@cosmicdrift/kumiko-framework 0.270.0 → 0.273.0

package/src/api/server.ts

@@ -1,17 +1,10 @@
 import { Hono } from "hono";
 import type { DbConnection, PgClient } from "../db/connection";
-import { createTenantDb } from "../db/tenant-db";
 import { createDerivativesContext } from "../derivatives/derivatives-context";
 import { EXT_FILE_PROVIDER, EXT_PRINCIPAL_STATUS } from "../engine/extension-names";
 import { runsInLane } from "../engine/run-in";
 import { createAnonymousUser } from "../engine/system-user";
-import {
-  type AppContext,
-  isFileField,
-  type Registry,
-  type RunIn,
-  SYSTEM_TENANT_ID,
-} from "../engine/types";
+import { type AppContext, isFileField, type Registry, type RunIn } from "../engine/types";
 import { createFileContext } from "../files/file-handle";
 import type { FileRoutesOptions } from "../files/file-routes";
 import { createFileRoutes } from "../files/file-routes";
@@ -491,9 +484,9 @@ export function buildServer(options: ServerOptions): KumikoServer {
 
   // MultiStreamProjections: one EventConsumer per MSP. Handler routes by
   // event.type into the MSP's apply map. MSPs aggregate cross-aggregate but
-  // still within one tenant by default — the applier receives the
-  // tenant-scoped DbRunner; SYSTEM_TENANT_ID events pass through the raw
-  // baseDb so system-level sinks can read across tenants.
+  // still within one tenant by default — the applier receives the plain
+  // baseDb DbRunner; tenant consistency comes from the triggering event's
+  // own tenantId, not a per-event TenantDb scope.
   //
   // Lane-filter (Welle 2.6.b): MSPs declare `runIn` to pin them to a
   // deploy-lane. An MSP with `runIn: "api"` won't be wired into the
@@ -535,12 +528,6 @@ export function buildServer(options: ServerOptions): KumikoServer {
         // production. Defensive return for the type-narrowing path.
         return;
       }
-      const scopedDb =
-        event.tenantId === SYSTEM_TENANT_ID ? baseDb : createTenantDb(baseDb, event.tenantId);
-      // Hand the raw DbRunner to apply(): MSPs write to their projection
-      // table directly, they don't go through the TenantDb wrapper.
-      const rawRunner =
-        event.tenantId === SYSTEM_TENANT_ID ? baseDb : (scopedDb as { raw: typeof baseDb }).raw; // @cast-boundary engine-bridge
       // Saga/process-manager ctx: apply can call ctx.appendEvent to cascade
       // a follow-up event onto another aggregate. Uses the triggering event's
       // tenantId + userId so the causal chain stays tenant-consistent.
@@ -553,7 +540,7 @@ export function buildServer(options: ServerOptions): KumikoServer {
         : undefined;
       const applyCtx = createMultiStreamApplyContext({
         registry: options.registry,
-        db: rawRunner,
+        db: baseDb,
         tenantId: event.tenantId,
         userId: event.metadata.userId,
         ...(mspOwner && { callerFeature: mspOwner }),
@@ -562,12 +549,12 @@ export function buildServer(options: ServerOptions): KumikoServer {
           derivatives: createDerivativesContext({
             files: mspFiles,
             registry: options.registry,
-            db: rawRunner,
+            db: baseDb,
             tenantId: event.tenantId,
           }),
         }),
       });
-      await applyFn(event, rawRunner, applyCtx);
+      await applyFn(event, baseDb, applyCtx);
       // Keep ctx reachable to satisfy the EventConsumerHandler signature.
       void ctx;
     },

package/src/bun-db/__tests__/query-guards.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "bun:test";
+import type { DbRunner } from "../../db/connection";
 import type { EntityTableMeta } from "../../db/entity-table-meta";
-import { incrementCounter, selectMany } from "../query";
+import { createTenantDb } from "../../db/tenant-db";
+import { testTenantId } from "../../stack";
+import { asRawClient, countWhere, incrementCounter, selectMany, transaction } from "../query";
 
 const meta: EntityTableMeta = {
   source: "unmanaged",
@@ -35,9 +38,8 @@ describe("bun-db guards — limit injection", () => {
 });
 
 describe("bun-db guards — silent tenant-scope bypass", () => {
-  // A TenantDb-shaped handle: has .raw.unsafe + the scoped methods + tenantId.
+  // A TenantDb-shaped handle: the scoped methods + tenantId, no `.unsafe` of its own.
   const tenantDb = {
-    raw: { unsafe: async () => [] as unknown[] },
     tenantId: "00000000-0000-4000-8000-000000000001",
     selectMany: async () => [],
     fetchOne: async () => undefined,
@@ -52,3 +54,58 @@ describe("bun-db guards — silent tenant-scope bypass", () => {
     ).rejects.toThrow("does not apply the tenant filter");
   });
 });
+
+describe("bun-db guards — a real TenantDb has no unfiltered escape via asRawClient", () => {
+  const tenantId = testTenantId(1);
+
+  // A runner whose unsafe()/begin() blow up — proves each guard throws
+  // BEFORE reaching the driver, same contract as `explodingDb` above.
+  function explodingRunner(): DbRunner {
+    return {
+      unsafe: async () => {
+        throw new Error("unsafe must not be reached — asRawClient should fail closed first");
+      },
+      begin: async () => {
+        throw new Error("begin must not be reached — asRawClient should fail closed first");
+      },
+    } as unknown as DbRunner;
+  }
+
+  test("asRawClient throws and points callers at ctx.db.unsafeRaw", () => {
+    const tdb = createTenantDb(explodingRunner(), tenantId);
+    expect(() => asRawClient(tdb)).toThrow("unsafeRaw");
+  });
+
+  test("countWhere throws before issuing any SQL", async () => {
+    const tdb = createTenantDb(explodingRunner(), tenantId);
+    await expect(countWhere(tdb, meta, {})).rejects.toThrow("unsafeRaw");
+  });
+
+  test("transaction throws before issuing any SQL", async () => {
+    const tdb = createTenantDb(explodingRunner(), tenantId);
+    await expect(transaction(tdb, async () => "unreached")).rejects.toThrow("unsafeRaw");
+  });
+});
+
+describe("bun-db guards — selectMany still delegates a real TenantDb, tenant-filtered", () => {
+  test("selectMany(tenantDb, ...) issues tenant-filtered SQL via the bound runner", async () => {
+    const tenantId = testTenantId(2);
+    const captured: { sql: string; values: readonly unknown[] }[] = [];
+    const recordingRunner: DbRunner = {
+      unsafe: async (sql: string, values: readonly unknown[]) => {
+        captured.push({ sql, values });
+        return [] as unknown[];
+      },
+      begin: async () => {
+        throw new Error("begin not used in this test");
+      },
+    } as unknown as DbRunner;
+    const tdb = createTenantDb(recordingRunner, tenantId);
+
+    await selectMany(tdb, meta, {});
+
+    expect(captured).toHaveLength(1);
+    expect(captured[0]?.sql).toMatch(/tenant_id/i);
+    expect(captured[0]?.values).toContain(tenantId);
+  });
+});

