@cosmicdrift/kumiko-framework 0.264.0 → 0.265.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.264.0",
+  "version": "0.265.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.264.0",
+    "@cosmicdrift/kumiko-types": "0.265.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.264.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.265.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/api/__tests__/api.test.ts

@@ -636,6 +636,10 @@ describe("POST /api/stream pre-pull race", () => {
       async resolveAuthClaims(): Promise<Record<string, unknown>> {
         return {};
       },
+      // Not exercised by this route — always "not_a_member" is fine.
+      async resolveActiveMembership() {
+        return { kind: "rejected", reason: "not_a_member" };
+      },
     };
   }
 

package/src/api/__tests__/auth-routes-cookie.test.ts

@@ -20,7 +20,7 @@ import { createJwtHelper } from "../jwt";
 const JWT_SECRET = "auth-routes-cookie-test-secret-min-32-characters";
 
 function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
-  const base: Dispatcher = {
+  const merged: Dispatcher = {
     async write(): Promise<WriteResult> {
       // Explicit `const: WriteResult` locks the `isSuccess: true` branch of
       // the union without an `as`-cast (which widens + silences the
@@ -46,8 +46,27 @@ function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Delegates to `merged.query` (not to a pre-override `base`) so the
+    // switch-tenant test's `query` override — which answers
+    // "tenant:query:memberships" — is what this sees too.
+    async resolveActiveMembership(userId, tenantId) {
+      const memberships = (await merged.query(
+        "tenant:query:memberships",
+        { userId },
+        TestUsers.user,
+      )) as ReadonlyArray<{
+        tenantId: string;
+        roles: readonly string[];
+      }>;
+      const membership = memberships.find((m) => m.tenantId === tenantId);
+      if (!membership) {
+        return { kind: "rejected", reason: "not_a_member" };
+      }
+      return { kind: "active", membership: { tenantId, roles: membership.roles } };
+    },
+    ...overrides,
   };
-  return { ...base, ...overrides };
+  return merged;
 }
 
 async function buildApp(

package/src/api/__tests__/auth-routes-invalid-body-invite.test.ts

@@ -33,6 +33,10 @@ function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Not exercised by these routes — always "not_a_member" is fine.
+    async resolveActiveMembership() {
+      return { kind: "rejected", reason: "not_a_member" };
+    },
     // Stream API added with r.streamHandler (#1446) — stub unused in these routes.
     async *stream(): AsyncGenerator<unknown> {},
   };

package/src/api/__tests__/auth-routes-mfa-preauth-confirm.test.ts

@@ -45,6 +45,10 @@ function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Not exercised by these routes — always "not_a_member" is fine.
+    async resolveActiveMembership() {
+      return { kind: "rejected", reason: "not_a_member" };
+    },
   };
   return { ...base, ...overrides };
 }

package/src/api/__tests__/auth-routes-mfa-preauth-enable-start.test.ts

@@ -46,6 +46,10 @@ function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Not exercised by these routes — always "not_a_member" is fine.
+    async resolveActiveMembership() {
+      return { kind: "rejected", reason: "not_a_member" };
+    },
   };
   return { ...base, ...overrides };
 }

package/src/api/__tests__/auth-routes-mfa-verify.test.ts

@@ -45,6 +45,10 @@ function createStubDispatcher(overrides?: Partial<Dispatcher>): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Not exercised by these routes — always "not_a_member" is fine.
+    async resolveActiveMembership() {
+      return { kind: "rejected", reason: "not_a_member" };
+    },
   };
   return { ...base, ...overrides };
 }

package/src/api/__tests__/auth-routes-trusted-proxy.test.ts

@@ -38,6 +38,10 @@ function failingDispatcher(): Dispatcher {
     async resolveAuthClaims(): Promise<Record<string, unknown>> {
       return {};
     },
+    // Not exercised by these routes — always "not_a_member" is fine.
+    async resolveActiveMembership() {
+      return { kind: "rejected", reason: "not_a_member" };
+    },
   };
 }
 

package/src/api/__tests__/server-boot-guards.test.ts

@@ -1,12 +1,15 @@
 // buildServer boot-time guards + httpRoute verb wiring (PUT branch).
 
 import { describe, expect, spyOn, test } from "bun:test";
+import { z } from "zod";
 import {
   createEntity,
   createFileField,
   createRegistry,
   createTextField,
   defineFeature,
+  defineQueryHandler,
+  EXT_PRINCIPAL_STATUS,
 } from "../../engine";
 import { createInMemorySearchAdapter } from "../../search";
 import { buildServer } from "../server";
@@ -203,3 +206,60 @@ describe("buildServer — search-adapter boot warning (#2051)", () => {
     }
   });
 });
+
+describe("buildServer — auth membershipQuery requires a principalStatus provider", () => {
+  const MEMBERSHIP_QN = "tenant:query:memberships";
+
+  // The registry auto-qualifies a SHORT handler name as `<feature>:query:<name>`,
+  // so the feature must be named "tenant" for MEMBERSHIP_QN to come out right.
+  const membershipQueryFeature = defineFeature("tenant", (r) => {
+    r.queryHandler(
+      defineQueryHandler({
+        name: "memberships",
+        schema: z.object({ userId: z.string() }),
+        handler: async () => [],
+        access: { roles: ["all"] },
+      }),
+    );
+  });
+
+  const principalStatusFeature = defineFeature("has-principal-status", (r) => {
+    r.extendsRegistrar(EXT_PRINCIPAL_STATUS, {});
+    r.useExtension(EXT_PRINCIPAL_STATUS, "has-principal-status", {
+      resolveStatus: async () => "active" as const,
+    });
+  });
+
+  test("throws when membershipQuery is registered but no feature provides principalStatus", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([membershipQueryFeature]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+        auth: { membershipQuery: MEMBERSHIP_QN },
+      }),
+    ).toThrow(/no feature provides the "principalStatus" contract/);
+  });
+
+  test("boots when a feature provides principalStatus", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([membershipQueryFeature, principalStatusFeature]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+        auth: { membershipQuery: MEMBERSHIP_QN },
+      }),
+    ).not.toThrow();
+  });
+
+  test("boots when the membershipQuery handler isn't registered at all (e.g. features:[] tests)", () => {
+    expect(() =>
+      buildServer({
+        registry: createRegistry([]),
+        context: {},
+        jwtSecret: JWT_SECRET,
+        auth: { membershipQuery: MEMBERSHIP_QN },
+      }),
+    ).not.toThrow();
+  });
+});

