@cosmicdrift/kumiko-framework 0.132.0 → 0.134.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.132.0",
+  "version": "0.134.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -189,7 +189,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.132.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.134.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/db/__tests__/assert-no-unreachable-live-rows.integration.test.ts

@@ -0,0 +1,139 @@
+// Runtime guard #722: before the rebuild swaps the shadow over the live table,
+// abort if a live row has NO event in the projection's source streams — a row
+// no replay can reconstruct (#498 ghost, direct-inserted without a .created
+// event), which the swap would silently drop.
+//
+// The guard is deliberately narrow (event EXISTENCE only, not a column diff):
+// the framework legitimately makes live diverge from a fresh replay in shipped
+// ways (blind-index erase→NULL, sensitive-strip, archived-stream wipe, the #494
+// backfill flow). Those rows all HAVE an event, so they are not ghosts and the
+// guard leaves them alone — proven by the "direct column-write" test below.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient, insertOne, selectMany } from "../../db/query";
+import { createBooleanField, createEntity, createTextField, defineFeature } from "../../engine";
+import { createRegistry } from "../../engine/registry";
+import { createEventsTable } from "../../event-store";
+import { rebuildProjection } from "../../pipeline";
+import { createProjectionStateTable } from "../../pipeline/projection-state";
+import { TestUsers, unsafeCreateEntityTable } from "../../stack";
+import { ensureTemporalPolyfill } from "../../time/polyfill";
+import { createEventStoreExecutor } from "../event-store-executor";
+import { buildEntityTable } from "../table-builder";
+import { createTenantDb, type TenantDb } from "../tenant-db";
+
+const userEntity = createEntity({
+  table: "read_unreachable_users",
+  fields: {
+    email: createTextField({ required: true }),
+    firstName: createTextField(),
+    isEnabled: createBooleanField({ default: true }),
+  },
+  softDelete: true,
+});
+
+const userFeature = defineFeature("unreachabletest", (r) => {
+  r.entity("user", userEntity);
+});
+
+const userTable = buildEntityTable("user", userEntity);
+const projectionName = "unreachabletest:projection:user-entity";
+const registry = createRegistry([userFeature]);
+
+let testDb: BunTestDb;
+let tdb: TenantDb;
+const adminUser = TestUsers.admin;
+
+beforeAll(async () => {
+  await ensureTemporalPolyfill();
+  testDb = await createTestDb();
+  await unsafeCreateEntityTable(testDb.db, userEntity, "user");
+  await createEventsTable(testDb.db);
+  await createProjectionStateTable(testDb.db);
+  tdb = createTenantDb(testDb.db, adminUser.tenantId);
+});
+
+afterAll(async () => {
+  await testDb.cleanup();
+});
+
+beforeEach(async () => {
+  await asRawClient(testDb.db).unsafe(
+    `TRUNCATE kumiko_events, read_unreachable_users, kumiko_projections RESTART IDENTITY CASCADE`,
+  );
+});
+
+async function snapshotTable(): Promise<readonly Record<string, unknown>[]> {
+  const rows = await selectMany(
+    testDb.db,
+    userTable,
+    {},
+    { orderBy: { col: "id", direction: "asc" } },
+  );
+  return rows as readonly Record<string, unknown>[];