package/src/bun-db/query.ts

@@ -100,11 +100,14 @@ export function asRawClient(db: unknown): RawClient {
   if (typeof dbAny["unsafe"] === "function") {
     return dbAny as unknown as RawClient;
   }
-  // TenantDb-shape: framework wrapper exposing the underlying runner as `.raw`.
-  // Callers that pass `ctx.db` instead of `ctx.db.raw` land here — unwrap once.
-  const raw = dbAny["raw"];
-  if (raw && typeof (raw as Record<string, unknown>)["unsafe"] === "function") {
-    return raw as unknown as RawClient;
+  // TenantDb (ctx.db) has no unfiltered escape via asRawClient anymore — fail
+  // closed instead of silently unwrapping a tenant-scoped handle.
+  if (isTenantDbShape(db)) {
+    throw new Error(
+      "asRawClient: received a tenant-scoped TenantDb (ctx.db). Raw SQL helpers do not apply the " +
+        "tenant filter — use a ctx.db.<method>, or ctx.db.unsafeRaw(reason) with escapeHatch: " +
+        "{ reason } on the handler/hook (r.systemScope() features: ctx.systemDb.unsafeRaw(reason)).",
+    );
   }
   // Drizzle DbConnection (legacy compat): $client = postgres-js Sql.
   const $client = dbAny["$client"];
@@ -118,7 +121,7 @@ export function asRawClient(db: unknown): RawClient {
     return sessionClient as unknown as RawClient;
   }
   throw new Error(
-    "bun-db: db argument has no .unsafe() — pass Bun.SQL, postgres-js Sql, TenantDb, or a transaction handle.",
+    "bun-db: db argument has no .unsafe() — pass Bun.SQL, postgres-js Sql, or a transaction handle.",
   );
 }
 
@@ -199,35 +202,35 @@ type TenantDbDelegate = {
   deleteMany(table: TableLike, where: WhereObject): Promise<void>;
 };
 
-function tenantDbDelegate(db: unknown): TenantDbDelegate | undefined {
-  if (typeof db !== "object" || db === null) return undefined;
+// Duck-types TenantDb: five scoped methods + tenantId, no `.unsafe` of its own.
+// A throwing systemScope guard Proxy fails closed here too — intended, not a bug.
+function isTenantDbShape(db: unknown): boolean {
+  if (typeof db !== "object" || db === null) return false;
   const d = db as Record<string, unknown>;
-  const raw = d["raw"];
-  if (
-    raw &&
-    typeof (raw as Record<string, unknown>)["unsafe"] === "function" &&
+  if (typeof d["unsafe"] === "function") return false;
+  return (
     typeof d["selectMany"] === "function" &&
     typeof d["fetchOne"] === "function" &&
     typeof d["insertOne"] === "function" &&
     typeof d["updateMany"] === "function" &&
     typeof d["deleteMany"] === "function" &&
     "tenantId" in d
-  ) {
-    return db as TenantDbDelegate;
-  }
-  return undefined;
+  );
+}
+
+function tenantDbDelegate(db: unknown): TenantDbDelegate | undefined {
+  return isTenantDbShape(db) ? (db as TenantDbDelegate) : undefined;
 }
 
-// Guard for helpers that do NOT delegate to TenantDb (upsert/increment/insertMany):
-// passing a TenantDb here would silently run unscoped against `.raw`, bypassing
-// the tenant filter. Fail loudly so the caller picks `ctx.db.<method>` (scoped)
-// or `ctx.db.raw` (explicit cross-tenant) on purpose.
+// Fails loudly for helpers that don't delegate to TenantDb (upsert/increment/insertMany) —
+// passing one here would otherwise reach asRawClient and throw with a less specific message.
 // @wrapper-known semantic-alias
 function assertNotTenantScoped(db: unknown, fnName: string): void {
   if (tenantDbDelegate(db) !== undefined) {
     throw new Error(
       `${fnName}: received a tenant-scoped db but this helper does not apply the tenant filter. ` +
-        `Pass ctx.db.raw for an explicit cross-tenant op, or use a scoped TenantDb method.`,
+        "Pass ctx.db.unsafeRaw(reason) (with escapeHatch: { reason } on the handler/hook) for an " +
+        "explicit cross-tenant op, or use a scoped TenantDb method.",
     );
   }
 }

