@cosmicdrift/kumiko-samples 0.356.0 → 0.357.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.356.0",
+  "version": "0.357.0",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.356.0",
+  "version": "0.357.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/auth-mfa/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "MFA enable asks to confirm saved recovery codes, code field autocompletes one-time codes",
+    "detail": "secretMint `reveal.acknowledge` (i18n key) renders a checkbox on the reveal card that must be ticked before the confirm step or the acknowledge button can be used; the tick never reaches the payload. Text fields accept an `autoComplete` token that reaches the input. The MFA enable screen uses both: a \"saved my recovery codes\" gate and `one-time-code` on the code field"
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/auth-mfa/i18n.ts

@@ -28,6 +28,7 @@ export const AUTH_MFA_FEATURE_I18N: Readonly<Record<string, LocalizedString>> =
   "mfa.enable.reveal.qr": { en: "Scan this QR code" },
   "mfa.enable.reveal.secret": { en: "Or enter this code manually" },
   "mfa.enable.reveal.recoveryCodes": { en: "Recovery codes" },
+  "mfa.enable.reveal.savedCodes": { en: "I have saved my recovery codes." },
 
   "mfa.enable.confirm.submit": { en: "Enable" },
   "mfa.enable.confirm.done": { en: "Two-factor authentication is now enabled." },

package/packages/bundled-features/src/auth-mfa/screens.ts

@@ -34,6 +34,7 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
   reveal: {
     title: i18nKey("mfa.enable.reveal.title"),
     warning: i18nKey("mfa.enable.reveal.warning"),
+    acknowledge: i18nKey("mfa.enable.reveal.savedCodes"),
     fields: [
       {
         field: "otpauthUri",
@@ -58,7 +59,13 @@ export const mfaEnableScreen: SecretMintScreenDefinition = {
   confirm: {
     handler: AuthMfaHandlers.enableConfirm,
     fields: {
-      code: { type: "text", required: true, minLength: 6, maxLength: 6 },
+      code: {
+        type: "text",
+        required: true,
+        minLength: 6,
+        maxLength: 6,
+        autoComplete: "one-time-code",
+      },
     },
     layout: { sections: [{ fields: ["code"] }] },
     carry: ["setupToken"],

package/packages/bundled-features/src/cap-counter/feature.ts

@@ -119,7 +119,13 @@ export const capCounterFeature = defineFeature(CAP_COUNTER_FEATURE, (r) => {
     id: CAP_COUNTER_LIST_SCREEN_ID,
     type: "entityList",
     entity: "cap-counter",
-    columns: ["tenantId", "capName", "value", "periodStart", "lastSoftWarnedAt"],
+    columns: [
+      "tenantId",
+      "capName",
+      "value",
+      "periodStart",
+      { field: "lastSoftWarnedAt", hideOnNarrow: true },
+    ],
     defaultSort: { field: "capName", dir: "asc" },
     // Search resolves against the caller's own tenant stream, so on this
     // cross-tenant operator list it would only ever hit the SystemAdmin's tenant.

package/packages/bundled-features/src/cap-overview/screens.ts

@@ -31,10 +31,12 @@ export function createTenantCapListScreen(
       { field: "name", label: "cap-overview.list.col.name" },
       { field: "tier", label: "cap-overview.list.col.tier" },
       { field: "billing", label: "cap-overview.list.col.billing" },
-      ...listedCaps.map((cap) => ({
+      // Name is the title; tier, billing and the first cap fill the card's three meta rows.
+      ...listedCaps.map((cap, index) => ({
         field: capFieldName(cap.id),
         label: cap.label,
         renderer: { react: { __component: CAP_USAGE_CELL_COMPONENT } },
+        ...(index > 0 && { hideOnNarrow: true }),
       })),
     ],
     searchable: true,

package/packages/bundled-features/src/crypto-shredding/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "forget-subject shreds note bodies attached to the subject and notes that mention it",
+    "detail": "`forget-subject` on a user or record subject now also erases the per-note keys of every `note-entry` that hangs on the subject as host entity (entityId, plus entityType for record subjects) or @-mentions it, unless the host entity's retention strategy is anonymize/blockDelete. The automated Art. 17 delete hook reaches notes on the user as host too, and the export lists them. Before, `forget-subject(contact)` left the note bodies readable. Consumer tests that expect readable note bodies after `forget-subject` on a contact (e.g. solon contact-notes-forget) now see the erased sentinel. Forgetting only the author still leaves the bodies readable."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/crypto-shredding/handlers/forget-subject.write.ts

@@ -40,6 +40,7 @@ import { purgeSearchDocumentsForSubject } from "@cosmicdrift/kumiko-framework/se
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import * as z from "zod";
 import { resolveRetentionPolicyForTenant } from "../../data-retention/index.js";
+import { eraseNoteBodiesReachingSubject } from "../../notes-history-user-data/index.js";
 import { revokeAllPatTokensForUser } from "../../personal-access-tokens/index.js";
 import { USER_STATUS } from "../../user/index.js";
 import {
@@ -300,6 +301,7 @@ async function sweepDerivedSubjectData(
   subject: SubjectId,
   subjectKey: string,
   crossTenantRunner: DbRunner,
+  audit: { readonly requestId: string; readonly erasedBy: string },
 ): Promise<string | undefined> {
   try {
     await runInSavepointIfSupported(crossTenantRunner, async (crossTenantSubjectRunner) => {
@@ -318,6 +320,17 @@ async function sweepDerivedSubjectData(
           subject,
         );
       }
+
+      // Note bodies are keyed per note, so the subject's own key never reaches them.
+      if (ctx.registry.features.has("notes-history")) {
+        await eraseNoteBodiesReachingSubject({
+          db: crossTenantSubjectRunner,
+          registry: ctx.registry,
+          subject,
+          erasedBy: audit.erasedBy,
+          requestId: audit.requestId,
+        });
+      }
     });
     return undefined;
   } catch (err) {
@@ -471,8 +484,9 @@ export const forgetSubjectWrite = defineWriteHandler({
     // but no event exists — a retry is a no-op erase plus the event. The
     // reverse order could leave an audit trail claiming a shred that never
     // happened.
+    const requestId = requestContext.get()?.requestId ?? "crypto-shredding:forget-subject";
     await kms.eraseKey(subject, {
-      requestId: requestContext.get()?.requestId ?? "crypto-shredding:forget-subject",
+      requestId,
       userId: event.user.id,
       eraseReason: event.payload.reason,
     });
@@ -482,6 +496,7 @@ export const forgetSubjectWrite = defineWriteHandler({
       subject,
       subjectKey,
       ctx.db.unsafeRaw(),
+      { requestId, erasedBy: event.user.id },
     );
 
