@cosmicdrift/kumiko-framework 0.334.0 → 0.336.0

package/src/changes.json

@@ -1,4 +1,268 @@
 [
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Boot gates with an explicit timeout reject start() naming the gate; gates without one warn after 60s",
+    "detail": "A `bootGate` job with an explicit `timeout` now rejects `start()` with a message naming the gate once that timeout elapses. Without `timeout` the gate keeps waiting and logs a warning naming it after 60s instead of blocking boot silently."
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Boot rejects unknown visibleWhen fields, bootGate with runOnBoot, and unknown money currency kinds",
+    "detail": "Boot now rejects three misconfigurations that previously failed silently: a dashboard screen-panel `visibleWhen.field` that is missing from the query's declared `outputSchema`, a job that combines `bootGate` with `runOnBoot` (it ran twice under one job id), and a money field whose `currency` source has an unknown `kind`. `auth-mfa:query:user-mfa:status` now declares its `outputSchema`."
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "Dry-run env output keeps multi-line field descriptions inside the comment",
+    "detail": "`KUMIKO_DRY_RUN_ENV` pulumi and k8s output now folds a multi-line `.describe()` text onto one comment line, so the continuation can no longer escape the `#` and run as a shell command or break the YAML stub. The `unprocessable-error-details-reason` codemod now skips a shorthand `reason` whose variable is only used in `details`."
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "waitForEvent ne-match ignores payloads without the referenced path",
+    "detail": "`waitForEvent` match atoms no longer match events that lack the referenced payload path, so `ne` no longer wakes a workflow on an unrelated event shape. Explicit `undefined` optionals on `r.nav()` entries are dropped from the client schema."
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "r.nav() explicit undefined optionals no longer reach the client schema"
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "public_intake_required 403 no longer discloses table and column names to anonymous callers",
+    "detail": "The `public_intake_required` 403 no longer puts the physical table name and personal-data column names into `message` or `details` (it keeps `reason`, `rootHandler` and `job`); they travel in the error `cause` for the server log. The event dispatcher counts idle-gated consumer turns in the new `kumiko_event_consumer_pass_skipped_total{reason=\"idle\"}` counter, since those turns open no `events.consumer.pass` span. Personal-data column sets for the anonymous write gate are cached per entity."
+  },
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "Idle-gated event consumer turns are counted in kumiko_event_consumer_pass_skipped_total"
+  },
+  {
+    "version": "0.336.0",
+    "type": "breaking",
+    "title": "/api/sse sends change signals without field values; anonymous connections only for declared entities",
+    "detail": "The SSE broadcast consumer no longer puts the event payload (changes, previous) on the tenant channel, because that channel fans out to every tenant member and to anonymous connections. Entity frames carry `{ id, aggregateType, eventType, version, createdAt }`. Anonymous connections get entity signals only for entities named by an anonymously callable query via the new `liveEntities` option; the query name alone grants nothing, because a signal carries the id of every row, including rows the query filters out. Frames without an entity are delivered only when `data.userId` matches the connected user. Boot fails when `liveEntities` names an unregistered entity.",
+    "migration": "Code that reads `data.payload` from SSE frames must load the data with a query after the signal instead. Public pages that update anonymously add `liveEntities: [\"<entity>\"]` to the anonymous query they refetch (for example a `page:current` query), otherwise the live update stays off for anonymous visitors. `createSseRoute(broker)` now needs a second argument, `{ anonymousLiveEntities: collectAnonymousLiveEntities(registry) }`."
+  },
+  {
+    "version": "0.336.0",
+    "type": "fix",
+    "title": "drainEventConsumers rejects an invalid maxPasses and drainJobs fails a stuck drain with a diagnosis",
+    "detail": "`drainEventConsumers` rejects a non-positive or non-integer `maxPasses` instead of returning without draining, and `drainJobs` accepts `timeoutMs` (default 10s) and fails a stuck drain with the pending job count and the consumers still behind. The stance report names which hint category (direct, user-owned, user-reference) a near-miss field resembles, and the `UnprocessableError` reason codemod no longer reports spread literals without a `reason` key and lists non-analyzable `details` arguments as unverified."
+  },
+  {
+    "version": "0.336.0",
+    "type": "improvement",
+    "title": "Codemod reports name the near-miss hint category and separate unverified sites from manual skips"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Agent tool manifests no longer offer the caller-chosen id on create tools",