package/src/changes.json

@@ -1,4 +1,95 @@
 [
+  {
+    "version": "0.272.0",
+    "type": "breaking",
+    "title": "r.step.read.findOne/read.findMany now tenant-filter by default; cross-tenant reads need unsafeAllTenants + escapeHatch (fw#2914).",
+    "detail": "`r.step.read.findOne`/`r.step.read.findMany` no longer read through the raw `DbRunner` bound to `ctx.db` (`tenantDbRunner(ctx.db)`, which bypassed every tenant filter). They now call `selectMany(ctx.db, table, where, opts)` — `ctx.db` is a `TenantDb`, so the same `TenantDb.selectMany` tenant filter that `ctx.db` method-form reads already apply now also applies here: own tenant + `SYSTEM_TENANT_ID` reference rows, and a caller-supplied `where.tenantId` outside that scope is narrowed away instead of passed through. Both steps gain an optional `unsafeAllTenants: { reason: string }` argument; when set, the step reads through `ctx.systemDb.unsafeRaw(reason)` (`r.systemScope()` features, already granted by the feature's own systemScope) or `ctx.db.unsafeRaw(reason)` otherwise — the latter throws `AccessDeniedError` unless the write/query handler declares `escapeHatch: { reason }` — and reports an `\"unsafe-raw\"` escape-hatch audit event, same as any other `ctx.db.unsafeRaw` use. Inside an `r.systemScope()` handler `ctx.db` stays a fail-closed guard, so a read step there without `unsafeAllTenants` still throws `InternalError` (the message now points at `ctx.systemDb`).",
+    "migration": "No change needed for a read step that only ever reads within the caller's own tenant — it now gets the same tenant filter `ctx.db` method-form reads already had, and a `where.tenantId` for a foreign tenant is silently narrowed to the caller's own scope instead of leaking rows. A read step that intentionally reads across tenants must add `unsafeAllTenants: { reason: \"<why the tenant filter cannot apply>\" }` to the step AND `escapeHatch: { reason }` (same reason) to the owning write/query handler (or run the step inside an `r.systemScope()` feature, where the grant already exists). No codemod — cross-tenant read-step usage is expected to be rare and needs a real reason per call site."
+  },
+  {
+    "version": "0.272.0",
+    "type": "breaking",
+    "title": "ctx.queryAsMember runs the queried handler inside a Postgres READ ONLY transaction — ctx.db and ctx.db.unsafeRaw writes fail (fw#2902).",
+    "detail": "`executeQuery` (`pipeline/dispatch-query.ts`) runs every query whose SessionUser has `origin: \"member-resolution\"` through `runInMemberReadOnlyTransaction` (`pipeline/member-read-only-transaction.ts`): the handler context, the handler, its postQuery hooks and the field-read filter execute inside a savepoint whose first statement is `SET TRANSACTION READ ONLY`. The savepoint is always rolled back — a released one would leave the caller's transaction read-only. With a caller transaction (write handler, in-transaction hook) the savepoint nests into it; without one (query handler, job, `dispatcher.createMemberReader`) the framework opens a pool transaction around the savepoint, holding one connection for the handler's runtime — nested queries' feature/trial gates and rate limits still use their own resolvers, so many concurrent member reads need pool headroom. Inside the subtransaction Postgres rejects switching back via `SET TRANSACTION READ WRITE` (SQLSTATE 25001). Nested `ctx.query` calls inherit the read-only handle; `ctx.queryAs` is now denied for a resolved member principal like the other identity switches (`member_resolution_read_only`), so it cannot reach a context with a writable `dbOutsideTransaction`. Every write — `ctx.db.insertOne`/`updateMany`/`deleteMany`, `ctx.db.unsafeRaw(...)` SQL, `SELECT ... FOR UPDATE/SHARE`, `nextval()`, temp tables — fails with SQLSTATE 25006, surfaced as `AccessDeniedError` (`details.reason` `member_resolution_read_only`, the PG error as `cause`). Feature gate, rate limit, access check and payload validation still run before the transaction opens; membership, principal and auth-claims resolution keep running on the root connection outside it. Handler code that deliberately issues transaction control (`COMMIT`, `RELEASE SAVEPOINT`, `SET SESSION CHARACTERISTICS`) through `unsafeRaw` is not covered — `unsafeRaw` already requires an `escapeHatch` declaration. Top-level `dispatcher.query` and HTTP queries of ordinary users are unchanged.",
+    "migration": "Find query handlers reached via `ctx.queryAsMember(userId, qn, ...)` (including handlers they call with `ctx.query`) and check them for database side effects: `ctx.db` inserts/updates/deletes, write SQL through `ctx.db.unsafeRaw`, row locks, sequences, temp tables, `ctx.queryAs` calls, or catching a failed statement and continuing (a failed statement now aborts the enclosing transaction). Move such side effects into a write handler called by the original caller, or read the data without writing. Code branching on the raw Postgres error from such a write must branch on `details.reason === \"member_resolution_read_only\"` instead. Audit at release: bundled-features 0 sites, solon 0, offlot-app 0, money-horse 0, kumiko-enterprise 0 (no consumer calls ctx.queryAsMember yet)."
+  },
+  {
+    "version": "0.272.0",
+    "type": "improvement",
+    "title": "Follow-up screens (secretMint, actionForm, entityEdit) return to the screen the navigation came from, including the dashboard hosting an embedded screen.",
+    "detail": "Screen-target navigate actions (list toolbar and row actions, default \"+ New\" and edit row actions, projectionDetail and entityEdit header actions, projectionDetail metric navigate, the create-app entityEdit row-click fallback) add a `returnTo` search param naming the outermost rendered KumikoScreen (`<shortScreenId>` or `<shortScreenId>/<entityId>`); a screen embedded via a dashboard `kind: \"screen\"` panel reports the dashboard. secretMint cancel/confirm, actionForm cancel/submit (not drawer-hosted) and entityEdit create/update submit, cancel and delete navigate to that target instead of their declared `redirect`/`cancelTarget` or the default entity list. A declared redirect that targets an entityEdit or projectionDetail screen (a forward navigation to the result) keeps precedence; forms without any declared navigation still stay put; delete never returns onto the deleted record. The value is validated on read: it must be one or two `/`-separated segments naming a registered short screen id (no `:`, not the form itself) the current user can access, an entityId is only accepted for entityEdit/projectionDetail targets and may not contain `\\ ? #` or whitespace, a non-singleton projectionDetail requires one; any other value is ignored. Visible behavior change: a form reached from a non-embedded list whose id-less redirect names another screen now returns to that list. Not covered: navigations issued by custom screen code via `nav.navigate`, restoring the host screen tab/filter params, and nested return chains. New renderer exports: `RETURN_TO_PARAM`, `ReturnHost`, `ReturnHostProvider`, `useReturnHost`, `useReturnTarget`, `resolveReturnTarget`, `navigateWithReturnTo`."
+  },
+  {
+    "version": "0.272.0",
+    "type": "improvement",
+    "title": "Entity-convention handlers accept escapeHatch: { reason } for cross-tenant access; crossTenant: true is deprecated (fw#2915).",