+}
+
+describe("assert-no-unreachable-live-rows / #722 ghost-row guard", () => {
+  test("clean executor-only projection rebuilds without firing the guard", async () => {
+    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+    await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
+    await crud.create({ email: "b@test.de", firstName: "Bob" }, adminUser, tdb);
+    const before = await snapshotTable();
+
+    const result = await rebuildProjection(projectionName, { db: testDb.db, registry });
+
+    expect(result.eventsProcessed).toBe(2);
+    expect(await snapshotTable()).toEqual(before);
+  });
+
+  test("ghost row (no backing event) → swap aborts, live untouched", async () => {
+    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+    const a = await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
+    if (!a.isSuccess) throw new Error("setup failed");
+
+    // Drift: clone the event-backed row into a second id WITHOUT appending an
+    // event — the #498 ghost. No replay can ever reconstruct it.
+    const [liveRow] = await selectMany(testDb.db, userTable, { id: a.data.id as string });
+    if (!liveRow) throw new Error("live row missing");
+    const ghostId = crypto.randomUUID();
+    // Deliberately bypass the EXECUTOR_ONLY brand: the whole point is to write
+    // the entity table WITHOUT going through the executor — the production bug
+    // the guard defends against.
+    const writable = userTable as unknown as Parameters<typeof insertOne>[1];
+    await insertOne(tdb, writable, { ...liveRow, id: ghostId, email: "ghost@test.de" });
+    expect(await snapshotTable()).toHaveLength(2);
+
+    await expect(rebuildProjection(projectionName, { db: testDb.db, registry })).rejects.toThrow(
+      /have no\s+event in the projection's source streams/,
+    );
+
+    // Swap never ran: both rows — including the ghost — survive.
+    const after = await snapshotTable();
+    expect(after).toHaveLength(2);
+    expect(after.map((r) => r["id"])).toContain(ghostId);
+  });
+
+  test("direct column-write on an event-backed row does NOT trip the guard", async () => {
+    // The row has a .created event, so it is not a ghost. Its column state was
+    // direct-written without an event (the #494 / blind-index-erase class) — the
+    // guard is event-existence-only and leaves it alone; the replay overwrites
+    // the column from the event, which is the intended, shipped behavior.
+    const crud = createEventStoreExecutor(userTable, userEntity, { entityName: "user" });
+    const a = await crud.create({ email: "a@test.de", firstName: "Alice" }, adminUser, tdb);
+    if (!a.isSuccess) throw new Error("setup failed");
+
+    await asRawClient(testDb.db).unsafe(
+      `UPDATE read_unreachable_users SET first_name = 'DirectWrite' WHERE id = $1`,
+      [a.data.id],
+    );
+
+    // No throw — the row is event-backed. Rebuild replays the create event.
+    await rebuildProjection(projectionName, { db: testDb.db, registry });
+
+    const [rebuilt] = await selectMany(testDb.db, userTable, { id: a.data.id as string });
+    expect(rebuilt?.["email"]).toBe("a@test.de");
+    // The direct write is overwritten by the replay — deliberately allowed.
+    expect(rebuilt?.["firstName"]).toBe("Alice");
+  });
+});

