@cosmicdrift/kumiko-samples 0.388.0 → 0.390.0

package/packages/bundled-features/src/user-data-rights/handlers/download-by-token.query.ts

@@ -201,8 +201,8 @@ export const downloadByTokenQuery = defineQueryHandler({
     // has none under resolverTrust: "authoritative").
     const provider = await makeTenantStorageProviderResolver({
       registry: ctx.registry,
-      configResolver: ctx.configResolver,
-      secrets: ctx.secrets,
+      configResolver: ctx.services.configResolver,
+      secrets: ctx.services.secrets,
       // @cast-boundary db-runner — helpers use only the query API that
       // DbConnection and DbTx share.
       db: runner as import("@cosmicdrift/kumiko-types/db-connection").DbConnection,

package/packages/bundled-features/src/user-data-rights/handlers/request-deletion.write.ts

@@ -50,7 +50,7 @@ export function createRequestDeletionHandler(opts: RequestDeletionOptions = {})
     escapeHatch: {
       grants: ["systemIdentity", "unsafeRaw"],
       reason:
-        "resolveGracePeriod reads the tenant compliance profile via ctx.queryAs(SYSTEM, " +
+        "resolveGracePeriod reads the tenant compliance profile via ctx.dispatch.queryAs(SYSTEM, " +
         "...) to compute the grace period end — the calling user's own identity has no read " +
         "access to that tenant-config projection. startDeletionGracePeriod also appends the " +
         "user lifecycle event on the SYSTEM_TENANT_ID user stream.",

package/packages/bundled-features/src/user-data-rights/handlers/restrict-account.write.ts

@@ -12,7 +12,7 @@ import { updateUserLifecycle } from "../lib/update-user-lifecycle.ts";
 
 // POST /api/user/restrict — GDPR Art. 18 account freeze.
 // Flips status=Active → Restricted and revokes all live sessions
-// for the user via cross-feature ctx.writeAs(sessions.revokeAllForUser).
+// for the user via cross-feature ctx.dispatch.writeAs(sessions.revokeAllForUser).
 //
 // Write API behaviour:
 //   - Login is blocked: login.write.ts checks status=Restricted (Atom 3).
@@ -53,7 +53,7 @@ export const restrictAccountWrite = defineWriteHandler({
   },
   escapeHatch: {
     reason:
-      "Revokes all live sessions of the (possibly self-)restricted user via ctx.writeAs(SYSTEM, " +
+      "Revokes all live sessions of the (possibly self-)restricted user via ctx.dispatch.writeAs(SYSTEM, " +
       "sessions:write:user-session:revoke-all-for-user) — that handler's own access gate needs " +
       "privileged roles the acting caller doesn't necessarily have. It also checks the target " +
       "user's membership in the admin's tenant and appends the user lifecycle status change on " +
@@ -112,10 +112,10 @@ export const restrictAccountWrite = defineWriteHandler({
 
     // Cross-feature: all live sessions are revoked; otherwise the user could
     // continue writing with an existing JWT until token expiry.
-    // ctx.writeAs(systemUser, ...) gives the privileged handler the
+    // ctx.dispatch.writeAs(systemUser, ...) gives the privileged handler the
     // System user roles required by its access gate.
     const systemUser = createSystemUser(event.user.tenantId);
-    await ctx.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
+    await ctx.dispatch.writeAs(systemUser, "sessions:write:user-session:revoke-all-for-user", {
       userId: targetUserId,
     });
 

package/packages/bundled-features/src/user-data-rights/handlers/run-forget-cleanup.write.ts

@@ -17,7 +17,11 @@ import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import * as z from "zod";
 import { resolveAppTenantModel } from "../lib/resolve-tenant-model.ts";
 import { makeTenantStorageProviderResolver } from "../lib/storage-provider-resolver.ts";
-import { runForgetCleanup, type SendDeletionExecutedEmailFn } from "../run-forget-cleanup.ts";
+import {
+  FORGET_CLEANUP_HANDLER_NAME,
+  runForgetCleanup,
+  type SendDeletionExecutedEmailFn,
+} from "../run-forget-cleanup.ts";
 
