@cosmicdrift/kumiko-bundled-features 0.105.2 → 0.109.0

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -22,6 +22,10 @@ import {
   SYSTEM_TENANT_ID,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createProjectionStateTable,
+  rebuildProjection,
+} from "@cosmicdrift/kumiko-framework/pipeline";
 import {
   createTestUser,
   setupTestStack,
@@ -84,6 +88,7 @@ beforeAll(async () => {
   await unsafeCreateEntityTable(stack.db, fieldDefinitionEntity);
   await unsafeCreateEntityTable(stack.db, propertyEntity);
   await createEventsTable(stack.db);
+  await createProjectionStateTable(stack.db);
 });
 
 afterAll(async () => {
@@ -919,3 +924,63 @@ describe("custom-fields integration — update-tenant-field (Bug-Bash D2)", () =
     expect(causeMessage).toContain("update-tenant-field");
   });
 });
+
+describe("custom-fields integration — official host-entity rebuild (#759)", () => {
+  test("rebuildProjection replays customField.set/cleared + fieldDefinition.deleted", async () => {
+    await defineField("property", "color", "text");
+    await defineField("property", "doomed", "text");
+    const propId = "dddddddd-dddd-4000-8000-00000000000d";
+    await createProperty(propId, "RebuildOfficial");
+    await setCustomField("property", propId, "color", "blue");
+    await setCustomField("property", propId, "doomed", "bye");
+    // fieldDef-delete cascade removes the key — the rebuild must preserve the
+    // removal (fieldDefinition.deleted rides the extra "field-definition" source).
+    await stack.http.writeOk(
+      "custom-fields:write:delete-tenant-field",
+      { entityName: "property", fieldKey: "doomed" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    let row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+
+    // The routine schema-migration path: full official rebuild of the host
+    // entity's implicit projection. Pre-#759 this reset every custom_fields
+    // jsonb to its default '{}' with no recovery path.
+    const result = await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+    expect(result.eventsProcessed).toBeGreaterThan(0);
+
+    row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    expect(row?.["name"]).toBe("RebuildOfficial");
+    expect(row?.["color"]).toBe("blue");
+    expect(row?.["doomed"]).toBeUndefined();
+  });
+
+  test("clear-custom-field removal survives the official rebuild", async () => {
+    await defineField("property", "flag", "text");
+    await defineField("property", "keep", "text");
+    const propId = "eeeeeeee-eeee-4000-8000-00000000000e";
+    await createProperty(propId, "ClearSurvives");
+    await setCustomField("property", propId, "flag", "on");
+    await setCustomField("property", propId, "keep", "yes");
+    await clearCustomField("property", propId, "flag");
+    await stack.eventDispatcher?.runOnce();
+
+    await rebuildProjection("property-test:projection:property-entity", {
+      db: stack.db,
+      registry: stack.registry,
+    });
+
+    const row = (await listProperties()).rows.find((r) => r["id"] === propId);
+    // Kontrollfeld beweist dass der Rebuild die set-Events real replayt hat —
+    // ein leeres {} wuerde "flag undefined" trivial erfuellen.
+    expect(row?.["keep"]).toBe("yes");
+    expect(row?.["flag"]).toBeUndefined();
+    expect(row?.["name"]).toBe("ClearSurvives");
+  });
+});

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -22,7 +22,7 @@
 //     (strip runs, host nulls the owner).
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
-import { asRawClient, insertOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   buildEntityTable,
   createEventStoreExecutor,
@@ -46,6 +46,7 @@ import {
   TestUsers,
   unsafeCreateEntityTable,
 } from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
 import { getTemporal } from "@cosmicdrift/kumiko-framework/time";
 import { z } from "zod";
 import { createComplianceProfilesFeature } from "../../compliance-profiles";
@@ -241,7 +242,7 @@ async function readRow(id: string): Promise<Record<string, unknown> | undefined>
 // the export runner iterates their data. Status active = NOT picked up by
 // runForgetCleanup.
 async function seedActiveUserWithMembership(): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: admin.id,
     tenantId: TENANT,
     email: `admin@example.com`,
@@ -258,7 +259,7 @@ async function seedActiveUserWithMembership(): Promise<void> {
 // Seed the acting admin as DeletionRequested + grace expired so
 // runForgetCleanup picks them up, with a membership in TENANT.
 async function seedForgetUserWithMembership(): Promise<void> {
-  await insertOne(stack.db, userTable, {
+  await seedRow(stack.db, userTable, {
     id: admin.id,
     tenantId: TENANT,
     email: `admin@example.com`,

