core-framework 4.0.0__tar.gz → 4.0.1__tar.gz

{core_framework-4.0.0 → core_framework-4.0.1}/CHANGELOG.md

@@ -4,6 +4,19 @@ Notable changes to **core-framework** (import **`core_framework`**). Format foll
 
 ## [Unreleased]
 
+## [4.0.1] - 2026-09-17
+
+### Fixed
+
+- **Testing plugin:** start-on-demand Auth emulator raises **`RuntimeError`** when the **`firebase`** CLI is missing (not a raw **`FileNotFoundError`**); the timeout message distinguishes spawn-from-CLI vs a port that is open but not serving Auth. See **`docs/testing.md`**.
+- **Testing plugin:** bundled Alembic uses the patched Testcontainers Settings instance when the host **`settings_loader`** is a host subclass cache, not **`core_framework.core.settings.load_default_settings`**. See **`docs/testing.md`**.
+- **Testing plugin:** a returned **`TestConfig`** always sets **`FIREBASE_AUTH_EMULATOR_HOST`**, so **`client`** lifespan **`init_firebase`** does not require **`firebase_config.json`**. Auth fixtures and the emulator process still require **`firebase_project_id="test"`**. Session **`client`** uses base URL **`http://test`**. See **`docs/testing.md`**.
+
+### Changed
+
+- **Host enqueue:** **`enqueue_job`** accepts a host task name string (**`job_name: WorkerJobName | str`**), matching **`enqueue_from_worker`**. See **`docs/library/package-api.md`**.
+- **CORS:** Default **`allowed_headers`** includes **`If-None-Match`**. CORS **`expose_headers`** includes **`ETag`** (with **`Retry-After`** and **`X-Request-ID`**). Hosts that overlay **`[cors].allowed_headers`** must include **`If-None-Match`** (an overlay replaces the default list).
+
 ## [4.0.0] - 2026-09-12
 
