@cosmicdrift/kumiko-samples 0.363.0 → 0.365.0

package/packages/bundled-features/src/template-resolver/web/document-toolbar-blocks.ts

@@ -1,5 +1,6 @@
 // @runtime client
 import type { ContentEditorProps } from "@cosmicdrift/kumiko-renderer";
+import type { ReactNode } from "react";
 
 export type DocumentToolbarBlock =
   | "image"
@@ -8,7 +9,8 @@ export type DocumentToolbarBlock =
   | "divider"
   | "repeat"
   | "pageBreak"
-  | "align";
+  | "align"
+  | "steps";
 
 /** Imperative access for an outside panel (placeholder list, resource list). */
 export type DocumentEditorHandle = {
@@ -39,8 +41,13 @@ export type DocumentEditorProps = ContentEditorProps & {
   readonly chrome?: DocumentEditorChrome;
   /** "compact" renders the placeholder and block buttons icon-only with a tooltip, for narrow columns. Default "full". */
   readonly toolbar?: "full" | "compact";
-  /** Called with the handle once the editor exists and with null when it is destroyed. */
-  readonly onEditorReady?: (handle: DocumentEditorHandle) => void;
+  /** Canvas only: wraps the editable area in a caller-owned page (letterhead, margins) instead of the default mail paper. */
+  readonly renderPaper?: (editable: ReactNode) => ReactNode;
+  /** Canvas only: renders the toolbar (and its insert panel) into this element instead of above the editor;
+   *  null renders none. Lets several region editors share one toolbar that follows the focused one. */
+  readonly toolbarHost?: HTMLElement | null;
+  /** Called with the handle once the editor exists and with null when it is destroyed (unmount or rebuild), so a held handle never outlives its editor. */
+  readonly onEditorReady?: (handle: DocumentEditorHandle | null) => void;
 };
 
 export const MAIL_DOCUMENT_BLOCKS = [
@@ -49,6 +56,7 @@ export const MAIL_DOCUMENT_BLOCKS = [
   "button",
   "divider",
   "repeat",
+  "steps",
 ] as const satisfies readonly DocumentToolbarBlock[];
 
 export const PDF_DOCUMENT_BLOCKS = [
@@ -57,5 +65,11 @@ export const PDF_DOCUMENT_BLOCKS = [
   "table",
   "divider",
   "repeat",
+  "steps",
   "pageBreak",
 ] as const satisfies readonly DocumentToolbarBlock[];
+
+/** Block set for a template-resource kind; every kind except "document-pdf" gets the mail set. */
+export function documentBlocksForKind(kind: string | undefined): readonly DocumentToolbarBlock[] {
+  return kind === "document-pdf" ? PDF_DOCUMENT_BLOCKS : MAIL_DOCUMENT_BLOCKS;
+}