package/src/api/auth-middleware.ts

@@ -1,5 +1,6 @@
 import type { Context, Next } from "hono";
 import { getCookie } from "hono/cookie";
+import { TENANT_TEARDOWN_STATUSES } from "../engine/active-membership";
 import { createAnonymousUser } from "../engine/system-user";
 import type { SessionUser, TenantId } from "../engine/types";
 import { parseTenantId } from "../engine/types/identifiers";
@@ -592,12 +593,6 @@ type RejectArgs = {
   details?: Record<string, unknown>;
 };
 
-const TENANT_LIFECYCLE_BLOCKED = new Set([
-  "destroyRequested",
-  "destroying",
-  "destroyFailed",
-  "destroyed",
-]);
 const TENANT_LIFECYCLE_CANCEL_QN = "tenant-lifecycle:write:cancel-destruction";
 
 async function requestsCancelDestruction(c: Context): Promise<boolean> {
@@ -634,7 +629,7 @@ async function rejectIfTenantTeardown(
 ): Promise<Response | undefined> {
   if (!resolveTenantLifecycleStatus) return undefined;
   const lifecycle = await resolveTenantLifecycleStatus(tenantId);
-  if (!lifecycle || !TENANT_LIFECYCLE_BLOCKED.has(lifecycle.status)) return undefined;
+  if (!lifecycle || !TENANT_TEARDOWN_STATUSES.has(lifecycle.status)) return undefined;
   if (lifecycle.status === "destroyRequested" && (await requestsCancelDestruction(c))) {
     return undefined;
   }

package/src/api/auth-routes.ts

@@ -6,9 +6,16 @@ import type Redis from "ioredis";
 import { z } from "zod";
 import { buildSessionRoles } from "../engine/membership-roles";
 import { createSystemUser } from "../engine/system-user";
-import { type SessionUser, SYSTEM_TENANT_ID, type TenantId } from "../engine/types";
+import {
+  type ActiveMembershipRejection,
+  type ActiveMembershipResult,
+  type SessionUser,
+  SYSTEM_TENANT_ID,
+  type TenantId,
+} from "../engine/types";
 import { NotFoundError } from "../errors";
 import type { Dispatcher } from "../pipeline/dispatcher";
+import { assertUnreachable } from "../utils";
 import { parseRoles } from "../utils/serialization";
 import { Routes } from "./api-constants";
 import {
@@ -167,6 +174,19 @@ function isUnknownHandlerError(e: unknown): boolean {
   return details?.entity === "handler";
 }
 
+function switchTenantRejectionResponse(c: Context, reason: ActiveMembershipRejection): Response {
+  switch (reason) {
+    case "not_a_member":
+      return c.json({ error: "not_a_member" }, 403);
+    case "principal_blocked":
+      return c.json({ error: "principal_blocked" }, 403);
+    case "tenant_teardown":
+      return c.json({ error: "tenant_unavailable" }, 410);
+    default:
+      return assertUnreachable(reason, "ActiveMembershipRejection");
+  }
+}
+
 type MembershipRow = {
   userId: string;
   tenantId: TenantId;
@@ -1324,17 +1344,11 @@ export function createAuthRoutes(
       return c.json({ error: "already_in_tenant" }, 400);
     }
 
-    // Check membership — uses the system identity because membershipQuery is
-    // locked to the system role. The auth-route is trusted server code; it
-    // asks the question on the user's behalf, not as the user.
-    let memberships: MembershipRow[];
+    // Membership + principal-blocked + tenant-teardown in one building
+    // block — trusted server code asking on the user's behalf, same trust boundary as before.
+    let activeMembership: ActiveMembershipResult;
     try {
-      // @cast-boundary engine-payload — generic dispatcher.query result
-      memberships = (await dispatcher.query(
-        config.membershipQuery,
-        { userId: user.id },
-        createSystemUser(user.tenantId),
-      )) as MembershipRow[];
+      activeMembership = await dispatcher.resolveActiveMembership(user.id, targetTenantId);
     } catch (e) {
       // No membershipQuery wired → switching tenants is just not offered in
       // this deployment. Any other error propagates so a broken query handler
@@ -1343,10 +1357,10 @@ export function createAuthRoutes(
       return c.json({ error: "tenant_switch_not_available" }, 400);
     }
 
-    const membership = memberships.find((m) => m.tenantId === targetTenantId);
-    if (!membership) {
-      return c.json({ error: "not_a_member" }, 403);
+    if (activeMembership.kind === "rejected") {
+      return switchTenantRejectionResponse(c, activeMembership.reason);
     }
+    const membership = activeMembership.membership;
 
     // Globale Rollen aus user-feature lesen wenn userQuery wired —
     // tenant-unabhängige Rollen (SystemAdmin etc.) überleben so den

package/src/api/server.ts

@@ -2,7 +2,7 @@ import { Hono } from "hono";
 import type { DbConnection, PgClient } from "../db/connection";
 import { createTenantDb } from "../db/tenant-db";
 import { createDerivativesContext } from "../derivatives/derivatives-context";
-import { EXT_FILE_PROVIDER } from "../engine/extension-names";
+import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names";
 import { runsInLane } from "../engine/run-in";
 import { createAnonymousUser } from "../engine/system-user";
 import {
@@ -443,6 +443,7 @@ export function buildServer(options: ServerOptions): KumikoServer {
     ...options.dispatcherOptions,
     lifecycle,
     sseBroker,
+    ...(options.auth ? { membershipQuery: options.auth.membershipQuery } : {}),
   });
 