package/src/db/queries/shadow-swap.ts

@@ -149,6 +149,68 @@ export async function fenceLiveTable(
   await raw.unsafe(`LOCK TABLE public.${quoteTableIdent(tableName)} IN ACCESS EXCLUSIVE MODE`);
 }
 
+// Ids reported when the swap is aborted — enough to locate the ghost rows
+// without dumping an unbounded set into the log.
+const UNREACHABLE_SAMPLE_LIMIT = 20;
+
+// Runs INSIDE the rebuild tx, under the fence, before swapShadowIntoLive. A live
+// row whose aggregate id has NO event in the projection's source streams is
+// UNREACHABLE: no replay can ever reconstruct it, so the swap would silently
+// drop it. That is the #498 ghost — a row direct-inserted without ever emitting
+// a .created event. The static CI guard cannot see it in data that already
+// exists in production, or on table identifiers it couldn't resolve; this
+// catches it at cutover and aborts (tx rolls back, live untouched).
+//
+// Deliberately NARROW — event EXISTENCE only, not a column or row-vs-shadow
+// diff. The framework legitimately makes live diverge from a fresh replay in
+// several SHIPPED ways, none of which is drift:
+//   - a blind-index column recomputed to NULL after the subject's key is
+//     shredded (GDPR erase) — the NULL is the intended end state;
+//   - a `sensitive` column stripped from the event log by design;
+//   - an archived stream that stops replaying (fw#832) — the row's wipe is the
+//     intended tombstone behavior, reported via backfill's `failed` list;
+//   - a legacy column direct-written before its handler emitted events, healed
+//     by the #494 backfill-then-rebuild flow.
+// Checking event existence INCLUDING archived streams leaves every one of them
+// alone: those rows all have a real event, so they are not ghosts. Column-level
+// drift detection (fail-hard vs. graceful repair) is the open question deferred
+// from #722.
+//
+// Implicit projections only (caller-gated). aggregate_id and the entity id are
+// both uuid, so the anti-join probes the events index without a cast.
+export async function assertNoUnreachableLiveRows(
+  tx: AnyDb,
+  projectionName: string,
+  tableName: string,
+  aggregateTypes: readonly string[],
+): Promise<void> {
+  // skip: no source streams → no events could back any row anyway; a rebuild
+  // of a subscription-less projection swaps an empty shadow (handled upstream).
+  if (aggregateTypes.length === 0) return;
+  const raw = asRawClient(tx);
+  const t = quoteTableIdent(tableName);
+  const ghosts = await raw.unsafe<{ id: unknown }>(
+    `SELECT l."id" FROM public.${t} l
+     WHERE NOT EXISTS (
+       SELECT 1 FROM "kumiko_events" e
+        WHERE e."aggregate_id" = l."id" AND e."aggregate_type" = ANY($1::text[])
+     )
+     LIMIT ${UNREACHABLE_SAMPLE_LIMIT}`,
+    [aggregateTypes],
+  );
+  // skip: every live row has a backing event — nothing unreachable, swap is safe
+  if (ghosts.length === 0) return;
+  const ids = ghosts.map((r) => String(r.id));
+  throw new Error(
+    `projection-rebuild "${projectionName}": ${ids.length}+ live rows in "${tableName}" have no ` +
+      `event in the projection's source streams and cannot be reconstructed by replay — the swap ` +
+      `would silently drop them (ids: ${ids.join(", ")}). A handler direct-inserted these rows ` +
+      `without emitting a .created event. Fix: register the table with r.unmanagedTable(meta, ` +
+      `{ reason }) to opt out of rebuild, or emit the missing events. See ` +
+      `docs/reference/entity-write-patterns.md. Rebuild aborted; live table untouched.`,
+  );
+}
+
 // Atomic swap, INSIDE the rebuild tx, AFTER replay. Schema-qualified so the
 // active shadow search_path can't redirect them. DROP without CASCADE: if any
 // object depends on the live table the swap fails loud and the whole rebuild

package/src/engine/__tests__/boot-validator-dashboard.test.ts

@@ -12,15 +12,25 @@ const STAT_PANEL = {
   valueField: "count",
 } as const;
 