 export type RunForgetCleanupOptions = {
   readonly sendDeletionExecutedEmail?: SendDeletionExecutedEmailFn;
@@ -56,7 +60,7 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
       const forgetDb = runner as DbConnection; // @cast-boundary db-runner — DbRunner narrows to DbConnection, config reads tolerate the outer tx
       const tenantModel = await resolveAppTenantModel({
         registry: ctx.registry,
-        configResolver: ctx.configResolver,
+        configResolver: ctx.services.configResolver,
         db: forgetDb,
         userId: ctx.user.id,
       });
@@ -65,14 +69,16 @@ export function createRunForgetCleanupHandler(opts: RunForgetCleanupOptions = {}
         registry: ctx.registry,
         now: T.Now.instant(),
         tenantModel,
-        ...(ctx.searchAdapter !== undefined && { searchAdapter: ctx.searchAdapter }),
+        ...(ctx.services.searchAdapter !== undefined && {
+          searchAdapter: ctx.services.searchAdapter,
+        }),
         buildStorageProvider: makeTenantStorageProviderResolver({
           registry: ctx.registry,
-          configResolver: ctx.configResolver,
-          secrets: ctx.secrets,
+          configResolver: ctx.services.configResolver,
+          secrets: ctx.services.secrets,
           db: forgetDb,
           userId: ctx.user.id,
-          handlerName: "user-data-rights:run-forget-cleanup",
+          handlerName: FORGET_CLEANUP_HANDLER_NAME,
         }),
         ...(opts.sendDeletionExecutedEmail && {
           sendDeletionExecutedEmail: opts.sendDeletionExecutedEmail,

package/packages/bundled-features/src/user-data-rights/index.ts

@@ -31,4 +31,11 @@ export {
   exportJobEntity,
   exportJobsTable,
 } from "./schema/export-job.ts";
-export { TENANT_MODEL_CONFIG_KEY } from "./web/constants.ts";
+export {
+  TENANT_MODEL_CONFIG_KEY,
+  USER_DATA_RIGHTS_FEATURE,
+  UserDataRightsHandlers,
+  UserDataRightsJobs,
+  UserDataRightsQueries,
+  UserDataRightsScreens,
+} from "./web/constants.ts";

package/packages/bundled-features/src/user-data-rights/lib/mail-transport-resolver.ts

@@ -31,7 +31,7 @@ export function makeTenantMailTransportResolver(
   return async (tenantId) => {
     if (!ctx.configResolver) {
       throw new Error(
-        `${ctx.handlerName}: ctx.configResolver missing — cannot resolve the mail transport for tenant ${tenantId}`,
+        `${ctx.handlerName}: ctx.services.configResolver missing — cannot resolve the mail transport for tenant ${tenantId}`,
       );
     }
     const config = createConfigAccessor(

package/packages/bundled-features/src/user-data-rights/lib/storage-provider-resolver.ts

@@ -30,7 +30,7 @@ export function makeTenantStorageProviderResolver(
   return async (tenantId) => {
     if (!ctx.configResolver) {
       throw new InternalError({
-        message: `[${ctx.handlerName}] ctx.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
+        message: `[${ctx.handlerName}] ctx.services.configResolver missing — cannot resolve the file provider for tenant ${tenantId}`,
       });
     }
     const config = createConfigAccessor(

package/packages/bundled-features/src/user-data-rights/lib/update-user-lifecycle.ts

@@ -62,7 +62,12 @@ export async function updateUserLifecycle(
   // (restrict/lift-restriction/grace-period/cancel/forget) that holds no row
   // version to pass as `payload.version`, which update() requires otherwise.
   // Callers needing a guard use `options.expect` instead.
-  const tenantDb = createTenantDb({ db: conn, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+  const tenantDb = createTenantDb({
+    db: conn,
+    tenantId: SYSTEM_TENANT_ID,
+    mode: "system",
+    reason: "User is tenant-agnostic, lifecycle transitions run in the system tenant",
+  });
   const result = await userExecutor.update(
     { id: userId, changes },
     createSystemUser(SYSTEM_TENANT_ID),

package/packages/bundled-features/src/user-data-rights/run-export-jobs.ts

@@ -54,7 +54,7 @@ import { generateDownloadToken } from "./token-helpers.ts";
 type Instant = InstanceType<ReturnType<typeof getTemporal>["Instant"]>;
 