   // Async event-dispatcher — the replacement for the old transactional
@@ -756,6 +757,18 @@ export function buildServer(options: ServerOptions): KumikoServer {
   // Public auth routes (login) need to be registered BEFORE the generic
   // api routes so Hono matches them first.
   if (options.auth) {
+    // A membershipQuery handler is registered but nothing fulfils
+    // principalStatus — surface that misconfig at boot instead of an InternalError on first login/switch-tenant.
+    if (
+      options.registry.getQueryHandler(options.auth.membershipQuery) &&
+      options.registry.getExtensionUsages(EXT_PRINCIPAL_STATUS).length === 0
+    ) {
+      throw new Error(
+        `[kumiko] auth membershipQuery "${options.auth.membershipQuery}" is registered but no feature ` +
+          'provides the "principalStatus" contract — mount the user feature (tenant switch and sign-in ' +
+          "need it to reject blocked principals).",
+      );
+    }
     app.route("/api", createAuthRoutes(dispatcher, jwt, options.auth));
   }
   app.route(

package/src/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.265.0",
+    "type": "improvement",
+    "title": "Active-membership building block (resolveActiveMembership) composes membership + principalStatus + tenant-lifecycle checks (fw#2872).",
+    "detail": "New `dispatcher.resolveActiveMembership(userId, tenantId)` / `ctx.resolveActiveMembership` returns an `ActiveMembershipResult` — either `active` with the raw membership roles, or `rejected` with reason `not_a_member` | `principal_blocked` | `tenant_teardown` (membership is checked first, so a non-member can't learn a foreign tenant's lifecycle/blocked state). It composes two new framework contracts, `EXT_PRINCIPAL_STATUS` (fulfilled by the bundled `user` feature) and `EXT_TENANT_LIFECYCLE_STATUS` (fulfilled by `tenant-lifecycle`), plus `TENANT_TEARDOWN_STATUSES` and the default `TENANT_MEMBERSHIPS_QUERY` handler name, and is now used by switch-tenant, login and auth-mfa verify/enable-confirm-preauth instead of each independently composing membership + status checks. `ctx.resolveActiveMembership` requires the same SYSTEM-identity grant as `ctx.queryAs`/`ctx.writeAs` with a system user (`r.systemScope()` or a declared `escapeHatch`), since it queries memberships as SYSTEM internally. Behaviourally: `POST /api/auth/switch-tenant` now answers 403 `principal_blocked` for a blocked principal and 410 `tenant_unavailable` for a target tenant in teardown (a tenant in `destroyRequested` is still allowed so its owner can cancel destruction); login skips a last-active tenant that is in teardown and falls through to the next active membership; MFA verify and enable-confirm-preauth reject a tenant in teardown; `buildServer` now throws at boot when the auth `membershipQuery` handler is registered but no feature provides the `principalStatus` contract (mount the bundled `user` feature); and `isPrincipalBlocked` now lives in `user` (still re-exported from `sessions` for existing importers).",
+    "migration": "No action for apps mounting the bundled `user` feature (runProdApp/runDevApp always do). A custom stack that registers the membership query without the `user` feature must mount `user` or register an `r.useExtension(EXT_PRINCIPAL_STATUS, ...)` provider, otherwise buildServer throws at boot. Clients of POST /api/auth/switch-tenant should handle the new 403 `principal_blocked` and 410 `tenant_unavailable` responses. A handler calling `ctx.resolveActiveMembership` needs an `escapeHatch` declaration (or `r.systemScope()`) the same way it would for a SYSTEM `queryAs`/`writeAs` call."
+  },
   {
     "version": "0.263.0",
     "type": "breaking",

package/src/engine/__tests__/hook-identity-switch-grant.test.ts

@@ -1,8 +1,12 @@
 import { describe, expect, mock, test } from "bun:test";
-import { AccessDeniedError } from "../../errors";
-import { createGatedIdentitySwitch, type QueryAsFn } from "../../pipeline/system-identity-switch";
+import { AccessDeniedError, FrameworkReasons } from "../../errors";
+import {
+  createGatedIdentitySwitch,
+  type QueryAsFn,
+  type ResolveActiveMembershipFn,
+} from "../../pipeline/system-identity-switch";
 import { createEntity, createRegistry, createSystemUser, defineFeature } from "../index";
-import type { AppContext, PostSaveHookFn, SaveContext } from "../types";
+import type { ActiveMembershipResult, AppContext, PostSaveHookFn, SaveContext } from "../types";
 import type { TenantId } from "../types/identifiers";
 
