@cosmicdrift/kumiko-samples 0.364.0 → 0.365.1

package/LICENSE

@@ -4,7 +4,7 @@ Parameters
 
 Licensor:             Marc Frost
 
-Licensed Work:        @cosmicdrift/kumiko-testing
+Licensed Work:        @cosmicdrift/kumiko-samples
                       The Licensed Work is © 2026 Marc Frost.
 
 Additional Use Grant: 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-samples",
-  "version": "0.364.0",
+  "version": "0.365.1",
   "description": "Source trees of the Kumiko sample recipes, sample apps and bundled features in repo layout, for tooling such as few-shot corpus builds.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.364.0",
+  "version": "0.365.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",

package/packages/bundled-features/src/audit/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Escape-hatch retention keeps the operator floor and deletes in bounded batches",
+    "detail": "An explicitly configured retention key now acts as a lower bound for tenant compliance-profile cutoffs, so a tenant profile can no longer delete events younger than the operator allows. A key left at its default does not count. Pruning runs in batches of 5000 events, each in its own transaction, until a batch comes back short."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Audit retention events always use the system user",
+    "detail": "Events written by the audit feature no longer fall back to the calling user id and always record the system user."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/audit/feature.ts

@@ -76,7 +76,7 @@ export function createAuditFeature(): FeatureDefinition {
             db: ctx.db.unsafeRaw(),
             registry: ctx.registry,
             configResolver: ctx.configResolver,
-            userId: ctx._userId ?? SYSTEM_USER_ID,
+            userId: SYSTEM_USER_ID,
           });
         },
       });

package/packages/bundled-features/src/audit/run-escape-hatch-retention.ts

@@ -1,4 +1,8 @@
-import { aggregateWhere, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  aggregateWhere,
+  runnerCanBeginTransaction,
+  selectMany,
+} from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   COMPLIANCE_PROFILES,
   subtractRetentionSpec,
@@ -27,7 +31,7 @@ import {
 
 // pruneEvents opens its own transaction, so a runner that cannot begin one (a tx handle) is rejected instead of nested.
 export function isDbConnection(runner: DbRunner): runner is DbConnection {
-  return "begin" in runner && typeof runner.begin === "function";
+  return runnerCanBeginTransaction(runner);
 }
 
 async function resolveRetentionDays(args: {
@@ -48,9 +52,30 @@ async function resolveRetentionDays(args: {
   return typeof raw === "number" && raw >= 1 ? raw : DEFAULT_ESCAPE_HATCH_RETENTION_DAYS;
 }
 
+// Only an operator-set value counts: the key's declared default must not override the tenant profiles.
+async function resolveExplicitRetentionDays(args: {
+  readonly registry: Registry;
+  readonly configResolver: ConfigResolver | undefined;
+  readonly db: DbConnection;
+  readonly userId: string;
+}): Promise<number | undefined> {
+  const keyDef = args.registry.getConfigKey(ESCAPE_HATCH_RETENTION_DAYS_KEY);
+  if (!args.configResolver || !keyDef) return undefined;
+  const { value, source } = await args.configResolver.getWithSource(
+    ESCAPE_HATCH_RETENTION_DAYS_KEY,
+    keyDef,
+    SYSTEM_TENANT_ID,
+    args.userId,
+    args.db,
+  );
+  const isOperatorSet = source !== "default" && source !== "missing";
+  return isOperatorSet && typeof value === "number" && value >= 1 ? value : undefined;
+}
+
 // Soft dependency: audit must stay mountable without compliance-profiles, so we probe its entity.
 const COMPLIANCE_PROFILE_ENTITY = "tenant-compliance-profile";
 const PRUNE_CHUNK_SIZE = 1000;
+const PRUNE_BATCH_SIZE = 5000;
 
 type AuditEventRow = {
   readonly aggregateId: string;
@@ -68,11 +93,13 @@ async function resolveTenantCutoff(
   db: DbConnection,
   tenantId: TenantId,
   now: Temporal.Instant,
+  operatorFloor: Temporal.Instant | undefined,
 ): Promise<Temporal.Instant> {
   const { profile } = await resolveProfileForTenant({ db, tenantId });
   const effective = subtractRetentionSpec(now, profile.auditLog.retention);
   const base = subtractRetentionSpec(now, COMPLIANCE_PROFILES[profile.key].auditLog.retention);
-  return earlierInstant(effective, base);
+  const profileCutoff = earlierInstant(effective, base);
+  return operatorFloor ? earlierInstant(profileCutoff, operatorFloor) : profileCutoff;
 }
 
