+
+  test("shows error banner when catalog query fails", () => {
+    catalogError = { i18nKey: "tags.section.empty" };
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-error")).toBeTruthy();
+    expect(screen.getByText("No tags found.")).toBeTruthy();
+  });
+
+  test("shows empty banner when catalog has no rows", () => {
+    catalogRows = [];
+    catalogData = { rows: catalogRows };
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-empty")).toBeTruthy();
+  });
+});
+
+describe("TagManager — catalog CRUD", () => {
+  test("renders tag row with scope label and usage count", () => {
+    catalogRows = [{ id: "t2", name: "note-tag", color: "#22c55e", scope: "note", version: 1 }];
+    catalogData = { rows: catalogRows };
+    assignmentRows = [{ tagId: "t2" }];
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    expect(screen.getByTestId("tag-manager-row-t2")).toBeTruthy();
+    expect(screen.getByText("@note")).toBeTruthy();
+    expect(screen.getByText("1×")).toBeTruthy();
+  });
+
+  test("create dispatches write with trimmed name/color/scope and refetches", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "  new-tag  " },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-new-color-swatch-#22c55e"));
+    fireEvent.change(document.getElementById("tag-manager-new-scope") as HTMLInputElement, {
+      target: { value: " note " },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.createTag, {
+        name: "new-tag",
+        color: "#22c55e",
+        scope: "note",
+      }),
+    );
+    await waitFor(() => expect(catalogRefetch).toHaveBeenCalled());
+    await waitFor(() => expect(assignmentsRefetch).toHaveBeenCalled());
+  });
+
+  test("create button stays disabled for empty trimmed name", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    const create = screen.getByTestId("tag-manager-create") as HTMLButtonElement;
+    expect(create.disabled).toBe(true);
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "   " },
+    });
+    expect(create.disabled).toBe(true);
+  });
+
+  test("save edit dispatches update and closes edit form", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+    expect(screen.getByTestId("tag-manager-edit-t1")).toBeTruthy();
+
+    fireEvent.change(document.getElementById("tag-edit-name-t1") as HTMLInputElement, {
+      target: { value: "renamed" },
+    });
+    fireEvent.click(screen.getByTestId("tag-edit-color-t1-swatch-#3b82f6"));
+    fireEvent.click(screen.getByTestId("tag-manager-save-t1"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.updateTag, {
+        id: "t1",
+        version: 1,
+        name: "renamed",
+        color: "#3b82f6",
+        scope: "",
+      }),
+    );
+    await waitFor(() => expect(screen.queryByTestId("tag-manager-edit-t1")).toBeNull());
+  });
+
+  test("cancel edit closes edit form without write", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+    fireEvent.click(screen.getByText("Cancel"));
+    expect(screen.queryByTestId("tag-manager-edit-t1")).toBeNull();
+    expect(dispatchSpy).not.toHaveBeenCalled();
+  });
+
+  test("delete confirm dispatches deleteTag and refetches", async () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-delete-btn-t1"));
+    expect(screen.getByTestId("tag-manager-delete-dialog")).toBeTruthy();
+    fireEvent.click(screen.getByTestId("tag-manager-delete-dialog-confirm"));
+
+    await waitFor(() =>
+      expect(dispatchSpy).toHaveBeenCalledWith(TagsHandlers.deleteTag, { id: "t1" }),
+    );
+    await waitFor(() => expect(catalogRefetch).toHaveBeenCalled());
+  });
+
+  test("failed write shows action error banner", async () => {
+    dispatchSpy.mockImplementationOnce(
