@cosmicdrift/kumiko-bundled-features 0.145.1 → 0.146.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.145.1",
+  "version": "0.146.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -107,14 +107,15 @@
     "./managed-pages": "./src/managed-pages/index.ts",
     "./managed-pages/web": "./src/managed-pages/web/index.ts",
     "./managed-pages/seeding": "./src/managed-pages/seeding.ts",
+    "./seo": "./src/seo/index.ts",
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.145.1",
-    "@cosmicdrift/kumiko-framework": "0.145.1",
-    "@cosmicdrift/kumiko-headless": "0.145.1",
-    "@cosmicdrift/kumiko-renderer": "0.145.1",
-    "@cosmicdrift/kumiko-renderer-web": "0.145.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.146.0",
+    "@cosmicdrift/kumiko-framework": "0.146.0",
+    "@cosmicdrift/kumiko-headless": "0.146.0",
+    "@cosmicdrift/kumiko-renderer": "0.146.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.146.0",
     "@mollie/api-client": "^4.5.0",
     "imapflow": "^1.3.3",
     "mailparser": "^3.9.8",

package/src/custom-fields/__tests__/custom-fields.integration.test.ts

@@ -435,9 +435,9 @@ describe("custom-fields integration — define resurrection (B1)", () => {
   });
 });
 
-describe("custom-fields integration — sensitive value self-projected, kept out of the event log (#2)", () => {
-  test("sensitive field: value reaches the projection but NOT kumiko_events", async () => {
-    await stack.http.writeOk(
+describe("custom-fields integration — no PII: `sensitive` rejected, every value in the log (#972)", () => {
+  test("define-tenant-field with `sensitive` is rejected at the schema boundary", async () => {
+    const err = await stack.http.writeErr(
       "custom-fields:write:define-tenant-field",
       {
         entityName: "property",
@@ -449,23 +449,14 @@ describe("custom-fields integration — sensitive value self-projected, kept out
       },
       admin,
     );
-    const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a1";
-    await createProperty(propId, "Sensitive Prop");
-    await setCustomField("property", propId, "taxId", "DE-TAX-999");
-
-    // Read model HAS the value — self-projected directly into the host row.
-    const props = await listProperties();
-    const row = props.rows.find((r) => r["id"] === propId);
-    expect(row?.["taxId"]).toBe("DE-TAX-999");
-
-    // The immutable event log does NOT carry the value (erasable by design).
-    const payload = await fetchSetEventPayload(propId, "taxId");
-    expect(payload).toBeDefined();
-    expect(payload?.["fieldKey"]).toBe("taxId");
-    expect(payload && "value" in payload).toBe(false);
+    expect(err.httpStatus).toBe(400);
+    expect(err.code).toBe("validation_error");
+    // The API sanitises zod messages to i18n keys — the reject surfaces as a
+    // custom validation issue on the serializedField path.
+    expect(JSON.stringify(err.details)).toContain('"serializedField"');
   });
 
-  test("non-sensitive field: value IS in the event log (control)", async () => {
+  test("every set carries its value in the event log", async () => {
     const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a2";
     await defineField("property", "publicNote", "text");
     await createProperty(propId, "Public Prop");
@@ -475,24 +466,13 @@ describe("custom-fields integration — sensitive value self-projected, kept out
     expect(payload?.["value"]).toBe("visible");
   });
 
-  test("rebuild replay: re-applying logged events restores non-sensitive, not sensitive", async () => {
+  test("rebuild replay: re-applying logged events restores ALL custom-field values", async () => {
     await defineField("property", "publicTag", "text");
-    await stack.http.writeOk(
-      "custom-fields:write:define-tenant-field",
-      {
-        entityName: "property",
-        fieldKey: "secret",
-        serializedField: { type: "text", sensitive: true },
-        required: false,
-        searchable: false,
-        displayOrder: 0,
-      },
-      admin,
-    );
+    await defineField("property", "vendorRef", "text");
     const propId = "aaaaaaaa-aaaa-4000-8000-0000000000a3";
     await createProperty(propId, "Rebuild Prop");
     await setCustomField("property", propId, "publicTag", "keepme");
-    await setCustomField("property", propId, "secret", "DE-TAX-777");
+    await setCustomField("property", propId, "vendorRef", "VR-777");
     await stack.eventDispatcher?.runOnce();
 