 // A cross-tenant audit (e.g. identity-switch) lives under the actor's tenant but must also
@@ -95,13 +122,20 @@ async function storingTenantIds(db: DbConnection): Promise<readonly TenantId[]>
   });
 }
 
-async function pruneByTenantProfiles(db: DbConnection): Promise<number> {
+async function pruneByTenantProfiles(
+  db: DbConnection,
+  operatorRetentionDays: number | undefined,
+): Promise<number> {
   const now = getTemporal().Now.instant();
+  const operatorFloor =
+    operatorRetentionDays === undefined
+      ? undefined
+      : now.subtract({ hours: operatorRetentionDays * 24 });
   const cutoffByTenant = new Map<TenantId, Temporal.Instant>();
   const cutoffOf = async (tenantId: TenantId): Promise<Temporal.Instant> => {
     const cached = cutoffByTenant.get(tenantId);
     if (cached) return cached;
-    const cutoff = await resolveTenantCutoff(db, tenantId, now);
+    const cutoff = await resolveTenantCutoff(db, tenantId, now, operatorFloor);
     cutoffByTenant.set(tenantId, cutoff);
     return cutoff;
   };
@@ -139,11 +173,32 @@ async function pruneByTenantProfiles(db: DbConnection): Promise<number> {
   return deletedCount;
 }
 
+async function pruneInBatches(
+  db: DbConnection,
+  olderThanDays: number,
+  batchSize = PRUNE_BATCH_SIZE,
+): Promise<number> {
+  const olderThan = getTemporal()
+    .Now.instant()
+    .subtract({ hours: olderThanDays * 24 });
+  let deletedCount = 0;
+  for (;;) {
+    const batch = await pruneEvents(db, {
+      aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
+      olderThan,
+      batchSize,
+    });
+    deletedCount += batch.deletedCount;
+    if (batch.deletedCount < batchSize) return deletedCount;
+  }
+}
+
 export async function runEscapeHatchRetention(args: {
   readonly db: DbRunner;
   readonly registry: Registry;
   readonly configResolver: ConfigResolver | undefined;
   readonly userId: string;
+  readonly batchSize?: number;
 }): Promise<{ readonly deletedCount: number }> {
   const { db } = args;
   if (!isDbConnection(db)) {
@@ -152,12 +207,9 @@ export async function runEscapeHatchRetention(args: {
 
   if (!args.registry.getEntity(COMPLIANCE_PROFILE_ENTITY)) {
     const olderThanDays = await resolveRetentionDays({ ...args, db });
-    const { deletedCount } = await pruneEvents(db, {
-      aggregateTypes: [ESCAPE_HATCH_USE_AGGREGATE_TYPE],
-      olderThanDays,
-    });
-    return { deletedCount };
+    return { deletedCount: await pruneInBatches(db, olderThanDays, args.batchSize) };
   }
 
-  return { deletedCount: await pruneByTenantProfiles(db) };
+  const operatorRetentionDays = await resolveExplicitRetentionDays({ ...args, db });
+  return { deletedCount: await pruneByTenantProfiles(db, operatorRetentionDays) };
 }

package/packages/bundled-features/src/auth-email-password/bootstrap.ts

@@ -36,14 +36,12 @@ import { tenantMembershipsTable } from "../tenant/membership-table.js";
 // kumiko-lint-ignore cross-feature-import bootstrap checks for an existing tenant
 import { tenantTable } from "../tenant/schema/tenant.js";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import type { GLOBAL_ROLE_OPTIONS } from "../user/constants.js";
+import type { GlobalRole } from "../user/constants.js";
 // kumiko-lint-ignore cross-feature-import bootstrap skips already activated users
 import { userTable } from "../user/schema/user.js";
 import { AuthHandlers } from "./constants.js";
 import { hasLiveInviteToken } from "./invite-token-store.js";
 