+      async () =>
+        ({ isSuccess: false, error: { i18nKey: "tags.section.empty" } }) as {
+          isSuccess: boolean;
+          data?: { id: string } | undefined;
+          error?: { i18nKey: string };
+        },
+    );
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "fail-tag" },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() => expect(screen.getByTestId("tag-manager-action-error")).toBeTruthy());
+  });
+});
+
+// 695/4: saveEdit silently no-ops on an empty trimmed name — the Save button
+// must reflect that in its disabled state, not just in the click handler.
+describe("TagManager — edit Save button", () => {
+  test("Save is disabled once the name is cleared to empty/whitespace", () => {
+    render(
+      <Wrapper>
+        <TagManager />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-edit-btn-t1"));
+
+    const save = screen.getByTestId("tag-manager-save-t1") as HTMLButtonElement;
+    expect(save.disabled).toBe(false);
+
+    const nameInput = document.getElementById("tag-edit-name-t1") as HTMLInputElement;
+    fireEvent.change(nameInput, { target: { value: "   " } });
+    expect(save.disabled).toBe(true);
+
+    fireEvent.change(nameInput, { target: { value: "renamed" } });
+    expect(save.disabled).toBe(false);
+  });
+});
+
+describe("TagManager — selection mode", () => {
+  test("filters tags by entityType scope and toggles selection", () => {
+    catalogRows = [
+      { id: "t1", name: "global", version: 1 },
+      { id: "t2", name: "note-only", scope: "note", version: 1 },
+      { id: "t3", name: "other", scope: "task", version: 1 },
+    ];
+    catalogData = { rows: catalogRows };
+    const onChange = mock((next: readonly string[]) => next);
+    let selected: readonly string[] = ["t1"];
+
+    render(
+      <Wrapper>
+        <TagManager
+          entityType="note"
+          selection={{
+            value: selected,
+            onChange: (next) => {
+              selected = next;
+              onChange(next);
+            },
+          }}
+        />
+      </Wrapper>,
+    );
+
+    expect(screen.getByTestId("tag-manager-row-t1")).toBeTruthy();
+    expect(screen.getByTestId("tag-manager-row-t2")).toBeTruthy();
+    expect(screen.queryByTestId("tag-manager-row-t3")).toBeNull();
+    expect(screen.queryByTestId("tag-manager-new-scope")).toBeNull();
+
+    fireEvent.click(screen.getByTestId("tag-manager-toggle-t2"));
+    expect(onChange).toHaveBeenCalledWith(["t1", "t2"]);
+
+    fireEvent.click(screen.getByTestId("tag-manager-toggle-t1"));
+    expect(onChange).toHaveBeenCalledWith([]);
+  });
+
+  test("create in selection mode adds new tag id to selection", async () => {
+    const onChange = mock((next: readonly string[]) => next);
+    render(
+      <Wrapper>
+        <TagManager entityType="note" selection={{ value: [], onChange }} />
+      </Wrapper>,
+    );
+    fireEvent.change(document.getElementById("tag-manager-new-name") as HTMLInputElement, {
+      target: { value: "picked" },
+    });
+    fireEvent.click(screen.getByTestId("tag-manager-create"));
+
+    await waitFor(() => expect(onChange).toHaveBeenCalledWith(["tag-new"]));
+  });
+
+  test("delete removes tag from selection when it was selected", async () => {
+    const onChange = mock((next: readonly string[]) => next);
+    render(
+      <Wrapper>
+        <TagManager selection={{ value: ["t1"], onChange }} />
+      </Wrapper>,
+    );
+    fireEvent.click(screen.getByTestId("tag-manager-delete-btn-t1"));
+    fireEvent.click(screen.getByTestId("tag-manager-delete-dialog-confirm"));
+
+    await waitFor(() => expect(onChange).toHaveBeenCalledWith([]));
+  });
+});