     // Wipe the read model, then replay the logged events through the REAL MSP
@@ -531,30 +511,10 @@ describe("custom-fields integration — sensitive value self-projected, kept out
     }
 
     const row = (await listProperties()).rows.find((r) => r["id"] === propId);
-    // Non-sensitive: restored from its value-bearing event.
+    // Every value restores from its value-bearing event — custom fields are
+    // fully rebuild-safe since #972 (no PII, no value-less events).
     expect(row?.["publicTag"]).toBe("keepme");
-    // Sensitive: the logged event carried no value → gone. The accepted, DURABLE
-    // rebuild-loss — and why a forget can't be undone by a rebuild.
-    expect(row?.["secret"]).toBeUndefined();
-  });
-
-  test("update-tenant-field rejects flipping `sensitive` (would orphan logged PII)", async () => {
-    await defineField("property", "maybePii", "text"); // non-sensitive at definition
-    const err = await stack.http.writeErr(
-      "custom-fields:write:update-tenant-field",
-      {
-        entityName: "property",
-        fieldKey: "maybePii",
-        serializedField: { type: "text", sensitive: true }, // attempt the flip
-        required: false,
-        searchable: false,
-        displayOrder: 0,
-      },
-      admin,
-    );
-    expect(err.httpStatus).toBe(422);
-    expect(err.code).toBe("unprocessable");
-    expect(err.details).toMatchObject({ reason: "field_sensitive_immutable" });
+    expect(row?.["vendorRef"]).toBe("VR-777");
   });
 });
 

package/src/custom-fields/__tests__/parse-serialized-field.test.ts

@@ -3,8 +3,16 @@ import { isFieldDefinitionRow, parseSerializedField } from "../lib/parse-seriali
 
 describe("parseSerializedField", () => {
   test("parses a valid JSON string into the typed shape", () => {
-    const parsed = parseSerializedField('{"type":"text","sensitive":true}');
-    expect(parsed).toEqual({ type: "text", sensitive: true });
+    const parsed = parseSerializedField(
+      '{"type":"text","retention":{"keepFor":"30d","strategy":"delete"}}',
+    );
+    expect(parsed).toEqual({ type: "text", retention: { keepFor: "30d", strategy: "delete" } });
+  });
+
+  test("throws on a stored definition with the removed `sensitive` key (#972)", () => {
+    expect(() => parseSerializedField('{"type":"text","sensitive":true}')).toThrow(
+      /custom fields don't support PII/,
+    );
   });
 
   test("accepts an already-parsed object (jsonb-tolerant driver path)", () => {
@@ -17,7 +25,7 @@ describe("parseSerializedField", () => {
   });
 
   test("returns null when the shape lacks a string type", () => {
-    expect(parseSerializedField('{"sensitive":true}')).toBeNull();
+    expect(parseSerializedField('{"fieldAccess":{}}')).toBeNull();
     expect(parseSerializedField({ type: 42 })).toBeNull();
   });
 

package/src/custom-fields/__tests__/user-data-rights.integration.test.ts

@@ -2,24 +2,16 @@
 // REAL export/forget runners (runUserExport / runForgetCleanup), not by
 // calling the registered hooks in isolation.
 //
-// What the real runners prove that direct hook calls cannot:
+// Since #972 the wiring is EXPORT-ONLY: custom fields carry supplemental
+// business data, not PII — runForgetCleanup has nothing to redact in the
+// customFields jsonb. The tests prove:
 //
-//   * runUserExport actually picks up the custom-fields export hook from the
-//     registry and folds its snippet into the user's cross-tenant bundle.
+//   * runUserExport picks up the custom-fields export hook from the registry
+//     and folds its snippet into the user's cross-tenant bundle (Art. 20).
 //
-//   * runForgetCleanup fires BOTH the host EXT_USER_DATA hook (owner-nulling
-//     anonymize) AND the custom-fields strip hook, in the order their declared
-//     `order` demands. The strip declares order -100 so it redacts sensitive
-//     jsonb keyed on `inserted_by_id` BEFORE the host hook nulls that column.
-//     If the ordering regressed, the host hook would null inserted_by_id first,
-//     the strip's `WHERE inserted_by_id = userId` would match 0 rows, and
-//     sensitive PII would silently survive (Art. 17 violation). Calling the
-//     hooks by hand never exercised this interaction.
-//
-//   * The anonymize-vs-delete strategy comes from the data-retention policy:
-//     no override → strategy "delete" (custom-fields strip is a no-op, host
-//     deletes the row); per-tenant anonymize override → strategy "anonymize"
-//     (strip runs, host nulls the owner).
+//   * runForgetCleanup leaves customFields untouched on anonymize (only the
+//     host hook nulls the owner) and lets the host delete-hook remove whole
+//     rows on strategy "delete".
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -76,9 +68,8 @@ const propertyEntity = createEntity({
 const propertyTable = buildEntityTable("property", propertyEntity);
 