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
-
 export type BootstrapInvite = {
   readonly email: string;
   /** Membership role in the tenant, validated like a tenant-admin invite

package/packages/bundled-features/src/auth-email-password/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Magic-link mail expiry and app name use the template locale",
+    "detail": "The expiry text, the app-name fallback and the notify locale follow the locale the auth mail template actually renders in, while the link keeps the request locale."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "systemInviteCreate takes an optional locale tag",
+    "detail": "The payload accepts a locale (BCP 47 tag) that wins over the request locale when rendering the invitation mail, so system callers such as the waitlist can invite in the recipient's language."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "Auth mails carry designer labels",
+    "detail": "The feature registers <feature>:feature.label and notify labels for password-reset, account-unlock, email-verification, signup-activation and invite, so the document designer lists them by name. German and Spanish ship in the locale packages."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/auth-email-password/feature.ts

@@ -30,6 +30,7 @@ import {
 } from "./handlers/signup-request.write.js";
 import { createSwitchTenantMfaGateHandler } from "./handlers/switch-tenant-mfa-gate.write.js";
 import { createVerifyEmailHandler } from "./handlers/verify-email.write.js";
+import { AUTH_EMAIL_PASSWORD_MAIL_I18N } from "./mail-i18n.js";
 import {
   AUTH_MAIL_VARIABLES,
   authMailLocalizedTemplate,
@@ -113,13 +114,8 @@ export type AccountLockoutOptions = {
   readonly lockoutDurationMinutes?: number;
 };
 
-// Magic-Link Self-Signup. Wenn gesetzt, registriert das Feature die
-// signup-request + signup-confirm-Handler. Der Token-Store (Redis)
-// kommt aus ctx.redis — tokenTtlMinutes ist der einzige Knopf
-// (Token-Material ist generateToken() = 256 Bit randomBytes, fest;
-// Memory feedback_no_options_without_need: keine Knöpfe ohne Bedarf).
-// Anders als reset/verify gibt's kein hmacSecret hier, weil der Token
-// opaque random ist (Redis ist Source of Truth).
+// Unlike reset/verify there is no hmacSecret: the signup token is opaque random
+// (256 bit) and Redis is the source of truth, so tokenTtlMinutes is the only knob.
 export type SignupOptions = SignupRequestOptions;
 
 // Tenant-Invite Magic-Link. Wenn gesetzt, registriert das Feature die
@@ -207,6 +203,7 @@ export function createAuthEmailPasswordFeature(
     // of silently dropping the mail.
     if (sendsMagicLinkMail(opts)) r.requires("delivery");
     r.envSchema(authEmailPasswordEnvSchema);
+    r.translations({ keys: AUTH_EMAIL_PASSWORD_MAIL_I18N });
 
     // Declared unconditionally: apps also issue the activation link from their
     // own flows (issueSignupActivation) without enabling the signup option.

package/packages/bundled-features/src/auth-email-password/handlers/invite-accept-with-login.write.ts

@@ -121,9 +121,8 @@ export function createInviteAcceptWithLoginHandler(opts: InviteAcceptWithLoginOp
     escapeHatch: {
       grants: ["unsafeRaw"],
       reason:
-        "Anonymous invite-accept has no session in the invited tenant yet — checks existing " +
-        "membership via ctx.queryAs(SYSTEM, tenant:query:memberships) of the invitation's tenant. " +
-        "Also reads the pending invitation by id (the invitee is not yet a member of the " +
+        "Anonymous invite-accept has no session in the invited tenant yet — reads the pending " +
+        "invitation by id (the invitee is not yet a member of the " +
         "invitation's tenant), adds the membership and accepts the invitation in the " +
         "invitation's tenant, which differs from the caller's tenant, and reads the MFA " +
         "enrollment of that tenant via the mfaStatusChecker callback.",

package/packages/bundled-features/src/auth-email-password/handlers/invite-create.write.ts