 // fw#2859: r.hook({ allOf }, ...) must get the same identity-switch gate as the handler-keyed path.
@@ -102,4 +106,81 @@ describe("r.hook({ allOf }, ...) identity-switch gate", () => {
       });
     }).toThrow(/non-empty string/);
   });
+
+  test("entity-wide hook WITHOUT escapeHatch does not inherit the handler's resolveActiveMembership grant", async () => {
+    const activeResult: ActiveMembershipResult = {
+      kind: "active",
+      membership: { tenantId: TENANT, roles: [] },
+    };
+    const ungatedResolveActiveMembership = mock(async () => activeResult);
+    const handlerCtx = {
+      ...createGatedIdentitySwitch('handler "test:write:thing:create"', true, {
+        queryAs: mock(async () => "ok") as QueryAsFn,
+        writeAs: async () => ({ isSuccess: true as const, data: null }),
+      }),
+      resolveActiveMembership: ungatedResolveActiveMembership as ResolveActiveMembershipFn,
+    };
+
+    let caught: unknown;
+    const feature = defineFeature("test", (r) => {
+      const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
+      const hookFn: PostSaveHookFn = async (_result, ctx) => {
+        const asContext = ctx as unknown as { resolveActiveMembership: ResolveActiveMembershipFn };
+        try {
+          await asContext.resolveActiveMembership("user-1", TENANT);
+        } catch (err) {
+          caught = err;
+        }
+      };
+      r.hook("postSave", { allOf: thing }, hookFn);
+    });
+
+    const registry = createRegistry([feature]);
+    const hooks = registry.getEntityPostSaveHooks("thing");
+    expect(hooks).toHaveLength(1);
+
+    await hooks[0]?.(dummySaveContext, handlerCtx as unknown as AppContext);
+
+    expect(caught).toBeInstanceOf(AccessDeniedError);
+    expect((caught as AccessDeniedError).details).toEqual({
+      reason: FrameworkReasons.systemIdentitySwitchDenied,
+    });
+    expect(ungatedResolveActiveMembership).not.toHaveBeenCalled();
+  });
+
+  test("entity-wide hook WITH escapeHatch reaches the original resolveActiveMembership even when the handler's own grant was false", async () => {
+    const activeResult: ActiveMembershipResult = {
+      kind: "active",
+      membership: { tenantId: TENANT, roles: ["User"] },
+    };
+    const ungatedResolveActiveMembership = mock(async () => activeResult);
+    const handlerCtx = {
+      ...createGatedIdentitySwitch('handler "test:write:thing:create"', false, {
+        queryAs: mock(async () => "ok") as QueryAsFn,
+        writeAs: async () => ({ isSuccess: true as const, data: null }),
+      }),
+      resolveActiveMembership: ungatedResolveActiveMembership as ResolveActiveMembershipFn,
+    };
+
+    let resolveResult: unknown;
+    const feature = defineFeature("test", (r) => {
+      const thing = r.entity("thing", createEntity({ table: "things", fields: {} }));
+      const hookFn: PostSaveHookFn = async (_result, ctx) => {
+        const asContext = ctx as unknown as { resolveActiveMembership: ResolveActiveMembershipFn };
+        resolveResult = await asContext.resolveActiveMembership("user-1", TENANT);
+      };
+      r.hook("postSave", { allOf: thing }, hookFn, {
+        escapeHatch: { reason: "test: allOf hook needs SYSTEM" },
+      });
+    });
+
+    const registry = createRegistry([feature]);
+    const hooks = registry.getEntityPostSaveHooks("thing");
+    expect(hooks).toHaveLength(1);
+
+    await hooks[0]?.(dummySaveContext, handlerCtx as unknown as AppContext);
+
+    expect(resolveResult).toEqual(activeResult);
+    expect(ungatedResolveActiveMembership).toHaveBeenCalledWith("user-1", TENANT);
+  });
 });

package/src/engine/active-membership.ts

@@ -0,0 +1,56 @@
+// principalStatus / tenantLifecycleStatus contracts consumed by
+// pipeline/active-membership.ts. Kept in engine/ (extension-registry surface), same split as tier-resolver-extension.ts.
+
+import type { DbConnection } from "../db/connection";
+import type { TenantId } from "./types/identifiers";
+
+// "unknown" = no persisted principal row for this userId — the caller
+// (INTERACTIVE_SIGN_IN_POLICY.allowUnknownPrincipal) decides whether that
+// counts as active or blocked; a background resolver for a stored userId
+// with a since-deleted row should not silently treat it as active.
+export type PrincipalStatus = "active" | "blocked" | "unknown";
+
+// Registered via r.useExtension(EXT_PRINCIPAL_STATUS, "user", principalStatusPlugin).
+export type PrincipalStatusPlugin = {
+  readonly resolveStatus: (
+    userId: string,
+    deps: { readonly db: DbConnection },
+  ) => Promise<PrincipalStatus>;
+};
+
+// `null` means the tenant has no lifecycle row (never entered teardown).
+export type TenantLifecycleStatusPlugin = {
+  readonly resolveStatus: (
+    tenantId: TenantId,
+    deps: { readonly db: DbConnection },
+  ) => Promise<{ readonly status: string } | null>;
+};
+
+// extension-usage `options` is engine-payload (unknown) — structurally
+// validate instead of casting blind, same pattern as isFileProviderPlugin.
+function hasResolveStatusFn(v: unknown): v is { readonly resolveStatus: unknown } {
+  return (
+    typeof v === "object" &&
+    v !== null &&
+    "resolveStatus" in v &&
+    typeof v.resolveStatus === "function"
+  );
+}
+
+export function isPrincipalStatusPlugin(v: unknown): v is PrincipalStatusPlugin {
+  return hasResolveStatusFn(v);
+}
+
+export function isTenantLifecycleStatusPlugin(v: unknown): v is TenantLifecycleStatusPlugin {
+  return hasResolveStatusFn(v);
+}
+
+// Same values auth-middleware.ts used to keep as its own private
+// TENANT_LIFECYCLE_BLOCKED set — moved here so the framework's active-
+// membership check and the request-level 410 gate can't drift apart.
+export const TENANT_TEARDOWN_STATUSES: ReadonlySet<string> = new Set([
+  "destroyRequested",
+  "destroying",
+  "destroyFailed",
+  "destroyed",
+]);

package/src/engine/extension-names.ts

@@ -155,6 +155,22 @@ export const EXT_EXTERNAL_RESOURCE = "externalResource" as const;
  */
 export const EXT_INFRA_RESOURCE = "infraResource" as const;
 
+/**
+ * `principalStatus` — "is this principal blocked from signing in" contract,
+ * consulted by the active-membership building block; fulfilled by the bundled `user` feature.
+ */
+export const EXT_PRINCIPAL_STATUS = "principalStatus" as const;
+
+/**
+ * `tenantLifecycleStatus` — tenant-teardown status contract, fulfilled by
+ * the bundled `tenant-lifecycle` feature; absent means no tenant is ever "in teardown".
+ */
+export const EXT_TENANT_LIFECYCLE_STATUS = "tenantLifecycleStatus" as const;
+
+// Default membership-list query handler name. Accepted coupling, same
+// pattern as FILE_PROVIDER_CONFIG_KEY — the `tenant` feature registers a handler under this literal.
+export const TENANT_MEMBERSHIPS_QUERY = "tenant:query:memberships" as const;
+
 /**
  * Union aller standardisierten Extension-Namen der Datenschutz-Surface.
  * Nicht alle Extensions im System sind in dieser Liste — andere