+    "detail": "Agent tool manifests no longer offer the caller-chosen `id` on create tools, since agent dispatch never runs as a system identity and the value was silently dropped. Combobox options now carry a value-based `data-testid`."
+  },
+  {
+    "version": "0.335.0",
+    "type": "improvement",
+    "title": "Stricter boot checks for list outputSchema envelopes, detail section fields, reference facet list handlers, metric navigate, dashboard screen panels, refEntity columns and checkbox columns",
+    "detail": "Stricter boot checks for screens and handlers; apps that carried a latent typo or misconfiguration now fail at boot instead of rendering an empty cell or doing nothing at runtime.\n- A plain (non-paged) query handler whose `outputSchema` declares the row shape instead of `{ rows, nextCursor }` now fails when a projectionList, relatedList, expandableRow or dashboard list panel uses it.\n- `projectionDetail` layout section `fields` are checked against the query's `outputSchema`.\n- A `reference` list facet requires the target's list query handler (`<feature>:query:<entity>:list`, or its central lookup override) to be registered.\n- `MetricSpec.navigate.screen`/`entity` are validated even without `tab`; `navigate.entity` needs `entityId`.\n- A dashboard `screen` panel must not embed an `actionForm`/`secretMint` with `redirect` or `cancelTarget`.\n- `refEntity` on entityList columns and dashboard list-panel columns must resolve to a registered entity.\n- `multiSelect` `display: \"checkboxes\"` rejects `columns` outside 1-4.\n- Personal-data detection for `openToAll` write handlers now also looks inside `z.map`, `z.set`, `z.promise` and `.catchall()` schemas.\n- Fixes false boot failures for cross-feature rowActions / `listScreenId` written as a fully-qualified screen QN, and for where-rules that use a bare outer column next to a qualified subquery.",
+    "migration": "Boot now fails for configurations that previously rendered empty or did nothing. Fix the named screen or field: wrap a list handler's outputSchema in { rows, nextCursor }, correct detail section field names, register the entity list handler (defineEntityListHandler) behind a reference facet, add entityId to a metric navigate.entity, drop redirect/cancelTarget on forms embedded in a dashboard, and use a registered entity for refEntity."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Encrypted-at-rest text config keys derive writeOnly settings fields; boot validator allows writeOnly on configEdit only for those keys"
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "migrate-db-raw codemod lists own-tenant calls with a spread after tenantId for manual review instead of rewriting them",
+    "detail": "The `migrate-db-raw` codemod no longer auto-rewrites own-tenant calls whose filter object has a spread after `tenantId`, since the spread can override it at runtime; such sites are listed for manual review."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "switch-tenant validates tenantId, fault logger tolerates non-string type, PII guard matches full ciphertext shape",
+    "detail": "`POST /api/auth/switch-tenant` answers 400 `invalid_tenant` for a missing or non-string `tenantId` instead of feeding it into the membership lookup. A non-string `type` in a request body no longer turns a 4xx into a 500 inside the fault logger. The PII ciphertext response guard now matches the full ciphertext shape, so user text containing the bare `kumiko-pii:v` marker no longer 500s reads. `kumiko upgrade --apply` records `pendingManual` in the marker when no codemod runs."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "File-storage boot gate reads the injected env, derivative erasure matches lowercase hashes only",
+    "detail": "The `FILE_STORAGE_PROVIDER` boot gate now reads the `env` passed to `validateBoot` (falling back to `process.env`), so an `envSource` handed to `runProdApp` with an empty `process.env` no longer fails the gate. `runDevApp` stops mutating `process.env` for an explicitly wired file provider. The derivative-key recognizer used by forget and tenant-destroy now matches the hash segment case-sensitively."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Boot rejects multiple principalStatus providers, updateMany rejects unknown columns again",
+    "detail": "Several fail-loud fixes. `buildServer` now also rejects more than one `principalStatus` provider when `auth.membershipQuery` is registered (previously every login 500ed at runtime). `updateMany` throws again on a key that is not a column, and the replay of historical update events skips fields removed from the entity instead. `lt`/`gt`/`lte`/`gte`/`like` on a jsonb column match nothing in the where builder, like the event-store read path.",
+    "migration": "`updateMany` now throws when `set` or `where` contains a key that is not a column of the table; remove such keys from your calls. Replay of historical update events still skips removed fields."
+  },
+  {
+    "version": "0.335.0",
+    "type": "improvement",
+    "title": "Boot validator rejects overlapping dateRange facet params, unknown subtitleHref/countField fields and whitespace in redirect.idFrom; clearer refEntity, nav and where-probe diagnostics",