package/src/custom-fields/constants.ts

@@ -31,6 +31,7 @@ export const CUSTOM_FIELDS_FORM_EXTENSION_NAME = "CustomFieldsFormSection";
 // Entity-CRUD auto-events for the `field-definition` entity. registry.ts emits
 // these as `${entityName}.created`/`.updated` (dot form) — they do NOT run
 // through r.defineEvent/toKebab, so the dot MUST stay.
+export const FIELD_DEFINITION_AGGREGATE_TYPE = "field-definition";
 export const FIELD_DEFINITION_CREATED_EVENT = "field-definition.created";
 export const FIELD_DEFINITION_UPDATED_EVENT = "field-definition.updated";
 // Qualified at registration via r.defineEvent — final name is

package/src/custom-fields/handlers/delete-system-field.write.ts

@@ -1,5 +1,6 @@
 import { SYSTEM_TENANT_ID, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -30,7 +31,7 @@ export const deleteSystemFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: {
           entityName: payload.entityName,

package/src/custom-fields/handlers/delete-tenant-field.write.ts

@@ -1,5 +1,6 @@
 import { isSystemTenant, type WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { fieldDefinitionAggregateId } from "../aggregate-id";
+import { FIELD_DEFINITION_AGGREGATE_TYPE } from "../constants";
 import { fieldDefinitionExecutor } from "../executor";
 import { customFieldsFeature } from "../feature";
 import { type DeleteFieldPayload, deleteFieldPayloadSchema } from "../schemas";
@@ -38,7 +39,7 @@ export const deleteTenantFieldHandler: WriteHandlerDef = {
     if (result.isSuccess) {
       await ctx.unsafeAppendEvent({
         aggregateId,
-        aggregateType: "field-definition",
+        aggregateType: FIELD_DEFINITION_AGGREGATE_TYPE,
         type: customFieldsFeature.exports.fieldDefinitionDeletedEvent.name,
         payload: { entityName: payload.entityName, fieldKey: payload.fieldKey, tenantId },
       });

package/src/custom-fields/wire-for-entity.ts

@@ -1,4 +1,4 @@
-import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import {
   createJsonbField,
   type FeatureRegistrar,
@@ -6,7 +6,8 @@ import {
   type JsonbFieldDef,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { CUSTOM_FIELDS_EXTENSION } from "./constants";
+import type { StoredEvent } from "@cosmicdrift/kumiko-framework/event-store";
+import { CUSTOM_FIELDS_EXTENSION, FIELD_DEFINITION_AGGREGATE_TYPE } from "./constants";
 import {
   clearCustomFieldKey,
   removeCustomFieldKeyForTenant,
@@ -36,8 +37,9 @@ export function customFieldsField(): JsonbFieldDef {
 