+    "detail": "`defineEntityCreateHandler`/`UpdateHandler`/`DeleteHandler`/`RestoreHandler`/`ListHandler`/`DetailHandler`, `defineEntityWriteHandler`/`defineEntityQueryHandler`, and `registerEntityCrud`'s `write`/`read` options now accept `escapeHatch: { reason }` (`EntityHandlerOptions.escapeHatch`, `@cosmicdrift/kumiko-types/entity-handlers`): the ONE declaring handler gets a system-mode `TenantDb` via a new framework-private `acknowledgeConventionCrossTenant(tenantDb, reason)` in `db/tenant-db.ts` (not exported from `db/index.ts`); write verbs (update/delete/restore) still address the target row's own tenant stream; `access` stays the only caller gate. Every use reports an `acknowledge-cross-tenant` escape-hatch audit event, same as the hand-written-handler escape hatches — unlike those, it grants neither `ctx.db.unsafeRaw`, `db.global()` writes, nor an identity switch. `crossTenant?: boolean` on `EntityHandlerOptions`/`EntityCrudHandlerDefaults` is now `@deprecated`: it keeps working, but `pipeline/dispatcher.ts` now logs `DEPRECATED_CROSS_TENANT_SIGNAL` (`\"deprecation:entity-handler-cross-tenant\"`) once per handler when `createDispatcher` boots, for a handler `isDeprecatedCrossTenantHandler` (new export, `engine/entity-handlers.ts`) identifies as built from `crossTenant: true`, and its use is audited the same `acknowledge-cross-tenant` way. `escapeHatch` set on an `EntityHandlerOptions`/`EntityCrudHandlerDefaults` object is NOT passed through to the produced `WriteHandlerDef`/`QueryHandlerDef`'s own `escapeHatch` field — it only gates the internal `TenantDb`, so the two `escapeHatch` fields (options-level vs. handler-def-level) are independent grants. `crossTenant: true` is planned for removal in a later breaking release.",
+    "migration": "Replace `crossTenant: true` with `escapeHatch: { reason: \"...\" }` on the same entity-convention handler call. Run `bun packages/framework/src/scripts/codemod/migrate-cross-tenant.ts [--dry-run] <path...>` first — it rewrites every `defineEntity*Handler`/`defineEntityWriteHandler`/`defineEntityQueryHandler` call whose entity name and verb it can read off the call itself, with a generated reason to replace with the concrete operator use case. Sites it lists as manual (a `crossTenant` on a shared/spread access object, a `registerEntityCrud` `write`/`read` block covering several verbs, a non-boolean-literal value, or an object that already declares `escapeHatch`) need a hand-written `escapeHatch: { reason }` per handler/verb.",
+    "codemod": "scripts/codemod/migrate-cross-tenant.ts"
+  },
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "Entity create handlers accept a caller-chosen id for idempotent creates from jobs/hooks.",
+    "detail": "`buildInsertSchema` — and every write handler built through `defineEntityCreateHandler`/`defineEntityWriteHandler`'s `create` verb — now accepts an optional `id` field validated as a UUID string. The create handler only honors it when the acting `SessionUser` is a system identity (`createSystemUser(tenantId, extraRoles)`; `extraRoles` is still needed to clear the handler's normal `hasAccess` role gate, and carrying `SYSTEM_ROLE` is what `isSystemIdentity` checks). An HTTP-authenticated end user's payload `id` is silently ignored and a fresh `generateId()` is minted, exactly as before this field existed — `SYSTEM_ROLE` is reserved and never assignable through tenant membership, so an ordinary caller can never present that identity. `executor.create()` already honored an explicit `id` (the seed/SCIM-import pattern); this only stops the generic create-handler schema from stripping it for a trusted caller. A same-id retry within the same tenant returns `version_conflict` (no duplicate row, no overwrite). A same id already used by a different tenant returns `unique_violation` instead — every entity's projection table has a plain `id` primary key that is not tenant-scoped, so the id space is shared per entity table across tenants; a deterministic id must fold the tenant id into its key to stay collision-free. New `generateDeterministicId(namespace, key)` (`@cosmicdrift/kumiko-framework/utils`, UUIDv5) sits next to `generateId()` for deriving such an id. The agent-tool manifest now lists `id` as an optional parameter on every entity's create tool; supplying it has no effect for a non-system caller, since agent-tool dispatch always passes the real caller's identity, never a system one.",
+    "migration": "No action for existing callers — the field is additive and inert for anyone but a system-identity caller, so no existing create request changes behavior. To create idempotently from an event-triggered job or hook: derive an id with `generateDeterministicId(namespace, key)` (fold the tenant id into `key` so two tenants can't collide), dispatch via `ctx.writeAs(createSystemUser(tenantId, [<a role your handler's access rule allows>]), qn, { ...payload, id })` instead of matching on description text or other business fields, and treat a `version_conflict` response as \"already created\"."
+  },
+  {
+    "version": "0.271.0",
+    "type": "breaking",
+    "title": "ctx.queryProjection(..., { unsafeAllTenants: true }) needs r.systemScope() or escapeHatch; EntityTableMeta projection tables are now tenant-filtered (fw#2913).",
+    "detail": "`ctx.queryProjection(qualifiedName, { unsafeAllTenants: true })` previously lifted the tenant filter for anyone who passed the option, with no declaration required. It now goes through the same gate as `ctx.queryAs`/`ctx.writeAs`/`ctx.queryAsMember` (`pipeline/system-identity-switch.ts`): a new `createGatedProjectionReader(callerLabel, hasGrant, ungated, audit)` wraps the reader `dispatch-shared.ts`'s `buildHandlerContext` builds, and only checks `unsafeAllTenants === true` — a call without that option is never gated. Without a grant it throws `AccessDeniedError` with the new reason `unsafe_all_tenants_denied` (`FrameworkReasons.unsafeAllTenantsDenied`, docs entry in `errors/i18n/{en,de}.yaml`). With a grant — the handler's `r.systemScope()` feature or a declared `escapeHatch: { reason }` — it reports exactly one new `EscapeHatchKind` `\"unsafe-all-tenants\"` event through the existing escape-hatch audit sink (added to `escapeHatchUsedSchema.kind` in `bundled-features/audit`). Inside a lifecycle hook, `withHookEscapeHatchGrant`/`bindHookEscapeHatchGrant` re-gate `ctx.queryProjection` the same way they already re-gate `queryAs`/`writeAs`/`queryAsMember` — only the hook's own `escapeHatch` grants it, never the enclosing handler's, and (like the identity-switch gate) not even the handler's own `r.systemScope()` feature carries into a hook without its own `escapeHatch`. New internal helpers in `pipeline/system-identity-switch.ts` — `ProjectionReader` (`HandlerContext[\"queryProjection\"]`), `createGatedProjectionReader`, `unsafeAllTenantsDenied` — are not re-exported from `pipeline/index.ts`. `defineProjectionQueryHandler` (`engine/entity-handlers.ts`) gained an `escapeHatch?: EscapeHatchDeclaration` option, forwarded onto the returned `QueryHandlerDef`. Separately, `hasTenantColumn` (`db/tenant-db.ts`, already used by `TenantDb`'s other escape hatches) is now exported from that module — an internal framework/pipeline helper, not re-exported from `db/index.ts` — and `ctx.queryProjection`'s auto-filter uses it instead of reading `projTable[\"tenantId\"]` directly — a projection table built from a plain `EntityTableMeta` (`defineUnmanagedTable`/`deriveEntityTableMeta`, no drizzle `SchemaTable` symbols) has no `tenantId` JS property, so its rows were never tenant-filtered before this fix even though the table has a `tenant_id` column.",