 // Gauge short name (feature.ts registers it via r.metric + resolves ctx.meter
-// into a MetricsHandle — jobs get no bound ctx.metrics, see feature.ts).
+// into a MetricsHandle — jobs get no bound ctx.obs.metrics, see feature.ts).
 // No "_seconds"/"_total" suffix: validateMetricName rejects both on a gauge.
 // Unit lives in the r.metric() `unit: "seconds"` declaration instead.
 export const EXPORT_CLEANUP_BACKLOG_AGE_METRIC = "export_cleanup_backlog_age";
@@ -727,7 +727,13 @@ function reportCleanupLastRun(metrics: MetricsHandle | undefined, now: Instant):
 // `requestedFromTenantId` preserves stream identity and keeps the stream counter consistent.
 // @wrapper-known semantic-alias
 function systemTenantDb(db: DbConnection, tenantId: TenantId) {
-  return createTenantDb({ db, tenantId, mode: "system" });
+  return createTenantDb({
+    db,
+    tenantId,
+    mode: "system",
+    reason:
+      "export jobs run per user across tenants, requestedFromTenantId keeps the stream identity",
+  });
 }
 
 function buildExportStorageKey(job: JobRow): string {

package/packages/bundled-features/src/user-data-rights/run-forget-cleanup.ts

@@ -56,6 +56,7 @@ import {
   type UserDataDeleteStrategy,
   type UserDataStorageProvider,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import {
   createEscapeHatchReporter,
   UNATTRIBUTED_ACTOR,
@@ -243,13 +244,23 @@ const HOOK_ORDER_DEFAULT = EXT_USER_DATA_ORDER.DEFAULT;
 // console.warn so a crafted reason can't forge extra log lines, and cap the
 // length against a log-flood. The unsanitized reason still lands in the
 // returned `incomplete` entry untouched.
+// Secret-read audit discriminator, not a QN; the value must stay stable for the audit trail.
+export const FORGET_CLEANUP_HANDLER_NAME = "user-data-rights:run-forget-cleanup" as const;
+
 export function sanitizeReasonForLog(reason: string): string {
   return reason.replace(/[\r\n]+/g, " ").slice(0, 500);
 }
 
-export async function runForgetCleanup(
-  args: RunForgetCleanupArgs,
-): Promise<RunForgetCleanupResult> {
+// Cross-tenant by design: the due-user and membership reads on the given runner and raw hook
+// statements must see every tenant, whatever RLS scope the caller (job, operator handler) runs in.
+export function runForgetCleanup(args: RunForgetCleanupArgs): Promise<RunForgetCleanupResult> {
+  return runInSystemRowLevelSecurityScope(
+    "forget cleanup anonymizes users across all tenants",
+    () => forgetDueUsers(args),
+  );
+}
+
+async function forgetDueUsers(args: RunForgetCleanupArgs): Promise<RunForgetCleanupResult> {
   const { db, registry, now, sendDeletionExecutedEmail, buildStorageProvider } = args;
   const kms = args.kms ?? configuredPiiSubjectKms();
   const appTenantModel: TenantUserModel = args.tenantModel ?? "multi-user";

package/packages/bundled-features/src/user-data-rights/run-user-export.ts

@@ -43,6 +43,7 @@ import {
   type UserDataExportHook,
   type UserDataExportSnippet,
 } from "@cosmicdrift/kumiko-framework/engine";
+import { runInSystemRowLevelSecurityScope } from "@cosmicdrift/kumiko-framework/internal/row-level-security";
 import {
   createEscapeHatchReporter,
   UNATTRIBUTED_ACTOR,
@@ -163,7 +164,16 @@ function buildHookDb(
  * **Operator signal:** if bundle.json exceeds 100 MB in the ZIP, trigger
  * telemetry and evaluate a schema refactor.
  */
-export async function runUserExport(args: RunUserExportArgs): Promise<UserExportBundle> {
+// Cross-tenant by design: the membership read on the given runner and raw hook statements
+// must see every tenant of the user, whatever RLS scope the caller runs in.
+export function runUserExport(args: RunUserExportArgs): Promise<UserExportBundle> {
+  return runInSystemRowLevelSecurityScope(
+    "user data export collects the subject's rows from all tenants",
+    () => exportUserData(args),
+  );
+}
+
+async function exportUserData(args: RunUserExportArgs): Promise<UserExportBundle> {
   const { db, registry, userId, now } = args;
 