-function dashboardFeature(panels: DashboardScreenDefinition["panels"]) {
+function dashboardFeature(
+  panels: DashboardScreenDefinition["panels"],
+  filter?: DashboardScreenDefinition["filter"],
+) {
   return defineFeature("demo", (r) => {
-    r.screen({ id: "overview", type: "dashboard", panels });
+    r.screen({
+      id: "overview",
+      type: "dashboard",
+      panels,
+      ...(filter !== undefined && { filter }),
+    });
     r.translations({
       keys: {
         "screen:overview.title": { de: "Übersicht", en: "Overview" },
         "demo:dashboard:panel:open-incidents": { de: "Offene Vorfälle", en: "Open incidents" },
         "demo:dashboard:panel:latest": { de: "Neueste", en: "Latest" },
         "demo:dashboard:col:name": { de: "Name", en: "Name" },
+        "demo:dashboard:group:net-worth": { de: "Net Worth", en: "Net Worth" },
+        "demo:dashboard:filter:region": { de: "Region", en: "Region" },
       },
     });
   });
@@ -90,4 +100,128 @@ describe("validateBoot — dashboard screens", () => {
     expect(keys).toContain("demo:dashboard:panel:latest");
     expect(keys).toContain("demo:dashboard:col:name");
   });
+
+  test("accepts a stat-group, feed, progress-list and custom panel", () => {
+    const feature = dashboardFeature(
+      [
+        {
+          kind: "stat-group",
+          id: "net-worth",
+          label: "demo:dashboard:group:net-worth",
+          stats: [STAT_PANEL],
+        },
+        {
+          kind: "feed",
+          id: "upcoming",
+          label: "demo:dashboard:panel:latest",
+          query: "demo:query:incident:latest",
+        },
+        {
+          kind: "progress-list",
+          id: "progress",
+          label: "demo:dashboard:panel:latest",
+          query: "demo:query:incident:latest",
+        },
+        {
+          kind: "custom",
+          id: "custom-panel",
+          component: { react: { __component: "demo-custom" } },
+        },
+      ],
+      {
+        id: "region",
+        label: "demo:dashboard:filter:region",
+        kind: "select",
+        options: [{ value: "eu", label: "demo:dashboard:filter:region" }],
+      },
+    );
+    expect(() => validateBoot([feature])).not.toThrow();
+  });
+
+  test("rejects a stat-group with an empty stats list", () => {
+    const feature = dashboardFeature([
+      { kind: "stat-group", id: "net-worth", label: "demo:dashboard:group:net-worth", stats: [] },
+    ]);
+    expect(() => validateBoot([feature])).toThrow(/empty stats list/);
+  });
+
+  test("rejects a duplicate id nested inside a stat-group", () => {
+    const feature = dashboardFeature([
+      STAT_PANEL,
+      {
+        kind: "stat-group",
+        id: "net-worth",
+        label: "demo:dashboard:group:net-worth",
+        stats: [STAT_PANEL],
+      },
+    ]);
+    expect(() => validateBoot([feature])).toThrow(/duplicate panel id/);
+  });
+
+  test("rejects a custom panel without a react/native component", () => {
+    const feature = dashboardFeature([{ kind: "custom", id: "custom-panel", component: {} }]);
+    expect(() => validateBoot([feature])).toThrow(/has no component/);
+  });
+
+  test("rejects a filter that sets neither options nor optionsQuery", () => {
+    const feature = dashboardFeature([STAT_PANEL], {
+      id: "region",
+      label: "demo:dashboard:filter:region",
+      kind: "select",
+    });
+    expect(() => validateBoot([feature])).toThrow(/exactly one of/);
+  });
+
+  test("rejects a filter that sets both options and optionsQuery", () => {
+    const feature = dashboardFeature([STAT_PANEL], {
+      id: "region",
+      label: "demo:dashboard:filter:region",
+      kind: "select",
+      options: [{ value: "eu", label: "demo:dashboard:filter:region" }],
+      optionsQuery: "demo:query:folder:list",
+    });
+    expect(() => validateBoot([feature])).toThrow(/exactly one of/);
+  });
+
+  test("rejects a filter with an empty options list", () => {
+    const feature = dashboardFeature([STAT_PANEL], {
+      id: "region",
+      label: "demo:dashboard:filter:region",
+      kind: "select",
+      options: [],
+    });
+    expect(() => validateBoot([feature])).toThrow(/filter.options is empty/);
+  });
+
+  test("requiredKeysFromScreen sammelt stat-group-Kinder- und Filter-Labels, aber keine custom-Panel-Keys", () => {
+    const screen: DashboardScreenDefinition = {
+      id: "overview",
+      type: "dashboard",
+      filter: {
+        id: "region",
+        label: "demo:dashboard:filter:region",
+        kind: "select",
+        options: [{ value: "eu", label: "demo:dashboard:col:name" }],
+      },
+      panels: [
+        {
+          kind: "stat-group",
+          id: "net-worth",
+          label: "demo:dashboard:group:net-worth",
+          stats: [STAT_PANEL],
+        },
+        {
+          kind: "custom",
+          id: "custom-panel",
+          component: { react: { __component: "demo-custom" } },
+        },
+      ],
+    };
+    const keys = requiredKeysFromScreen("demo", screen);
+    expect(keys).toContain("demo:dashboard:group:net-worth");
+    expect(keys).toContain("demo:dashboard:panel:open-incidents");
+    expect(keys).toContain("demo:dashboard:filter:region");
+    expect(keys).toContain("demo:dashboard:col:name");
+    expect(keys).not.toContain("custom-panel");
+  });
 });