package/packages/bundled-features/src/template-resolver/web/i18n.ts

@@ -17,6 +17,7 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.divider": "Divider",
     "template-resolver.documentEditor.heading3": "Heading 3",
     "template-resolver.documentEditor.image": "Image",
+    "template-resolver.documentEditor.imageBlock": "Image · inline",
     "template-resolver.documentEditor.imageAlt": "Alt text (optional)",
     "template-resolver.documentEditor.insert": "Insert",
     "template-resolver.documentEditor.insertPlaceholder": "Placeholder",
@@ -36,13 +37,19 @@ export const defaultTranslations: TranslationsByLocale = {
     "template-resolver.documentEditor.alignJustify": "Justified",
     "template-resolver.documentEditor.repeatBarList": "Repeat · {list}",
     "template-resolver.documentEditor.repeatHeader": "Repeat header row",
-    "template-resolver.documentEditor.keepRowsTogether": "Keep rows together",
     "template-resolver.documentEditor.paragraph": "Paragraph",
     "template-resolver.documentEditor.paragraphStyle": "Paragraph style",
     "template-resolver.documentEditor.placeholder": "Write your text…",
     "template-resolver.documentEditor.removeLink": "Remove link",
     "template-resolver.documentEditor.repeat": "Repeat",
     "template-resolver.documentEditor.repeatList": "List to repeat",
+    "template-resolver.documentEditor.steps": "Steps",
+    "template-resolver.documentEditor.stepsVariable": "Current step from",
+    "template-resolver.documentEditor.stepsList": "Steps, separated by commas (value=label)",
+    "template-resolver.documentEditor.stepsDefault":
+      "reported=Reported, investigating=Investigating, resolved=Resolved",
+    "template-resolver.documentEditor.invalidSteps":
+      "Enter 1 to 8 different steps; values use letters, digits, - and _.",
     "template-resolver.documentEditor.resourceKey": "Resource key",
     "template-resolver.documentEditor.table": "Table",
     "template-resolver.editor.titleLabel": "Title",
@@ -82,11 +89,31 @@ export const defaultTranslations: TranslationsByLocale = {
     "templateResolver.errors.resource.unsupportedImage":
       "This file is not a supported image. Use PNG, JPEG, WebP or GIF.",
     "templateResolver.errors.template.systemResourcesNeedSystemTenant":
-      "Resource files can only be imported as system templates by a user of the system tenant.",
+      "Resource files of system templates can only be imported or exported by a user of the system tenant.",
+    "templateResolver.errors.template.bundleLocalesDiffer":
+      "The locales of this template differ in content format or variables, so they cannot be exported as one bundle.",
     "templateResolver.errors.collection.kindNotAllowed":
       "“{detail}” templates are written through their own editor, not through a collection.",
     "templateResolver.errors.noSystemTemplate": "There is no active system template to reset to.",
-    "templateResolver.errors.template.invalidMeta": "Invalid template settings: {detail}",
+    "templateResolver.errors.noDraft": "There is no draft to discard.",
+    "templateResolver.errors.template.invalidMeta": "The template settings are invalid.",
+    "templateResolver.errors.template.meta.subject.required": "The subject is missing.",
+    "templateResolver.errors.template.meta.subject.invalid":
+      "The subject is invalid (at most 200 characters, no line breaks).",
+    "templateResolver.errors.template.meta.previewText.required": "The preview text is missing.",
+    "templateResolver.errors.template.meta.previewText.invalid":
+      "The preview text is invalid (at most 200 characters, no line breaks).",
+    "templateResolver.errors.template.meta.senderName.required": "The sender name is missing.",
+    "templateResolver.errors.template.meta.senderName.invalid":
+      "The sender name is invalid (at most 80 characters, no line breaks).",
+    "templateResolver.errors.template.meta.replyTo.required": "The reply-to address is missing.",
+    "templateResolver.errors.template.meta.replyTo.invalid":
+      "The reply-to address is not a valid email address.",
+    "templateResolver.errors.template.meta.layoutSlug.required": "The layout is missing.",
+    "templateResolver.errors.template.meta.layoutSlug.invalid": "The chosen layout is invalid.",
+    "templateResolver.errors.template.meta.fileName.required": "The file name is missing.",
+    "templateResolver.errors.template.meta.fileName.invalid":
+      "The file name is invalid: no slashes, quotes, semicolons or two dots in a row.",
     "templateResolver.errors.template.unknownPlaceholders": "Unknown placeholders: {detail}",
     "templateResolver.errors.template.missingRequiredPlaceholders":
       "Required placeholders are not used: {detail}",
@@ -112,7 +139,8 @@ export const defaultTranslations: TranslationsByLocale = {
       "There is no PDF template “{slug}” for this tenant or the system.",
     "template-resolver.documentEditor.htmlSource": "HTML source",
     "template-resolver.documentEditor.removeBlock": "Remove block",
-    "template-resolver.documentEditor.selectedBlock": "Selected block",
+    "template-resolver.documentEditor.list": "List",
+    "template-resolver.documentEditor.more": "More",
     "template-resolver.documentEditor.showHtml": "HTML",
     "template-resolver.documentEditor.underline": "Underline",
     "template-resolver.editor.saveFailed": "Save failed.",

package/packages/bundled-features/src/template-resolver/web/index.ts

@@ -5,6 +5,14 @@
 // `@cosmicdrift/kumiko-bundled-features/template-resolver` and has no React or
 // DOM deps.
 