   const memberships = await selectMany<{ tenantId: TenantId }>(db, tenantMembershipsTable, {

package/packages/bundled-features/src/user-data-rights/web/constants.ts

@@ -27,6 +27,8 @@ export const UserDataRightsQueries = {
   exportStatus: "user-data-rights:query:export-status",
   myAuditLog: "user-data-rights:query:my-audit-log",
   downloadByJob: "user-data-rights:query:download-by-job",
+  downloadByToken: "user-data-rights:query:download-by-token",
+  listDownloadAttempts: "user-data-rights:query:list-download-attempts",
 } as const;
 
 // App-level config: tenant-occupancy model. "single-user" tells the forget
@@ -36,11 +38,25 @@ export const UserDataRightsQueries = {
 // `overrides.set(TENANT_MODEL_CONFIG_KEY, "single-user")`.
 export const TENANT_MODEL_CONFIG_KEY = "user-data-rights:config:tenant-model" as const;
 
+export const UserDataRightsJobs = {
+  runExportJobs: "user-data-rights:job:run-export-jobs",
+  runForgetCleanup: "user-data-rights:job:run-forget-cleanup",
+} as const;
+
+export const UserDataRightsScreens = {
+  exportJobList: "user-data-rights:screen:export-job-list",
+  downloadAttemptList: "user-data-rights:screen:download-attempt-list",
+} as const;
+
 export const UserDataRightsHandlers = {
   requestExport: "user-data-rights:write:request-export",
   requestDeletion: "user-data-rights:write:request-deletion",
+  requestDeletionByEmail: "user-data-rights:write:request-deletion-by-email",
+  confirmDeletionByToken: "user-data-rights:write:confirm-deletion-by-token",
   cancelDeletion: "user-data-rights:write:cancel-deletion",
   restrictAccount: "user-data-rights:write:restrict-account",
+  liftRestriction: "user-data-rights:write:lift-restriction",
+  runForgetCleanup: "user-data-rights:write:run-forget-cleanup",
 } as const;
 
 // Foreign QN: the lifecycle status (active / deletionRequested / restricted)

package/packages/bundled-features/src/user-data-rights/web/index.ts

@@ -7,6 +7,12 @@
 export { type UserDataRightsClientOptions, userDataRightsClient } from "./client-plugin.tsx";
 export type { ConfirmAccountDeletionScreenProps } from "./confirm-deletion-screen.tsx";
 export { ConfirmAccountDeletionScreen } from "./confirm-deletion-screen.tsx";
+export {
+  UserDataRightsHandlers,
+  UserDataRightsJobs,
+  UserDataRightsQueries,
+  UserDataRightsScreens,
+} from "./constants.ts";
 export { defaultTranslations } from "./default-translations.ts";
 export { formatDate } from "./privacy-center-screen.tsx";
 export { makePublicDeletionGate, type PublicDeletionRoutes } from "./public-deletion-gate.tsx";

package/packages/bundled-features/src/user-profile/handlers/change-email.write.ts

@@ -24,7 +24,7 @@ function invalidCredentials() {
 
 // Change-email — authenticated, self-only. The user confirms with their
 // current password (re-authentication as with change-password); the new
-// address is written through the user-update handler via ctx.writeAs(system)
+// address is written through the user-update handler via ctx.dispatch.writeAs(system)
 // because `email` is field-level privileged and would otherwise be silently
 // stripped during self-updates. emailVerified is set to false — the app then
 // triggers the verification flow (request-email-verification is public; the
@@ -45,8 +45,8 @@ export const changeEmailWrite = defineWriteHandler({
   escapeHatch: {
     grants: ["systemIdentity"],
     reason:
-      "Reads the caller's own passwordHash via ctx.queryAs(SYSTEM, user:findForAuth), checks " +
-      "email uniqueness the same way, and writes the new email via ctx.writeAs(SYSTEM, " +
+      "Reads the caller's own passwordHash via ctx.dispatch.queryAs(SYSTEM, user:findForAuth), checks " +
+      "email uniqueness the same way, and writes the new email via ctx.dispatch.writeAs(SYSTEM, " +
       "user:update) — field-access on passwordHash/email is privileged-only.",
   },
   // Payload carries the current password.
@@ -56,7 +56,7 @@ export const changeEmailWrite = defineWriteHandler({
   handler: async (event, ctx) => {
     const systemUser = createSystemUser(event.user.tenantId);
 