+    "migration": "A handler or hook that calls `ctx.queryProjection(qualifiedName, { unsafeAllTenants: true })`, or registers `defineProjectionQueryHandler(name, qn, { unsafeAllTenants: true, ... })`, now needs `r.systemScope()` on its feature or `escapeHatch: { reason: \"<why this handler needs every tenant's rows>\" }` declared on the write/query/stream handler (or on the `r.hook(...)` call, if the read happens inside a hook) — code branching on `details.reason` for the resulting denial must also accept `unsafe_all_tenants_denied`. A hook inside an `r.systemScope()` feature does NOT inherit that grant for `unsafeAllTenants` either (same rule as `ctx.queryAs`/`ctx.writeAs`): it needs its own `escapeHatch: { reason }` on the `r.hook(...)` call. Separately, any projection built from `defineUnmanagedTable`/`deriveEntityTableMeta` (an `EntityTableMeta` with a `tenant_id` column, not wrapped in `table()`'s `SchemaTable`) is now tenant-scoped on every plain `ctx.queryProjection(qualifiedName)` call, where it previously returned every tenant's rows unfiltered. A handler that relied on that bug to read cross-tenant now needs the `unsafeAllTenants: true` opt-in plus a grant, same as above. No codemod — both call sites are rare enough to review by hand."
+  },
+  {
+    "version": "0.271.0",
+    "type": "breaking",
+    "title": "systemScope handlers default to a per-tenant+handler rate limit; nested-write refuses a foreign-tenant/foreign-owner parent row (fw#2861).",
+    "detail": "`r.systemScope()` write/query/stream handlers that declare no `rateLimit` now default to `{ per: \"tenant+handler\", limit: 600, windowSeconds: 60 }` — only when `context.rateLimit` is already configured, and never for a SYSTEM-identity caller. `per: \"tenant+handler\"` (not `\"tenant\"`) so one hot handler cannot starve every other systemScope handler's shared tenant quota. `RateLimitDeclaration` (`RateLimitOption | RateLimitDisabled`) replaces `RateLimitOption` on `WriteHandlerDef`/`QueryHandlerDef`/`StreamHandlerDef` (and their `*Definition`/inline-options counterparts): `rateLimit: { disabled: true, reason: \"...\" }` opts a handler out of both the explicit and default limit; the boot validator rejects an empty reason. `enforceRateLimit` (`pipeline/dispatch-shared.ts`) takes a new `isSystemScope: boolean` 5th param; the three dispatch call sites now call it unconditionally. `computeHasRateLimitedHandler`/`wantsL3` stay limited to explicit, non-`disabled` `rateLimit` declarations on purpose. 40 bundled systemScope handlers newly get the default; 7 self-scoped read handlers hit on every page load (traffic scales with signed-in users, not tenant ops) declare `rateLimit: { disabled: true, reason }` instead — `user:query:user:me`, `tenant:query:me`, `config:query:{cascade,values,schema,readiness}`, `delivery:query:preferences` (full per-feature list in the systemscope-rate-limit-nested-ownership changeset). None of the 47 was anonymous-accessible, so no opt-out was required for that reason. Separately, `executeNestedWrite` now refuses to attach nested children to a parent row a custom (non-executor) `:create` handler returned without independently verifying ownership: a new `isForeignTenantParentRow` check refuses a returned row from another tenant (skipped for `r.systemScope()` handlers), and `checkWriteFieldOwnership(parentEntity, parentRow, user)` refuses a same-tenant row whose ownership-bound field does not resolve to the caller — both roll back the whole nested write.",
+    "migration": "If your app configures a RateLimitResolver (the rate-limiting feature, an explicit `context.rateLimit`, or L1/L2 middleware options that auto-wire one), every `r.systemScope()` write/query/stream handler without its own `rateLimit` is now limited to 600 calls per tenant per handler per 60s for non-SYSTEM callers. Declare an explicit `rateLimit: { per, limit, windowSeconds }` on a handler that legitimately needs more, or `rateLimit: { disabled: true, reason: \"...\" }` for a per-user self-scoped read whose traffic scales with signed-in users rather than tenant operations (L1 IP limits still apply). Separately, a custom `<entity>:create` handler used under a `nestedWrite: true` relation must return the row it just created for the calling user: returning another tenant's row, or a row whose ownership-bound field(s) do not resolve to the caller, now fails the whole nested write with `access_denied` before any child rows are written."
+  },
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "Escape-hatch uses emit security:escape-hatch-used (audit event or warn log) (fw#2861).",
+    "detail": "Every framework escape hatch now reports its use through a new `EscapeHatchReporter`: `ctx.db.unsafeRaw(reason)`/`ctx.dbOutsideTransaction.unsafeRaw(reason)`, `ctx.systemDb.unsafeRaw(reason)`, `ctx.systemDb.acknowledgeCrossTenant(reason)` (including `outsideTransaction.acknowledgeCrossTenant`), `db.global(table)` write methods (`insertOne`/`updateMany`/`deleteMany`), and a granted non-self identity switch via `ctx.queryAs`/`ctx.writeAs`/`ctx.queryAsMember`. Each use emits `{ handler, kind, reason, tenantId, actor, target? }` (`kind` is one of `\"unsafe-raw\"`, `\"acknowledge-cross-tenant\"`, `\"global-write\"`, `\"identity-switch\"`) through the dispatcher-scoped `AppContext._escapeHatchAuditSink` when wired (set by the `audit` feature at boot), or logged as `security:escape-hatch-used` via `log.warn(...)` otherwise. Identical `(handler, kind, reason, tenantId, actor, target)` tuples are deduplicated per dispatcher within a 60s window (`createEscapeHatchReportWindow`, `DispatchContext.escapeHatchReportWindow`) so hot systemScope queries don't write one events row per request. `createTenantDb`/`createUncheckedSystemDb` built without an explicit reporter fall back to `fallbackEscapeHatchReporter`, which warn-logs attributed to handler `\"<unattributed>\"` / actor `\"<unattributed>\"`. New optional params: `TenantDbGrants.report`, `createUncheckedSystemDb`'s 3rd `report` param, `createGatedIdentitySwitch`'s 5th `audit` param. New pipeline exports: `createEscapeHatchReporter`, `createEscapeHatchReportWindow`, `fallbackEscapeHatchReporter`, `reportEscapeHatchUse`, `ESCAPE_HATCH_USED_SIGNAL`. New types: `EscapeHatchKind`, `EscapeHatchTarget`, `EscapeHatchUseEvent`, `EscapeHatchAuditSink`, `EscapeHatchReporter`, `AppContext._escapeHatchAuditSink`."
+  },
+  {
+    "version": "0.271.0",
+    "type": "breaking",
+    "title": "`TenantDb.raw` is removed — framework infrastructure gets the connection injected (fw#2860).",
+    "detail": "`TenantDb.raw` (`@cosmicdrift/kumiko-types/tenant-db-types`) no longer exists. Framework infrastructure that used to read it — the event-store executor's CRUD verbs, `read.findMany`/`read.findOne`/`unsafeProjectionDelete`/`unsafeProjectionUpsert` engine steps, the entity-convention `crossTenant` handlers, `UncheckedSystemDb.unsafeRaw`, the MSP consumer's per-event `apply()` in `api/server.ts`, and `db/assert-exists-in.ts`'s TenantDb duck-type — now resolves the bound `DbRunner` through a new framework-private module `db/tenant-db-runner.ts` (`bindTenantDbRunner`/`tenantDbRunner`, a `WeakMap<TenantDb, DbRunner>` keyed by the exact object `createTenantDb` built; not re-exported from `db/index.ts` or any package-exports entry, so feature code cannot import it). `asRawClient` (`bun-db/query.ts`) no longer unwraps a `.raw`-shaped TenantDb; it throws when handed one, same as the raw-SQL helpers built on it (`countWhere`, `transaction`, `runInSavepoint`/`runInSavepointIfSupported`, `executeRawQuery`/`executeRawQueryRead`, `upsertOnConflict`, `incrementCounter`, `insertMany`, `deleteManyBatched`) — they no longer accept a `TenantDb` at all. `tenantDbDelegate`'s TenantDb duck-type check no longer looks for `.raw`. `pipeline/projections-runner.ts`'s `runProjections(result, registry, runner)` takes an explicitly-resolved `DbRunner | undefined` (the dispatcher's `resolveDbSource(ctx, tx)`, threaded through `runLifecycle`) instead of reaching into `ctx.db.raw` / `ctx.systemDb.acknowledgeCrossTenant(...).raw` itself; it throws `InternalError` if `result.event` is set but no runner was resolved. `bundled-features/tenant/seeding.ts`'s `fireEntityPostSave`'s optional 4th argument changed from a bare `tenantId` to `{ tenantId, db }` — the caller (already holding a legitimately-declared runner) hands it in instead of the helper trying to pull one out of `context.db`. The boot validator now also rejects a `tenancy: \"global\"` entity whose owning feature does not declare `r.systemScope()` — a convention write on such an entity would otherwise still dispatch in tenant-mode. `packages/bundled-features/src/jobs/handlers/list.query.ts` switched from `ctx.systemDb.acknowledgeCrossTenant(reason)` to `ctx.systemDb.unsafeRaw(reason)` since it calls `countWhere` directly.",