@@ -32,6 +32,7 @@ import {
   type WriteFailure,
   writeFailure,
 } from "@cosmicdrift/kumiko-framework/errors";
+import { isValidLocaleTag } from "@cosmicdrift/kumiko-framework/i18n";
 import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import * as z from "zod";
 // kumiko-lint-ignore cross-feature-import invite-flow lebt in auth-email-password (Magic-Link-Pattern), DB-row-owner ist tenant-feature
@@ -50,7 +51,7 @@ import {
   unassignableMembershipRoleError,
 } from "../../tenant/membership-roles.js";
 // kumiko-lint-ignore cross-feature-import global-role options are owned by the user feature
-import { GLOBAL_ROLE_OPTIONS } from "../../user/constants.js";
+import { GLOBAL_ROLE_OPTIONS, type GlobalRole } from "../../user/constants.js";
 // kumiko-lint-ignore cross-feature-import invitee lookup by email reads the user row
 import { userTable } from "../../user/schema/user.js";
 import { AUTH_INVITE_DEFAULT_TTL_MINUTES } from "../constants.js";
@@ -60,8 +61,6 @@ import { invalidateExistingInviteToken, storeInviteToken } from "../invite-token
 import { dispatchMagicLinkMail, resolveHandlerMailLocale } from "../magic-link-mail.js";
 import { AuthMailNotificationTypes } from "../mail-notifications.js";
 
-type GlobalRole = (typeof GLOBAL_ROLE_OPTIONS)[number];
-
 const InviteCreateSchema = z.object({
   email: z.email(),
   role: z.string().min(1).max(50),
@@ -116,6 +115,7 @@ type InviteIssueRequest = {
   readonly email: string;
   readonly role: string;
   readonly globalRoles: readonly GlobalRole[];
+  readonly locale?: string | undefined;
 };
 
 function checkAssignableInviteRole(
@@ -239,7 +239,7 @@ async function issueInvitation(
   const token = generateToken();
   await storeInviteToken(ctx.redis, { invitationId, token, ttlSeconds });
 
-  const locale = resolveHandlerMailLocale(ctx, opts.locale);
+  const locale = request.locale ?? resolveHandlerMailLocale(ctx, opts.locale);
 
   await dispatchMagicLinkMail(
     ctx.notify,
@@ -317,6 +317,8 @@ const SystemInviteCreateSchema = z.object({
   email: z.email(),
   role: z.string().min(1).max(50),
   globalRoles: z.array(z.enum(GLOBAL_ROLE_OPTIONS)).max(GLOBAL_ROLE_OPTIONS.length).default([]),
+  // Preferred over the request locale: provisioning callers know the invitee's language.
+  locale: z.string().max(35).refine(isValidLocaleTag, "invalid locale tag").optional(),
 });
 
 // System-only sibling of invite-create: the only path that can put global

package/packages/bundled-features/src/auth-email-password/handlers/switch-tenant-mfa-gate.write.ts

@@ -21,7 +21,7 @@ const SwitchTenantMfaGateSchema = z.object({
 });
 
 export type SwitchTenantMfaGateData =
-  | { readonly kind: "mfa-gate-clear" }
+  | { readonly kind: "mfa-gate-clear"; readonly roles: readonly string[] }
   | NonNullable<Awaited<ReturnType<typeof gateEnforceMfa>>>;
 
 // Dispatched by POST /auth/switch-tenant with the system identity. The handler
@@ -54,7 +54,7 @@ export function createSwitchTenantMfaGateHandler(
       );
       const roles = buildSessionRoles(parseRoles(userRow?.roles ?? null), active.membership.roles);
       const mfaGate = await gateEnforceMfa(ctx, opts, userId, tenantId, roles);
-      return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear" } };
+      return { isSuccess: true, data: mfaGate ?? { kind: "mfa-gate-clear", roles } };
     },
   });
 }