-    const me = (await ctx.queryAs(systemUser, UserQueries.findForAuth, {
+    const me = (await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
       id: event.user.id,
     })) as { id: string; email: string; passwordHash: string | null; version: number } | null; // @cast-boundary db-runner
 
@@ -79,7 +79,9 @@ export const changeEmailWrite = defineWriteHandler({
       );
     }
 
-    const existing = await ctx.queryAs(systemUser, UserQueries.findForAuth, { email: newEmail });
+    const existing = await ctx.dispatch.queryAs(systemUser, UserQueries.findForAuth, {
+      email: newEmail,
+    });
     if (existing !== null) {
       return writeFailure(
         new UnprocessableError(UserErrors.emailAlreadyExists, {
@@ -93,7 +95,7 @@ export const changeEmailWrite = defineWriteHandler({
     // backfillUserStreamTenants.
     const writer = createSystemUser(SYSTEM_TENANT_ID);
 
-    const writeRes = await ctx.writeAs(writer, UserHandlers.update, {
+    const writeRes = await ctx.dispatch.writeAs(writer, UserHandlers.update, {
       id: me.id,
       version: me.version,
       changes: { email: newEmail, emailVerified: false },

package/packages/bundled-features/src/waitlist/changes.json

@@ -1,4 +1,22 @@
 [
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "A failing notifyRecipient SQL statement no longer aborts the submit",
+    "detail": "The resolver receives a ctx whose systemDb runs in a savepoint, so a failed statement is rolled back and the submit answers 200 with the entry stored. Only ctx.systemDb is savepoint-scoped; other ctx handles stay in the handler transaction."
+  },
+  {
+    "version": "0.389.0",
+    "type": "improvement",
+    "title": "waitlist purge retry after a failed shred is covered",
+    "detail": "An integration test fails the second key shred of a purge, checks that the entries stay and no audit event is written, and that the retried purge erases every entry and records its audit event. No runtime change."
+  },
+  {
+    "version": "0.389.0",
+    "type": "fix",
+    "title": "Waitlist import enforces the live field limits",
+    "detail": "migrateLegacyWaitlist counts a source row with a value above the live field limit as unreadable instead of importing it; importWaitlistEntry throws for it."
+  },
   {
     "version": "0.388.0",
     "type": "fix",

package/packages/bundled-features/src/waitlist/feature.ts

@@ -32,6 +32,7 @@ import {
 
 export function createWaitlistFeature(opts: WaitlistOptions = {}): FeatureDefinition {
   return defineFeature(WAITLIST_FEATURE, (r) => {
+    r.adoptsBundledLists();
     r.describe(
       "Public waitlist: an anonymous, rate-limited `submit` handler collects name, email and optional company, portfolio and message (a honeypot field and per-email dedupe keep bots and repeat submits out, and the response body is identical whether or not an address was already listed), and mails the submitter a confirmation. SystemAdmins review entries in a list screen and invite or reject them; an invite creates the entrant's own tenant (or joins one shared tenant) and mails an accept link with the configured membership role, never a global role. Entries are platform-wide, their personal data is crypto-shredding-ready, and the EXT_USER_DATA hooks export and erase entries matching a user's email.",
     );

package/packages/bundled-features/src/waitlist/handlers/export-purge.write.ts

@@ -21,7 +21,7 @@ const PurgeSchema = z.object({ confirmCount: z.number().int().min(0) }).strict()
 const ExportSchema = z.object({}).strict();
 