+    "migration": "`ctx.db.raw` → `ctx.db.global(table)` for `tenancy: \"global\"` tables, otherwise `ctx.db.unsafeRaw(reason)` with `escapeHatch: { reason }` on the handler/hook; r.systemScope() features `ctx.systemDb.unsafeRaw(reason)`. Raw SQL helpers (countWhere, transaction, runInSavepoint*, executeRawQuery*, upsert*, incrementCounter, insertMany, deleteManyBatched) no longer accept a TenantDb. Hand-built TenantDb objects passed to the EventStoreExecutor must be created via createTenantDb. `tenancy: \"global\"` entities must live in an r.systemScope() feature. Custom callers of fireEntityPostSave pass `{ tenantId, db }` as 4th argument.",
+    "codemod": "scripts/codemod/migrate-db-raw.ts"
+  },
+  {
+    "version": "0.271.0",
+    "type": "fix",
+    "title": "Projection/MSP rebuild aborts instead of silently dropping row level security from the live table (fw#2907).",
+    "detail": "New `assertLiveTableHasNoRowLevelSecurity(tx, tableName, projectionName?)` in `db/queries/shadow-swap.ts` checks `pg_class.relrowsecurity`/`relforcerowsecurity` and `pg_policy` (public schema) for the live table before the shadow swap. `rebuildProjection` and `rebuildMultiStreamProjection` now call it before `buildShadowTable`, alongside the existing `assertLiveColumnsMatchMeta` fence, and `swapShadowIntoLive` re-checks it again right before the cutover under the fence. Previously the shadow, built from `EntityTableMeta` (which carries no RLS/policy information), would swap over a live table with RLS enabled/forced or any policy and silently drop all of it. `replayMigrationsDir`'s shape-neutral ALTER-clause recognizer (`db/replay-migration-sql.ts`) now also accepts `FORCE`/`NO FORCE ROW LEVEL SECURITY` instead of throwing \"unparsed table-DDL statement\".",
+    "migration": "No action for tables without RLS. A table with RLS enabled/forced or any policy can no longer be rebuilt online — rebuild fails with the table name; drop the RLS/policies or keep the table out of rebuild (see kumiko-platform docs/plans/rls-evaluation.md)."
+  },
+  {
+    "version": "0.271.0",
+    "type": "breaking",
+    "title": "Boot validator requires every screen to be reachable from the app's nav tree.",
+    "detail": "`validateScreens` now rejects a screen that has no own `nav`, no standalone `r.nav()` pointed at it anywhere in the composed feature set, and no resolvable parent list (`listScreenId`, or a rowAction/toolbarAction/drawer navigate target from an `entityList`/`projectionList`, or — for `entityEdit` — a same-entity `entityList`) — unless it declares `dormant: true`. `dormant` (previously only on `CustomScreenDefinition`) is now on every screen type. The resolution logic is the same `resolveNavParentScreen` the renderer's breadcrumb/NavTree already used, moved into `@cosmicdrift/kumiko-framework/engine/screen-helpers.ts` (re-exported through `ui-types`) instead of a second copy, and widened to also recognize toolbarActions and drawer-kind targets, not just entityList rowActions. The check is skipped when the composed feature set registers no nav entries anywhere at all (an isolated feature/recipe/test boot has no nav tree to be orphaned from).",
+    "migration": "A screen that boots inside an app with at least one nav entry somewhere, but isn't itself reachable, now fails boot with \"has no nav entry and no resolvable list\". Fix by declaring `listScreenId` (or a rowAction/toolbarAction navigate target from a list screen pointed at it), adding a standalone `r.nav()` for it, or setting `dormant: true` if it's intentionally reachable only via a direct link/redirect or a consuming app's own `r.nav()` (the established pattern for app-placed settings-area screens like `tenant-list`/`user-list`/`tier-admin`/personal-access-tokens' list/`profile`, now applied consistently across bundled-features)."
+  },
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "projectionDetail tabs mode (\"Akte\") gets a more consistent layout — visible changes, no API break.",
+    "detail": "A `projectionDetail` screen's tabs layout now renders header actions on the right of the title row instead of trailing after the metrics band, centers the status badge vertically next to the title, and no longer doubles the screen's `description` as a subtitle under the tabs (it still renders as the form subtitle outside tabs mode). A `relatedList` section in tabs mode keeps the same table frame, search box and facet toolbar a plain list screen has instead of dropping its card chrome. A `fields`-kind section inside a tabs layout now renders as its own titled card instead of a bare, title-less grid. The bundled `notesHistory` client's `NotesSection` renders as two cards (\"New note\" and \"History\") instead of individually bordered entries.",
+    "migration": "No action required — every change here is visual, with no schema or API break. Apps with e2e assertions pinned to `render-edit-form-subtitle` in tabs mode, or to the previous Stammdaten testId structure, must update those assertions to the new testIds."
+  },
+  {
+    "version": "0.271.0",
+    "type": "improvement",
+    "title": "A relatedList tab section can reuse the generic <entity>:list query via parentFilter instead of a bespoke child-rows handler.",
+    "detail": "`EditRelatedListSection` gains `parentFilter?: { field: string }` — an alternative to `parentParam` that sends the parent record's id as `payload.filter: { field, op: \"eq\", value: parentId }` instead of a bespoke top-level payload key, so a tab section can bind directly to the generic `<entity>:list` query and get its search (including the search index and reference-label search), facets and paging for free. `parentFilter` and `parentParam` are mutually exclusive. It composes with `toolbarActions` (including `visible`/`params` evaluated against the parent record), reference facets, `EditFieldsSection.groups`, and `ActionFormScreenDefinition.fieldLabels` — all from the same release.",
+    "migration": "Not required for existing screens — `parentFilter` is opt-in and `parentParam` keeps working unchanged. To migrate a bespoke tab query, replace its handler with the entity's own `<entity>:list` query and set `parentFilter: { field: \"<fk>\" }` on the section; move any \"add row for this tab\" action from a header action into the section's own `toolbarActions`. Before: `{ kind: \"relatedList\", query: \"leases:query:lease-items:list\", parentParam: \"leaseId\" }` backed by a custom `lease-items:list` handler that filters by `leaseId` itself. After: `{ kind: \"relatedList\", query: \"leases:query:item:list\", parentFilter: { field: \"leaseId\" } }` backed by `r.queryHandler(defineEntityListHandler(\"item\", itemEntity, { access }))` — search/filters/paging now run in the DB through the same query a plain list screen uses."
+  },
   {
     "version": "0.269.0",
     "type": "breaking",