package/src/engine/__tests__/boot-validator-located-timestamps.test.ts

@@ -7,25 +7,9 @@
 import { describe, expect, test } from "bun:test";
 import { validateBoot } from "../boot-validator";
 import { defineFeature } from "../define-feature";
-import { createEntity, createTimestampField, createTzField, locatedTimestamp } from "../factories";
+import { createEntity, createTimestampField, createTzField } from "../factories";
 
 describe("validateBoot — locatedBy markers", () => {
-  test("locatedTimestamp(name) Helper-Pair passiert validiert (positive case)", () => {
-    const feature = defineFeature("test", (r) => {
-      r.entity(
-        "order",
-        createEntity({
-          fields: {
-            ...locatedTimestamp("pickup"),
-            ...locatedTimestamp("delivery"),
-          },
-        }),
-      );
-    });
-
-    expect(() => validateBoot([feature])).not.toThrow();
-  });
-
   test("manuelle Konstruktion mit korrektem Pair passiert (positive case)", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
@@ -75,7 +59,7 @@ describe("validateBoot — locatedBy markers", () => {
     expect(() => validateBoot([feature])).toThrow(/expected "tz"/);
   });
 
-  test("Fehlermeldung verweist auf locatedTimestamp-Helper als Fix", () => {
+  test("Fehlermeldung verweist auf createLocatedTimestampField als Fix", () => {
     const feature = defineFeature("test", (r) => {
       r.entity(
         "order",
@@ -87,7 +71,7 @@ describe("validateBoot — locatedBy markers", () => {
       );
     });
 
-    expect(() => validateBoot([feature])).toThrow(/locatedTimestamp\("pickup"\)/);
+    expect(() => validateBoot([feature])).toThrow(/createLocatedTimestampField/);
   });
 
   test("Timestamp ohne locatedBy ist OK (reiner UTC-Instant)", () => {

package/src/engine/__tests__/deep-link.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from "bun:test";
+import { buildDeepLinkUrl } from "../deep-link";
+
+describe("buildDeepLinkUrl()", () => {
+  test("screenId only", () => {
+    expect(buildDeepLinkUrl("https://app.example.com", { screenId: "jobs" })).toBe(
+      "https://app.example.com/jobs",
+    );
+  });
+
+  test("screenId + entityId", () => {
+    expect(
+      buildDeepLinkUrl("https://app.example.com", { screenId: "jobs", entityId: "job-1" }),
+    ).toBe("https://app.example.com/jobs/job-1");
+  });
+
+  test("workspaceId + screenId + entityId, in path order", () => {
+    expect(
+      buildDeepLinkUrl("https://app.example.com", {
+        workspaceId: "admin",
+        screenId: "jobs",
+        entityId: "job-1",
+      }),
+    ).toBe("https://app.example.com/admin/jobs/job-1");
+  });
+
+  test("strips trailing slash(es) from baseUrl", () => {
+    expect(buildDeepLinkUrl("https://app.example.com/", { screenId: "jobs" })).toBe(
+      "https://app.example.com/jobs",
+    );
+    expect(buildDeepLinkUrl("https://app.example.com//", { screenId: "jobs" })).toBe(
+      "https://app.example.com/jobs",
+    );
+  });
+});

package/src/engine/__tests__/factories-time.test.ts

@@ -1,17 +1,12 @@
 // Unit-Tests für die neuen Time-Field-Factories
-// (createTimestampField, createTzField, locatedTimestamp).
+// (createTimestampField, createTzField, createLocatedTimestampField).
 //
 // Test-Fokus: korrektes Field-Shape + locatedBy-Marker-Verdrahtung. Die
 // echte TZ-Konvertierung (Wall-Clock ↔ UTC) testen wir später beim
 // DB-Wrapper-Schritt.
 
 import { describe, expect, test } from "bun:test";
-import {
-  createLocatedTimestampField,
-  createTimestampField,
-  createTzField,
-  locatedTimestamp,
-} from "../factories";
+import { createLocatedTimestampField, createTimestampField, createTzField } from "../factories";
 
 describe("createTimestampField", () => {
   test("default-Form ist nicht-required UTC-Instant ohne locatedBy", () => {
@@ -57,65 +52,6 @@ describe("createTzField", () => {
   });
 });
 