 ### Breaking
@@ -90,7 +103,7 @@ Notable changes to **core-framework** (import **`core_framework`**). Format foll
 - **Prometheus same-host scrape default:** Manual Observability Deployment omit/empty/comment-only **`PROMETHEUS_TARGETS_{NODE,POSTGRES,REDIS}`** writes **`host.docker.internal`** / **`instance: app`** from **`deploy/observability/targets.default/`** (`:9100` / `:9187` / `:9121`). A leftover empty variable is not “no scrapes” — set **`[]`** for no targets. Overlay YAML for extra hosts. Manual install copies those defaults into **`targets/{node,postgres,redis}/hosts.yml`**. See **`docs/deployments/deploy-playbook.md`** and **`docs/deployments/guides/setup/observability-lgtm-setup.md`**.
 - **Host config defaults:** Settings Field defaults (deploy-template literals) and **zone fill** / **trusted-host fill** / **cors-origin fill** / **e2e-origin fill** / **publish-parent fill** so a load with only the Settings-required set succeeds. Empty product host / publish root no longer fail-closed. Empty **`public_path_prefix`** takes the Field default (see **Breaking**). A host bump applies Field defaults for omitted keys; **zone fill**, **trusted-host fill**, and **cors-origin fill** need **`public_zone`** in a Settings source; deleting GitHub constants requires omitting those keys from *the host’s* template (a bump does not rewrite the host workflow). **development** blank/omitted **`OPENAPI_URL`** → **`/openapi.json`** (`/docs`); **`OPENAPI_URL=off`** disables OpenAPI in any environment; **`APP_DEBUG`** stays **false** everywhere unless overlaid; **production** stays OpenAPI **off**. Omit **`ALLOWED_HOSTS`** with **`PUBLIC_ZONE`** set → **`localhost`**, **`127.0.0.1`**, **`api.{zone}`** (plus **`test`** outside production). Omit **`[cors]`** or **`CORS_ALLOWED_ORIGINS`** with **`PUBLIC_ZONE`** set → **`https://{zone}`**, **`https://www.{zone}`** (plus **`http://localhost:3000`**, **`http://127.0.0.1:3000`** outside production; production fill never adds a loopback origin). Omit **`WRITE_POSTGRES_HOST`** / **`REDIS_HOST`** → **`127.0.0.1`**. Omit **`WRITE_POSTGRES_DB`** → **`postgres`**. Write Postgres **user** stays required. Omit **`E2E_API_BASE_URL`** / **`E2E_MEDIA_BASE_URL`** / **`E2E_ALLOWED_ORIGIN`** on **development** smoke with **`PUBLIC_ZONE`** set → **`https://api.{zone}`**, **`https://media.{zone}`**, **`https://{zone}`**. See **`docs/library/package-api.md`**, **`docs/deployments/deploy-playbook.md`**, and **`docs/deployments/host-config-defaults-design.md`**.
 - **Product identity gate name:** **`check_caller_identity`** is the product identity gate (empty identity and account-removal **403** on every method; ban **403** on mutates only). **`check_not_banned`** remains as an alias of the same callable. Host admin routes still use **`check_admin_identity`**. See **`docs/library/package-api.md`**.
-- **User service pair-block and ban reads removed:** **`user_deps.user_service.retrieve_block_exists_between`**, **`retrieve_block_exists_between_strong`**, and **`retrieve_restriction_lookup_is_banned`** are gone (no core caller after see went one-way). Hosts that AND availability before Compare / friends-only unlock use **`retrieve_restriction_lookup_is_muted_or_banned`** (mirror-eventual) per user; viewer-blocked-target is **`retrieve_block_exists_strong`**. See **`docs/library/package-api.md`**.
+- **User service pair-block and ban reads removed:** **`user_deps.user_service.retrieve_block_exists_between`**, **`retrieve_block_exists_between_strong`**, and **`retrieve_restriction_lookup_is_banned`** are gone (no core caller after see went one-way). Hosts that AND availability before friends-only unlock use **`retrieve_restriction_lookup_is_muted_or_banned`** (mirror-eventual) per user; viewer-blocked-target is **`retrieve_block_exists_strong`**. See **`docs/library/package-api.md`**.
 - **Worker composition imports:** Importing **`build_worker_settings_kwargs`**, **`CORE_FRAMEWORK_QUEUE_NAME`**, or **`create_worker_settings_for_shared_runtime`** no longer constructs **`Settings`**. Accessing **`WorkerSettings`** (including **`arq core_framework.worker.main.WorkerSettings`**) still calls **`load_default_settings()`** to populate ARQ class attributes. See **`docs/library/package-api.md`**.
 - **Restriction-change fan-out:** Restriction writes still use the same HTTP routes. Lookup mirrors stay must-converge on the moderation outbox (Barrier 1). When mute/ban/unrestrict **truth** actually changes, the outbox handler enqueues Barrier 2 **after** mirrors land (`process_restriction_reactions`, job id `restriction_reactions:{user_id}:{commit_token}:{trigger}`, `keep_result=0`). Groups strip is must-converge on entered-banned, with an hourly heal (`schedule_restriction_heals` at **:00 UTC**) that re-enqueues leftover banned ∩ still-in-groups (`commit_token` `heal`; heal skips actor wipe). Actor inbox wipe is best-effort inline in producer Barrier 2. Repeat-ban / mirror-repair / warn-insert stay mirrors-only (`trigger` `none`). Producers write payload version **2**; other versions dead-letter. Hosts register **`register_restriction_mirror`** / **`register_restriction_reaction`** / **`register_restriction_heal`** after configure, on **API and worker** (worker is load-bearing). Mute/ban no longer produce or register `process_ban_user_side_effects` / `process_actor_notification_wipe`. User-detail invalidation stays on the command path. Ban does not revoke refresh tokens. See **`docs/design/moderation-restriction-fanout-design.md`**, **`docs/library/package-api.md`**, and **`docs/library/workers.md`**.
 - **Account-removal analytics carve-out:** Raw `utm_events.user_id` / `request_context.viewer_id` and `post_views.request_context.viewer_id` are not spine contributors. They age out by retention/rollup; aggregate counts stay. See **`docs/design/account-removal-spine-design.md`** decision **#8**.
@@ -344,7 +357,7 @@ Notable changes to **core-framework** (import **`core_framework`**). Format foll
 ### Breaking
 
 - **Breaking (clients — events ingest):** Traffic source for request context uses the **`client-referrer`** header instead of browser **`Referer`**. Clients should send an explicit referrer URL (for example captured from `document.referrer` on first load).
-- **Breaking (clients — events ingest):** Rename event type **`view`** → **`impression`** on `POST /events`. Clients and hosts must send `type: "impression"` for subject-impression batches (post views, calculator opens, etc.). Core enum: **`EventType.IMPRESSION`** (replaces **`EventType.VIEW`**). Host handlers registered on `"view"` must re-register on **`"impression"`** (for example Henry calculator view ingest).
+- **Breaking (clients — events ingest):** Rename event type **`view`** → **`impression`** on `POST /events`. Clients and hosts must send `type: "impression"` for subject-impression batches (post views, host-owned subject impressions, etc.). Core enum: **`EventType.IMPRESSION`** (replaces **`EventType.VIEW`**). Host handlers registered on `"view"` must re-register on **`"impression"`**.
 - **Breaking (hosts — imports):** Rename **`EVENT_TOKEN_MAX_AGE_VIEW_SECONDS`** → **`EVENT_TOKEN_MAX_AGE_SECONDS`** in **`core_framework.application.events.event_token`** (behavior unchanged; token max-age remains 600s for all event types).
 