+    "detail": "Boot validator follow-ups.\n- A `dateRange` facet param name used by more than one dateRange facet on a projectionList screen now fails boot (the facets overwrote each other's bound).\n- `header.subtitleHref` and a section's `countField` on a projectionDetail screen are checked against the query's `outputSchema`.\n- `redirect.idFrom` with leading or trailing whitespace now fails boot instead of silently navigating without an id.\n- A `refEntity` pointing at a feature that is not mounted now says so and names `r.requires(...)` instead of listing \"(none)\" entities.\n- The nav inversion warning no longer prints `requires roles []` for a leaf with an invalid `openToAll`, and the unreachable-screen warning points workspace apps at `r.workspace({ nav })` instead of a non-existent allowlist.\n- The where-rule boot probe renders `ctx.tableName` with the real table name, matching runtime.",
+    "migration": "Boot now fails for configurations that silently misbehaved. Give each dateRange facet on a screen its own from/to params, point header.subtitleHref and section countField at fields of the query's outputSchema, and remove stray whitespace from redirect.idFrom."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Malformed waitForEvent matchExpr rows are skipped instead of blocking the wakeup projection",
+    "detail": "Review round 2 fixes for waitForEvent matching, read steps, env parsing and agent reasons.\n- A pending workflow row with a malformed or unsupported `matchExpr` is now skipped and logged instead of aborting the wakeup projection for every other run waiting on the same event. `evaluateEventMatch` reports a structurally malformed AST as a readable `Malformed EventMatch` error.\n- `read.findOne` and `read.findMany` reject a non-object `unsafeAllTenants` (for example `true`) with an `InternalError` instead of a raw `TypeError`.\n- `parseEnv` reports a refinement that throws as a `KumikoBootError`, and the ciphertext-only slot caveat for refinements is documented.\n- Removed the unused `AgentReasons.permissionDenied` (`agent.permission_denied`) reason and its error-docs pages; nothing emitted it."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "AgentReasons.permissionDenied removed",
+    "migration": "Drop references to `AgentReasons.permissionDenied` / `\"agent.permission_denied\"`. The framework never emitted this reason."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "ExtraRouteRejection retryAfterSeconds must be a safe integer; token-request routes stop logging rate_limited",
+    "detail": "`ExtraRouteRejection` now rejects a `retryAfterSeconds` beyond the safe-integer range, so the `Retry-After` header is always valid delta-seconds. Password-reset style token-request routes no longer log `rate_limited` handler results as errors."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Feature-AST patcher handles quoted keys, stream-handler escapeHatch and shorthand piiFields",
+    "detail": "The feature-AST patcher now replaces and unsets string-literal keys such as `\"description\": \"old\"` instead of appending a duplicate key or skipping the unset. `addStreamHandler` accepts `escapeHatch`. The defineEvent extractor accepts a shorthand `{ piiFields }` stance and reports a non-literal options argument with its own message."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "File byte routes survive undecryptable fileName; loadAggregate and appendProvenanceEvent reject empty type parts",
+    "detail": "`GET /files/:id` and the download-url route now fall back to the filename \"download\" when the stored fileName cannot be decrypted (malformed ciphertext, erased subject, annotation drift) instead of returning 500 or leaking ciphertext into headers. `loadAggregate` rejects an empty `aggregateType` instead of loading the unfiltered stream, and `appendProvenanceEvent` rejects event types with an empty owner or name."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "FileRef type drops the unreachable isDeleted field",
+    "detail": "The exported `FileRef` type no longer carries `isDeleted`. Soft-deleted rows were already filtered out before the guard sees a file, so the field was never reachable. Custom file access guards that read `fileRef.isDeleted` must drop that check.",
+    "migration": "Remove reads of `fileRef.isDeleted` in custom file access guards; soft-deleted rows never reach the guard."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "File content check covers csv alias, local list scoped to prefix, provider contract checked, locale tags canonicalized",
+    "detail": "File storage and locale hardening. `validateFileContent` now rejects binary bytes for an extension with a declared-MIME alias (a real `.xls` renamed to `.csv`), so custom upload routes using `validateFile` + `validateFileContent` are covered. `tenantExportPrefix` and `tenantStoragePrefixes` throw for a tenant id equal to the reserved `exports` segment. The local provider's `list()` only walks the prefix directory instead of the whole storage root. A file-provider plugin whose built provider lacks a required method now fails loudly at resolve time. `canonicalizeLocaleTag` normalizes region and script subtags (`de-AT`, `zh-Hant-TW`), so `X-Locale: DE-at` finds a `de-AT` mail registration.",