package/src/tags/web/__tests__/tag-section.test.tsx

@@ -22,6 +22,8 @@ let assignmentRows: readonly AssignmentRow[] = [];
 beforeEach(() => {
   catalogRows = [];
   assignmentRows = [];
+  catalogRefetch.mockClear();
+  assignmentsRefetch.mockClear();
 });
 
 const dispatchSpy = mock(async (type: string) =>
@@ -30,11 +32,13 @@ const dispatchSpy = mock(async (type: string) =>
     : { isSuccess: true, data: undefined },
 );
 
+const catalogRefetch = mock(async () => {});
+const assignmentsRefetch = mock(async () => {});
 const useQuerySpy = mock((type: string) => ({
   data: type === TagsQueries.tagList ? { rows: catalogRows } : { rows: assignmentRows },
   loading: false,
   error: null,
-  refetch: mock(async () => {}),
+  refetch: type === TagsQueries.tagList ? catalogRefetch : assignmentsRefetch,
 }));
 
 const actual_renderer = await import("@cosmicdrift/kumiko-renderer");
@@ -63,6 +67,13 @@ const StubPicker = ({
     <button type="button" data-testid="picker-add-t2" onClick={() => onChange([...value, "t2"])}>
       add t2
     </button>
+    <button
+      type="button"
+      data-testid="picker-add-t2-t3"
+      onClick={() => onChange([...value, "t2", "t3"])}
+    >
+      add t2+t3
+    </button>
     <button
       type="button"
       data-testid="picker-remove-t1"
@@ -169,6 +180,41 @@ describe("TagSection", () => {
     );
   });
 
+  test("partial write failure still refetches — no stale UI for the writes that succeeded", async () => {
+    catalogRows = [
+      { id: "t1", name: "important" },
+      { id: "t2", name: "project-x" },
+      { id: "t3", name: "urgent" },
+    ];
+    assignmentRows = [{ tagId: "t1", entityType: "note", entityId: "note-1" }];
+    dispatchSpy.mockClear();
+    dispatchSpy.mockImplementation(async (_type: string, payload?: Record<string, unknown>) =>
+      payload?.["tagId"] === "t3"
+        ? { isSuccess: false, error: { i18nKey: "tags.error.assignFailed" } }
+        : { isSuccess: true, data: undefined },
+    );
+
+    render(
+      <Wrapper>
+        <TagSection entityName="note" entityId="note-1" />
+      </Wrapper>,
+    );
+
+    // t2 assigns OK, t3 fails — the loop stops, but refetch must still run so
+    // the UI reflects the t2 write that already succeeded server-side.
+    fireEvent.click(screen.getByTestId("picker-add-t2-t3"));
+    await waitFor(() => expect(screen.getByTestId("tags-section-action-error")).toBeTruthy());
+
+    expect(catalogRefetch).toHaveBeenCalled();
+    expect(assignmentsRefetch).toHaveBeenCalled();
+
+    dispatchSpy.mockImplementation(async (type: string) =>
+      type === TagsHandlers.createTag
+        ? { isSuccess: true, data: { id: "tag-new" } }
+        : { isSuccess: true, data: undefined },
+    );
+  });
+
   test("create-mode (no entityId yet) shows the save-first hint instead of the section", () => {
     render(
       <Wrapper>

package/src/tags/web/tag-manager.tsx

@@ -308,7 +308,7 @@ export function TagManager({
                 <div className="flex gap-2">
                   <Button
                     variant="primary"
-                    disabled={busy}
+                    disabled={busy || editName.trim() === ""}
                     onClick={() => saveEdit(tag)}
                     testId={`tag-manager-save-${tag.id}`}
                   >

package/src/tags/web/tag-section.tsx

@@ -119,14 +119,17 @@ export function TagSection({
       try {
         for (const tagId of added) {
           if (!(await writeOk(TagsHandlers.assignTag, { tagId, entityType: entityName, entityId })))
-            return;
+            break;
         }
         for (const tagId of removed) {
           if (!(await writeOk(TagsHandlers.removeTag, { tagId, entityType: entityName, entityId })))
-            return;
+            break;
         }
-        await refetch();
       } finally {
+        // Unconditional: even a partial failure may have persisted some
+        // writes server-side — skipping refetch here would leave the UI
+        // stale relative to those, undetected until the next interaction.
+        await refetch();
         setBusy(false);
       }
     })();

package/src/template-resolver/testing.ts

@@ -74,10 +74,11 @@ export async function assertConsumerHandlesNotFound(
   const { tenantId } = opts;
   let rejected = false;
   let err: unknown;
+  const slug = `conformance-not-found-${crypto.randomUUID()}`;
   try {
     await consumer.resolve({
       tenantId,
-      slug: "conformance-not-found-slug",
+      slug,
       kind: "mail-html",
       locale: "de",
     });