 ### Migration
@@ -412,7 +425,7 @@ Transactional outbox (block, follow, restriction), post views retention, and inc
   - Run **`cf-alembic`** so the **`user`** migration stream applies **`user_add_event_outbox`** (`"user".event_outbox`).
   - Hosts that only run the API (no worker) still need **`[outbox]`** in config because **`Settings`** requires it; the API does not connect that pool.
 - **Breaking (hosts — migration):** When upgrading to a release that includes restriction outbox (Phase 3), run **`cf-alembic`** so the **`moderation`** migration stream applies **`moderation_add_event_outbox`** (`moderation.event_outbox`). The worker must run **`schedule_poll_moderation_outbox`** (registered in core worker schedules) for durable restriction mirror fanout.
-- **Breaking (hosts — config):** Add **`[retention]`** with **`post_views_retention_days`** (default **90**). Deploy variable **`RETENTION_POST_VIEWS_DAYS`**. Hosts that subclass **`Settings`** may extend **`RetentionConfig`** with additional retention keys (for example calculator views on Henry).
+- **Breaking (hosts — config):** Add **`[retention]`** with **`post_views_retention_days`** (default **90**). Deploy variable **`RETENTION_POST_VIEWS_DAYS`**. Hosts that subclass **`Settings`** may extend **`RetentionConfig`** with additional retention keys (for example a host-owned view table).
 - **Breaking (hosts — migration):** When upgrading to a release that includes post views retention, run **`cf-alembic`** so the **`post`** migration stream applies **`post_post_views_retention_high_water_mark`** (`post_stats.view_count_aggregated_up_to`, **`post_views`** retention indexes, backfill). The worker must run **`schedule_prune_post_views`** (registered in core worker schedules) for age-based **`post_views`** pruning.
 
 ## [2.1.0] - 2026-06-25
@@ -770,4 +783,5 @@ First **SemVer-stable** release per **`docs/library/package-api.md`**.
 [3.2.0]: https://github.com/NepNepFFXIV/core-framework/compare/v3.1.0...v3.2.0
 [3.3.0]: https://github.com/NepNepFFXIV/core-framework/compare/v3.2.0...v3.3.0
 [4.0.0]: https://github.com/NepNepFFXIV/core-framework/compare/v3.3.0...v4.0.0
-[unreleased]: https://github.com/NepNepFFXIV/core-framework/compare/v4.0.0...HEAD
+[4.0.1]: https://github.com/NepNepFFXIV/core-framework/compare/v4.0.0...v4.0.1
+[unreleased]: https://github.com/NepNepFFXIV/core-framework/compare/v4.0.1...HEAD

{core_framework-4.0.0 → core_framework-4.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: core-framework
-Version: 4.0.0
+Version: 4.0.1
 Summary: Core framework package (import as core_framework)
 Project-URL: Homepage, https://github.com/NepNepFFXIV/core-framework
 Project-URL: Repository, https://github.com/NepNepFFXIV/core-framework
@@ -8,7 +8,7 @@ License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.14
 Requires-Dist: aiofiles>=25.1.0
-Requires-Dist: alembic>=1.19.1
+Requires-Dist: alembic>=1.20.0
 Requires-Dist: arq>=0.28.0
 Requires-Dist: asyncer>=0.0.18
 Requires-Dist: asyncpg>=0.31.0
@@ -30,11 +30,11 @@ Requires-Dist: opentelemetry-instrumentation-redis<0.66,>=0.65b0
 Requires-Dist: opentelemetry-sdk<1.45,>=1.44.0
 Requires-Dist: opentelemetry-semantic-conventions<0.66,>=0.65b0
 Requires-Dist: orjson>=3.12.0
-Requires-Dist: pillow-heif>=1.5.0
+Requires-Dist: pillow-heif>=1.7.0
 Requires-Dist: pillow>=12.3.0
 Requires-Dist: pyinstrument>=5.1.3
 Requires-Dist: python-ulid>=4.0.1
-Requires-Dist: resend[async]>=2.37.0
+Requires-Dist: resend[async]>=2.44.0
 Requires-Dist: structlog>=26.1.0
 Requires-Dist: tenacity>=9.1.4
 Provides-Extra: testing

{core_framework-4.0.0 → core_framework-4.0.1}/config.toml

@@ -80,6 +80,7 @@ allowed_headers = [
     "Authorization",
     "Content-Type",
     "Idempotency-Key",
+    "If-None-Match",
     "Profiling-Key",
     "Client-Referrer",
 ]

{core_framework-4.0.0 → core_framework-4.0.1}/config.toml.template

@@ -68,6 +68,7 @@ allowed_headers = [
     "Authorization",
     "Content-Type",
     "Idempotency-Key",
+    "If-None-Match",
     "Profiling-Key",
     "Client-Referrer",
 ]

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/api/admin/outbox/schemas.py

@@ -56,5 +56,5 @@ class OutboxDeadRowResponse(BaseModel):
     failure_count: int
     last_error: str | None
     payload_version: int
-    payload: dict[str, Any]
+    payload: Any
     created_at: datetime