 // Vollständige integration der custom-fields-Bundle für eine spezifische
 // host-entity. Eine einzige Aufruf-Stelle pro consumer registriert ALLE
-// wiring-Aspekte: extension-tracking, MSP für value-projection, postQuery-
-// hook für API-flatten, search-payload-extension für indexable customFields.
+// wiring-Aspekte: extension-tracking, MSP für value-projection, rebuild-
+// replay via extendEntityProjection, postQuery-hook für API-flatten,
+// search-payload-extension für indexable customFields.
 //
 // Consumer-side:
 //
@@ -61,15 +63,20 @@ export function customFieldsField(): JsonbFieldDef {
 //      emittiert haben. Updated entityTable.customFields jsonb über
 //      jsonb_set / jsonb-key-removal.
 //
-//   3. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
+//   3. r.extendEntityProjection — hängt dieselben apply-Handler in die
+//      implicit projection der host-entity, damit rebuildProjection die
+//      customField-Events mit-replayt. Ohne das fällt customFields bei
+//      jedem Entity-Rebuild (Schema-Migration!) auf `{}` zurück (#759).
+//
+//   4. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
 //      diese entity wird `row.customFields` jsonb auf root-level expanded
 //      damit die API-response wie Stammfelder aussieht.
 //
-//   4. r.searchPayloadExtension(entity, contributor) — searchable
+//   5. r.searchPayloadExtension(entity, contributor) — searchable
 //      customFields-keys werden flach ins Meilisearch-Index-Doc beigetragen
 //      (F3-wiring).
 //
-//   5. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
+//   6. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
 //      einer fieldDefinition werden orphan values aus allen entity-rows
 //      entfernt (key-removal pro fieldKey).
 export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
@@ -87,80 +94,100 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
   const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
   const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
 
-  r.multiStreamProjection({
-    name: `custom-fields-${entityName}-projection`,
-    apply: {
-      [setEventType]: async (event, tx) => {
-        // skip: MSP feuert für ALLE aggregate-types die customField.set
-        // emittieren — wir wollen nur die unserer wired host-entity.
-        // Andere consumers haben eigene MSPs für ihre Entities.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
+  // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
+  // entity-projection-extension replayt sie in rebuildProjection — gleiche
+  // SQL-Helper, beide idempotent. 2-Param-Signatur ist die gemeinsame
+  // Teilmenge von MultiStreamApplyFn und SingleStreamApplyFn.
+  const applyCustomFieldSet = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für ALLE aggregate-types die customField.set emittieren —
+    // wir wollen nur die unserer wired host-entity. Andere consumers haben
+    // eigene Wirings für ihre Entities.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
 
-        // skip: sensitive fields self-project in the write handler (see
-        // set-custom-field) and persist a value-less event so PII never enters
-        // the log. Such events arrive here with value === undefined — skipping
-        // is correct both live (the handler already wrote the row) and on replay
-        // (the value is intentionally gone, the accepted rebuild-loss).
-        if (payload.value === undefined) return;
+    // skip: sensitive fields self-project in the write handler (see
+    // set-custom-field) and persist a value-less event so PII never enters
+    // the log. Such events arrive here with value === undefined — skipping
+    // is correct both live (the handler already wrote the row) and on replay
+    // (the value is intentionally gone, the accepted rebuild-loss).
+    if (payload.value === undefined) return;
 
-        // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
-        // wird angelegt (create_missing=true ist default). value muss als
-        // jsonb-literal kommen.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await setCustomFieldValue(
-          tx,
-          tableName,
-          payload.fieldKey,
-          payload.value,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [clearedEventType]: async (event, tx) => {
-        // skip: MSP feuert für alle aggregate-types — nur unsere host-entity
-        // verarbeiten.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+    // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
+    // wird angelegt (create_missing=true ist default). value muss als
+    // jsonb-literal kommen.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await setCustomFieldValue(
+      tx,
+      tableName,
+      payload.fieldKey,
+      payload.value,
+      event.aggregateId,
+      event.tenantId,
+    );
+  };
 