-describe("locatedTimestamp(name) Helper", () => {
-  test("erzeugt korrektes Pair aus <name>At + <name>Tz mit locatedBy-Verdrahtung", () => {
-    const fields = locatedTimestamp("pickup");
-    expect(fields).toEqual({
-      pickupAt: { type: "timestamp", locatedBy: "pickupTz" },
-      pickupTz: { type: "tz" },
-    });
-  });
-
-  test("required-Override propagiert auf BEIDE Felder", () => {
-    const fields = locatedTimestamp("delivery", { required: true });
-    expect(fields).toEqual({
-      deliveryAt: { type: "timestamp", locatedBy: "deliveryTz", required: true },
-      deliveryTz: { type: "tz", required: true },
-    });
-  });
-
-  test("access-Override propagiert auf BEIDE Felder (Field-Level Read-Access)", () => {
-    const fields = locatedTimestamp("internal", {
-      access: { read: ["Dispatcher"] },
-    });
-    expect(fields).toEqual({
-      internalAt: {
-        type: "timestamp",
-        locatedBy: "internalTz",
-        access: { read: ["Dispatcher"] },
-      },
-      internalTz: { type: "tz", access: { read: ["Dispatcher"] } },
-    });
-  });
-
-  test("locatedBy-Marker zeigt immer auf das EIGENE Tz-Feld (nicht auf einen anderen Namen)", () => {
-    // Das ist der Kern des Patterns — wenn die zwei Felder nicht
-    // konsistent verdrahtet sind, fliegt der Boot-Validator (kommt in
-    // späterer Iteration). Hier prüfen wir die Helper-Garantie.
-    for (const name of ["a", "x_y", "long_field_name"]) {
-      const fields = locatedTimestamp(name);
-      const at = fields[`${name}At`];
-      if (at?.type !== "timestamp") throw new Error("at field missing");
-      expect(at.locatedBy).toBe(`${name}Tz`);
-    }
-  });
-
-  test("Spread in createEntity-fields Kompositions-tauglich", () => {
-    // Realer Use-Case: pickup + delivery in einer Entity, plus normale Felder.
-    const entityFields = {
-      ...locatedTimestamp("pickup"),
-      ...locatedTimestamp("delivery"),
-      // Kein Konflikt zwischen den beiden Pairs.
-    };
-    expect(Object.keys(entityFields).sort()).toEqual([
-      "deliveryAt",
-      "deliveryTz",
-      "pickupAt",
-      "pickupTz",
-    ]);
-  });
-});
-
 describe("createLocatedTimestampField (Phase A — atomarer Field-Type)", () => {
   test("default-Form ist nicht-required mit type 'locatedTimestamp'", () => {
     expect(createLocatedTimestampField()).toEqual({

package/src/engine/__tests__/{visual-tree-patterns.test.ts → tree-actions-patterns.test.ts}

@@ -1,15 +1,5 @@
 import { describe, expect, test } from "bun:test";
 import { buildTarget, createRegistry, defineFeature } from "../index";
-import type { TreeChildrenSubscribe, TreeNode } from "../types/tree-node";
-
-// Stub-Provider für Tests. Form: (ctx) => (emit) => unsubscribe.
-// Emittet einmal initial, kein Cleanup nötig (no-op unsubscribe).
-function makeStubProvider(nodes: readonly TreeNode[]): TreeChildrenSubscribe {
-  return () => (emit) => {
-    emit(nodes);
-    return () => {};
-  };
-}
 
 describe("r.treeActions — registrar slot", () => {
   test("feature without r.treeActions leaves the slot undefined", () => {
@@ -63,80 +53,12 @@ describe("r.treeActions — registrar slot", () => {
   });
 });
 