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/api/admin/users/schemas.py

@@ -123,7 +123,7 @@ class UserDetailResponse(BaseModel):
 class UserChangeHistoryItem(BaseModel):
     user_id: UserID
     actor: UserReference
-    entity_type: str
+    entity_type: Literal["users", "user_profiles", "user_deletions"]
     field: str
     old_value: str | None
     new_value: str | None

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/api/comments/schemas.py

@@ -2,7 +2,12 @@ from typing import Annotated
 
 from pydantic import AfterValidator, Field
 
-from core_framework.domains.comment import MAX_CONTENT_LENGTH, SUBJECT_KIND_MAX_LENGTH, SUBJECT_KIND_PATTERN
+from core_framework.domains.comment import (
+    MAX_CONTENT_LENGTH,
+    SUBJECT_ID_MAX_LENGTH,
+    SUBJECT_KIND_MAX_LENGTH,
+    SUBJECT_KIND_PATTERN,
+)
 
 
 def _validate_comment_content_not_blank(v: str) -> str:
@@ -23,7 +28,16 @@ CommentSubjectKind = Annotated[
     Field(min_length=1, max_length=SUBJECT_KIND_MAX_LENGTH, pattern=SUBJECT_KIND_PATTERN),
 ]
 
+
+def _validate_comment_subject_id_not_blank(v: str) -> str:
+    stripped = v.strip()
+    if not stripped:
+        raise ValueError("must not be blank")
+    return stripped
+
+
 CommentSubjectId = Annotated[
     str,
-    Field(min_length=1, max_length=128),
+    Field(min_length=1, max_length=SUBJECT_ID_MAX_LENGTH),
+    AfterValidator(_validate_comment_subject_id_not_blank),
 ]

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/api/system/router.py

@@ -1,8 +1,10 @@
-from asyncio import TaskGroup
+from asyncio import TaskGroup, timeout
+from collections.abc import Awaitable
 from typing import Final
 
 from cashews import cache
 from fastapi import APIRouter, Request, Response, status
+from structlog import get_logger
 
 from core_framework.core.runtime import CoreRuntime
 
@@ -12,6 +14,9 @@ router = APIRouter(
 
 OK_STATUS: Final[str] = "OK"
 ERROR_STATUS: Final[str] = "ERROR"
+PROBE_TIMEOUT_SECONDS: Final[float] = 2.0
+
+logger = get_logger(__name__)
 
 
 def _get_runtime(request: Request) -> CoreRuntime:
@@ -24,40 +29,34 @@ def _get_runtime(request: Request) -> CoreRuntime:
     )
 
 
-async def _probe_write_postgres(runtime: CoreRuntime) -> str:
+async def _run_probe(name: str, probe: Awaitable[object]) -> str:
     try:
-        async with runtime.write_postgres.get_connection() as connection:
-            await connection.fetchval("select 1")
+        async with timeout(PROBE_TIMEOUT_SECONDS):
+            await probe
     except Exception:
+        logger.exception("Readiness probe failed", dependency=name)
         return ERROR_STATUS
     return OK_STATUS
 
 
-async def _probe_read_postgres(runtime: CoreRuntime) -> str:
-    try:
-        async with runtime.read_postgres.get_connection() as connection:
-            await connection.fetchval("select 1")
-    except Exception:
-        return ERROR_STATUS
-    return OK_STATUS
+async def _probe_write_postgres(runtime: CoreRuntime) -> None:
+    async with runtime.write_postgres.get_connection() as connection:
+        await connection.fetchval("select 1")
 
 
-async def _probe_cashews_cache() -> str:
-    try:
-        if not cache.is_setup() or not cache.is_init:
-            return ERROR_STATUS
-        await cache.ping()
-    except Exception:
-        return ERROR_STATUS
-    return OK_STATUS
+async def _probe_read_postgres(runtime: CoreRuntime) -> None:
+    async with runtime.read_postgres.get_connection() as connection:
+        await connection.fetchval("select 1")
 
 
-async def _probe_redis_queue(runtime: CoreRuntime) -> str:
-    try:
-        await runtime.redis_queue.redis_queue.ping()
-    except Exception:
-        return ERROR_STATUS
-    return OK_STATUS
+async def _probe_cashews_cache() -> None:
+    if not cache.is_setup() or not cache.is_init:
+        raise RuntimeError("Cashews backend is not ready")
+    await cache.ping()
+
+
+async def _probe_redis_queue(runtime: CoreRuntime) -> None:
+    await runtime.redis_queue.redis_queue.ping()
 
 
 @router.get("/health")
@@ -70,10 +69,10 @@ async def readiness_check(request: Request, response: Response) -> dict[str, str
     runtime = _get_runtime(request)
 
     async with TaskGroup() as tg:
-        write_task = tg.create_task(_probe_write_postgres(runtime))
-        read_task = tg.create_task(_probe_read_postgres(runtime))
-        cashews_task = tg.create_task(_probe_cashews_cache())
-        queue_task = tg.create_task(_probe_redis_queue(runtime))
+        write_task = tg.create_task(_run_probe("write_postgres", _probe_write_postgres(runtime)))
+        read_task = tg.create_task(_run_probe("read_postgres", _probe_read_postgres(runtime)))
+        cashews_task = tg.create_task(_run_probe("cashews_cache", _probe_cashews_cache()))
+        queue_task = tg.create_task(_run_probe("redis_queue", _probe_redis_queue(runtime)))
 
     write_postgres_status = write_task.result()
     read_postgres_status = read_task.result()