+export { MAIL_TONES, type MailTone } from "../mail-constants.js";
+export {
+  PDF_DEFAULT_MARGIN_MM,
+  PDF_FOOTER_MARGIN_MM,
+  PDF_HEADER_MARGIN_MM,
+  PDF_ORIENTATIONS,
+  PDF_PAGE_FORMATS,
+} from "../pdf-constants.js";
 export {
   TemplateResolverErrors,
   TemplateResolverHandlers,

package/packages/bundled-features/src/template-resolver/web/placeholder-line-editor.tsx

@@ -6,7 +6,7 @@
 
 import { cn } from "@cosmicdrift/kumiko-renderer-web";
 import { Extension, Node } from "@tiptap/core";
-import { UndoRedo } from "@tiptap/extensions";
+import { Placeholder, UndoRedo } from "@tiptap/extensions";
 import { EditorContent, useEditor } from "@tiptap/react";
 import StarterKit from "@tiptap/starter-kit";
 import { type ReactNode, useMemo, useState } from "react";
@@ -26,7 +26,11 @@ export type PlaceholderLineEditorProps = {
   /** Placeholders shown as system chips (a different tint). */
   readonly systemVariables?: readonly string[];
   readonly readOnly?: boolean;
-  readonly onEditorReady?: (handle: DocumentEditorHandle) => void;
+  /** Drops the input frame so the line sits flat inside a label/value row. */
+  readonly flat?: boolean;
+  /** Hint shown while the line is empty. */
+  readonly placeholder?: string;
+  readonly onEditorReady?: (handle: DocumentEditorHandle | null) => void;
   readonly "aria-label": string;
 };
 
@@ -50,6 +54,8 @@ function LineEditorBody({
   variableLabels,
   systemVariables,
   readOnly,
+  flat,
+  placeholder,
   onEditorReady,
   ariaLabel,
 }: {
@@ -59,7 +65,9 @@ function LineEditorBody({
   readonly variableLabels: Readonly<Record<string, string>>;
   readonly systemVariables: readonly string[];
   readonly readOnly: boolean;
-  readonly onEditorReady: ((handle: DocumentEditorHandle) => void) | undefined;
+  readonly flat: boolean;
+  readonly placeholder: string | undefined;
+  readonly onEditorReady: ((handle: DocumentEditorHandle | null) => void) | undefined;
   readonly ariaLabel: string;
 }): ReactNode {
   const extensions = useMemo(
@@ -88,12 +96,13 @@ function LineEditorBody({
         undoRedo: false,
       }),
       DocumentVariable.extend({
-        addNodeView: () => createVariableView(variableLabels, systemVariables),
+        addNodeView: () => createVariableView(variableLabels, systemVariables, flat),
       }),
       UndoRedo,
       BlockLineBreaks,
+      ...(placeholder === undefined ? [] : [Placeholder.configure({ placeholder })]),
     ],
-    [variableLabels, systemVariables],
+    [variableLabels, systemVariables, flat, placeholder],
   );
 
   const editor = useEditor({
@@ -111,6 +120,7 @@ function LineEditorBody({
       transformPastedHTML: (html) => singleLine(html.replace(/<[^>]*>/g, " ")),
     },
     onCreate: ({ editor: created }) => onEditorReady?.(createEditorHandle(created)),
+    onDestroy: () => onEditorReady?.(null),
     onUpdate: ({ editor: e }) => onChange(contentToLine(e.getJSON().content?.[0]?.content)),
   });
 
@@ -118,9 +128,11 @@ function LineEditorBody({
     <EditorContent
       editor={editor}
       className={cn(
-        "flex min-h-9 items-center rounded-md border border-input bg-transparent px-3 text-base md:text-sm",
+        "flex items-center bg-transparent text-base md:text-sm",
+        flat ? "min-h-10" : "min-h-9 rounded-md border border-input px-3",
         "[&_.ProseMirror]:w-full [&_.ProseMirror]:whitespace-nowrap [&_.ProseMirror]:outline-none",
         "[&_p]:m-0",
+        "[&_.is-editor-empty]:before:pointer-events-none [&_.is-editor-empty]:before:float-left [&_.is-editor-empty]:before:h-0 [&_.is-editor-empty]:before:text-muted-foreground [&_.is-editor-empty]:before:content-[attr(data-placeholder)]",
         readOnly && "opacity-60",
       )}
     />
@@ -134,6 +146,8 @@ export default function PlaceholderLineEditor({
   variableLabels = NO_LABELS,
   systemVariables = NO_NAMES,
   readOnly = false,
+  flat = false,
+  placeholder,
   onEditorReady,
   "aria-label": ariaLabel,
 }: PlaceholderLineEditorProps): ReactNode {
@@ -152,7 +166,7 @@ export default function PlaceholderLineEditor({
 