-        // jsonb minus operator (`-`) entfernt key aus jsonb-object.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await clearCustomFieldKey(
-          tx,
-          tableName,
-          payload.fieldKey,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [fieldDefDeletedType]: async (event, tx) => {
-        // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
-        // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
-        // entity falls die deleted-fieldDef für diese entity galt.
-        const payload = event.payload as {
-          entityName: string;
-          fieldKey: string;
-          tenantId?: TenantId;
-        }; // @cast-boundary engine-payload
-        // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
-        // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
-        // ihre Rows.
-        if (payload.entityName !== entityName) return;
+  const applyCustomFieldCleared = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für alle aggregate-types — nur unsere host-entity
+    // verarbeiten.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+
+    // jsonb minus operator (`-`) entfernt key aus jsonb-object.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await clearCustomFieldKey(tx, tableName, payload.fieldKey, event.aggregateId, event.tenantId);
+  };
+
+  const applyFieldDefinitionDeleted = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
+    // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
+    // entity falls die deleted-fieldDef für diese entity galt.
+    const payload = event.payload as {
+      entityName: string;
+      fieldKey: string;
+      tenantId?: TenantId;
+    }; // @cast-boundary engine-payload
+    // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
+    // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
+    // ihre Rows.
+    if (payload.entityName !== entityName) return;
+
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    // Scope cleanup to the deleted definition's owning tenant. System-scope
+    // definitions apply to every tenant → cascade across all rows; tenant-
+    // scope deletions must only touch that tenant's rows, else deleting one
+    // tenant's field strips the same kebab key from every tenant (data loss).
+    // Fallback to the event's stream tenantId for events appended before the
+    // payload carried tenantId.
+    const defTenantId = payload.tenantId ?? event.tenantId;
+    if (isSystemTenant(defTenantId)) {
+      await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
+    } else {
+      await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
+    }
+  };
 
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        // Scope cleanup to the deleted definition's owning tenant. System-scope
-        // definitions apply to every tenant → cascade across all rows; tenant-
-        // scope deletions must only touch that tenant's rows, else deleting one
-        // tenant's field strips the same kebab key from every tenant (data loss).
-        // Fallback to the event's stream tenantId for events appended before the
-        // payload carried tenantId.
-        const defTenantId = payload.tenantId ?? event.tenantId;
-        if (isSystemTenant(defTenantId)) {
-          await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
-        } else {
-          await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
-        }
-      },
+  r.multiStreamProjection({
+    name: `custom-fields-${entityName}-projection`,
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
+    },
+  });
+
+  // Rebuild-wiring (#759): ohne das replayt rebuildProjection nur die
+  // entity-lifecycle-Events und resettet jede customFields-jsonb auf ihr
+  // Default `{}` — die Werte existieren ausschließlich als customField.set/
+  // .cleared-Events. set/cleared reiten auf dem HOST-entity-Stream
+  // (aggregateType = entityName, von source schon abgedeckt);
+  // fieldDefinition.deleted lebt auf dem "field-definition"-Stream und
+  // kommt deshalb als extra source dazu.
+  r.extendEntityProjection(entityName, {
+    sources: [FIELD_DEFINITION_AGGREGATE_TYPE],
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
     },
   });
 

package/src/data-retention/__tests__/parse-override.test.ts

@@ -1,6 +1,14 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
 
+// A mid-test assertion throw skips the trailing `warn.mockRestore()` in that
+// test, leaving the spy live for every test after it (551/1) — this backstop
+// restores unconditionally regardless of how the test exited.
+afterEach(() => {
+  const warn = console.warn as unknown as { mockRestore?: () => void };
+  warn.mockRestore?.();
+});
+
 // parseRetentionOverrideOrNull is the read boundary for a tenant's stored
 // data-retention override (DSGVO-relevant policy in a config column). It must
 // never let a corrupt or schema-violating value reach the retention decision:
@@ -31,19 +39,17 @@ describe("parseRetentionOverrideOrNull", () => {
   });
 
   test("corrupt JSON returns null without throwing", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(() => parse("{not json")).not.toThrow();
     expect(parse("{not json")).toBeNull();
-    warn.mockRestore();
   });
 
   test("JSON that parses but violates the schema is dropped to null — never leaked through", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(parse('{"strategy":"delete"}')).toBeNull(); // enum drift
     expect(parse('{"keepFor":"30days"}')).toBeNull(); // keepFor format drift
     expect(parse('{"keepFor":42}')).toBeNull(); // wrong type
     expect(parse('{"unknownKey":1}')).toBeNull(); // strict() rejects extra keys
-    warn.mockRestore();
   });
 
   test("each dropped value surfaces exactly one operator warning", () => {
@@ -51,6 +57,5 @@ describe("parseRetentionOverrideOrNull", () => {
     parse("{not json");
     parse('{"strategy":"delete"}');
     expect(warn).toHaveBeenCalledTimes(2);
-    warn.mockRestore();
   });
 });