package/packages/bundled-features/src/auth-email-password/magic-link-mail.ts

@@ -77,24 +77,28 @@ export async function dispatchMagicLinkMail(
   // mailT already root-falls-back; appUrl must use the same negotiated tag
   // or language-in-path apps 404 on e.g. /de-AT/activate.
   const urlLocale = resolveMailLocale(locale);
+  // Template, expiry formatting and app-name fallback must share one locale,
+  // otherwise an English template shows e.g. French "3 heures".
+  const templateLocale = authMailTemplateLocale(spec.notificationType, locale);
   const { validFor, validUntil } = tokenMailExpiry(
     {
       expiresAt: params.expiresAt,
       ...(params.issuedAt !== undefined && { issuedAt: params.issuedAt }),
       ...(params.timeZone !== undefined && { timeZone: params.timeZone }),
     },
-    locale,
+    templateLocale,
   );
   await notify(spec.notificationType, {
     route: { email: params.email },
     data: {
-      appName: params.appName ?? spec.fallbackAppName ?? mailT(locale, "auth.mail.appNameDefault"),
+      appName:
+        params.appName ?? spec.fallbackAppName ?? mailT(templateLocale, "auth.mail.appNameDefault"),
       actionUrl: appendToken(resolveAppUrl(params.appUrl, urlLocale), params.token),
       validFor,
       validUntil,
       ...(params.role !== undefined && { role: params.role }),
     },
-    locale: authMailTemplateLocale(spec.notificationType, locale),
+    locale: templateLocale,
     priority: "critical",
   });
 }

package/packages/bundled-features/src/auth-email-password/mail-i18n.ts

@@ -0,0 +1,10 @@
+// @runtime client
+// Server-registered so the document designer names the seeded auth mails.
+export const AUTH_EMAIL_PASSWORD_MAIL_I18N: Readonly<Record<string, { readonly en: string }>> = {
+  "auth-email-password:feature.label": { en: "Sign-in" },
+  "auth-email-password:notify.password-reset.label": { en: "Password reset" },
+  "auth-email-password:notify.account-unlock.label": { en: "Account unlock" },
+  "auth-email-password:notify.email-verification.label": { en: "Email verification" },
+  "auth-email-password:notify.signup-activation.label": { en: "Sign-up activation" },
+  "auth-email-password:notify.invite.label": { en: "Invitation" },
+};

package/packages/bundled-features/src/billing-foundation/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Termination record re-reads the stream after the provider call",
+    "detail": "The cancel-at-provider call can take long, so the termination event is appended with a freshly fetched stream version instead of the one read before it."
+  },
+  {
+    "version": "0.365.0",
+    "type": "improvement",
+    "title": "Contract mails carry designer labels",
+    "detail": "Feature and notify labels for contract-confirmation, contract-termination-receipt and contract-termination-operator-notice name the contract mails in the document designer."
+  },
   {
     "version": "0.364.0",
     "type": "fix",

package/packages/bundled-features/src/billing-foundation/consumer-protection/termination-record.ts

@@ -238,7 +238,14 @@ export function createRecordContractTerminationHandler(
         effectiveAtIso,
         providerCancel,
       };
-      await stream.appendOne({
+      // Re-fetch after the external call: a webhook appended meanwhile would
+      // otherwise fail the append on a stale expectedVersion although the
+      // provider already cancelled.
+      const streamAfterProviderCall = await ctx.fetchForWriting({
+        aggregateId: subscriptionAggregateId(tenantId),
+        aggregateType: SUBSCRIPTION_AGGREGATE_TYPE,
+      });
+      await streamAfterProviderCall.appendOne({
         type: CONTRACT_TERMINATION_REQUESTED_EVENT_QN,
         payload: recorded,
       });

package/packages/bundled-features/src/billing-foundation/i18n.ts

@@ -4,6 +4,12 @@
 type LocalizedString = { readonly en: string };
 
 export const BILLING_FOUNDATION_I18N: Readonly<Record<string, LocalizedString>> = {
+  "billing-foundation:feature.label": { en: "Billing" },
+  "billing-foundation:notify.contract-confirmation.label": { en: "Contract confirmation" },
+  "billing-foundation:notify.contract-termination-receipt.label": { en: "Termination receipt" },
+  "billing-foundation:notify.contract-termination-operator-notice.label": {
+    en: "Termination notice to operator",
+  },
   "screen:billing-plans.title": { en: "Billing" },
   "billing-foundation.plans.billingDisabled": {
     en: "Billing is not active yet. Your current plan stays in place.",

package/packages/bundled-features/src/billing-foundation/subscription-tier-sync.ts

@@ -4,6 +4,8 @@
 // so it is now a factory parameter.
 