   return (
     <LineEditorBody
-      key={`${epoch}-${readOnly}-${JSON.stringify(stableLabels)}`}
+      key={`${epoch}-${readOnly}-${JSON.stringify(stableLabels)}-${stableSystem.join("\n")}`}
       id={id}
       initialValue={value}
       onChange={(next) => {
@@ -162,6 +176,8 @@ export default function PlaceholderLineEditor({
       variableLabels={stableLabels}
       systemVariables={stableSystem}
       readOnly={readOnly}
+      flat={flat}
+      placeholder={placeholder}
       onEditorReady={onEditorReady}
       ariaLabel={ariaLabel}
     />

package/packages/bundled-features/src/tenant/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Post-save seed hooks use the after-commit notify factory",
+    "detail": "afterCommit seed hooks now get a notify function bound to the signup dispatcher's job runner when the dispatcher provides one, falling back to the regular factory. The afterCommit hook context is built only when the hook actually runs."
+  },
   {
     "version": "0.357.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant/handlers/update-member-roles.write.ts

@@ -9,7 +9,6 @@ import {
   mayOverrideTenant,
   mergeAssignedRoles,
   parseTenantId,
-  type SessionUser,
   SYSTEM_ROLE,
   type TenantId,
   withResponseData,
@@ -50,10 +49,6 @@ function resolveTargetTenantId(
   return parseTenantId(payloadTenantId) ?? undefined;
 }
 
-function foreignStreamTenant(user: SessionUser, targetTenantId: TenantId): TenantId | undefined {
-  return targetTenantId === user.tenantId ? undefined : targetTenantId;
-}
-
 // Editing your OWN roles keeps the current session: roles are re-derived per
 // request, so the new roles apply at once without a re-login. Other sessions
 // of that user and any foreign edit still revoke all.
@@ -195,8 +190,8 @@ export const updateMemberRolesWrite = defineWriteHandler({
     }
 
     // The membership stream lives on the membership's tenant (where seedTenantMembership/
-    // invite-accept wrote it); a cross-tenant operator addresses it without becoming a member.
-    // Same-tenant writes run on a tenant-mode db, which refuses a stream override.
+    // invite-accept wrote it); streamTenantId addresses it with the operator as actor, also
+    // without membership there.
     const result = await executor.update(
       {
         id: row["id"] as string, // @cast-boundary db-row
@@ -205,7 +200,7 @@ export const updateMemberRolesWrite = defineWriteHandler({
       },
       event.user,
       db,
-      { streamTenantId: foreignStreamTenant(event.user, targetTenantId) },
+      { streamTenantId: targetTenantId },
     );
 
     return withResponseData(result, {

package/packages/bundled-features/src/tenant/seeding.ts

@@ -101,26 +101,6 @@ export type SeedTenantHooks = {
   readonly context: AppContext;
 };
 
-// Shared by seedTenant/seedTenantMembership/auth-email-password's
-// seedUserWithPassword: fires the same entity-scoped postSave hooks the
-// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
-// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
-// lifecycle-hooks instance per call, no systemHooks — only feature-
-// registered entity/handler hooks fire (search-index/SSE system hooks are
-// wired at server-boot and out of reach here).
-//
-// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
-// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
-// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
-// closures over the caller's tenant (self-signup is anonymous/system).
-// `query`/`write` bridges still share the caller's identity; hooks that
-// need a full identity switch use `writeAs`/`queryAs`.
-//
-// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
-// (HandlerContext from a live write), afterCommit hooks are queued onto the
-// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
-// Connection) they still fire immediately — there is no outer TX to wait for.
-//
 function buildSeedHookNotify(
   context: AppContext,
   scopedUser: SessionUser,
@@ -129,7 +109,11 @@ function buildSeedHookNotify(
 ): AppContext["notify"] {
   const notifyFactory = context._notifyFactory;
   if (!notifyFactory) return context.notify;
-  if (notifyTiming === "inline") return notifyFactory(scopedUser, targetTenantId);
+  const notifyAfterCommit = (context._notifyAfterCommitFactory ?? notifyFactory)(
+    scopedUser,
+    targetTenantId,
+  );
+  if (notifyTiming === "inline") return notifyAfterCommit;
   // Still inside the caller's write tx: delivery DB work must not wait for an app-pool slot.
   const notifyInsideTransaction = (context._notifyInTransactionFactory ?? notifyFactory)(
     scopedUser,
@@ -140,12 +124,31 @@ function buildSeedHookNotify(
   return createDeferringNotify({
     registry: context.registry,
     tenantId: targetTenantId,
-    notifyAfterCommit: notifyFactory(scopedUser, targetTenantId),
+    notifyAfterCommit,
     notifyNow: notifyInsideTransaction,
     scheduleAfterCommit,
   });
 }
 