     // User subject: close the login door. DEK-erase makes the passwordHash

package/packages/bundled-features/src/delivery/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "Delivery idempotencyKey is released when nothing was delivered",
+    "detail": "A retry of a failed notify() with the same idempotencyKey is no longer skipped as a duplicate. The key is deleted when no recipient got a `sent` or `queued` delivery, also when notify() throws; one successful recipient keeps it, even if notify() throws afterwards (a retry would re-send to them). For queued channels the send/render job deletes the key after its final failed attempt, not per retry. That reference is only attached when a `route` call has exactly one channel address; `to` calls (user lists) and multi-channel routes keep the key after queueing. The job payload gains an optional `idempotencyKey`, backward compatible. `createDeliveryTestContext` accepts `idempotencyRedis`."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/delivery/chat-webhook-sender.ts

@@ -57,7 +57,7 @@ export type ChatWebhookRequest = ChatWebhookTarget & {
 function policyFor(request: ChatWebhookRequest, target: URL): EgressPolicy {
   return request.requireHttps
     ? { kind: "external" }
-    : { kind: "internal", allowHosts: [target.hostname] };
+    : { kind: "internal", allowOrigins: [target.origin] };
 }
 
 function hostMatches(hostname: string, allowedHost: string): boolean {

package/packages/bundled-features/src/delivery/constants.ts

@@ -26,6 +26,11 @@ export {
   type DeliveryStatusValue,
 } from "./public-names.js";
 
+// Single source for claim (delivery-service) and terminal-failure release (jobs).
+export function deliveryIdempotencyRedisKey(tenantId: string, key: string): string {
+  return `delivery:idem:${tenantId}:${key}`;
+}
+
 // notify() priority → BullMQ job priority. Lower number = processed first; all
 // > 0 so prioritised delivery jobs never mix with BullMQ's "0 = unprioritised
 // FIFO" bucket. critical jobs jump ahead of normal/low in the worker queue.

package/packages/bundled-features/src/delivery/delivery-service.ts

@@ -6,6 +6,7 @@ import type {
   EscapeHatchAuditSink,
   NotifyDelivery,
   NotifyJobDispatcher,
+  NotifyOptions,
   NotifyPriority,
   Registry,
   TenantId,
@@ -21,7 +22,12 @@ import { redactErrorText } from "../shared/index.js";
 import { hashUnsubscribeAddress } from "./address-opt-out.js";
 import { appendAttemptEvent, logAttempt } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DELIVERY_CHANNEL_EXTENSION, DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import {
+  DELIVERY_CHANNEL_EXTENSION,
+  DeliveryJobs,
+  deliveryIdempotencyRedisKey,
+  deliveryPriorityRank,
+} from "./constants.js";
 import {
   type AddressOptOutKey,
   addressOptOutKey,
@@ -171,11 +177,43 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         "Delivery idempotencyKey requires options.idempotencyRedis (or rateLimit.redis) to be configured",
       );
     }
-    const k = `delivery:idem:${tenantId}:${key}`;
-    const res = await idemRedis.set(k, "1", "EX", ttlSec, "NX");
+    const res = await idemRedis.set(
+      deliveryIdempotencyRedisKey(tenantId, key),
+      "1",
+      "EX",
+      ttlSec,
+      "NX",
+    );
     return res === "OK";
   }
 
+  function isDeliveredOrQueued(delivery: NotifyDelivery): boolean {
+    return delivery.status === "sent" || delivery.status === "queued";
+  }
+
+  // A key that guarded nothing must not turn the caller's retry into a skipped duplicate.
+  // Partial success keeps it: a retry would re-send to those who got it.
+  async function releaseIdempotencyIfNothingDelivered(
+    tenantId: TenantId,
+    key: string | undefined,
+    run: NotifyRun,
+  ): Promise<void> {
+    // skip: no key claimed, or a recipient already got the notification
+    if (!key || run.deliveries.some(isDeliveredOrQueued)) return;
+    await idemRedis?.del(deliveryIdempotencyRedisKey(tenantId, key));
+  }
+
+  // Only a single-channel route lets the queued job free the key on terminal failure
+  // without risking a duplicate send on another channel.
+  function jobIdempotencyKeyFor(
+    idempotencyKey: string | undefined,
+    route: NotifyOptions["route"],
+  ): string | undefined {
+    if (!idempotencyKey || !route) return undefined;
+    const routedChannelCount = channels.filter((channel) => route[channel.name]).length;
+    return routedChannelCount === 1 ? idempotencyKey : undefined;
+  }
+
   async function resolveUserIdsForTenant(tenantId: TenantId): Promise<readonly string[]> {
     if (!tenantUserIdsQuery) {
       throw new Error("Tenant broadcast requires tenantUserIdsQuery in DeliveryServiceOptions");
@@ -233,6 +271,9 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     readonly deliveries: NotifyDelivery[];
     readonly jobDispatcher: NotifyJobDispatcher | undefined;
     readonly locale: string | undefined;
+    // Set only when exactly one channel carries the call: the queued job may then free
+    // the key on terminal failure without risking a duplicate send on another channel.
+    readonly jobIdempotencyKey: string | undefined;
   };
 
   function recordDelivery(
@@ -343,6 +384,7 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
           deliveryAttemptId,
           priority,
           message,
+          ...(run.jobIdempotencyKey !== undefined && { idempotencyKey: run.jobIdempotencyKey }),
         },
         { priority: deliveryPriorityRank[priority] },
       );
@@ -745,14 +787,74 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
     }
   }
 