package/src/engine/index.ts

@@ -1,6 +1,14 @@
 // Public API
 
 export { hasAccess } from "./access";
+export {
+  isPrincipalStatusPlugin,
+  isTenantLifecycleStatusPlugin,
+  type PrincipalStatus,
+  type PrincipalStatusPlugin,
+  TENANT_TEARDOWN_STATUSES,
+  type TenantLifecycleStatusPlugin,
+} from "./active-membership";
 export {
   collectWriteHandlerQns,
   SECURITY_BASELINE_FEATURE_NAMES,
@@ -90,12 +98,15 @@ export {
   EXT_EXTERNAL_RESOURCE,
   EXT_FILE_PROVIDER,
   EXT_INFRA_RESOURCE,
+  EXT_PRINCIPAL_STATUS,
   EXT_SEARCH_ADAPTER,
   EXT_STORAGE_PROVIDER,
   EXT_TENANT_DATA,
+  EXT_TENANT_LIFECYCLE_STATUS,
   EXT_USER_DATA,
   EXT_USER_DATA_ORDER,
   FILE_PROVIDER_CONFIG_KEY,
+  TENANT_MEMBERSHIPS_QUERY,
 } from "./extension-names";
 export type {
   StorageProviderDestroyTenantHook,
@@ -283,6 +294,9 @@ export {
 export type {
   AccessRule,
   ActionFormScreenDefinition,
+  ActiveMembership,
+  ActiveMembershipRejection,
+  ActiveMembershipResult,
   AgentExposure,
   AgentHandlerHints,
   AgentRisk,

package/src/engine/types/index.ts

@@ -138,6 +138,9 @@ export type {
 } from "@cosmicdrift/kumiko-types/fields";
 export type {
   AccessRule,
+  ActiveMembership,
+  ActiveMembershipRejection,
+  ActiveMembershipResult,
   AgentExposure,
   AgentHandlerHints,
   AgentRisk,

package/src/pipeline/__tests__/system-identity-switch.integration.test.ts

@@ -75,6 +75,24 @@ const probeFeature = defineFeature("idswitch-probe", (r) => {
     access: { roles: ["Admin"] },
   });
 
+  // --- ctx.resolveActiveMembership: gated the same as a SYSTEM queryAs/writeAs ---
+  r.queryHandler(
+    "resolve-active-membership-no-hatch",
+    z.object({}),
+    async (query, ctx) => ctx.resolveActiveMembership(query.user.id, query.user.tenantId),
+    { access: { roles: ["User"] } },
+  );
+
+  r.queryHandler(
+    "resolve-active-membership-with-hatch",
+    z.object({}),
+    async (query, ctx) => ctx.resolveActiveMembership(query.user.id, query.user.tenantId),
+    {
+      access: { roles: ["User"] },
+      escapeHatch: { reason: "test: needs SYSTEM to resolve membership" },
+    },
+  );
+
   // --- Direct SYSTEM switch: gated by the CALLING handler's own escapeHatch ---
   r.writeHandler(
     "write-as-system-no-hatch",
@@ -276,6 +294,26 @@ describe("ctx.queryAs(SYSTEM, ...) — gated by the calling handler's escapeHatc
   });
 });
 
+describe("ctx.resolveActiveMembership — gated like a SYSTEM queryAs/writeAs", () => {
+  test("WITHOUT escapeHatch: fails with access_denied", async () => {
+    const err = await stack.http.queryErr(
+      "idswitch-probe:query:resolve-active-membership-no-hatch",
+      {},
+      user,
+    );
+    expect(err.code).toBe("access_denied");
+  });
+
+  test("WITH escapeHatch: the SYSTEM-identity gate lets the call through (no membershipQuery wired here, so it fails downstream instead)", async () => {
+    const err = await stack.http.queryErr(
+      "idswitch-probe:query:resolve-active-membership-with-hatch",
+      {},
+      user,
+    );
+    expect(err.code).not.toBe("access_denied");
+  });
+});
+
 describe("ctx.queryAs(nonSystemUser, ...) — never gated by this feature", () => {
   test("delegates to the target's own access check: denied when the target user lacks the role", async () => {
     const err = await stack.http.queryErr(