+// Shared by seedTenant/seedTenantMembership/auth-email-password's
+// seedUserWithPassword: fires the same entity-scoped postSave hooks the
+// real dispatcher would (registry.getEntityPostSaveHooks by entityName),
+// just without the full HTTP/JWT roundtrip a fixture doesn't need. Fresh
+// lifecycle-hooks instance per call, no systemHooks — only feature-
+// registered entity/handler hooks fire (search-index/SSE system hooks are
+// wired at server-boot and out of reach here).
+//
+// Tenant re-scope (#1566): when `targetTenantId` is set we rebuild the
+// tenant-bound pieces of the context (`_tenantId`, `db`, `notify`,
+// `hasFeature`, `user.tenantId`) — a shallow `{ ...ctx, _tenantId }` left
+// closures over the caller's tenant (self-signup is anonymous/system).
+// `query`/`write` bridges still share the caller's identity; hooks that
+// need a full identity switch use `writeAs`/`queryAs`.
+//
+// afterCommit (#1566): when `hooks.context.scheduleAfterCommit` is present
+// (HandlerContext from a live write), afterCommit hooks are queued onto the
+// dispatcher's sink and flush post-commit. Without a sink (fixture / plain
+// Connection) they still fire immediately — there is no outer TX to wait for.
 // `runner` comes from the caller, which already holds a declared DbRunner —
 // a TenantDb exposes no runner back out to feature code.
 function scopeSeedHookContext(
@@ -219,13 +222,16 @@ export async function fireEntityPostSave(
     target === undefined
       ? hooks.context
       : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "deferUntilCommit");
-  const afterCommitContext =
-    target === undefined
-      ? hooks.context
-      : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "inline");
   await lifecycle.runPostSave(pseudoType, entityData, scopedContext, HookPhases.inTransaction);
   const runAfterCommit = () =>
-    lifecycle.runPostSave(pseudoType, entityData, afterCommitContext, HookPhases.afterCommit);
+    lifecycle.runPostSave(
+      pseudoType,
+      entityData,
+      target === undefined
+        ? hooks.context
+        : scopeSeedHookContext(hooks.context, target.tenantId, target.db, "inline"),
+      HookPhases.afterCommit,
+    );
   if (scopedContext.scheduleAfterCommit) {
     scopedContext.scheduleAfterCommit(runAfterCommit);
   } else {

package/packages/bundled-features/src/tenant-handover/move-entity-graph.ts

@@ -28,6 +28,7 @@ import {
   executeRawQuery,
   extractTableName,
   physicalColumnName,
+  toPostgresArrayLiteral,
 } from "@cosmicdrift/kumiko-framework/db";
 import { MAX_TRANSFER_DEPTH, type Registry } from "@cosmicdrift/kumiko-framework/engine";
 import { UnprocessableError } from "@cosmicdrift/kumiko-framework/errors";
@@ -79,7 +80,12 @@ async function moveFileRefs(args: {
     args.db,
     `UPDATE ${FILE_REFS_TABLE} SET tenant_id = $1 ` +
       `WHERE tenant_id = $2 AND entity_type = $3 AND entity_id = ANY($4) RETURNING id`,
-    [args.destinationTenantId, args.sourceTenantId, args.entityType, args.entityIds],
+    [
+      args.destinationTenantId,
+      args.sourceTenantId,
+      args.entityType,
+      toPostgresArrayLiteral(args.entityIds),
+    ],
   );
   const movedIds = rows.map((row) => row.id);
   if (movedIds.length === 0) return 0;
@@ -126,7 +132,12 @@ async function moveChildRows(args: {
     `UPDATE "${args.tableName}" SET "${args.tenantCol}" = $1 ` +
       `WHERE "${args.typeCol}" = $2 AND "${args.idCol}" = ANY($3) AND "${args.tenantCol}" = $4 ` +
       `RETURNING "${args.pkCol}" AS id`,
-    [args.destinationTenantId, args.parentEntityType, args.parentRowIds, args.sourceTenantId],
+    [
+      args.destinationTenantId,
+      args.parentEntityType,
+      toPostgresArrayLiteral(args.parentRowIds),
+      args.sourceTenantId,
+    ],
   );
   return rows.map((row) => row.id);
 }
@@ -149,7 +160,7 @@ async function moveReferencedChildRows(args: {
     `UPDATE "${args.tableName}" SET "${args.tenantCol}" = $1 ` +
       `WHERE "${args.refCol}" = ANY($2) AND "${args.tenantCol}" = $3 ` +
       `RETURNING "${args.pkCol}" AS id`,
-    [args.destinationTenantId, args.parentRowIds, args.sourceTenantId],
+    [args.destinationTenantId, toPostgresArrayLiteral(args.parentRowIds), args.sourceTenantId],
   );
   return rows.map((row) => row.id);
 }