+  async function dispatchNotification(
+    notificationType: string,
+    options: NotifyOptions,
+    tenantId: TenantId,
+    priority: NotifyPriority,
+    run: NotifyRun,
+  ): Promise<void> {
+    const { to, route, data } = options;
+    if (route) {
+      await deliverDirect(
+        route,
+        notificationType,
+        data,
+        tenantId,
+        priority,
+        options.recipientId ?? null,
+        run,
+      );
+      // skip: explicit route is delivered directly, no recipient resolution needed
+      return;
+    }
+
+    if (to !== undefined) {
+      let userIds: readonly string[];
+
+      if (typeof to === "string") {
+        userIds = [to];
+      } else if ("tenant" in to) {
+        userIds = await resolveUserIdsForTenant(to.tenant);
+      } else {
+        userIds = to;
+      }
+
+      const prefetchedAddresses =
+        priority === "critical"
+          ? new Map<string, string | null>()
+          : await prefetchUserAddresses(userIds, tenantId, notificationType);
+      const suppressed = await loadSuppressedAddresses(
+        tenantId,
+        notificationType,
+        priority,
+        [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      );
+
+      for (const userId of userIds) {
+        await deliverToUser(
+          userId,
+          notificationType,
+          data,
+          tenantId,
+          priority,
+          run,
+          prefetchedAddresses,
+          suppressed,
+        );
+      }
+    }
+  }
+
   return {
     async notify(notificationType, options, _user, tenantId, jobDispatcher) {
-      const { to, route, data, idempotencyKey } = options;
+      const { route, idempotencyKey } = options;
       const priority: NotifyPriority = options.priority ?? "normal";
       const run: NotifyRun = {
         deliveries: [],
         jobDispatcher: options.immediate ? undefined : (jobDispatcher ?? jobRunner),
         locale: options.locale,
+        jobIdempotencyKey: jobIdempotencyKeyFor(idempotencyKey, route),
       };
 
       if (idempotencyKey) {
@@ -772,54 +874,20 @@ export function createDeliveryService(options: DeliveryServiceOptions): Delivery
         }
       }
 
-      if (route) {
-        await deliverDirect(
-          route,
-          notificationType,
-          data,
-          tenantId,
-          priority,
-          options.recipientId ?? null,
-          run,
-        );
-        return { deliveries: run.deliveries };
-      }
-
-      if (to !== undefined) {
-        let userIds: readonly string[];
-
-        if (typeof to === "string") {
-          userIds = [to];
-        } else if ("tenant" in to) {
-          userIds = await resolveUserIdsForTenant(to.tenant);
-        } else {
-          userIds = to;
-        }
-
-        const prefetchedAddresses =
-          priority === "critical"
-            ? new Map<string, string | null>()
-            : await prefetchUserAddresses(userIds, tenantId, notificationType);
-        const suppressed = await loadSuppressedAddresses(
-          tenantId,
-          notificationType,
-          priority,
-          [...prefetchedAddresses.values()].filter((address): address is string => !!address),
+      try {
+        await dispatchNotification(notificationType, options, tenantId, priority, run);
+      } catch (err) {
+        // A failing release must not replace the dispatch error the caller retries on.
+        await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run).catch(
+          (releaseErr: unknown) => {
+            logError.warn(`idempotency key release failed: ${redactedMessageOf(releaseErr)}`, {
+              notificationType,
+            });
+          },
         );
-
-        for (const userId of userIds) {
-          await deliverToUser(
-            userId,
-            notificationType,
-            data,
-            tenantId,
-            priority,
-            run,
-            prefetchedAddresses,
-            suppressed,
-          );
-        }
+        throw err;
       }
+      await releaseIdempotencyIfNothingDelivered(tenantId, idempotencyKey, run);
       return { deliveries: run.deliveries };
     },
   };

package/packages/bundled-features/src/delivery/feature.ts

@@ -247,15 +247,21 @@ export function createDeliveryFeature(options?: DeliveryFeatureOptions): Feature
           label: i18nKey("delivery.log.col.channel"),
           renderer: { react: { __component: DELIVERY_CHANNEL_CELL_COMPONENT } },
         },
-        { field: "recipientLabel", label: i18nKey("delivery.log.col.recipient") },
+        {
+          field: "recipientLabel",
+          label: i18nKey("delivery.log.col.recipient"),
+          hideOnNarrow: true,
+        },
         {
           field: "status",
           label: i18nKey("delivery.log.col.status"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_STATUS_CELL_COMPONENT } },
         },
         {
           field: "error",
           label: i18nKey("delivery.log.col.error"),
+          hideOnNarrow: true,
           renderer: { react: { __component: DELIVERY_ERROR_CELL_COMPONENT } },
         },
       ],

package/packages/bundled-features/src/delivery/jobs.ts

@@ -18,7 +18,7 @@ import type { JobRunner } from "@cosmicdrift/kumiko-framework/jobs";
 import * as z from "zod";
 import { appendAttemptEvent } from "./attempt-log.js";
 import { buildChannelContext } from "./channel-context.js";
-import { DeliveryJobs, deliveryPriorityRank } from "./constants.js";
+import { DeliveryJobs, deliveryIdempotencyRedisKey, deliveryPriorityRank } from "./constants.js";
 import { collectChannels, redactedMessageOf } from "./delivery-service.js";
 import type {
   ChannelMessage,
@@ -44,6 +44,7 @@ const renderJobPayloadSchema = z.object({
   deliveryAttemptId: z.string(),
   priority: z.enum(["critical", "normal", "low"]),
   message: channelMessageSchema,
+  idempotencyKey: z.string().optional(),
 });
 
 const sendJobPayloadSchema = renderJobPayloadSchema.extend({
@@ -110,6 +111,30 @@ function entryFor(
   };
 }
 