+    "migration": "A file-provider plugin whose built provider lacks a required method now throws at resolve time; make sure custom file providers implement the full provider interface."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "Global-table tenant writes reject loudly, restore maps unique violations, managed unique-index changes recreate",
+    "detail": "Tenant-mode `updateMany`/`deleteMany` on a `tenancy: \"global\"` table now reject with an `AccessDeniedError` pointing at `db.global(table)` instead of silently matching zero rows. `restore` on a soft-deleted row whose unique value was re-used now returns a 409 `unique_violation` instead of a raw 500. The migration generator now recreates a managed projection when an existing index becomes unique, changes columns or widens its WHERE.",
+    "migration": "Tenant-mode `updateMany`/`deleteMany` on a `tenancy: \"global\"` table now throws instead of matching zero rows; switch those calls to `db.global(table)`."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Guard edge cases, extension entityName fallback and dispatcher drain waiting for in-flight passes",
+    "detail": "Guards: the runtime-isolation guard now follows value re-exports (`export * from`, `export { x } from`) and reads the `kumiko.runtime` marker in the repo-root `package.json`. The upgrade-state guard prefers the repo-local `node_modules/.bin/kumiko-upgrade` over a PATH entry. The error-reasons guard no longer flags prose reasons passed to `withUnsafeRawGrant`. Remaining German guard messages are now English. Blank `entityName` overrides on extension sections fall back to the host entity. `EventDispatcher.drain()` now also waits for a pass still in its idle pre-check."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "i18n key guard covers multiSelect option labels and writeForm section descriptions",
+    "detail": "The i18n key guard now requires translations for filterable `multiSelect` option labels and for the `description` of a `projectionDetail` writeForm section. Missing translations used to fall back silently; they now fail the guard.",
+    "migration": "The i18n required-surface-keys check now requires translations for filterable `multiSelect` option labels and `projectionDetail` writeForm section descriptions; add the missing keys to your locale files."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "perTenant fan-out without context.db reports the missing db instead of a missing tenant feature",
+    "detail": "A perTenant job on a job runner built without `context.db` now fails with a message that names the missing `context.db` when the tenant feature is mounted, instead of telling the operator to mount it. A readiness failure during `stop()` is now logged at debug level."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Key Manager boot resolves slots in parallel, validates the previous-KEK version up front and keeps the fetch error as cause",
+    "detail": "The Key Manager boot resolution now resolves all KEK slots in parallel, rejects a previous KEK without `PLATFORM_KEK_PREVIOUS_VERSION` before any Key Manager call, keeps the original network error as `cause`, and names the slot in the partial-wiring error. The boot log line names the source actually taken."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Boot column check skips loose/catchall output schemas; schema-walk error names the handler",
+    "detail": "The query output-schema column check now skips `z.looseObject()` and `.catchall()` row schemas, since they accept keys beyond the declared shape. The schema-size guard for write-handler input schemas now names the feature and handler in its boot error."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Multi-stream projection rebuild honors the shutdown AbortSignal",
+    "detail": "`rebuildMultiStreamProjection` now accepts an `AbortSignal` and checks it per replayed event. The boot backfill's shutdown signal reaches it, so a SIGTERM during a long multi-stream replay rolls the transaction back and releases the consumer lock instead of hanging until the pod is killed."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "multiSelect filters handle empty and non-string values and NULL columns; forget sweeps tolerate missing columns and serial ids",
+    "detail": "multiSelect list filters no longer return every row for an empty array value, no longer fail with a 500 on boolean or numeric client values, and `ne` now keeps rows whose column is NULL. The forget sweeps (blind-index nulling, search purge) skip lookupable or searchable fields whose columns are missing from a migrated table instead of aborting after the key was erased, and the self-PII tenant probe ignores serial-id entities instead of throwing on a uuid subject id."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "App-schema JSON-safety rejects NaN/Infinity and cyclic defaults",