package/src/pipeline/active-membership.ts

@@ -0,0 +1,178 @@
+// One framework-owned composition of membership / principal-status /
+// tenant-lifecycle checks so login, switch-tenant and MFA completion can't independently drift.
+
+import type { DbConnection } from "../db/connection";
+import {
+  isPrincipalStatusPlugin,
+  isTenantLifecycleStatusPlugin,
+  type PrincipalStatusPlugin,
+  TENANT_TEARDOWN_STATUSES,
+  type TenantLifecycleStatusPlugin,
+} from "../engine/active-membership";
+import { EXT_PRINCIPAL_STATUS, EXT_TENANT_LIFECYCLE_STATUS } from "../engine/extension-names";
+import { createSystemUser } from "../engine/system-user";
+import type { ActiveMembershipResult, Registry } from "../engine/types";
+import type { TenantId } from "../engine/types/identifiers";
+import { InternalError } from "../errors";
+import { executeQuery } from "./dispatch-query";
+import { type DispatchContext, resolveDbSource } from "./dispatch-shared";
+
+export type ActiveMembershipPolicy = {
+  // destroyRequested still counts as active — owners must be able to cancel
+  // destruction; auth-middleware's own 410 gate then only admits that write.
+  readonly allowPendingDestruction: boolean;
+  // Whether a userId with no persisted principal row counts as active — a
+  // future background caller may instead want to fail closed.
+  readonly allowUnknownPrincipal: boolean;
+};
+
+export const INTERACTIVE_SIGN_IN_POLICY: ActiveMembershipPolicy = {
+  allowPendingDestruction: true,
+  allowUnknownPrincipal: true,
+};
+
+type RawMembershipRow = {
+  readonly tenantId: string;
+  readonly roles: readonly string[];
+  readonly tenantName?: string;
+  readonly tenantKey?: string;
+};
+
+// membershipQuery is a per-app-registered handler — engine-payload, not
+// trusted shape. Structural validation instead of a blind cast.
+function isMembershipRow(v: unknown): v is RawMembershipRow {
+  if (typeof v !== "object" || v === null) return false;
+  if (!("tenantId" in v) || typeof v.tenantId !== "string") return false;
+  if (!("roles" in v) || !Array.isArray(v.roles) || !v.roles.every((r) => typeof r === "string")) {
+    return false;
+  }
+  if ("tenantName" in v && v.tenantName !== undefined && typeof v.tenantName !== "string") {
+    return false;
+  }
+  if ("tenantKey" in v && v.tenantKey !== undefined && typeof v.tenantKey !== "string") {
+    return false;
+  }
+  return true;
+}
+
+async function findMembership(
+  ctx: DispatchContext,
+  userId: string,
+  tenantId: TenantId,
+): Promise<RawMembershipRow | undefined> {
+  const rawMemberships = await executeQuery(
+    ctx,
+    ctx.membershipQuery,
+    { userId },
+    createSystemUser(tenantId),
+  );
+  if (!Array.isArray(rawMemberships) || !rawMemberships.every(isMembershipRow)) {
+    throw new InternalError({
+      message:
+        `dispatcher.resolveActiveMembership: membershipQuery "${ctx.membershipQuery}" returned ` +
+        "a malformed result — expected an array of {tenantId, roles, tenantName?, tenantKey?} rows.",
+    });
+  }
+  return rawMemberships.find((m) => m.tenantId === tenantId);
+}
+
+function resolvePrincipalPlugin(registry: Registry): PrincipalStatusPlugin {
+  const usages = registry.getExtensionUsages(EXT_PRINCIPAL_STATUS);
+  if (usages.length !== 1) {
+    throw new InternalError({
+      message:
+        usages.length === 0
+          ? `dispatcher.resolveActiveMembership: no "${EXT_PRINCIPAL_STATUS}" provider registered — mount the user feature.`
+          : `dispatcher.resolveActiveMembership: multiple "${EXT_PRINCIPAL_STATUS}" providers registered — exactly one is expected.`,
+    });
+  }
+  const usage = usages[0];
+  if (!usage || !isPrincipalStatusPlugin(usage.options)) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: "${usage?.entityName}" registered under "${EXT_PRINCIPAL_STATUS}" without a resolveStatus(userId, {db}) — extension options must be a PrincipalStatusPlugin.`,
+    });
+  }
+  return usage.options;
+}
+
+function resolveLifecyclePlugin(registry: Registry): TenantLifecycleStatusPlugin | undefined {
+  const usages = registry.getExtensionUsages(EXT_TENANT_LIFECYCLE_STATUS);
+  if (usages.length > 1) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: multiple "${EXT_TENANT_LIFECYCLE_STATUS}" providers registered — exactly one (or zero) is expected.`,
+    });
+  }
+  const usage = usages[0];
+  if (!usage) return undefined;
+  if (!isTenantLifecycleStatusPlugin(usage.options)) {
+    throw new InternalError({
+      message: `dispatcher.resolveActiveMembership: "${usage.entityName}" registered under "${EXT_TENANT_LIFECYCLE_STATUS}" without a resolveStatus(tenantId, {db}) — extension options must be a TenantLifecycleStatusPlugin.`,
+    });
+  }
+  return usage.options;
+}
+
+function isTeardownRejected(
+  status: { readonly status: string } | null,
+  policy: ActiveMembershipPolicy,
+): boolean {
+  return (
+    status !== null &&
+    TENANT_TEARDOWN_STATUSES.has(status.status) &&
+    !(status.status === "destroyRequested" && policy.allowPendingDestruction)
+  );
+}
+
+// Order is load-bearing: a non-member must never learn a foreign tenant's
+// lifecycle/blocked state, so membership is resolved and checked FIRST.
+export async function resolveActiveMembershipFn(
+  ctx: DispatchContext,
+  userId: string,
+  tenantId: TenantId,
+  policy: ActiveMembershipPolicy,
+): Promise<ActiveMembershipResult> {
+  const { registry } = ctx;
+
+  const membership = await findMembership(ctx, userId, tenantId);
+  if (!membership) {
+    return { kind: "rejected", reason: "not_a_member" };
+  }
+
+  const principalPlugin = resolvePrincipalPlugin(registry);
+  const dbSource = resolveDbSource(ctx, undefined);
+  if (!dbSource) {
+    throw new InternalError({
+      message:
+        "dispatcher.resolveActiveMembership requires a database connection — none is configured.",
+    });
+  }
+  // resolveDbSource(ctx, undefined) never returns a tx, only AppContext.db —
+  // the dispatcher boundary holds that as the root DbConnection, same as buildAuthClaimsContext.
+  const db = dbSource as DbConnection; // @cast-boundary db-operator
+
+  const principalStatus = await principalPlugin.resolveStatus(userId, { db });
+  if (
+    principalStatus === "blocked" ||
+    (principalStatus === "unknown" && !policy.allowUnknownPrincipal)
+  ) {
+    return { kind: "rejected", reason: "principal_blocked" };
+  }
+
+  const lifecyclePlugin = resolveLifecyclePlugin(registry);
+  if (lifecyclePlugin) {
+    const lifecycle = await lifecyclePlugin.resolveStatus(tenantId, { db });
+    if (isTeardownRejected(lifecycle, policy)) {
+      return { kind: "rejected", reason: "tenant_teardown" };
+    }
+  }
+
+  return {
+    kind: "active",
+    membership: {
+      tenantId,
+      roles: membership.roles,
+      ...(membership.tenantName !== undefined ? { tenantName: membership.tenantName } : {}),
+      ...(membership.tenantKey !== undefined ? { tenantKey: membership.tenantKey } : {}),
+    },
+  };
+}

package/src/pipeline/dispatch-shared.ts

@@ -64,6 +64,7 @@ import {
 } from "../observability";
 import { buildBucketKey } from "../rate-limit";
 import { createTzContext, isValidIanaTimeZone } from "../time";
+import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
 import { appendDomainEventCore } from "./append-event-core";
 import { resolveAuthClaims as runAuthClaimsResolver } from "./auth-claims-resolver";
 import { executeQuery } from "./dispatch-query";
@@ -75,7 +76,7 @@ import {
 } from "./dispatcher-utils";
 import type { IdempotencyGuard } from "./idempotency";
 import type { LifecycleHooks } from "./lifecycle-pipeline";
-import { createGatedIdentitySwitch } from "./system-identity-switch";
+import { createGatedIdentitySwitch, systemIdentitySwitchDenied } from "./system-identity-switch";
 import type { TenantTimezoneCache } from "./tenant-timezone-cache";
 