 async function appendAudit(ctx: HandlerContext, type: string, count: number): Promise<void> {
-  await ctx.unsafeAppendEvent({
+  await ctx.events.unsafeAppend({
     aggregateId: generateId(),
     aggregateType: WAITLIST_AUDIT_AGGREGATE_TYPE,
     type,

package/packages/bundled-features/src/waitlist/handlers/invite.write.ts

@@ -111,7 +111,7 @@ async function ensureOwnTenant(
 
   const newTenantId = parseTenantId(crypto.randomUUID());
   if (!newTenantId) throw new InternalError({ message: "waitlist:invite: tenant id mint failed" });
-  const created = await ctx.writeAs(createSystemUser(newTenantId), TenantHandlers.create, {
+  const created = await ctx.dispatch.writeAs(createSystemUser(newTenantId), TenantHandlers.create, {
     id: newTenantId,
     key,
     name: entry.company ?? entry.name,
@@ -167,7 +167,7 @@ export function createInviteHandler(invite: WaitlistInviteOptions = DEFAULT_INVI
       // inviteCreate is admin-only (no system role); the system variant with an
       // empty globalRoles list is the only in-process path, and a waitlist
       // invite must never grant a global role.
-      const invited = await ctx.writeAs(
+      const invited = await ctx.dispatch.writeAs(
         createSystemUser(target.tenantId),
         AuthHandlers.systemInviteCreate,
         {

package/packages/bundled-features/src/waitlist/handlers/reject.write.ts

@@ -64,7 +64,7 @@ async function revokeInvitation(
       db,
       { id, version },
       createSystemUser(tenantId),
-      ctx.redis,
+      ctx.services.redis,
     );
     if (cancelled) return cancelled;
   }

package/packages/bundled-features/src/waitlist/handlers/submit.write.ts

@@ -1,8 +1,14 @@
-import { acquireNamespacedAdvisoryLock } from "@cosmicdrift/kumiko-framework/db";
+import {
+  acquireNamespacedAdvisoryLock,
+  createSystemDbView,
+  createTenantDb,
+  runInSavepointIfSupported,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   access,
   defineWriteHandler,
   type HandlerContext,
+  type TenantId,
   type WriteResult,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
@@ -25,7 +31,7 @@ import { WAITLIST_NOTIFICATION_TYPES, WAITLIST_STATUS } from "../web/constants.t
 // framework's other fixed advisory-lock keys.
 const SUBMIT_LOCK_NAMESPACE = 0x776c7374;
 const SUBMIT_LOCK_REASON =
-  "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check; TenantDb has no lock API";
+  "takes the per-email advisory lock so parallel submits cannot both pass the duplicate check and wraps the admin-recipient resolver in a savepoint so a failing statement cannot abort the submit transaction; TenantDb has neither API";
 
 // Logged-in callers carry no anonymous role, so every signed-in role must be listed.
 const SUBMIT_ROLES = access.roles(
@@ -73,18 +79,31 @@ async function hasOpenEntryForEmail(email: string, ctx: HandlerContext): Promise
   return found.rows.length > 0;
 }
 