+// Only the final retry frees the key: earlier failures are retried by the runner and
+// must still dedup. Assumes ctx.redis is the handle the service claimed on; runProdApp
+// wires the same instance into both.
+async function releaseIdempotencyOnTerminalFailure(
+  ctx: JobContext,
+  p: RenderJobPayload,
+): Promise<void> {
+  // skip: nothing to release before the last attempt or without an idempotency key
+  if (!ctx.finalAttempt || !p.idempotencyKey) return;
+  if (!ctx.redis) {
+    ctx.log.warn("delivery: idempotency key not released, job context has no redis", {
+      notificationType: p.notificationType,
+    });
+    return;
+  }
+  try {
+    await ctx.redis.del(deliveryIdempotencyRedisKey(p.tenantId, p.idempotencyKey));
+  } catch (err) {
+    ctx.log.warn(`delivery: idempotency key release failed: ${redactedMessageOf(err)}`, {
+      notificationType: p.notificationType,
+    });
+  }
+}
+
 // The job runner stores err.message in the run row, and BullMQ keeps failedReason and
 // the stack trace in Redis in plain text, so the rethrown error carries only the code.
 // The redacted message goes to the log.
@@ -132,6 +157,7 @@ async function failAttempt(
     p.deliveryAttemptId,
     entryFor(p, "failed", code, p.address),
   );
+  await releaseIdempotencyOnTerminalFailure(ctx, p);
   throw new Error(code);
 }
 

package/packages/bundled-features/src/delivery/testing.ts

@@ -18,6 +18,7 @@ export type CreateDeliveryTestContextOptions = {
   readonly log?: Logger;
   readonly jobRunner?: JobRunner;
   readonly secrets?: SecretsContext;
+  readonly idempotencyRedis?: Redis;
 };
 
 /**

package/packages/bundled-features/src/notes-history/entity.ts

@@ -26,17 +26,18 @@ import {
 //
 // `body` is instead `personal: { of: "id" }` (Row-Subject, fw#2596/#2786):
 // the note's OWN row is its content's subject, so `body` is encrypted under a
-// per-note key that nothing else shares. That key gets erased only when
-// `note-mention` (below) names this note as reached by a forgotten subject
-// (see `notes-history-user-data/hooks.ts`) — a note with no mention on the
-// forgotten subject is untouched. GDPR erasure of the AUTHOR still separately
+// per-note key that nothing else shares. That key gets erased only when the
+// note is reached by a forgotten subject: `note-mention` (below) names the
+// subject, or the note hangs on the subject as host (entityId, plus entityType
+// for record subjects). See `notes-history-user-data/hooks.ts`; any other note
+// is untouched. GDPR erasure of the AUTHOR still separately
 // shreds `authorName` (`personal: { of: "authorId" }`, the name as stamped at
 // write time); the two erasures are independent.
 //
 // Known gap (fw#2596, not fixed by this entity): prose that names a third
 // party without a structured @-mention is not tracked — regex/NLP over
-// free text is unreliable. The operator's manual `forget-subject` path
-// covers what this structured trigger misses.
+// free text is unreliable. An operator must erase such a note's own record
+// subject (`forget-subject` kind "record", entity "note-entry") to cover it.
 export function createNoteEntryEntity(
   access?: EntityDefinition["access"],
   parents?: readonly string[],

package/packages/bundled-features/src/notes-history-user-data/hooks.ts

@@ -4,9 +4,17 @@
 // dependency. Mirrors job-run/delivery-attempt (user-data-rights-defaults):
 // export-only, erasure via crypto-shredding.
 
-import { configuredPiiSubjectKms } from "@cosmicdrift/kumiko-framework/crypto";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { configuredPiiSubjectKms, type SubjectId } from "@cosmicdrift/kumiko-framework/crypto";
+import type { DbRunner, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import type {
+  Registry,
+  TenantId,
+  UserDataDeleteHook,
+  UserDataExportHook,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
+  type RetentionPresetKey,
   resolveRetentionPolicyForTenant,
   resolveTenantRetentionPreset,
 } from "../data-retention/index.js";
@@ -32,95 +40,134 @@ export const noteEntryExportHook: UserDataExportHook = async (ctx) => {
   };
 };
 