-describe("r.tree — registrar slot", () => {
-  test("feature without r.tree leaves the slot undefined", () => {
-    const feature = defineFeature("empty", () => {});
-    expect(feature.treeProvider).toBeUndefined();
-  });
-
-  test("single r.tree call stores the provider function on the FeatureDefinition", () => {
-    const provider = makeStubProvider([{ label: "Marketing" }]);
-    const feature = defineFeature("text-content", (r) => {
-      r.tree(provider);
-    });
-    expect(feature.treeProvider).toBe(provider);
-  });
-
-  test("second r.tree call throws — only-once-guard", () => {
-    expect(() =>
-      defineFeature("dupe", (r) => {
-        r.tree(makeStubProvider([]));
-        r.tree(makeStubProvider([]));
-      }),
-    ).toThrow(/r\.tree\(\) already called/);
-  });
-
-  test("treeActions and tree are independent slots — can declare one without the other", () => {
-    const onlyActions = defineFeature("a", (r) => {
-      r.treeActions({ list: {} });
-    });
-    expect(onlyActions.treeActions).toBeDefined();
-    expect(onlyActions.treeProvider).toBeUndefined();
-
-    const onlyProvider = defineFeature("b", (r) => {
-      r.tree(makeStubProvider([]));
-    });
-    expect(onlyProvider.treeActions).toBeUndefined();
-    expect(onlyProvider.treeProvider).toBeDefined();
-  });
-});
-
-describe("Registry.getTreeProviders + getTreeActions", () => {
-  test("empty registry returns empty providers map and undefined actions", () => {
+describe("Registry.getTreeActions", () => {
+  test("empty registry returns undefined actions", () => {
     const reg = createRegistry([]);
-    expect(reg.getTreeProviders().size).toBe(0);
     expect(reg.getTreeActions("nonexistent")).toBeUndefined();
   });
 
-  test("aggregates providers from multiple features keyed by feature name", () => {
-    const providerA = makeStubProvider([{ label: "A-root" }]);
-    const providerB = makeStubProvider([{ label: "B-root" }]);
-    const featureA = defineFeature("text-content", (r) => {
-      r.tree(providerA);
-    });
-    const featureB = defineFeature("legal-pages", (r) => {
-      r.tree(providerB);
-    });
-    const reg = createRegistry([featureA, featureB]);
-
-    const providers = reg.getTreeProviders();
-    expect(providers.size).toBe(2);
-    expect(providers.get("text-content")).toBe(providerA);
-    expect(providers.get("legal-pages")).toBe(providerB);
-  });
-
-  test("features without r.tree are absent from the providers map (Zero-Whitelist-Filter)", () => {
-    const featureWithProvider = defineFeature("text-content", (r) => {
-      r.tree(makeStubProvider([]));
-    });
-    const featureWithoutProvider = defineFeature("schema-editor", () => {});
-    const reg = createRegistry([featureWithProvider, featureWithoutProvider]);
-
-    const providers = reg.getTreeProviders();
-    expect(providers.has("text-content")).toBe(true);
-    expect(providers.has("schema-editor")).toBe(false);
-  });
-
   test("getTreeActions returns the erased map for a feature that declared r.treeActions", () => {
     const feature = defineFeature("text-content", (r) => {
       r.treeActions({
@@ -153,9 +75,7 @@ describe("Registry.getTreeProviders + getTreeActions", () => {
   });
 
   test("getTreeActions returns undefined for a feature without r.treeActions", () => {
-    const feature = defineFeature("no-actions", (r) => {
-      r.tree(makeStubProvider([]));
-    });
+    const feature = defineFeature("no-actions", () => {});
     const reg = createRegistry([feature]);
 
     expect(reg.getTreeActions("no-actions")).toBeUndefined();
@@ -169,7 +89,7 @@ describe("Registry.getTreeProviders + getTreeActions", () => {
 // returnt einen typed Handle, der via setup-export durch FeatureDefinition
 // fließt und compile-time-typisiert vom Schicht-1-buildTarget konsumiert
 // wird. Ohne diese Tests würde ein Type-Drift in einer der zwei Schichten
-// erst in V.1.1 sichtbar — siehe advisor-Verdict + Memory `[EventDef-
+// erst spät sichtbar — siehe advisor-Verdict + Memory `[EventDef-
 // Exports-Pattern]`.
 // =============================================================================