-// The resolver usually reads config. It runs before the per-email advisory lock so a
-// slow resolver does not extend the lock. It still shares the handler transaction: a
-// thrown JS error is swallowed here, but a failed SQL statement inside it would abort
-// the transaction, so resolvers must not issue statements that can fail.
+// The resolver usually reads config. It runs before the per-email advisory lock so a slow
+// resolver does not extend the lock. Postgres aborts the whole transaction after a failed
+// statement, even one whose JS error is caught here, so the resolver gets a ctx whose
+// systemDb is bound to its own savepoint: a failing statement rolls back only that.
+// Statements through any other ctx handle (ctx.dispatch.query, ctx.dispatch.write) stay in the handler transaction.
 async function resolveAdminRecipient(
   opts: WaitlistOptions,
   ctx: HandlerContext,
+  systemDb: NonNullable<HandlerContext["systemDb"]>,
+  tenantId: TenantId,
 ): Promise<string | null> {
   try {
-    return (await opts.notifyRecipient?.(ctx)) || null;
+    return await runInSavepointIfSupported(systemDb.unsafeRaw(SUBMIT_LOCK_REASON), async (sp) => {
+      const savepointSystemDb = createSystemDbView(
+        createTenantDb({
+          db: sp,
+          tenantId,
+          mode: "system",
+          reason: "waitlist entries are system-tenant rows submitted by an anonymous guest",
+        }),
+      );
+      return (await opts.notifyRecipient?.({ ...ctx, systemDb: savepointSystemDb })) || null;
+    });
   } catch (err) {
-    ctx.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
+    ctx.obs.log?.warn("[waitlist:submit] admin notice recipient resolution failed", {
       error: err instanceof Error ? err.message : String(err),
     });
     return null;
@@ -102,7 +121,7 @@ async function sendBestEffort(
     }
     await send(ctx.notify);
   } catch (err) {
-    ctx.log?.warn(`[waitlist:submit] ${label} mail failed`, {
+    ctx.obs.log?.warn(`[waitlist:submit] ${label} mail failed`, {
       error: err instanceof Error ? err.message : String(err),
     });
   }
@@ -130,7 +149,12 @@ export function createSubmitHandler(opts: WaitlistOptions) {
           message: "waitlist:submit requires ctx.systemDb — is r.systemScope() set?",
         });
       }
-      const adminRecipient = await resolveAdminRecipient(opts, ctx);
+      const adminRecipient = await resolveAdminRecipient(
+        opts,
+        ctx,
+        ctx.systemDb,
+        event.user.tenantId,
+      );
       await acquireNamespacedAdvisoryLock(
         ctx.systemDb.unsafeRaw(SUBMIT_LOCK_REASON),
         SUBMIT_LOCK_NAMESPACE,

package/packages/bundled-features/src/waitlist/import.ts

@@ -3,7 +3,7 @@ import type { TenantDb } from "@cosmicdrift/kumiko-framework/db";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import type { Temporal } from "@cosmicdrift/kumiko-types/temporal";
 import { normalizeEmail, platformActor, waitlistExecutor } from "./lib.ts";
-import type { WaitlistStatus } from "./web/constants.ts";
+import { WAITLIST_FIELD_LIMITS, type WaitlistStatus } from "./web/constants.ts";
 
 export type WaitlistImportEntry = {
   /** Stable identity of the source row (e.g. `offlot:<uuid>`); the new entry id derives from it. */
@@ -43,18 +43,38 @@ export function isWaitlistImportId(id: string): boolean {
   return id[14] === "5";
 }
 
+// The live submit schema caps these fields; an imported value above the cap would be
+// stored but could never pass a later update through the same payload schema.
+export function waitlistImportEntryWithinLimits(entry: WaitlistImportEntry): boolean {
+  const limited: ReadonlyArray<readonly [string | undefined, number]> = [
+    [entry.name, WAITLIST_FIELD_LIMITS.name],
+    [entry.email, WAITLIST_FIELD_LIMITS.email],
+    [entry.locale, WAITLIST_FIELD_LIMITS.locale],
+    [entry.company, WAITLIST_FIELD_LIMITS.company],
+    [entry.portfolio, WAITLIST_FIELD_LIMITS.portfolio],
+    [entry.message, WAITLIST_FIELD_LIMITS.message],
+  ];
+  return limited.every(([value, max]) => value === undefined || value.length <= max);
+}
+
 function presentOnly(fields: Record<string, unknown>): Record<string, unknown> {
   return Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
 }
 
-// Writes through the entity executor, so events, projection and subject encryption
-// behave exactly as for a live submit. No mail, no rate limit, no duplicate-by-email
+// Writes through the entity executor, so events and projection match a live submit; subject
+// encryption applies only when the caller configured a PII KMS (the CLI wires it from env
+// and aborts without one). No mail, no rate limit, no duplicate-by-email
 // check: the source row is the truth and the id makes the call idempotent.
 export async function importWaitlistEntry(
   db: TenantDb,
   entry: WaitlistImportEntry,
   options: { readonly dryRun?: boolean } = {},
 ): Promise<WaitlistImportOutcome> {
+  if (!waitlistImportEntryWithinLimits(entry)) {
+    throw new InternalError({
+      message: `waitlist import entry ${entry.sourceKey} exceeds a field length limit`,
+    });
+  }
   const id = waitlistImportId(entry.sourceKey);
   const existing = await waitlistExecutor.detail({ id }, platformActor(), db);
   if (existing) return "skipped";