+type NoteRow = {
+  readonly id: string;
+  readonly tenantId: TenantId;
+  readonly entityType: string;
+  readonly entityId: string;
+  readonly body: unknown;
+  readonly insertedAt: unknown;
+};
+
+// What erasing a subject's key reaches: notes that @-mention the subject plus notes
+// attached to it as host. Export and erasure both go through this, so Art. 15
+// lists exactly what Art. 17 shreds.
+async function selectNotesReachingSubject(
+  db: DbRunner | TenantDb,
+  subject: SubjectId,
+): Promise<readonly NoteRow[]> {
+  if (subject.kind === "tenant") return [];
+  const subjectId = subject.kind === "user" ? subject.userId : subject.id;
+  const attachedWhere =
+    subject.kind === "record"
+      ? { entityType: subject.entity, entityId: subjectId }
+      : { entityId: subjectId };
+
+  const mentions = await selectMany<{ noteId: string }>(db, noteMentionTable, { subjectId });
+  const mentioned =
+    mentions.length === 0
+      ? []
+      : await selectMany<NoteRow>(db, noteEntryTable, {
+          id: { in: [...new Set(mentions.map((m) => m.noteId))] },
+        });
+  const attached = await selectMany<NoteRow>(db, noteEntryTable, attachedWhere);
+
+  const byId = new Map<string, NoteRow>();
+  for (const note of [...mentioned, ...attached]) byId.set(note.id, note);
+  return [...byId.values()];
+}
+
 // `authorName` is separately annotated `personal: { of: "authorId" }`
 // (entity.ts), so forgetting the AUTHOR already crypto-shreds that field on
-// its own — unrelated to this hook. `body` is Row-Subject (`personal: { of:
-// "id" }`): its key is per-note, not per-user, so forgetting a user only
-// reaches a note's body when that note structurally @-mentions the user via
-// a `note-mention` row (fw#2787). Free-text mentions are NOT detected —
-// that's the documented gap in entity.ts, not a bug here.
+// its own. `body` is Row-Subject (`personal: { of: "id" }`): its key is per
+// note, so forgetting a subject only reaches a body when the note structurally
+// @-mentions the subject (`note-mention`, fw#2787) or hangs on it as host.
+// Free-text mentions are NOT detected — the documented gap in entity.ts.
 //
-// Per reached note: consult the HOST entity's (entityType, not note-entry's
-// own) retention strategy first — blockDelete/anonymize must win over
-// erasure, same rule the automated forget-cleanup pipeline applies to every
-// other entity. The `strategy` this hook itself is called with is resolved
-// for note-entry, not the host, so it is deliberately unused here.
+// Per reached note the HOST entity's retention strategy (entityType, resolved
+// for the note's own tenant — the manual forget-subject path runs cross-tenant)
+// is consulted first: anonymize/blockDelete win over erasure, same rule the
+// automated forget-cleanup applies to every other entity.
 //
-// Precondition: this ONLY erases anything if the app mounts a KMS adapter —
-// without one, record-owned fields fall back to plaintext storage
-// framework-wide (see pii-field-encryption.ts) and forget is a true no-op.
-// That gap is a property of the framework's crypto-shredding design, not
-// specific to this hook; apps that need Art.17 coverage without KMS must
-// mount one.
-export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+// Without a mounted KMS this erases nothing: record-owned fields fall back to
+// plaintext framework-wide (see pii-field-encryption.ts), so apps that need
+// Art. 17 coverage must mount one.
+export async function eraseNoteBodiesReachingSubject(args: {
+  readonly db: DbRunner | TenantDb;
+  readonly registry: Registry;
+  readonly subject: SubjectId;
+  readonly erasedBy: string;
+  readonly requestId: string;
+}): Promise<void> {
   const kms = configuredPiiSubjectKms();
-  // skip: no KMS adapter mounted — record-owned fields stay plaintext framework-wide, forget is a true no-op
+  // skip: no KMS adapter mounted — forget is a true no-op
   if (!kms) return;
 
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  // skip: no note-mention rows for this user — nothing structurally reaches this user's data to shred
-  if (mentions.length === 0) return;
-
-  const noteIds = new Set(mentions.map((m) => m.noteId));
-  // Once per hook run: the preset depends on the tenant only, not the note.
-  const tenantPreset = await resolveTenantRetentionPreset({
-    db: ctx.db,
-    registry: ctx.registry,
-    tenantId: ctx.tenantId,
-  });
-  // Append-only rows are never hard-deleted, so every mentioned note should
-  // resolve; a missing one has no host and thus no retention policy to consult.
-  const notes = await ctx.db.selectMany<{ id: string; entityType: string }>(noteEntryTable, {
-    id: { in: [...noteIds] },
-  });
-  const strategyByEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
+  const notes = await selectNotesReachingSubject(args.db, args.subject);
+  const dataRetentionMounted = args.registry.features.has("data-retention");
+  const presetByTenant = new Map<string, RetentionPresetKey | null>();
+  const strategyByTenantAndEntityType = new Map<string, ReturnType<typeof policyToStrategy>>();
   for (const note of notes) {
-    let strategy = strategyByEntityType.get(note.entityType);
+    const strategyKey = `${note.tenantId}:${note.entityType}`;
+    let strategy = strategyByTenantAndEntityType.get(strategyKey);
     if (strategy === undefined) {
+      let tenantPreset = presetByTenant.get(note.tenantId);
+      if (tenantPreset === undefined) {
+        tenantPreset = await resolveTenantRetentionPreset({
+          db: args.db,
+          registry: args.registry,
+          tenantId: note.tenantId,
+        });
+        presetByTenant.set(note.tenantId, tenantPreset);
+      }
       const hostPolicy = await resolveRetentionPolicyForTenant({
-        db: ctx.db,
-        registry: ctx.registry,
-        tenantId: ctx.tenantId,
+        db: args.db,
+        registry: args.registry,
+        tenantId: note.tenantId,
         entityName: note.entityType,
         preloadedTenantPreset: tenantPreset,
+        // Without data-retention there is no override table to read.
+        ...(!dataRetentionMounted && { preloadedOverride: null }),
       });
       strategy = policyToStrategy(hostPolicy.policy?.strategy ?? null);
-      strategyByEntityType.set(note.entityType, strategy);
+      strategyByTenantAndEntityType.set(strategyKey, strategy);
     }
     if (strategy === "anonymize") continue;
-    const noteId = note.id;
 
     await kms.eraseKey(
-      { kind: "record", entity: "note-entry", id: noteId },
+      { kind: "record", entity: "note-entry", id: note.id },
       {
-        requestId: "notes-history-user-data:forget-mentioned-notes",
-        userId: ctx.userId,
-        eraseReason: "notes-history:mention-forget",
+        requestId: args.requestId,
+        userId: args.erasedBy,
+        eraseReason: "notes-history:subject-forget",
       },
     );
   }
+}
+
+export const noteEntryDeleteHook: UserDataDeleteHook = async (ctx) => {
+  await eraseNoteBodiesReachingSubject({
+    db: ctx.db,
+    registry: ctx.registry,
+    subject: { kind: "user", userId: ctx.userId },
+    erasedBy: ctx.userId,
+    requestId: "notes-history-user-data:forget-reached-notes",
+  });
 };
 