+    "detail": "The app-schema JSON-safety check now rejects `NaN`/`Infinity` defaults and guards against self-referencing values. The agent doc lint reports exposed handlers whose input schema cannot be converted to JSON Schema (they were silently left out of the agent manifest). Icon-only list and edit action buttons now also set `title`, so sighted mouse users get the hover tooltip."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Executor create/restore validate before connection binding; clearer rebuild and backfill errors",
+    "detail": "The event-store executor's `create()` and `restore()` now run their validation (global-tenancy guard, `soft_delete_not_enabled`) before resolving the connection, so callers get the proper 4xx error instead of an internal \"no connection bound\" error. List `totalCount` always counts over the full WHERE, and a PII backfill failure for an unresolvable catalog event subject no longer suggests the entity-only retry options. The shadow-swap RLS and blind-index error messages now state the concrete action (full KMS wiring for the blind-index key)."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "afterCommit hook writes run in their own transaction, plus cache, nested-write, skip-poison and search-consumer fixes",
+    "detail": "Writes from an afterCommit hook now run as their own transaction with their own afterCommit flush, so the nested write's hooks fire and a failing projection rolls it back. The tenant timezone cache no longer stores a value read before a concurrent config write. Nested-write ownership checks complete a partial parent row from the stored row. `skipPoisonEvent` locks the consumer row before computing pending gaps. The search consumer fails an event for retry when its context has no database instead of removing the index entry."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Qualified redirects resolve in their named feature, update forms skip untouched required fields, secretMint confirm can restart",
+    "detail": "A qualified redirect target (`feature:screen:id`) is now resolved inside the named feature, so a same-id screen in the redirecting feature no longer swallows the created record id. An entityEdit update form only presence-checks required fields the user changed, so a legacy row with an empty, newly required field can still be saved. The secretMint confirm step always offers a cancel that restarts at the mint form when no redirect or cancelTarget is set."
+  },
+  {
+    "version": "0.335.0",
+    "type": "breaking",
+    "title": "totalsMatch rejects a payload that carries only one side of the pair",
+    "detail": "A `totalsMatch` pair is now validated as a unit. A payload that carries only the embedded list or only its sibling money field is rejected with a validation error, because update payloads only carry `changes` and the sum could otherwise drift away from the total.",
+    "migration": "Send the embedded list and its sibling money field together in every create and update payload. A partial update that changes only `total` or only the list now fails validation."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Transfer-graph boot check rejects a multiple reference only when its target is transferable",
+    "detail": "The transfer-graph boot check now rejects a `multiple` reference on a transferable entity only when the target entity is itself transferable. A multiple reference to a plain lookup entity boots again."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Empty KUMIKO_TRUSTED_PROXY_HOPS is treated as unset, and dist no longer ships compiled codemods",
+    "detail": "`parseTrustedProxyHopsEnv` treats an empty `KUMIKO_TRUSTED_PROXY_HOPS` as unset, so a blank `.env` template line no longer crashes the dev boot while prod ignored it. The published package also no longer ships the unusable compiled `dist/scripts/` codemod copies."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "Upgrade marker needs an installed version, Meilisearch drop keeps sibling prefixes, drainJobs sees pre-run job failures",
+    "detail": "`kumiko upgrade --apply` now refuses to write a marker when no installed Kumiko version can be found under the target, instead of recording the `--from` filter value. It also finds `node_modules/@cosmicdrift/*` packages that are workspace symlinks. `MeilisearchAdapter.dropAllIndexes()` only drops tenant indexes of its own prefix and leaves indexes of a longer sibling prefix alone. `drainJobs()` now rejects when a perTenant fan-out or an unknown job fails before the job body runs."
+  },
+  {
+    "version": "0.335.0",
+    "type": "fix",
+    "title": "SSE stream closes when access is revoked",
+    "detail": "The live event stream (GET /sse) now closes as soon as the session behind it is revoked or the user's tenant roles change or the membership is removed. User-addressed frames such as in-app notifications are delivered only to the addressed user instead of the whole tenant."
+  },
+  {
+    "version": "0.335.0",
+    "type": "improvement",
+    "title": "Boot validator checks redirect targets of writeHandler record actions",
+    "detail": "An unknown `redirect` screen on a projectionDetail or entityEdit action or section action fails boot, like entityEdit `redirect`.",
+    "migration": "If a writeHandler record action already carries a `redirect` that does not resolve to a registered screen, fix or remove it."
+  },
   {
     "version": "0.334.0",
     "type": "improvement",