 import {
+  isTierAssignmentSource,
+  type TierAssignmentSource,
   TierAssignmentSources,
   TierEngineHandlers,
   TierEngineQueries,
@@ -67,7 +69,7 @@ type ExistingTierAssignment = {
   readonly id: string;
   readonly version: number;
   readonly tier: unknown;
-  readonly source: unknown;
+  readonly source: TierAssignmentSource | null;
 };
 
 function findTierAssignment(
@@ -78,7 +80,13 @@ function findTierAssignment(
   if (!row || typeof row["id"] !== "string" || typeof row["version"] !== "number") {
     return undefined;
   }
-  return { id: row["id"], version: row["version"], tier: row["tier"], source: row["source"] };
+  const source = row["source"];
+  return {
+    id: row["id"],
+    version: row["version"],
+    tier: row["tier"],
+    source: isTierAssignmentSource(source) ? source : null,
+  };
 }
 
 export function createSubscriptionTierSync<TTier extends string>(

package/packages/bundled-features/src/cap-counter/book-cap-usage.ts

@@ -280,6 +280,12 @@ export type ReadRollingCapUsageOptions = {
   readonly windowDays: number;
 };
 
+// A release is written up to a reservation TTL after its increment; once the increment left the
+// window the release must not subtract from other increments still inside it.
+function isBefore(isoInstant: string, cutoff: Temporal.Instant): boolean {
+  return Temporal.Instant.compare(Temporal.Instant.from(isoInstant), cutoff) < 0;
+}
+
 async function sumRollingEventAmounts(
   db: TenantDb,
   tenantId: TenantId,
@@ -289,20 +295,26 @@ async function sumRollingEventAmounts(
   const aggregateId = rollingCapAggregateId(tenantId, options.capName);
   const cutoff = Temporal.Now.instant().subtract({ hours: options.windowDays * 24 });
 
-  const rows = await db.selectMany<{ payload: { amount?: number } }>(eventsTable, {
-    tenantId,
-    aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
-    aggregateId,
-    type,
-    createdAt: { gte: cutoff },
-  });
+  const rows = await db.selectMany<{ payload: { amount?: number; incrementedAt?: string } }>(
+    eventsTable,
+    {
+      tenantId,
+      aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
+      aggregateId,
+      type,
+      createdAt: { gte: cutoff },
+    },
+  );
 
   let total = 0;
   for (const row of rows) {
     // @cast-boundary engine-payload — events.payload is jsonb (typed as
     // unknown by drizzle's $type<Record<string,unknown>>); narrowing the
     // shape here mirrors enforceRollingCap's own read-side contract.
-    const payload = row["payload"] as { amount?: number };
+    const payload = row["payload"] as { amount?: number; incrementedAt?: string };
+    if (typeof payload.incrementedAt === "string" && isBefore(payload.incrementedAt, cutoff)) {
+      continue;
+    }
     if (typeof payload.amount === "number") {
       total += payload.amount;
     }

package/packages/bundled-features/src/cap-counter/cap-reservation.ts

@@ -37,6 +37,7 @@ type CapReservationRow = {
   readonly periodStartIso: string | null;
   readonly amount: number;
   readonly expiresAt: Temporal.Instant;
+  readonly createdAt: Temporal.Instant;
 };
 
 const NOTHING_TO_RELEASE: WriteResult = { isSuccess: true, data: {} };
@@ -136,13 +137,14 @@ function rollingEvent(
   amount: number,
   expectedVersion: number,
   type: string,
+  extraPayload: { readonly incrementedAt?: string } = {},
 ) {
   return {
     aggregateId: rollingCapAggregateId(user.tenantId, capName),
     aggregateType: CAP_COUNTER_ROLLING_AGGREGATE_TYPE,
     expectedVersion,
     type,
-    payload: { capName, amount },
+    payload: { capName, amount, ...extraPayload },
     metadata: { userId: user.id },
   };
 }
@@ -213,7 +215,10 @@ async function giveBackRolling(
   );
   await appendEventInTenantDb(
     txDb,
-    rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN),
+    // The window filter must use the increment's time: a sweep releases up to a TTL later.
+    rollingEvent(user, row.capName, row.amount, version, ROLLING_RELEASED_EVENT_QN, {
+      incrementedAt: row.createdAt.toString(),
+    }),
   );
   return NOTHING_TO_RELEASE;
 }