-// Erasure reaches every note that structurally mentions the user (see
-// noteEntryDeleteHook), so the Art. 15/20 export must list those notes too.
+// Erasure reaches every note that mentions the user or hangs on the user as host
+// (see eraseNoteBodiesReachingSubject), so the Art. 15/20 export lists those too.
 export const noteMentionExportHook: UserDataExportHook = async (ctx) => {
-  const mentions = await ctx.db.selectMany<{ noteId: string }>(noteMentionTable, {
-    subjectId: ctx.userId,
-  });
-  if (mentions.length === 0) return null;
-  const noteIds = [...new Set(mentions.map((m) => m.noteId))];
-  const notes = await ctx.db.selectMany(noteEntryTable, { id: { in: noteIds } });
+  const notes = await selectNotesReachingSubject(ctx.db, { kind: "user", userId: ctx.userId });
   if (notes.length === 0) return null;
   return {
     entity: "note-mention",
     rows: notes.map((note) => ({
-      noteId: note["id"],
-      entityType: note["entityType"],
-      entityId: note["entityId"],
-      body: note["body"],
-      insertedAt: note["insertedAt"],
+      noteId: note.id,
+      entityType: note.entityType,
+      entityId: note.entityId,
+      body: note.body,
+      insertedAt: note.insertedAt,
     })),
   };
 };

package/packages/bundled-features/src/notes-history-user-data/index.ts

@@ -13,9 +13,11 @@ import {
   noteMentionExportHook,
 } from "./hooks.js";
 
+export { eraseNoteBodiesReachingSubject } from "./hooks.js";
+
 export const notesHistoryUserDataFeature = defineFeature("notes-history-user-data", (r) => {
   r.describe(
-    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+    "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
   );
   // user-data-rights is the hard dependency (EXT_USER_DATA host). notes-history
   // is OPTIONAL: if it's mounted toggleable(default=false), a hard r.requires

package/packages/bundled-features/src/personal-access-tokens/screens.ts

@@ -60,11 +60,13 @@ export const patListScreen: ProjectionListScreenDefinition = {
     {
       field: "createdAt",
       label: i18nKey("pat.list.col.created"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
     {
       field: "expiresAt",
       label: i18nKey("pat.list.col.expires"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],

package/packages/bundled-features/src/sessions/screens.ts

@@ -48,6 +48,7 @@ export const createSessionListScreen = (
     {
       field: "revokedAt",
       label: i18nKey("sessions.list.col.revokedAt"),
+      hideOnNarrow: true,
       renderer: { format: "timestamp" },
     },
   ],
@@ -123,6 +124,7 @@ export const sessionMineScreen: ProjectionListScreenDefinition = {
     {
       field: "current",
       label: i18nKey("sessions.mine.col.current"),
+      hideOnNarrow: true,
       renderer: { format: "boolean" },
     },
   ],

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.357.0",
+    "type": "improvement",
+    "title": "The member roles form only offers roles the signed-in admin may assign",
+    "detail": "New query tenant:query:member-role-availability; TenantAdmin still sees every role."
+  },
   {
     "version": "0.354.0",
     "type": "breaking",

package/packages/bundled-features/src/tenant/constants.ts

@@ -26,9 +26,10 @@ export const MEMBER_ROLES_CELL_COMPONENT = "MemberRolesCell" as const;
 // Admin (rank 2) shares the invite-create screen with TenantAdmin — TenantAdmin
 // must not appear here or Admin sees an unassignable option (fw#2414).
 export const DEFAULT_INVITE_ROLE_OPTIONS = ["User", "Editor", "Admin"] as const;
-// Full assignable rank list, used by memberRolesEditScreen: that screen is
-// prefilled with a member's *current* roles, so it must be able to represent
-// every rank a membership can actually hold, including TenantAdmin (fw#2452).
+// Full rank list for memberRolesEditScreen: it is prefilled with a member's
+// *current* roles, so it must represent every rank a membership can hold,
+// including TenantAdmin (fw#2452). The screen hides what the caller may not
+// assign via TenantQueries.memberRoleAvailability.
 export const OWNER_INVITE_ROLE_OPTIONS = [
   "User",
   "Member",
@@ -67,6 +68,8 @@ export const TenantQueries = {
   invitations: "tenant:query:invitations",
   // Combined active-members + pending-invitations list backing /members.
   teamList: "tenant:query:team:list",
+  // Per-role assignability for the caller, mirrors the rank rule of updateMemberRoles.
+  memberRoleAvailability: "tenant:query:member-role-availability",
 } as const;
 
 // Error codes

package/packages/bundled-features/src/tenant/feature.ts

@@ -20,6 +20,7 @@ import { invitationsQuery } from "./handlers/invitations.query.js";
 import { listQuery } from "./handlers/list.query.js";
 import { meQuery } from "./handlers/me.query.js";
 import { memberDirectoryQuery } from "./handlers/member-directory.query.js";
+import { memberRoleAvailabilityQuery } from "./handlers/member-role-availability.query.js";
 import { membersQuery } from "./handlers/members.query.js";
 import { membershipsQuery } from "./handlers/memberships.query.js";
 import { removeMemberWrite } from "./handlers/remove-member.write.js";
@@ -166,6 +167,7 @@ export function createTenantFeature(options?: TenantFeatureOptions): FeatureDefi
       resolveUserIds: r.queryHandler(resolveUserIdsQuery),
       invitations: r.queryHandler(invitationsQuery),
       teamList: r.queryHandler(teamListQuery),
+      memberRoleAvailability: r.queryHandler(memberRoleAvailabilityQuery),
     };
 