package/src/scripts/codemod/migrate-cross-tenant.ts

@@ -168,8 +168,20 @@ export function migrateCrossTenantSource(
   const rewrites: Rewrite[] = [];
   const manual: ManualSite[] = [];
 
+  // Captured up front: a forgotten node can no longer report its position.
+  const lineByAssignment = new Map(targets.map((a) => [a, a.getStartLineNumber()]));
+
   for (const assignment of targets) {
-    if (assignment.wasForgotten()) continue;
+    // A forgotten node has no position or text left; a bare `continue` would
+    // drop a security-relevant crossTenant switch from the report entirely.
+    if (assignment.wasForgotten()) {
+      manual.push({
+        file: fileName,
+        line: lineByAssignment.get(assignment) ?? 0,
+        why: "node was invalidated by an earlier rewrite in this file — run the codemod on this file again",
+      });
+      continue;
+    }
     const line = assignment.getStartLineNumber();
     const init = assignment.getInitializer();
 
@@ -327,7 +339,7 @@ async function main(): Promise<void> {
     }
   }
 
-  process.exit(0);
+  process.exit(allManual.length > 0 ? 1 : 0);
 }
 
 if (import.meta.main) {

package/src/scripts/codemod/migrate-db-raw.ts

@@ -89,14 +89,22 @@ function isValidOwnTenantIdValue(valueNode: Node): boolean {
 
 function objectHasValidOwnTenantId(obj: Node): boolean {
   if (!Node.isObjectLiteralExpression(obj)) return false;
-  for (const prop of obj.getProperties()) {
-    if (Node.isPropertyAssignment(prop) && prop.getName() === "tenantId") {
-      const init = prop.getInitializer();
-      return init !== undefined && isValidOwnTenantIdValue(init);
-    }
-    if (Node.isShorthandPropertyAssignment(prop) && prop.getName() === "tenantId") {
-      return isConstTenantIdBinding(enclosingFunctionScope(prop), "tenantId");
-    }
+  const props = obj.getProperties();
+  const tenantIdIndex = props.findIndex(
+    (prop) =>
+      (Node.isPropertyAssignment(prop) || Node.isShorthandPropertyAssignment(prop)) &&
+      prop.getName() === "tenantId",
+  );
+  if (tenantIdIndex === -1) return false;
+  // A later spread can override the literal tenantId at runtime.
+  if (props.slice(tenantIdIndex + 1).some((prop) => Node.isSpreadAssignment(prop))) return false;
+  const prop = props[tenantIdIndex];
+  if (Node.isPropertyAssignment(prop)) {
+    const init = prop.getInitializer();
+    return init !== undefined && isValidOwnTenantIdValue(init);
+  }
+  if (Node.isShorthandPropertyAssignment(prop)) {
+    return isConstTenantIdBinding(enclosingFunctionScope(prop), "tenantId");
   }
   return false;
 }

package/src/scripts/codemod/migrate-open-to-all.ts

@@ -188,6 +188,12 @@ function collectFiles(paths: string[]): string[] {
   return files;
 }
 
+// Remaining manual sites still fail boot validation, so upgrade-cli must not
+// treat this run as a completed migration.
+export function exitCodeForManualSites(manualCount: number): 0 | 1 {
+  return manualCount > 0 ? 1 : 0;
+}
+
 async function main(): Promise<void> {
   let options: CliOptions;
   try {
@@ -241,7 +247,7 @@ async function main(): Promise<void> {
     }
   }
 
-  process.exit(0);
+  process.exit(exitCodeForManualSites(allManual.length));
 }
 
 if (import.meta.main) {

package/src/scripts/codemod/pii-personal-migration.ts

@@ -440,6 +440,8 @@ function findTargetFiles(rootDir: string): string[] {
 
 export type StanceClass = "direct" | "user-owned" | "user-reference" | "near-miss" | "unclassified";
 
+export type HintCategory = "direct" | "user-owned" | "user-reference";
+
 export type StanceSite = {
   readonly line: number;
   readonly field: string;
@@ -447,14 +449,23 @@ export type StanceSite = {
   readonly callee: string;
   readonly stance: StanceClass;
   readonly hint: string | undefined;
+  readonly nearMissOf: HintCategory | undefined;
 };
 
-const ALL_PII_NAME_HINTS: readonly string[] = [
-  ...PII_DIRECT_NAME_HINTS,
-  ...PII_USER_OWNED_NAME_HINTS,
-  ...PII_USER_REFERENCE_NAME_HINTS,
+type CategorizedHint = readonly [hint: string, category: HintCategory];
+
+const ALL_PII_NAME_HINTS: readonly CategorizedHint[] = [
+  ...[...PII_DIRECT_NAME_HINTS].map((hint): CategorizedHint => [hint, "direct"]),
+  ...[...PII_USER_OWNED_NAME_HINTS].map((hint): CategorizedHint => [hint, "user-owned"]),
+  ...[...PII_USER_REFERENCE_NAME_HINTS].map((hint): CategorizedHint => [hint, "user-reference"]),
 ];
 
+type FieldClassification = {
+  readonly stance: StanceClass;
+  readonly hint: string | undefined;
+  readonly nearMissOf: HintCategory | undefined;
+};
+
 const REPORT_STANCE_CALLEES = new Set(["createTextField", "createLongTextField"]);
 
 // Mirrors guard-text-field-stance.ts's hasPersonalStance exactly.
@@ -473,7 +484,14 @@ function reportStanceHasPersonalStance(obj: ObjectLiteralExpression): boolean {
 function reportStanceEnclosingFieldName(call: CallExpression): string | undefined {
   let node = call.getParent();
   while (node) {
-    if (Node.isPropertyAssignment(node)) return node.getName();
+    if (Node.isPropertyAssignment(node)) {
+      // getName() keeps the quotes of a string-literal key; computed keys have no static name.
+      const nameNode = node.getNameNode();
+      if (Node.isStringLiteral(nameNode) || Node.isNoSubstitutionTemplateLiteral(nameNode)) {
+        return nameNode.getLiteralText();
+      }
+      return Node.isIdentifier(nameNode) ? nameNode.getText() : undefined;
+    }
     node = node.getParent();
   }
   return undefined;
@@ -506,72 +524,112 @@ function reportStanceResolveEntity(call: CallExpression): string | null {
   return varDecl ? varDecl.getName() : null;
 }
 