package/packages/bundled-features/src/waitlist/legacy-migrate.ts

@@ -28,6 +28,7 @@ import {
   importWaitlistEntry,
   isWaitlistImportId,
   type WaitlistImportEntry,
+  waitlistImportEntryWithinLimits,
   waitlistImportId,
 } from "./import.ts";
 import { WAITLIST_STATUS, type WaitlistStatus } from "./web/constants.ts";
@@ -265,12 +266,17 @@ export async function migrateLegacyWaitlist(
       options.from === "offlot"
         ? await mapOfflotRow(row)
         : mapPublicstatusRow(row, options.defaultLocale);
-    if (!entry) {
+    if (!entry || !waitlistImportEntryWithinLimits(entry)) {
       unreadable += 1;
       continue;
     }
     await transaction(db, async (tx) => {
-      const tenantDb = createTenantDb({ db: tx, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+      const tenantDb = createTenantDb({
+        db: tx,
+        tenantId: SYSTEM_TENANT_ID,
+        mode: "system",
+        reason: "legacy waitlist import writes system-tenant rows",
+      });
       const outcome = await importWaitlistEntry(tenantDb, entry, { dryRun: options.dryRun });
       if (outcome === "created") created += 1;
       else skipped += 1;

package/packages/bundled-features/src/waitlist/link-on-signup.ts

@@ -69,7 +69,13 @@ export const linkWaitlistOnSignup: MultiStreamApplyFn = async (event, tx) => {
   // skip: another membership came first.
   if (first && first.id !== event.aggregateId) return;
 
-  const db = createTenantDb({ db: tx, tenantId: SYSTEM_TENANT_ID, mode: "system" });
+  const db = createTenantDb({
+    db: tx,
+    tenantId: SYSTEM_TENANT_ID,
+    mode: "system",
+    reason:
+      "linking a signup to its waitlist entry updates system-tenant rows from a membership event",
+  });
   const user = await fetchOne<{ email?: unknown }>(tx, userTable, { id: membership.userId });
   // skip: user row unreadable (erased or not projected yet).
   if (typeof user?.email !== "string") return;

package/packages/bundled-features/src/waitlist/options.ts

@@ -22,7 +22,8 @@ export type WaitlistInviteOptions =
 export type WaitlistOptions = {
   /** Address for an admin notification mail on each new entry. Null, an empty
    *  string or an absent option sends none. Best effort, never fails the submit,
-   *  also when the resolver throws or rejects. */
+   *  also when the resolver throws or rejects. `ctx.systemDb` is bound to a savepoint, so a
+   *  failing statement through it is rolled back without aborting the submit transaction. */
   readonly notifyRecipient?: (ctx: HandlerContext) => string | null | Promise<string | null>;
   /** Language of the admin notice mail (en, de or es; anything else falls back to en).
    *  Not taken from the request: a submit comes from the entrant, not the operator. */

package/packages/bundled-features/src/workflow-runner/changes.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.390.0",
+    "type": "fix",
+    "title": "Woken workflow runs are due on the next resume tick",
+    "detail": "The event subscriber stamped wakeAt with the app clock, while the resume job selects due rows with the database clock. With an app clock ahead of the database, a woken row was not due yet and waited for a later tick. wakeAt is now set with the database clock, like the due-runs query."
+  },
   {
     "version": "0.370.0",
     "type": "breaking",

package/packages/bundled-features/src/workflow-runner/db/queries/due-runs.ts

@@ -8,7 +8,7 @@ export type DueRow = { readonly runId: string; readonly stepIndex: number };
 export const DUE_RUNS_BATCH_SIZE = 100;
 
 // Dedup happens solely via resume-run's VersionConflictError-checked claim
-// (ctx.tryAppendEvent on WORKFLOW_RESUMED) — a second dispatch for the same
+// (ctx.events.tryAppend on WORKFLOW_RESUMED) — a second dispatch for the same
 // row loses that race and no-ops. No row locks: in an autocommit statement
 // they would be released right after the SELECT and guard nothing.
 // `now()` stays the DB clock so job-host clock skew cannot mark rows due early.