     // Entity-convention handlers for the SystemAdmin entityList/entityEdit

package/packages/bundled-features/src/tenant/handlers/member-role-availability.query.ts

@@ -0,0 +1,25 @@
+import {
+  access,
+  assignableAppRolesOf,
+  canActorAssignRole,
+  defineQueryHandler,
+} from "@cosmicdrift/kumiko-framework/engine";
+import * as z from "zod";
+import { memberRoleOptions } from "../member-role-options.js";
+
+export const memberRoleAvailabilityQuery = defineQueryHandler({
+  name: "member-role-availability",
+  schema: z.object({}),
+  access: { roles: access.admin },
+  description:
+    "Lists every role the member roles form offers and whether the caller's own rank may assign it; the form hides the roles marked disabled.",
+  handler: async (query, ctx) => {
+    const assignableAppRoles = assignableAppRolesOf(ctx.registry);
+    return {
+      rows: memberRoleOptions(assignableAppRoles).map((value) => ({
+        value,
+        disabled: !canActorAssignRole(query.user.roles, value, assignableAppRoles),
+      })),
+    };
+  },
+});

package/packages/bundled-features/src/tenant/member-role-options.ts

@@ -0,0 +1,6 @@
+import type { AssignableAppRoles } from "@cosmicdrift/kumiko-framework/engine";
+import { OWNER_INVITE_ROLE_OPTIONS } from "./constants.js";
+
+export function memberRoleOptions(assignableAppRoles: AssignableAppRoles): readonly string[] {
+  return [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()];
+}

package/packages/bundled-features/src/tenant/screens.ts

@@ -15,10 +15,10 @@ import {
   MEMBER_ROLES_EDIT_SCREEN_ID,
   MEMBER_STATUS_CELL_COMPONENT,
   MEMBERS_SCREEN_ID,
-  OWNER_INVITE_ROLE_OPTIONS,
   TenantHandlers,
   TenantQueries,
 } from "./constants.js";
+import { memberRoleOptions } from "./member-role-options.js";
 
 // Cross-tenant SystemAdmin platform view of the tenants themselves. The tenant
 // feature runs with `r.systemScope()`, so the entityList returns every tenant.
@@ -107,6 +107,7 @@ export function createMembersScreen(options?: {
         field: "lastSeenAt",
         label: i18nKey("tenant.members.col.lastActivity"),
         renderer: { format: "timestamp" },
+        hideOnNarrow: true,
       },
     ],
     defaultSort: { field: "createdAt", dir: "desc" },
@@ -199,13 +200,15 @@ export function createMemberRolesEditScreen(assignableAppRoles: AssignableAppRol
     cancelTarget: MEMBERS_SCREEN_ID,
     fields: {
       userId: { type: "text", required: true },
-      // Prefilled with the member's current roles, so the option list must be
-      // able to represent every assignable rank — DEFAULT_INVITE_ROLE_OPTIONS
-      // omits TenantAdmin and would silently strip it on submit. Escalation
-      // still stays server-side via findForbiddenRoleAssignment (update-member-roles.write.ts).
+      // Prefilled with the member's current roles, so the static options must
+      // represent every rank (DEFAULT_INVITE_ROLE_OPTIONS omits TenantAdmin and
+      // would silently strip it on submit); the availability query hides what the
+      // caller may not assign. Enforcement stays server-side via
+      // findForbiddenRoleAssignment (update-member-roles.write.ts).
       roles: {
         type: "multiSelect",
-        options: [...OWNER_INVITE_ROLE_OPTIONS, ...assignableAppRoles.keys()],
+        options: memberRoleOptions(assignableAppRoles),
+        optionsAvailabilityQuery: TenantQueries.memberRoleAvailability,
         required: true,
       },
     },

package/packages/bundled-features/src/user/screens.ts

@@ -17,7 +17,14 @@ export const userListScreen: EntityListScreenDefinition = {
   id: "user-list",
   type: "entityList",
   entity: "user",
-  columns: ["email", "displayName", "roles", "tenants", "status", "emailVerified"],
+  columns: [
+    "email",
+    "displayName",
+    "roles",
+    "tenants",
+    "status",
+    { field: "emailVerified", hideOnNarrow: true },
+  ],
   rowActions: [
     {
       kind: "navigate",

package/packages/bundled-features/src/user-data-rights/screens.ts

@@ -68,7 +68,14 @@ export const downloadAttemptListScreen: EntityListScreenDefinition = {
   id: "download-attempt-list",
   type: "entityList",
   entity: "download-attempt",
-  columns: ["attemptedAt", "result", "via", "ip", "attemptedByUserId", "jobId"],
+  columns: [
+    "attemptedAt",
+    "result",
+    "via",
+    "ip",
+    { field: "attemptedByUserId", hideOnNarrow: true },
+    { field: "jobId", hideOnNarrow: true },
+  ],
   searchable: false,
   access: { roles: access.systemAdmin },
   // Inert until an app navs it (see file header) — no nav area to resolve

package/packages/bundled-features/src/waitlist/screens.ts

@@ -6,7 +6,14 @@ export const waitlistListScreen: EntityListScreenDefinition = {
   id: "waitlist-list",
   type: "entityList",
   entity: "waitlistEntry",
-  columns: ["name", "email", "company", "status", "locale", "submittedAt"],
+  columns: [
+    "name",
+    "email",
+    "company",
+    "status",
+    "locale",
+    { field: "submittedAt", hideOnNarrow: true },
+  ],
   defaultSort: { field: "submittedAt", dir: "desc" },
   access: adminAccess,
   searchable: true,

package/samples/apps/marketing-demo/src/features/assets/schema/asset.ts

@@ -116,10 +116,10 @@ export const assetListScreen: EntityListScreenDefinition = {
     "status",
     "department",
     "owner",
-    "location",
-    "vendor",
-    "purchaseDate",
-    "warrantyUntil",
+    { field: "location", hideOnNarrow: true },
+    { field: "vendor", hideOnNarrow: true },
+    { field: "purchaseDate", hideOnNarrow: true },
+    { field: "warrantyUntil", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "name", dir: "asc" },