package/packages/bundled-features/src/tenant-lifecycle/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "One sweep tick shares a single stage budget between all destroying tenants",
+    "detail": "The destruction sweep used to give every destroying tenant its own full stage budget, so a few large tenants stretched one tick far beyond the minute cron window and the following ticks were skipped. The tick budget is now divided evenly over the destroying tenants. Each tenant's slice starts when that tenant's turn begins, so an overrun by one tenant never leaves the next ones with a zero slice. runNextDestructionStage accepts an optional deadlineAt."
+  },
   {
     "version": "0.354.0",
     "type": "improvement",

package/packages/bundled-features/src/tenant-lifecycle/run-tenant-destroy.ts

@@ -290,6 +290,7 @@ export async function runNextDestructionStage(args: {
   readonly escapeHatchAuditSink?: EscapeHatchAuditSink;
   readonly escapeHatchAuditLog?: Logger;
   readonly actor?: string;
+  readonly deadlineAt?: number;
 }): Promise<StageTickResult> {
   const events = await loadAggregate(args.db, args.tenantId, args.tenantId);
   const { completed, abandoned, attemptsByStage } = replayStageState(events);
@@ -316,7 +317,7 @@ export async function runNextDestructionStage(args: {
     escapeHatchAuditSink: args.escapeHatchAuditSink,
     escapeHatchAuditLog: args.escapeHatchAuditLog,
     actor: args.actor,
-    deadlineAt: Date.now() + DESTRUCTION_STAGE_TICK_BUDGET_MS,
+    deadlineAt: args.deadlineAt ?? Date.now() + DESTRUCTION_STAGE_TICK_BUDGET_MS,
   };
 
   let version = lastEventVersion(events);
@@ -456,9 +457,16 @@ export async function runTenantDestructionSweep(args: {
 
   let advanced = 0;
   const destroying = await selectMany<{ id: string }>(args.db, tenantTable, destroyingWhere);
+  // One budget per sweep tick, split evenly so a large tenant cannot eat the
+  // window and starve the ones behind it. Each slice starts when its tenant
+  // starts: anchoring to a shared tick deadline would hand tenants after an
+  // overrun a zero slice, and a no-progress stage counts as a failed attempt.
+  const sliceMs = DESTRUCTION_STAGE_TICK_BUDGET_MS / Math.max(1, destroying.length);
   for (const row of destroying) {
+    const tenantDeadlineAt = Date.now() + sliceMs;
     try {
       const result = await runNextDestructionStage({
+        deadlineAt: tenantDeadlineAt,
         db: args.db,
         registry: args.registry,
         tenantId: row.id as TenantId,

package/packages/bundled-features/src/tenant-lifecycle/stages.ts

@@ -88,8 +88,9 @@ const tenantMembershipCrud = createEventStoreExecutor(
   },
 );
 