package/src/data-retention/resolve-for-tenant.ts

@@ -26,15 +26,27 @@ export interface ResolveForTenantArgs {
    * Tenant-Override (Layer 3) zurueck.
    */
   readonly tenantPreset?: RetentionPresetKey | null;
+  /**
+   * Pre-fetched override row for this (tenantId, entityName) pair — lets a
+   * bulk caller (the cleanup cron, N entities × M tenants) read every
+   * override for a tenant ONCE and pass each row in, instead of one
+   * `fetchOne` per entity. undefined (the default) still runs the
+   * single-lookup fetchOne for the "policy-for" query handler's use case.
+   * `null` explicitly means "pre-fetched, no override row exists".
+   */
+  readonly preloadedOverride?: { config: string | null } | null;
 }
 
 export async function resolveRetentionPolicyForTenant(
   args: ResolveForTenantArgs,
 ): Promise<EffectiveRetentionPolicy> {
-  const overrideRow = (await fetchOne(args.db, tenantRetentionOverrideTable, {
-    tenantId: args.tenantId,
-    entityName: args.entityName,
-  })) as { config: string | null } | null; // @cast-boundary db-runner
+  const overrideRow =
+    args.preloadedOverride !== undefined
+      ? args.preloadedOverride
+      : ((await fetchOne(args.db, tenantRetentionOverrideTable, {
+          tenantId: args.tenantId,
+          entityName: args.entityName,
+        })) as { config: string | null } | null); // @cast-boundary db-runner
 
   const tenantOverride = parseRetentionOverrideOrNull(
     overrideRow?.config ?? null,

package/src/data-retention/run-retention-cleanup.ts

@@ -6,9 +6,15 @@
 // Strategy auf Rows an deren reference-Timestamp aelter als der keepFor-Cutoff
 // ist:
 //
-//   - hardDelete  → deleteManyBatched (selbst-begrenzt, kein Full-Table-Scan)
-//   - softDelete  → isDeleted=true/deletedAt=now, nur auf noch-nicht-geloeschte
+//   - hardDelete  → executor.forget pro Row (Event → rebuild-safe hard purge)
+//   - softDelete  → executor.delete pro Row (Event → rebuild-safe soft-delete),
+//                   nur auf noch-nicht-geloeschte (isDeleted:false-Filter)
 //   - anonymize   → DEFERRED (siehe unten)
+//
+// Über den Executor statt Batch-deleteMany/updateMany: ein eventloser Batch-Write
+// auf die (erased) Projektions-Tabelle wird beim Projection-Rebuild
+// gewischt/resurrektiert — das #648-Loch. Kosten: N Events pro Cleanup statt ein
+// Batch-Statement (per-Row-Ceiling, Batch-Event-Variante als Follow-up).
 //   - blockDelete → ignoriert (Aufbewahrungs-Pflicht; user-forget loest anonymize)
 //
 // **Schaerfer als soft-delete-cleanup:** dieser Cron hardDeleted LIVE Rows
@@ -24,12 +30,23 @@
 // zeitgesteuertes anonymize; der user-forget-Flow (run-forget-cleanup) deckt
 // anonymize keyed auf userId ab. Follow-up fuer den Marker.
 
-import { deleteManyBatched, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { DbRunner, WhereObject } from "@cosmicdrift/kumiko-framework/db";
-import type { Registry, TenantId } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbRunner,
+  type WhereObject,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createSystemUser,
+  type EntityId,
+  type Registry,
+  type TenantId,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { computeCutoff, type Instant } from "./keep-for";
 import type { RetentionPresetKey } from "./presets";
 import { resolveRetentionPolicyForTenant } from "./resolve-for-tenant";
+import { tenantRetentionOverrideTable } from "./schema/tenant-retention-override";
 
 const DEFAULT_BATCH_LIMIT = 1000;
 const DEFAULT_REFERENCE_FIELD = "createdAt";
@@ -71,6 +88,24 @@ export interface RunRetentionCleanupResult {
   readonly skipped: readonly RetentionCleanupSkip[];
 }
 