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/auth/access_service.py

@@ -6,7 +6,8 @@ import core_framework.domains.moderation.dependencies as moderation_deps
 import core_framework.domains.user.dependencies as user_deps
 from core_framework.application.auth.models import UserDetail
 from core_framework.core import CacheKey
-from core_framework.domains.user import UserIdentity
+from core_framework.domains.moderation import UserModeration
+from core_framework.domains.user import RESERVED_USER_IDS, UserIdentity
 
 
 @cache.early(
@@ -17,6 +18,12 @@ from core_framework.domains.user import UserIdentity
 )
 async def get_user_detail(*, user_id: str) -> UserDetail:
     """Return cached identity, moderation, and account-removal fence."""
+    if user_id in RESERVED_USER_IDS:
+        return UserDetail(
+            identity=UserIdentity.DEFAULT,
+            moderation=UserModeration.DEFAULT,
+            account_removal_in_progress=False,
+        )
     async with asyncio.TaskGroup() as tg:
         identity_task = tg.create_task(user_deps.user_service.retrieve_user_identity_mapping(user_ids={user_id}))
         moderation_task = tg.create_task(

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/comments/admin_service.py

@@ -156,7 +156,7 @@ async def retrieve_admin_comments(
 
 
 async def tombstone_comment_for_moderator(*, actor_id: str, comment_id: str) -> None:
-    """Tombstone a comment as ``tombstoned_by_moderator`` and record one audit event."""
+    """Tombstone a comment as ``tombstoned_by_moderator`` and enqueue cleanup."""
     impact = await comment_deps.comment_service.tombstone_comment(
         comment_id=comment_id,
         tombstone_status=CommentStatus.TOMBSTONED_BY_MODERATOR,
@@ -164,15 +164,7 @@ async def tombstone_comment_for_moderator(*, actor_id: str, comment_id: str) ->
     if impact is None:
         raise ContentNotFoundException()
 
-    await enqueue_comment_tombstone_cleanup(impact=impact)
-    await moderation_deps.moderation_service.record_moderation_action(
-        actor_id=actor_id,
-        action_type=ModerationActionType.TOMBSTONE_COMMENT,
-        action_metadata={
-            "comment_id": comment_id,
-            "author_id": impact.author_id_before_tombstone,
-        },
-    )
+    await enqueue_comment_tombstone_cleanup(impact=impact, actor_id=actor_id)
     stats_impact = CommentStatsImpact(
         comment_id=impact.comment_id,
         subject_kind=impact.subject_kind,
@@ -395,7 +387,7 @@ async def run_destructive_comment_delete(
             subject_id=impact.subject_id,
             parent_comment_id=impact.parent_comment_id,
         )
-    elif precollected_comment_ids or precollected_attachment_asset_ids:
+    else:
         if resolved_subject_kind is None or resolved_subject_id is None:
             logger.error(
                 "Destructive comment delete missing subject context; finalizing without stats",
@@ -404,7 +396,7 @@ async def run_destructive_comment_delete(
                 attachment_asset_count=len(precollected_attachment_asset_ids),
             )
             await finalize_deleted_comments_cleanup(
-                deleted_comment_ids=precollected_comment_ids,
+                deleted_comment_ids=precollected_comment_ids | {comment_id},
                 attachment_asset_ids=precollected_attachment_asset_ids,
             )
         else:

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/comments/aggregation_service.py

@@ -1,14 +1,10 @@
 from asyncio import TaskGroup
 
-from structlog import get_logger
-
 import core_framework.domains.comment.dependencies as comment_deps
 import core_framework.domains.moderation.dependencies as moderation_deps
 from core_framework.application.comments.kind_registry import get_comment_kind_subject
 from core_framework.domains.comment import CommentStatsImpact
 
-logger = get_logger(__name__)
-
 
 async def aggregate_comment_stats(*, comment_id: str) -> None:
     """Recompute and persist aggregate stats for a comment."""
@@ -46,12 +42,4 @@ async def mark_parent_stats_dirty_for_comment_impact(*, impact: CommentStatsImpa
     port = get_comment_kind_subject(kind=impact.subject_kind)
     if port is None:
         return
-    try:
-        await port.mark_parent_stats_dirty(subject_id=impact.subject_id)
-    except Exception:
-        logger.exception(
-            "Failed to mark parent stats dirty",
-            comment_id=impact.comment_id,
-            subject_kind=impact.subject_kind,
-            subject_id=impact.subject_id,
-        )
+    await port.mark_parent_stats_dirty(subject_id=impact.subject_id)