 // Framework/pipeline stays bundled-features-free, so this can't import the
@@ -123,6 +124,9 @@ export type DispatchContext = {
   tenantTimezoneCache: TenantTimezoneCache;
   tracer: ReturnType<typeof getFallbackTracer>;
   meter: ReturnType<typeof getFallbackMeter>;
+  // Qualified name of the membership-list query handler consulted by
+  // resolveActiveMembershipFn — defaults to TENANT_MEMBERSHIPS_QUERY, overridable via DispatcherOptions.
+  membershipQuery: string;
 };
 
 // Narrowing-helper: AppContext.db ist DbConnection|TenantDb|undefined. Die
@@ -591,6 +595,15 @@ export async function buildHandlerContext(
     // dispatcher.resolveAuthClaims) cannot drift.
     resolveAuthClaims: (claimsUser: SessionUser) => resolveAuthClaimsFn(ctx, claimsUser), // @wrapper-known semantic-alias
 
+    // Thin pass-through, same reasoning as resolveAuthClaims above — one
+    // resolve impl lives on the dispatcher so callers can't drift apart.
+    // Internally queries memberships as SYSTEM, so it needs the same grant
+    // as a SYSTEM queryAs/writeAs (r.systemScope() or escapeHatch).
+    resolveActiveMembership: (userId: string, tenantId: TenantId) => {
+      if (!allowSystemIdentity) throw systemIdentitySwitchDenied(`handler "${type}"`);
+      return resolveActiveMembershipFn(ctx, userId, tenantId, INTERACTIVE_SIGN_IN_POLICY); // @wrapper-known semantic-alias
+    },
+
     // Feature-effective check for in-handler opt-in logic. Scope:
     // **current user's tenant** — for cross-tenant lookups (rare,
     // SysAdmin operations) read effectiveFeatures(otherTenantId) directly.

package/src/pipeline/dispatcher.ts

@@ -1,10 +1,20 @@
 import type { SseBroker } from "../api/sse-broker";
 import type { buildEntityTable } from "../db/table-builder";
+import { TENANT_MEMBERSHIPS_QUERY } from "../engine/extension-names";
 import type { defineTransitions } from "../engine/state-machine";
 import type { EffectiveFeaturesResolver } from "../engine/tier-resolver-extension";
-import type { AppContext, JobRunnerRef, Registry, SessionUser, WriteResult } from "../engine/types";
+import type {
+  ActiveMembershipResult,
+  AppContext,
+  JobRunnerRef,
+  Registry,
+  SessionUser,
+  WriteResult,
+} from "../engine/types";
+import type { TenantId } from "../engine/types/identifiers";
 import { reraiseAsKumikoError } from "../errors";
 import { getFallbackMeter, getFallbackTracer, registerStandardMetrics } from "../observability";
+import { INTERACTIVE_SIGN_IN_POLICY, resolveActiveMembershipFn } from "./active-membership";
 import { runBatch, unwrapSingle } from "./dispatch-batch";
 import { executeQuery } from "./dispatch-query";
 import type { BatchCommand, BatchResult, DispatchContext } from "./dispatch-shared";
@@ -25,6 +35,9 @@ export type DispatcherOptions = {
   idempotency?: IdempotencyGuard;
   lifecycle?: LifecycleHooks;
   jobRunner?: JobRunnerRef;
+  // Qualified name of the membership-list query handler consulted by
+  // dispatcher.resolveActiveMembership. Defaults to TENANT_MEMBERSHIPS_QUERY.
+  membershipQuery?: string;
   // Resolves the effective-feature set per tenant — the dispatcher uses
   // it to gate calls to handlers of disabled features (403 feature_disabled)
   // and to populate ctx.hasFeature. Absent = all features treated as
@@ -81,6 +94,9 @@ export type Dispatcher = {
   // This is the single resolve implementation — ctx.resolveAuthClaims is a
   // thin pass-through so both entry points can't drift.
   resolveAuthClaims(user: SessionUser): Promise<Record<string, unknown>>;
+  // Membership check for interactive sign-in paths (login, MFA completion,
+  // tenant switch) — single resolve implementation so callers can't independently drift.
+  resolveActiveMembership(userId: string, tenantId: TenantId): Promise<ActiveMembershipResult>;
 };
 
 export function createDispatcher(
@@ -89,6 +105,7 @@ export function createDispatcher(
   options: DispatcherOptions = {},
 ): Dispatcher {
   const { idempotency, lifecycle, jobRunner, effectiveFeatures, sseBroker } = options;
+  const membershipQuery = options.membershipQuery ?? TENANT_MEMBERSHIPS_QUERY;
 
   // Pre-build tables and transition maps for auto-guard (avoid per-request allocation)
   const tableCache = new Map<string, ReturnType<typeof buildEntityTable>>();
@@ -116,6 +133,7 @@ export function createDispatcher(
     tenantTimezoneCache,
     tracer: dispatcherTracer,
     meter: dispatcherMeter,
+    membershipQuery,
   };
 
   return {
@@ -143,5 +161,8 @@ export function createDispatcher(
     },
 
     resolveAuthClaims: (user) => resolveAuthClaimsFn(ctx, user),
+
+    resolveActiveMembership: (userId, tenantId) =>
+      resolveActiveMembershipFn(ctx, userId, tenantId, INTERACTIVE_SIGN_IN_POLICY),
   };
 }

package/src/pipeline/system-identity-switch.ts

@@ -1,14 +1,20 @@
 import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user";
 import type {
+  ActiveMembershipResult,
   EscapeHatchDeclaration,
   LifecycleHookFn,
   SessionUser,
   WriteResult,
 } from "../engine/types";
+import type { TenantId } from "../engine/types/identifiers";
 import { AccessDeniedError, FrameworkReasons, InternalError } from "../errors";
 
 export type QueryAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<unknown>;
 export type WriteAsFn = (user: SessionUser, qn: string, payload: unknown) => Promise<WriteResult>;
+export type ResolveActiveMembershipFn = (
+  userId: string,
+  tenantId: TenantId,
+) => Promise<ActiveMembershipResult>;
 export type IdentitySwitch = { readonly queryAs: QueryAsFn; readonly writeAs: WriteAsFn };
 
 export function isSystemIdentity(user: SessionUser): boolean {
@@ -22,7 +28,7 @@ export function isSystemIdentitySwitchAllowed(
   return !isSystemIdentity(asUser) || allowSystemIdentity;
 }
 