+// Select one batchLimit-sized page of matching rows and run the executor op per
+// row (event → rebuild-safe). Returns the count of successful ops.
+async function purgeMatchingRows(
+  db: DbRunner,
+  table: Parameters<typeof selectMany>[1],
+  where: WhereObject,
+  batchLimit: number,
+  op: (id: EntityId) => Promise<{ readonly isSuccess: boolean }>,
+): Promise<number> {
+  const rows = await selectMany<{ id: EntityId }>(db, table, where, { limit: batchLimit });
+  let count = 0;
+  for (const row of rows) {
+    const res = await op(row.id);
+    if (res.isSuccess) count++;
+  }
+  return count;
+}
+
 export async function runRetentionCleanup(
   args: RunRetentionCleanupArgs,
 ): Promise<RunRetentionCleanupResult> {
@@ -82,6 +117,27 @@ export async function runRetentionCleanup(
   const anonymizeDeferred: string[] = [];
   const skipped: RetentionCleanupSkip[] = [];
 
+  // Retention writes go through the executor (events) so a projection rebuild
+  // replays the cleanup — a batch deleteMany/updateMany on the (erased)
+  // projection table is eventless and gets wiped/resurrected on rebuild (the
+  // #648 hole this closes). The cron acts as the system actor; the WHERE already
+  // tenant-scopes, so a system-mode TenantDb (no extra filter) is correct.
+  // ponytail: per-row events, one batchLimit-sized page per entity per run —
+  // the daily cron converges (hardDelete removes rows, softDelete's isDeleted
+  // filter shrinks the set). A single batched forget/delete event is a follow-up.
+  const systemUser = createSystemUser(tenantId);
+  const tdb = createTenantDb(db, tenantId, "system");
+
+  // Pre-load every override row for this tenant ONCE — N entities × M
+  // tenants would otherwise mean one fetchOne per entity per tenant, even
+  // though the whole set for a tenant is a single small, indexed read.
+  const overrideRows = await selectMany<{ entityName: string; config: string | null }>(
+    db,
+    tenantRetentionOverrideTable,
+    { tenantId },
+  );
+  const overrideByEntity = new Map(overrideRows.map((r) => [r.entityName, { config: r.config }]));
+
   for (const proj of registry.getAllProjections().values()) {
     // Nur implicit-Entity-Projektionen mit Tabelle — wie soft-delete-cleanup.
     // Custom-Projektionen + unmanaged-Tables (z.B. sessions) sind kein Target.
@@ -94,9 +150,12 @@ export async function runRetentionCleanup(
       tenantId,
       entityName,
       tenantPreset,
+      preloadedOverride: overrideByEntity.get(entityName) ?? null,
     });
     const policy = resolved.policy;
     if (!policy) continue;
+    const entity = registry.getEntity(entityName);
+    if (!entity) continue;
 
     const table = proj.table as Record<string, unknown>; // @cast-boundary column-presence probe
     const declaredReference = policy.reference ?? DEFAULT_REFERENCE_FIELD;
@@ -118,8 +177,10 @@ export async function runRetentionCleanup(
 
     switch (policy.strategy) {
       case "hardDelete": {
-        const res = await deleteManyBatched(db, proj.table, where, { limit: batchLimit });
-        hardDeleted += res.deleted;
+        const executor = createEventStoreExecutor(proj.table, entity, { entityName });
+        hardDeleted += await purgeMatchingRows(db, proj.table, where, batchLimit, (id) =>
+          executor.forget({ id }, systemUser, tdb),
+        );
         break;
       }
       case "softDelete": {
@@ -127,13 +188,14 @@ export async function runRetentionCleanup(
           skipped.push({ entityName, reason: "missing_softdelete_columns" });
           break;
         }
-        const updated = await updateMany(
+        const executor = createEventStoreExecutor(proj.table, entity, { entityName });
+        softDeleted += await purgeMatchingRows(
           db,
           proj.table,
-          { isDeleted: true, deletedAt: now },
           { ...where, isDeleted: false },
+          batchLimit,
+          (id) => executor.delete({ id }, systemUser, tdb),
         );
-        softDeleted += updated.length;
         break;
       }
       case "anonymize": {