package/samples/apps/marketing-demo/src/features/helpdesk/schema/ticket.ts

@@ -123,10 +123,10 @@ export const ticketListScreen: EntityListScreenDefinition = {
     "severity",
     "status",
     "department",
-    "assignee",
-    "reporter",
-    "dueDate",
-    "spentMinutes",
+    { field: "assignee", hideOnNarrow: true },
+    { field: "reporter", hideOnNarrow: true },
+    { field: "dueDate", hideOnNarrow: true },
+    { field: "spentMinutes", hideOnNarrow: true },
   ],
   pageSize: 25,
   defaultSort: { field: "severity", dir: "desc" },

package/samples/apps/showcase/src/features/items/schema/item.ts

@@ -102,7 +102,7 @@ export const itemListScreen: EntityListScreenDefinition = {
     "dueDate",
     // Tier 2.7e-4 Demo — Reference-Spalte. Renderer macht Bulk-Lookup
     // auf item:list (limit:200), zeigt parentId als parent.title.
-    "parentId",
+    { field: "parentId", hideOnNarrow: true },
   ],
   // Server-side Pagination Demo — Showcase seedet ~200 items, der
   // Pager hat 4 Seiten zum Durchklicken bei pageSize: 50.

package/samples/apps/styleguide/src/features/demo/feature.ts

@@ -228,9 +228,9 @@ export const demoFeature = defineFeature("styleguide", (r) => {
       "status",
       "isActive",
       "quantity",
-      "rating",
-      "publishedAt",
-      "price",
+      { field: "rating", hideOnNarrow: true },
+      { field: "publishedAt", hideOnNarrow: true },
+      { field: "price", hideOnNarrow: true },
     ],
     pagination: "pages",
     pageSize: 25,

package/samples/apps/styleguide/src/features/gallery/web/Gallery.tsx

@@ -331,7 +331,7 @@ export function Gallery(): ReactNode {
         {/* Standalone <Section> (outside Form) = the calculator-result-card
             standard. title-only = existing consumer (publicstatus/tier-admin),
             must NOT regress from the border-b removal; subtitle +
-            actions footer = new. No divider under the title (shadcn pattern). */}
+            actions (title row, top right) = new. No divider under the title (shadcn pattern). */}
         <div className="flex max-w-md flex-col gap-6">
           <Section title="Affordable rate / month">
             <div className="text-2xl font-semibold tabular-nums">€2,500.00</div>

package/samples/apps/ui-walkthrough/src/features/rental/screens.ts

@@ -27,7 +27,7 @@ const OPEN_FILL_COLUMNS = [
   "einheit",
   "liegenschaft",
   "beginn",
-  "ende",
+  { field: "ende", hideOnNarrow: true },
   "status",
 ] as const;
 
@@ -145,7 +145,11 @@ const POSITION_COLUMNS = [
     label: "rental:entity:leasePosition:field:gueltigVon",
     sortable: true,
   },
-  { field: "gueltigBis", label: "rental:entity:leasePosition:field:gueltigBis" },
+  {
+    field: "gueltigBis",
+    label: "rental:entity:leasePosition:field:gueltigBis",
+    hideOnNarrow: true,
+  },
 ] as const;
 
 export const leaseDetailScreen: ProjectionDetailScreenDefinition = {

package/samples/apps/ui-walkthrough/src/features/vehicles/screens.ts

@@ -31,7 +31,14 @@ export const vehicleListScreen: EntityListScreenDefinition = {
   id: "vehicle-list",
   type: "entityList",
   entity: "vehicle",
-  columns: ["marke", "modell", "baujahr", "preis", "zustand", "scheckheftGepflegt"],
+  columns: [
+    "marke",
+    "modell",
+    "baujahr",
+    "preis",
+    "zustand",
+    { field: "scheckheftGepflegt", hideOnNarrow: true },
+  ],
   searchPlaceholder: "vehicles.search.placeholder",
   defaultSort: { field: "marke", dir: "asc" },
   rowActions: [
@@ -129,7 +136,7 @@ export const campaignListScreen: EntityListScreenDefinition = {
     "aktionStartet",
     "aktionEndet",
     "meta",
-    "gepostet",
+    { field: "gepostet", hideOnNarrow: true },
     { field: "gestartetAm", hideOnNarrow: true },
   ],
   searchPlaceholder: "vehicles.search.placeholder",

package/samples/apps/use-all-bundled/feature-manifest.json

@@ -1954,7 +1954,7 @@
     },
     {
       "name": "notes-history-user-data",
-      "description": "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook looks up `note-mention` for notes that structurally @-mention the forgotten user and crypto-shreds each reached note's row-subject key (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for notes without such a mention. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
+      "description": "GDPR (Art. 20 export / Art. 17 erasure) coverage for the `notes-history` feature's `note-entry` and `note-mention` entities. Mounts the export hook so a user's authored notes are included in the user-data export bundle; the note-entry delete hook crypto-shreds the row-subject key of each note that structurally @-mentions the forgotten user (`note-mention`) or hangs on the user as host entity (after consulting that note's host entity's retention strategy — blockDelete/anonymize win over erasure), keeping the append-only history intact for all other notes. The manual `crypto-shredding` forget-subject command reaches the same notes for user and record subjects through the exported `eraseNoteBodiesReachingSubject`, and the export lists them under `note-mention`. `note-mention`'s own hooks are a no-op — it is a plain FK pointer, not separately exportable content. Kept separate from `notes-history` so notes consumers without the user-data-rights pipeline don't pull a hard dependency — requires `user-data-rights`, optionalRequires `notes-history`.",
       "toggleableDefault": null,
       "requires": [
         "user-data-rights"