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/comments/cleanup_service.py

@@ -17,6 +17,7 @@ from core_framework.domains.comment import (
     CommentStatus,
     CommentTombstoneImpact,
 )
+from core_framework.domains.moderation import ModerationActionType
 
 logger = get_logger(__name__)
 
@@ -56,8 +57,10 @@ async def run_comment_tombstone_cleanup(
     parent_comment_id: str | None,
     tombstone_status: str,
     attachment_asset_ids: list[str],
+    actor_id: str | None = None,
+    worker_job_id: str | None = None,
 ) -> None:
-    """Rebuild tombstone impact from ARQ primitives and run finalize cleanup."""
+    """Rebuild tombstone impact from ARQ primitives, run finalize cleanup, and audit when queued by a moderator."""
     await finalize_comment_tombstone_cleanup(
         impact=CommentTombstoneImpact(
             comment_id=comment_id,
@@ -69,9 +72,19 @@ async def run_comment_tombstone_cleanup(
             attachment_asset_ids=tuple(attachment_asset_ids),
         )
     )
+    if actor_id is not None:
+        await moderation_deps.moderation_service.record_moderation_action_for_job(
+            job_id=worker_job_id,
+            actor_id=actor_id,
+            action_type=ModerationActionType.TOMBSTONE_COMMENT,
+            action_metadata={
+                "comment_id": comment_id,
+                "author_id": author_id_before_tombstone,
+            },
+        )
 
 
-async def enqueue_comment_tombstone_cleanup(*, impact: CommentTombstoneImpact) -> None:
+async def enqueue_comment_tombstone_cleanup(*, impact: CommentTombstoneImpact, actor_id: str | None = None) -> None:
     """Best-effort enqueue of comment tombstone cross-domain cleanup."""
     job_id = f"comment_tombstone_cleanup:{impact.comment_id}"
     try:
@@ -84,6 +97,7 @@ async def enqueue_comment_tombstone_cleanup(*, impact: CommentTombstoneImpact) -
             parent_comment_id=impact.parent_comment_id,
             tombstone_status=impact.tombstone_status.value,
             attachment_asset_ids=list(impact.attachment_asset_ids),
+            actor_id=actor_id,
             _job_id=job_id,
         )
         if job is None:
@@ -157,7 +171,7 @@ async def finalize_deleted_comments_cleanup(
 async def finalize_comment_destructive_delete_cleanup(*, impact: CommentDestructiveDeleteImpact) -> None:
     """Run cross-domain cleanup after comment-schema destructive deletion completes."""
     await finalize_deleted_comments_cleanup(
-        deleted_comment_ids=impact.deleted_comment_ids,
+        deleted_comment_ids=impact.deleted_comment_ids | {impact.root_comment_id},
         attachment_asset_ids=impact.attachment_asset_ids,
     )
 

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/comments/post_subject.py

@@ -32,7 +32,7 @@ class PostCommentSubjectPort:
 
     async def resolve_inbox_recipients(self, *, subject_id: str, mention_user_ids: set[str]) -> CommentInboxRecipients:
         """Return the post author as owner and mention candidates allowed by post visibility."""
-        post = await post_deps.post_service.retrieve_post_with_metadata_by_id_if_exists_strong(post_id=subject_id)
+        post = await post_deps.post_service.retrieve_post_with_metadata_by_id_if_exists(post_id=subject_id)
         if post is None or post.visibility is PostVisibility.PRIVATE:
             return CommentInboxRecipients(owner_user_ids=frozenset(), mention_user_ids=frozenset())
         mention_user_ids = set(mention_user_ids)

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/comments/rating_subject.py

@@ -33,7 +33,7 @@ class RatingCommentSubjectPort:
 
     async def resolve_inbox_recipients(self, *, subject_id: str, mention_user_ids: set[str]) -> CommentInboxRecipients:
         """Return the rating author as owner and pass mention candidates through."""
-        rating = await rating_deps.rating_service.retrieve_rating_by_id_strong(rating_id=subject_id)
+        rating = await rating_deps.rating_service.retrieve_rating_by_id(rating_id=subject_id)
         if rating is None:
             return CommentInboxRecipients(owner_user_ids=frozenset(), mention_user_ids=frozenset())
         return CommentInboxRecipients(

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/email/send.py

@@ -40,7 +40,11 @@ async def render_and_send_transactional_email(
     try:
         subject, html_body, plain_text_body = renderer(context)
     except Exception:
-        logger.exception("Transactional email render failed", kind=kind)
+        logger.exception(
+            "Transactional email render failed",
+            reason="renderer_exception",
+            kind=kind,
+        )
         raise
 
     await email_service.send(

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/notifications/notification_service.py