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -385,6 +385,83 @@ describe("event-store-executor write-verbs — version_conflict edge cases", ()
   });
 });
 
+// =============================================================================
+// Explicit-id create: cross-tenant isolation, no resurrection of a deleted row
+// =============================================================================
+
+const deletedIdEntity = createEntity({
+  table: "read_es_write_deleted_id",
+  fields: {
+    email: createTextField({ required: true, personal: false, reason: "test_fixture" }),
+  },
+  softDelete: true,
+});
+const deletedIdTable = buildEntityTable("esWriteDeletedId", deletedIdEntity);
+
+describe("event-store-executor write-verbs — explicit-id tenant isolation + soft-delete", () => {
+  const crud = createEventStoreExecutor(deletedIdTable, deletedIdEntity, {
+    entityName: "esWriteDeletedId",
+  });
+  let otherTenantDb: TenantDb;
+
+  beforeAll(async () => {
+    await unsafeCreateEntityTable(testDb.db, deletedIdEntity, "esWriteDeletedId");
+    otherTenantDb = createTenantDb(testDb.db, TestUsers.otherTenant.tenantId);
+  });
+
+  beforeEach(async () => {
+    await asRawClient(testDb.db).unsafe(
+      `TRUNCATE kumiko_events, read_es_write_deleted_id RESTART IDENTITY CASCADE`,
+    );
+  });
+
+  test("create with an id already used by another tenant → conflict, tenant A's row untouched, no leak", async () => {
+    // The event log itself is tenant-scoped (UNIQUE (tenant_id, aggregate_id,
+    // version)) and would happily let tenant B open its own stream at the
+    // same id — but every entity's projection table has a plain `id` primary
+    // key (table-builder.ts), shared across all tenants for that entity
+    // type. So a same-id create for a different tenant fails at the
+    // projection-insert step with `unique_violation`, not `version_conflict`
+    // — a different, still-typed error, and the mapped error's details carry
+    // only entityName/constraintName, nothing that identifies tenant A's row.
+    const first = await crud.create({ email: "tenant-a@test.de" }, admin, tdb);
+    if (!first.isSuccess) throw new Error("setup failed");
+
+    const other = await crud.create(
+      { id: first.data.id, email: "tenant-b@test.de" },
+      TestUsers.otherTenant,
+      otherTenantDb,
+    );
+    expect(other.isSuccess).toBe(false);
+    if (other.isSuccess) return;
+    expect(other.error.code).toBe("unique_violation");
+    expect(JSON.stringify(other.error.details)).not.toContain(admin.tenantId);
+
+    const row = await asRawClient(testDb.db).unsafe(
+      `SELECT email FROM read_es_write_deleted_id WHERE id = $1`,
+      [first.data.id],
+    );
+    expect((row as unknown as { email: string }[])[0]?.email).toBe("tenant-a@test.de");
+  });
+
+  test("create with the id of a soft-deleted row → version_conflict, no resurrection", async () => {
+    const created = await crud.create({ email: "gone@test.de" }, admin, tdb);
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const deleted = await crud.delete({ id: created.data.id }, admin, tdb);
+    expect(deleted.isSuccess).toBe(true);
+
+    const resurrect = await crud.create(
+      { id: created.data.id, email: "back-from-the-dead@test.de" },
+      admin,
+      tdb,
+    );
+    expect(resurrect.isSuccess).toBe(false);
+    if (resurrect.isSuccess) return;
+    expect(resurrect.error.code).toBe("version_conflict");
+  });
+});
+
 // =============================================================================
 // Concurrent update race → EventStoreVersionConflict catch + entityCache.del
 // on forget/restore (create/update/delete already exercise cache in the