-function systemIdentitySwitchDenied(callerLabel: string): AccessDeniedError {
+export function systemIdentitySwitchDenied(callerLabel: string): AccessDeniedError {
   return new AccessDeniedError({
     message:
       `${callerLabel} may not switch identity to SYSTEM — declare r.systemScope() or ` +
@@ -57,9 +63,9 @@ export function createGatedIdentitySwitch(
   return gated;
 }
 
-function readIdentitySwitchFn<TFn extends QueryAsFn | WriteAsFn>(
+function readIdentitySwitchFn<TFn extends QueryAsFn | WriteAsFn | ResolveActiveMembershipFn>(
   context: object,
-  key: "queryAs" | "writeAs",
+  key: "queryAs" | "writeAs" | "resolveActiveMembership",
 ): TFn | undefined {
   if (!(key in context)) return undefined;
   const value = (context as Record<string, unknown>)[key];
@@ -74,6 +80,12 @@ function unavailableIdentitySwitchFn(callerLabel: string, kind: "queryAs" | "wri
   };
 }
 
+function deniedResolveActiveMembership(callerLabel: string): ResolveActiveMembershipFn {
+  return async () => {
+    throw systemIdentitySwitchDenied(callerLabel);
+  };
+}
+
 // Fail-closed fallback for a ctx not built by the dispatcher bridge (unit-test stub, duplicated module instance).
 function fallbackUngatedIdentitySwitch(
   callerLabel: string,
@@ -86,29 +98,48 @@ function fallbackUngatedIdentitySwitch(
   };
 }
 
-export function withHookIdentitySwitchGrant<TContext extends object>(
-  context: TContext,
+// Reuses the ORIGINAL ungated pair when known, so this grant doesn't compose with the caller's.
+function gatedIdentitySwitchFields(
   callerLabel: string,
   escapeHatch: EscapeHatchDeclaration | undefined,
-): TContext {
-  const ctxQueryAs = readIdentitySwitchFn<QueryAsFn>(context, "queryAs");
-  const ctxWriteAs = readIdentitySwitchFn<WriteAsFn>(context, "writeAs");
-  if (!ctxQueryAs && !ctxWriteAs) return context;
-
-  // Reuse the ORIGINAL ungated pair when known, so this grant doesn't compose with the caller's.
+  ctxQueryAs: QueryAsFn | undefined,
+  ctxWriteAs: WriteAsFn | undefined,
+): Partial<IdentitySwitch> {
+  if (!ctxQueryAs && !ctxWriteAs) return {};
   const ungated: IdentitySwitch =
     (ctxQueryAs && ungatedByGated.get(ctxQueryAs)) ??
     (ctxWriteAs && ungatedByGated.get(ctxWriteAs)) ??
     fallbackUngatedIdentitySwitch(callerLabel, ctxQueryAs, ctxWriteAs);
-
   const gated = createGatedIdentitySwitch(callerLabel, escapeHatch !== undefined, ungated);
   return {
-    ...context,
     ...(ctxQueryAs && { queryAs: gated.queryAs }),
     ...(ctxWriteAs && { writeAs: gated.writeAs }),
   };
 }
 
+export function withHookIdentitySwitchGrant<TContext extends object>(
+  context: TContext,
+  callerLabel: string,
+  escapeHatch: EscapeHatchDeclaration | undefined,
+): TContext {
+  const ctxQueryAs = readIdentitySwitchFn<QueryAsFn>(context, "queryAs");
+  const ctxWriteAs = readIdentitySwitchFn<WriteAsFn>(context, "writeAs");
+  const ctxResolveActiveMembership = readIdentitySwitchFn<ResolveActiveMembershipFn>(
+    context,
+    "resolveActiveMembership",
+  );
+  if (!ctxQueryAs && !ctxWriteAs && !ctxResolveActiveMembership) return context;
+
+  return {
+    ...context,
+    ...gatedIdentitySwitchFields(callerLabel, escapeHatch, ctxQueryAs, ctxWriteAs),
+    ...(ctxResolveActiveMembership &&
+      escapeHatch === undefined && {
+        resolveActiveMembership: deniedResolveActiveMembership(callerLabel),
+      }),
+  };
+}
+
 // Re-gates a hook's own ctx.queryAs/ctx.writeAs instead of inheriting the handler's grant.
 export function bindHookIdentitySwitchGrant(
   fn: LifecycleHookFn,

package/src/testing/handler-context.ts

@@ -57,6 +57,7 @@ export function bridgeStub(opts?: {
   | "loadAggregateWithSnapshot"
   | "queryProjection"
   | "resolveAuthClaims"
+  | "resolveActiveMembership"
   | "hasFeature"
   | "metrics"
   | "metricsFor"
@@ -118,6 +119,9 @@ export function bridgeStub(opts?: {
     resolveAuthClaims: notAvailable(
       "resolveAuthClaims",
     ) as unknown as HandlerContext["resolveAuthClaims"],
+    resolveActiveMembership: notAvailable(
+      "resolveActiveMembership",
+    ) as unknown as HandlerContext["resolveActiveMembership"],
     // Stub defaults to always-enabled — matches the dispatcher's behaviour
     // when no effectiveFeatures resolver is wired (tests without toggles).
     hasFeature: async () => true,