@@ -30,7 +30,7 @@ async def _existing_mention_recipient_ids(*, mention_user_ids: list[str], author
     candidate_recipient_ids = set(mention_user_ids) - {author_id} - RESERVED_USER_IDS
     if not candidate_recipient_ids:
         return set()
-    identity_mapping = await user_deps.user_service.retrieve_user_identity_mapping_strong(
+    identity_mapping = await user_deps.user_service.retrieve_user_identity_mapping(
         user_ids=candidate_recipient_ids,
     )
     return {uid for uid in candidate_recipient_ids if uid in identity_mapping}
@@ -150,7 +150,7 @@ async def _handle_new_reply_notifications(
     parent_comment_id: str,
     content: str | None,
 ) -> None:
-    parent = await comment_deps.comment_service.retrieve_comment_with_metadata_by_id_if_exists_strong(
+    parent = await comment_deps.comment_service.retrieve_comment_with_metadata_by_id_if_exists(
         comment_id=parent_comment_id,
     )
     if parent is None:

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/outbox/handlers.py

@@ -31,6 +31,10 @@ type OutboxEventHandler = Callable[..., Awaitable[None]]
 
 def _require_payload_strings(*, row: OutboxRow, keys: tuple[str, ...]) -> dict[str, str]:
     """Extract required payload strings, dead-lettering invalid payload shape (decision #22)."""
+    if not isinstance(row.payload, dict):
+        raise NonRetryableOutboxHandlerError(
+            f"invalid payload shape {type(row.payload).__name__} for event {row.event_name!r}"
+        )
     invalid = [key for key in keys if not isinstance(row.payload.get(key), str) or not row.payload[key].strip()]
     if invalid:
         raise NonRetryableOutboxHandlerError(f"invalid required payload keys {invalid!r} for event {row.event_name!r}")

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/posts/admin_service.py

@@ -147,7 +147,7 @@ async def retrieve_post_by_id(*, post_id: str) -> dict[str, Any]:
 
 
 async def tombstone_post_for_moderator(*, actor_id: str, post_id: str) -> None:
-    """Tombstone a post as ``tombstoned_by_moderator`` and record one audit event."""
+    """Tombstone a post as ``tombstoned_by_moderator`` and enqueue cleanup."""
     impact = await post_deps.post_service.tombstone_post(
         post_id=post_id,
         tombstone_status=PostStatus.TOMBSTONED_BY_MODERATOR,
@@ -155,15 +155,7 @@ async def tombstone_post_for_moderator(*, actor_id: str, post_id: str) -> None:
     if impact is None:
         raise ContentNotFoundException()
 
-    await enqueue_post_tombstone_cleanup(impact=impact)
-    await moderation_deps.moderation_service.record_moderation_action(
-        actor_id=actor_id,
-        action_type=ModerationActionType.TOMBSTONE_POST,
-        action_metadata={
-            "post_id": post_id,
-            "author_id": impact.author_id_before_tombstone,
-        },
-    )
+    await enqueue_post_tombstone_cleanup(impact=impact, actor_id=actor_id)
 
 
 async def accept_destructive_post_delete(*, actor_id: str, post_id: str) -> None:

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/posts/cleanup_service.py

@@ -10,6 +10,7 @@ import core_framework.domains.notification.dependencies as notification_deps
 import core_framework.domains.post.dependencies as post_deps
 from core_framework.application.shared import worker_jobs
 from core_framework.application.shared.enums import WorkerJobName
+from core_framework.domains.moderation import ModerationActionType
 from core_framework.domains.post import (
     PostAuthorDestructiveDeleteImpact,
     PostAuthorTombstoneImpact,
@@ -54,8 +55,10 @@ async def run_post_tombstone_cleanup(
     author_id_before_tombstone: str,
     tombstone_status: str,
     attachment_asset_ids: list[str],
+    actor_id: str | None = None,
+    worker_job_id: str | None = None,
 ) -> None:
-    """Rebuild tombstone impact from ARQ primitives and run finalize cleanup."""
+    """Rebuild tombstone impact from ARQ primitives, run finalize cleanup, and audit when queued by a moderator."""
     await finalize_post_tombstone_cleanup(
         impact=PostTombstoneImpact(
             post_id=post_id,
@@ -64,9 +67,19 @@ async def run_post_tombstone_cleanup(
             attachment_asset_ids=tuple(attachment_asset_ids),
         )
     )
+    if actor_id is not None:
+        await moderation_deps.moderation_service.record_moderation_action_for_job(
+            job_id=worker_job_id,
+            actor_id=actor_id,
+            action_type=ModerationActionType.TOMBSTONE_POST,
+            action_metadata={
+                "post_id": post_id,
+                "author_id": author_id_before_tombstone,
+            },
+        )
 
 
-async def enqueue_post_tombstone_cleanup(*, impact: PostTombstoneImpact) -> None:
+async def enqueue_post_tombstone_cleanup(*, impact: PostTombstoneImpact, actor_id: str | None = None) -> None:
     """Best-effort enqueue of post tombstone cross-domain cleanup."""
     job_id = f"post_tombstone_cleanup:{impact.post_id}"
     try:
@@ -76,6 +89,7 @@ async def enqueue_post_tombstone_cleanup(*, impact: PostTombstoneImpact) -> None
             author_id_before_tombstone=impact.author_id_before_tombstone,
             tombstone_status=impact.tombstone_status.value,
             attachment_asset_ids=list(impact.attachment_asset_ids),
+            actor_id=actor_id,
             _job_id=job_id,
         )
         if job is None:

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/posts/public_service.py

@@ -19,7 +19,7 @@ from core_framework.domains.post import (
     PostStatus,
     PostWithMetadata,
 )
-from core_framework.domains.user import UserIdentity
+from core_framework.domains.user import RESERVED_USER_IDS, UserIdentity
 
 
 def _mentioned_user_ids_for_posts(
@@ -82,6 +82,11 @@ def _serialize_post(
     stats = post_stats_mapping[post.id]
     hashtags = hashtags_mapping[post.id]
     author_identity = user_identity_mapping[post.author_id]
+    if author_identity == UserIdentity.DEFAULT:
+        author_identity = UserIdentity.REDACTED_AUTHOR
+        author_id = UserIdentity.REDACTED_AUTHOR.user_id
+    else:
+        author_id = post.author_id
     is_tombstone = post.status.is_tombstone
     viewer_context = None
     if not is_tombstone and liked_ids is not None and reported_ids is not None:
@@ -99,7 +104,7 @@ def _serialize_post(
     return {
         "id": post.id,
         "author": {
-            "user_id": post.author_id,
+            "user_id": author_id,
             "username": author_identity.username,
             "display_name": author_identity.display_name,
         },
@@ -139,9 +144,24 @@ async def _hydrate_posts(*, posts: list[PostWithMetadata], viewer_id: str | None
     """Batch-load stats, tags, attachments, identities, and viewer/author context for public post payloads."""
     if not posts:
         return []
-    post_ids = {post.id for post in posts}
     author_ids = {post.author_id for post in posts}
-    owned_post_ids = {p.id for p in posts if viewer_id is not None and p.author_id == viewer_id}
+    active_posts = [post for post in posts if not post.status.is_tombstone]
+    if not active_posts:
+        user_identity_mapping = await user_deps.user_service.retrieve_user_identity_mapping(user_ids=author_ids)
+        return [
+            _serialize_post(
+                post=post,
+                post_stats_mapping=defaultdict(lambda: PostStats.DEFAULT),
+                hashtags_mapping=defaultdict(list),
+                mentions_mapping=defaultdict(list),
+                attachments_mapping=defaultdict(list),
+                user_identity_mapping=user_identity_mapping,
+                viewer_id=viewer_id,
+            )
+            for post in posts
+        ]
+    post_ids = {post.id for post in active_posts}
+    owned_post_ids = {p.id for p in active_posts if viewer_id is not None and p.author_id == viewer_id}
     async with TaskGroup() as tg:
         liked_reported_task = tg.create_task(_retrieve_viewer_context_ids(viewer_id=viewer_id, post_ids=post_ids))
         stats_task = tg.create_task(post_deps.post_service.retrieve_post_stats_mapping(post_ids=post_ids))
@@ -159,7 +179,7 @@ async def _hydrate_posts(*, posts: list[PostWithMetadata], viewer_id: str | None
         )
     liked_ids, reported_ids = liked_reported_task.result()
     mentions_mapping = mentions_task.result()
-    mention_user_ids = _mentioned_user_ids_for_posts(posts=posts, mentions_mapping=mentions_mapping)
+    mention_user_ids = _mentioned_user_ids_for_posts(posts=active_posts, mentions_mapping=mentions_mapping)
     user_identity_mapping = await user_deps.user_service.retrieve_user_identity_mapping(
         user_ids=author_ids | mention_user_ids
     )
@@ -220,6 +240,8 @@ async def retrieve_posts_by_user_id(
     limit: int,
 ) -> list[dict[str, Any]]:
     """Return a paginated profile feed for ``user_id`` visible to ``viewer_id``."""
+    if user_id in RESERVED_USER_IDS:
+        return []
     posts = await post_deps.post_service.retrieve_posts_by_user_id(
         user_id=user_id,
         cursor=cursor,

{core_framework-4.0.0 → core_framework-4.0.1}/core_framework/application/ratings/authenticated_service.py

@@ -24,11 +24,11 @@ async def upsert_my_rating(
         body=body,
     )
     if rating.body is None:
-        dropped_upvotes = await rating_deps.rating_service.remove_rating_upvotes_for_rating(rating_id=rating.id)
+        await rating_deps.rating_service.remove_rating_upvotes_for_rating(rating_id=rating.id)
         dropped_reports = await moderation_deps.moderation_service.remove_review_reports_by_target_ids(
             target_ids={rating.id},
         )
-        if dropped_upvotes or dropped_reports:
+        if dropped_reports:
             await rating_deps.rating_service.insert_rating_stats_dirty(rating_id=rating.id)