package/src/db/__tests__/event-store-executor.integration.test.ts

@@ -807,7 +807,7 @@ describe("event-store-executor — pii subject encryption", () => {
       0,
     );
     if (!storedEvent) throw new Error("no persisted event for the aggregate");
-    const applied = await applyEntityEvent(storedEvent, piiTable, piiEntity, tdb.raw);
+    const applied = await applyEntityEvent(storedEvent, piiTable, piiEntity, testDb.db);
     expect(applied.kind).toBe("applied");
 
     const rawRows = (await asRawClient(testDb.db).unsafe(

package/src/db/__tests__/replay-migration-sql.test.ts

@@ -365,6 +365,23 @@ ALTER TABLE "widgets" OWNER TO app_user;`,
     }
   });
 
+  test("FORCE / NO FORCE ROW LEVEL SECURITY is shape-neutral (fw#2907)", () => {
+    const dir = tmpMigrationsDir();
+    try {
+      write(
+        dir,
+        "0001_init.sql",
+        `CREATE TABLE IF NOT EXISTS "widgets" ("id" uuid PRIMARY KEY, "title" text);
+ALTER TABLE "widgets" FORCE ROW LEVEL SECURITY;
+ALTER TABLE widgets NO FORCE ROW LEVEL SECURITY;`,
+      );
+      const replayed = replayMigrationsDir(dir);
+      expect([...(replayed.get("widgets")?.columns ?? [])].sort()).toEqual(["id", "title"]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
   test("unexpected table: migrations create a table the snapshot doesn't know about", () => {
     const dir = tmpMigrationsDir();
     try {

package/src/db/__tests__/tenant-db-convention-cross-tenant.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, test } from "bun:test";
+import type { EscapeHatchKind } from "@cosmicdrift/kumiko-types/handlers";
+import type { TenantDb } from "@cosmicdrift/kumiko-types/tenant-db-types";
+import { InternalError } from "../../errors";
+import { testTenantId } from "../../stack";
+import type { DbRunner } from "../connection";
+import * as dbIndex from "../index";
+import { acknowledgeConventionCrossTenant, createTenantDb, withUnsafeRawGrant } from "../tenant-db";
+import { tenantDbRunner } from "../tenant-db-runner";
+
+const tenantId = testTenantId(1);
+const REASON = "operator scan across every tenant";
+
+function fakeRunner(): DbRunner {
+  return {
+    unsafe: async () => [],
+    begin: async () => {
+      throw new Error("begin not used in these tests");
+    },
+  } as unknown as DbRunner;
+}
+
+describe("acknowledgeConventionCrossTenant", () => {
+  test("returns a system-mode TenantDb with the same tenantId", () => {
+    const tdb = createTenantDb(fakeRunner(), tenantId);
+    const result = acknowledgeConventionCrossTenant(tdb, REASON);
+    expect(result.mode).toBe("system");
+    expect(result.tenantId).toBe(tenantId);
+  });
+
+  test("reports acknowledge-cross-tenant exactly once via grants.report", () => {
+    const reports: Array<{ kind: EscapeHatchKind; reason: string }> = [];
+    const tdb = createTenantDb(fakeRunner(), tenantId, "tenant", undefined, undefined, undefined, {
+      report: (kind, reason) => {
+        reports.push({ kind, reason });
+      },
+    });
+    acknowledgeConventionCrossTenant(tdb, REASON);
+    expect(reports).toEqual([{ kind: "acknowledge-cross-tenant", reason: REASON }]);
+  });
+
+  test("throws for an empty reason", () => {
+    const tdb = createTenantDb(fakeRunner(), tenantId);
+    expect(() => acknowledgeConventionCrossTenant(tdb, "")).toThrow();
+    expect(() => acknowledgeConventionCrossTenant(tdb, "   ")).toThrow();
+  });
+
+  test("throws InternalError for a TenantDb not built by createTenantDb", () => {
+    const handBuilt = { tenantId, mode: "tenant" } as unknown as TenantDb;
+    expect(() => acknowledgeConventionCrossTenant(handBuilt, REASON)).toThrow(InternalError);
+  });
+
+  test("still resolves after withUnsafeRawGrant rebinds the TenantDb", () => {
+    const runner = fakeRunner();
+    const tdb = createTenantDb(runner, tenantId);
+    const regranted = withUnsafeRawGrant(tdb, { reason: "unrelated unsafeRaw grant" });
+    const result = acknowledgeConventionCrossTenant(regranted, REASON);
+    expect(result.mode).toBe("system");
+    expect(tenantDbRunner(result)).toBe(runner);
+  });
+
+  test("tenantDbRunner(result) resolves to the original runner", () => {
+    const runner = fakeRunner();
+    const tdb = createTenantDb(runner, tenantId);
+    const result = acknowledgeConventionCrossTenant(tdb, REASON);
+    expect(tenantDbRunner(result)).toBe(runner);
+  });
+
+  test("db/index.ts does not export acknowledgeConventionCrossTenant", () => {
+    expect("acknowledgeConventionCrossTenant" in dbIndex).toBe(false);
+  });
+});