-// A hint only counts at a segment boundary (index 0, an uppercase letter in
-// the original, or preceded by `_`) — otherwise a coincidental substring
-// like "text" inside "contextId" would false-positive.
+function isSegmentStart(fieldOriginal: string, index: number): boolean {
+  return (
+    index === 0 || /[A-Z]/.test(fieldOriginal[index] ?? "") || fieldOriginal[index - 1] === "_"
+  );
+}
+
+// A hint only counts when it starts and ends on a segment boundary (index 0 /
+// end of field, an uppercase letter in the original, or `_`) — otherwise a
+// coincidental substring like "text" in "contextId" or "type" in "contentType"
+// would false-positive.
 function hintOccursAtBoundary(fieldLower: string, fieldOriginal: string, hint: string): boolean {
   let searchFrom = 0;
   for (;;) {
     const index = fieldLower.indexOf(hint, searchFrom);
     if (index === -1) return false;
-    const atBoundary =
-      index === 0 || /[A-Z]/.test(fieldOriginal[index] ?? "") || fieldOriginal[index - 1] === "_";
-    if (atBoundary) return true;
+    const end = index + hint.length;
+    if (
+      isSegmentStart(fieldOriginal, index) &&
+      (end === fieldOriginal.length || isSegmentStart(fieldOriginal, end))
+    ) {
+      return true;
+    }
     searchFrom = index + 1;
   }
 }
 
-function findLongestBoundaryHint(fieldLower: string, fieldOriginal: string): string | undefined {
-  let best: string | undefined;
-  for (const hint of ALL_PII_NAME_HINTS) {
-    if (best && hint.length <= best.length) continue;
-    if (hintOccursAtBoundary(fieldLower, fieldOriginal, hint)) best = hint;
+function findLongestBoundaryHint(
+  fieldLower: string,
+  fieldOriginal: string,
+): CategorizedHint | undefined {
+  let best: CategorizedHint | undefined;
+  for (const entry of ALL_PII_NAME_HINTS) {
+    const [hint] = entry;
+    if (best && hint.length <= best[0].length) continue;
+    if (hintOccursAtBoundary(fieldLower, fieldOriginal, hint)) best = entry;
   }
   return best;
 }
 
 function segmentAlignedSuffixes(fieldOriginal: string): string[] {
   const fieldLower = fieldOriginal.toLowerCase();
-  const suffixes: string[] = [];
+  const starts: number[] = [];
   for (let index = 0; index < fieldOriginal.length; index++) {
-    const atBoundary =
-      index === 0 || /[A-Z]/.test(fieldOriginal[index] ?? "") || fieldOriginal[index - 1] === "_";
-    if (atBoundary) suffixes.push(fieldLower.slice(index));
+    if (isSegmentStart(fieldOriginal, index)) starts.push(index);
   }
-  return suffixes;
+  // Hints are lowercase, so a hint's own segment boundary is unknowable. A
+  // single-segment tail ("Number", "Owner") is too generic to align with one;
+  // two or more segments ("UserId") are specific enough.
+  return starts.slice(0, -1).map((index) => fieldLower.slice(index));
 }
 
 // The hint sets only carry exact full names, so a suffix variant of one
 // (e.g. "...UserId" of "assigneeUserId") otherwise slips through undetected.
-function findShortestHintContainingSuffix(fieldOriginal: string): string | undefined {
-  let best: string | undefined;
+// The suffix must be the tail of the hint: plain `includes` matched "number"
+// inside "phonenumber" for "orderNumber".
+function findShortestHintContainingSuffix(fieldOriginal: string): CategorizedHint | undefined {
+  let best: CategorizedHint | undefined;
   for (const suffix of segmentAlignedSuffixes(fieldOriginal)) {
     if (suffix.length < 5) continue;
-    for (const hint of ALL_PII_NAME_HINTS) {
-      if (!hint.includes(suffix)) continue;
-      if (!best || hint.length < best.length) best = hint;
+    for (const entry of ALL_PII_NAME_HINTS) {
+      const [hint] = entry;
+      if (hint === suffix || !hint.endsWith(suffix)) continue;
+      if (!best || hint.length < best[0].length) best = entry;
     }
   }
   return best;
 }
 