package/packages/bundled-features/src/cap-counter/changes.json

@@ -1,4 +1,17 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "breaking",
+    "title": "Handlers wrapped with withCapEnforcement or withRollingCapEnforcement are rejected when called through a nested ctx.write",
+    "detail": "Since the wrappers reserve through reserveBeforeTransaction, the dispatcher rejects a nested ctx.write, ctx.writeAs or handler-to-handler call of such a handler with an internal error (\"has a pre-transaction phase ... cannot run as a nested write\") instead of running it. Before the reservation lifecycle change the wrapped handler ran normally when called nested.",
+    "migration": "Dispatch rolling- and calendar-capped handlers only as top-level commands (HTTP write or batch). A handler that calls one through ctx.write declares the cap on itself instead, or the call moves out of the handler into a client or job that dispatches a top-level command."
+  },
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Rolling cap release remembers the original booking time",
+    "detail": "rolling-released events now carry the incrementedAt of the booking they return, so readRollingCapUsage no longer subtracts a release whose increment already left the rolling window."
+  },
   {
     "version": "0.364.0",
     "type": "breaking",

package/packages/bundled-features/src/cap-counter/handlers/increment-rolling.write.ts

@@ -40,6 +40,8 @@ export const rollingIncrementedSchema = incrementRollingSchema;
 /** Payload of the event that gives a reserved rolling amount back. */
 export const rollingReleasedSchema = incrementRollingSchema.extend({
   amount: z.number().int().positive(),
+  /** When the released increment was booked; absent on events written before it was recorded. */
+  incrementedAt: z.string().optional(),
 });
 
 // Rolling-Increment-Handler — append-only. Race-frei: zwei parallele

package/packages/bundled-features/src/cap-overview/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.365.0",
+    "type": "fix",
+    "title": "Cap overview lists no destroyed tenants",
+    "detail": "tenant-options and tenant-caps-list now filter destroyed tenants and keep reading tenant names through the PII-aware path."
+  },
   {
     "version": "0.338.0",
     "type": "breaking",

package/packages/bundled-features/src/cap-overview/handlers/tenant-caps-list.query.ts

@@ -176,7 +176,8 @@ export function createTenantCapsListQuery(caps: readonly CapSpec[], listCaps: re
       );
 
       const tenants = await decryptTenantNames(
-        await selectMany<TenantRow>(db, tenantTable, {}),
+        // Destroyed tenants decrypt to the erased sentinel, which a picker or list would show verbatim.
+        await selectMany<TenantRow>(db, tenantTable, { destroyedAt: null }),
         "cap-overview:tenant-caps:list",
       );
       const assignments = await selectMany<TierAssignmentRow>(db, tierAssignmentTable, {});

package/packages/bundled-features/src/cap-overview/handlers/tenant-options.query.ts

@@ -23,7 +23,8 @@ export const tenantOptionsQuery = defineQueryHandler({
       "cap-overview:tenant-options — SystemAdmin dashboard tenant-filter options",
     );
     const tenants = await decryptTenantNames(
-      await selectMany<TenantRow>(db, tenantTable, {}),
+      // Destroyed tenants decrypt to the erased sentinel, which the picker would show verbatim.
+      await selectMany<TenantRow>(db, tenantTable, { destroyedAt: null }),
       "cap-overview:tenant-options",
     );
     const sorted = [...tenants].sort((a, b) => a.name.localeCompare(b.name));

package/packages/bundled-features/src/channel-discord/discord-channel.ts

@@ -8,9 +8,11 @@ import {
 
 export type DiscordChannelOptions = ChatWebhookChannelOptions;
 
+const DISCORD_WEBHOOK_PREFIX = "channel-discord:webhooks.";
+
 export const DISCORD_SECRET_KEYS = {
-  webhookPrefix: "channel-discord:webhooks.",
-  webhookKeyFor: (connection: string) => `channel-discord:webhooks.${connection}`,
+  webhookPrefix: DISCORD_WEBHOOK_PREFIX,
+  webhookKeyFor: (connection: string) => `${DISCORD_WEBHOOK_PREFIX}${connection}`,
 } as const;
 
 export const DISCORD_DEFAULT_ALLOWED_HOSTS = ["discord.com", "discordapp.com"] as const;