-// Every hook still runs each tick (they are idempotent), so a later hook is not
-// starved by an earlier one that keeps reporting done:false.
+// Every hook runs each tick (they are idempotent) but all share one ctx.deadlineAt: an
+// earlier hook that keeps reporting done:false can use up the budget, so later chunking
+// hooks time out with nothing processed until it finishes.
 function newOutcomeAccumulator(): {
   add: (result: TenantDestroyHookResult | void) => void;
   outcome: () => StageRunOutcome;

package/packages/bundled-features/src/tier-engine/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "set-tenant-tier accepts an optional source so a manual grant can return to billing control",
+    "detail": "The handler payload takes source (manual, billing or default, default manual). Writing the row with source billing makes the subscription tier sync treat it as billing-driven again, so the next webhook overwrites the tier. The handler stays SystemAdmin only."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "tier-assignment source is a select field of TierAssignmentSources",
+    "detail": "The source column keeps its text storage, but the entity now validates it against manual, billing and default, so a typo can no longer bypass the manual-grant protection of the billing sync. TierAssignmentSource and isTierAssignmentSource are exported; the billing sync narrows the stored value with the guard."
+  },
+  {
+    "version": "0.364.0",
+    "type": "fix",
+    "title": "Tier cache: stale single reload cannot overwrite a newer full resync",
+    "detail": "A single-tenant reload that started before a full resync and resolved after it could restore an outdated tier. The resync now advances the per-tenant ticket for deleted and adopted tenants too, and assignment changes are published remote-only."
+  },
   {
     "version": "0.354.0",
     "type": "fix",

package/packages/bundled-features/src/tier-engine/constants.ts

@@ -22,6 +22,15 @@ export const TierAssignmentSources = {
   default: "default",
 } as const;
 
+export type TierAssignmentSource =
+  (typeof TierAssignmentSources)[keyof typeof TierAssignmentSources];
+
+const TIER_ASSIGNMENT_SOURCE_VALUES: readonly string[] = Object.values(TierAssignmentSources);
+
+export function isTierAssignmentSource(value: unknown): value is TierAssignmentSource {
+  return typeof value === "string" && TIER_ASSIGNMENT_SOURCE_VALUES.includes(value);
+}
+
 // Qualified query handler names.
 export const TierEngineQueries = {
   list: "tier-engine:query:tier-assignment:list",

package/packages/bundled-features/src/tier-engine/entity.ts

@@ -1,4 +1,9 @@
-import { createEntity, createTextField } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createSelectField,
+  createTextField,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { type TierAssignmentSource, TierAssignmentSources } from "./constants.js";
 
 // tier-assignment — pro Plattform-Tenant genau ein Aggregat. Aggregate-ID
 // wird deterministisch aus tenantId abgeleitet (uuidv5, siehe aggregate-id.ts).
@@ -35,9 +40,9 @@ export const tierAssignmentEntity = createEntity({
     }),
     // Origin of the assignment, see TierAssignmentSources. Optional for back-compat with
     // rows without source. Protects manual grants from being overwritten by the billing sync.
-    source: createTextField({
+    source: createSelectField({
+      options: Object.values(TierAssignmentSources),
       required: false,
-      maxLength: 20,
       personal: false,
       reason: "technical_reference",
     }),
@@ -48,6 +53,6 @@ export type TierAssignmentRow = {
   readonly id: string;
   readonly version: number;
   readonly tier: string;
-  readonly source: string | null;
+  readonly source: TierAssignmentSource | null;
   readonly tenantId: string;
 };

package/packages/bundled-features/src/tier-engine/feature.ts

@@ -338,7 +338,8 @@ export function createTierEngineFeature<
     };
     const publishAssignmentChange = (tenantId: TenantId): void => {
       const message: TierAssignmentSyncMessage = { tenantId };
-      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message);
+      // The writer already updated its own cache; only other pods need to re-read.
+      busHolder.bus?.publish(CACHE_SYNC_TOPICS.tierAssignment, message, { remoteOnly: true });
     };
 
     // Trial: zeit-abgeleitet aus tenant.inserted_at (≈ Signup), live am
@@ -533,10 +534,17 @@ export function createTierEngineFeature<
           const isNewerThanSnapshot = (tenantId: TenantId): boolean =>
             (latestTicket.get(tenantId) ?? 0) > startedAtTicket;
           for (const tenantId of [...cache.keys()]) {
-            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) cache.delete(tenantId);
+            if (!loaded.has(tenantId) && !isNewerThanSnapshot(tenantId)) {
+              cache.delete(tenantId);
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
           for (const [tenantId, features] of loaded) {
-            if (!isNewerThanSnapshot(tenantId)) cache.set(tenantId, features);
+            if (!isNewerThanSnapshot(tenantId)) {
+              cache.set(tenantId, features);
+              // Makes a single reload that started before this snapshot discard its older result.
+              latestTicket.set(tenantId, startedAtTicket);
+            }
           }
         };