-function classifyFieldStance(field: string): { stance: StanceClass; hint: string | undefined } {
-  const fieldLower = field.toLowerCase();
-  if (PII_DIRECT_NAME_HINTS.has(fieldLower)) return { stance: "direct", hint: fieldLower };
-  if (PII_USER_OWNED_NAME_HINTS.has(fieldLower)) return { stance: "user-owned", hint: fieldLower };
-  if (PII_USER_REFERENCE_NAME_HINTS.has(fieldLower))
-    return { stance: "user-reference", hint: fieldLower };
-  const containmentHint = findLongestBoundaryHint(fieldLower, field);
-  if (containmentHint) return { stance: "near-miss", hint: containmentHint };
-  const suffixHint = findShortestHintContainingSuffix(field);
-  if (suffixHint) return { stance: "near-miss", hint: suffixHint };
-  return { stance: "unclassified", hint: undefined };
+function classifyFieldStance(field: string): FieldClassification {
+  const fieldLower = field.replaceAll("_", "").toLowerCase();
+  if (PII_DIRECT_NAME_HINTS.has(fieldLower)) {
+    return { stance: "direct", hint: fieldLower, nearMissOf: undefined };
+  }
+  if (PII_USER_OWNED_NAME_HINTS.has(fieldLower)) {
+    return { stance: "user-owned", hint: fieldLower, nearMissOf: undefined };
+  }
+  if (PII_USER_REFERENCE_NAME_HINTS.has(fieldLower)) {
+    return { stance: "user-reference", hint: fieldLower, nearMissOf: undefined };
+  }
+  const nearMiss =
+    findLongestBoundaryHint(field.toLowerCase(), field) ?? findShortestHintContainingSuffix(field);
+  if (nearMiss) {
+    return { stance: "near-miss", hint: nearMiss[0], nearMissOf: nearMiss[1] };
+  }
+  return { stance: "unclassified", hint: undefined, nearMissOf: undefined };
 }
 
-export function reportStanceForSource(source: string, filePath: string): StanceSite[] {
-  const project = new Project({ useInMemoryFileSystem: true, skipFileDependencyResolution: true });
-  const sourceFile = project.createSourceFile(filePath, source);
+function createReportStanceProject(): Project {
+  return new Project({ useInMemoryFileSystem: true, skipFileDependencyResolution: true });
+}
 
+export function reportStanceForSource(
+  source: string,
+  filePath: string,
+  project: Project = createReportStanceProject(),
+): StanceSite[] {
+  const sourceFile = project.createSourceFile(filePath, source, { overwrite: true });
+  try {
+    return collectStanceSites(sourceFile);
+  } finally {
+    // A shared project would otherwise keep every scanned file's AST alive.
+    project.removeSourceFile(sourceFile);
+  }
+}
+
+function collectStanceSites(sourceFile: SourceFile): StanceSite[] {
   const sites: StanceSite[] = [];
   for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
     const exprNode = call.getExpression();
@@ -591,9 +649,9 @@ export function reportStanceForSource(source: string, filePath: string): StanceS
     // A call with no enclosing field (e.g. a bare createTextField() at top
     // level) has no real name to classify — `createTextField(...)` would
     // otherwise false-positive as a near-miss on its own "Text".
-    const { stance, hint } = enclosingField
+    const { stance, hint, nearMissOf }: FieldClassification = enclosingField
       ? classifyFieldStance(enclosingField)
-      : { stance: "unclassified" as const, hint: undefined };
+      : { stance: "unclassified", hint: undefined, nearMissOf: undefined };
 
     sites.push({
       line: call.getStartLineNumber(),
@@ -602,6 +660,7 @@ export function reportStanceForSource(source: string, filePath: string): StanceS
       callee,
       stance,
       hint,
+      nearMissOf,
     });
   }
   return sites;
@@ -620,6 +679,13 @@ function findReportStanceFiles(rootDir: string): string[] {
   return files.sort();
 }
 
+function formatHintSuffix(site: StanceSite): string {
+  if (!site.hint) return "";
+  return site.nearMissOf
+    ? ` (hint: ${site.hint}, near ${site.nearMissOf})`
+    : ` (hint: ${site.hint})`;
+}
+
 function reportStance(rootDir: string): void {
   console.log(
     `Scanning every .ts/.tsx under ${rootDir} except node_modules/dist/build/*.d.ts — guard-text-field-stance scans packages/*/src/** only, so counts can differ outside that scope.`,
@@ -634,8 +700,9 @@ function reportStance(rootDir: string): void {
   };
   let total = 0;
 
+  const project = createReportStanceProject();
   for (const file of findReportStanceFiles(rootDir)) {
-    const sites = reportStanceForSource(readFileSync(file, "utf8"), file);
+    const sites = reportStanceForSource(readFileSync(file, "utf8"), file, project);
     if (sites.length === 0) continue;
 
     console.log(`\n${relative(rootDir, file)}`);
@@ -643,7 +710,7 @@ function reportStance(rootDir: string): void {
       totals[site.stance]++;
       total++;
       const entity = site.entity ?? "<unresolved>";
-      const hintSuffix = site.hint ? ` (hint: ${site.hint})` : "";
+      const hintSuffix = formatHintSuffix(site);
       console.log(
         `  ${site.line}  ${site.field}  entity=${entity}  ${site.callee}  ${site.stance}${hintSuffix}`,
       );