 // Host entity gets its own EXT_USER_DATA-registration too — that's the
-// canonical setup. The host's anonymize hook NULLS inserted_by_id (default
-// order 0); the custom-fields strip (order -100) must run first. Both fire in
-// the same runForgetCleanup sub-transaction.
+// canonical setup. The host's anonymize hook NULLS inserted_by_id; the
+// custom-fields wiring contributes export only (#972).
 const hostExportHook: UserDataExportHook = async (ctx) => {
   const rows = await asRawClient(ctx.db).unsafe(
     `SELECT id, name FROM read_t15c_properties WHERE inserted_by_id = $1 AND tenant_id = $2`,
@@ -99,9 +90,7 @@ const hostDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
       [ctx.userId, ctx.tenantId],
     );
   } else {
-    // anonymize: clear owner, keep row + non-sensitive customFields. Runs AFTER
-    // the custom-fields strip (order -100 < 0) — if it ran first, the strip's
-    // owner-keyed WHERE would match nothing.
+    // anonymize: clear owner, keep row + customFields.
     await asRawClient(ctx.db).unsafe(
       `UPDATE read_t15c_properties SET inserted_by_id = NULL WHERE inserted_by_id = $1 AND tenant_id = $2`,
       [ctx.userId, ctx.tenantId],
@@ -304,10 +293,10 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
   test("export: customFields jsonb lands in the user's export bundle", async () => {
     await seedActiveUserWithMembership();
     const propertyId = "11111111-1111-4000-8000-000000000001";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await defineField("vipFlag", { type: "boolean" });
     await createProperty(propertyId, "Hofgarten 12");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await setField(propertyId, "vipFlag", true);
     await stack.eventDispatcher?.runOnce();
 
@@ -324,19 +313,19 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     expect(cfSnippet).toBeDefined();
     expect(cfSnippet?.rows).toHaveLength(1);
     expect(cfSnippet?.rows[0]?.["customFields"]).toMatchObject({
-      email: "alice@example.com",
+      contactRef: "crm-4711",
       vipFlag: true,
     });
   });
 
-  test("forget anonymize: strip runs BEFORE host owner-nulling → sensitive key gone, non-sensitive kept", async () => {
+  test("forget anonymize: customFields stay fully intact (export-only wiring, #972)", async () => {
     await seedForgetUserWithMembership();
     await seedPropertyAnonymizeOverride();
     const propertyId = "22222222-2222-4000-8000-000000000002";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await defineField("vipFlag", { type: "boolean" });
     await createProperty(propertyId, "Anonymize-Me");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await setField(propertyId, "vipFlag", true);
     await stack.eventDispatcher?.runOnce();
 
@@ -349,39 +338,19 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     expect(result.errors).toHaveLength(0);
 
     const row = await readRow(propertyId);
-    // Host hook ran (owner nulled), and the strip ran BEFORE it (sensitive
-    // key removed despite the owner-keyed WHERE — proof of the -100 ordering).
+    // Host hook ran (owner nulled); custom fields hold business data, not
+    // PII — nothing was stripped.
     expect(row?.["inserted_by_id"]).toBeNull();
-    const customFields = row?.["custom_fields"] as Record<string, unknown> | undefined;
-    expect(customFields).toBeDefined();
-    expect(customFields).not.toHaveProperty("email");
-    expect(customFields).toMatchObject({ vipFlag: true });
-
-    // The other half of erasure: the sensitive value was self-projected and the
-    // customField.set event was persisted value-less — so PII never entered the
-    // immutable log. Without this, the strip above would be undone by a rebuild.
-    const eventRows = await asRawClient(stack.db).unsafe(
-      "SELECT payload FROM kumiko_events WHERE aggregate_id = $1",
-      [propertyId],
-    );
-    const setPayloads = (eventRows as ReadonlyArray<{ payload: unknown }>).map((r) =>
-      typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload,
-    ) as Array<Record<string, unknown>>;
-    const emailSet = setPayloads.find((p) => p?.["fieldKey"] === "email");
-    expect(emailSet).toBeDefined();
-    expect(emailSet && "value" in emailSet).toBe(false);
-    // Control: the non-sensitive value DID go through the log (normal path).
-    const vipSet = setPayloads.find((p) => p?.["fieldKey"] === "vipFlag");
-    expect(vipSet?.["value"]).toBe(true);
+    expect(row?.["custom_fields"]).toMatchObject({ contactRef: "crm-4711", vipFlag: true });
   });
 
-  test("forget delete (no override → strategy delete): host removes the row, strip is a no-op", async () => {
+  test("forget delete (no override → strategy delete): host removes the row", async () => {
     await seedForgetUserWithMembership();
     // No retention override → policyToStrategy(null) = "delete".
     const propertyId = "33333333-3333-4000-8000-000000000003";
-    await defineField("email", { type: "text", sensitive: true });
+    await defineField("contactRef", { type: "text" });
     await createProperty(propertyId, "Delete-Me");
-    await setField(propertyId, "email", "alice@example.com");
+    await setField(propertyId, "contactRef", "crm-4711");
     await stack.eventDispatcher?.runOnce();
 
     const result = await runForgetCleanup({
@@ -391,8 +360,7 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     });
     expect(result.processedUserIds).toContain(admin.id);
 
-    // Host delete-hook removed the row; custom-fields strip stayed out of the
-    // way (it returns early on strategy=delete).
+    // Host delete-hook removed the row wholesale — customFields go with it.
     expect(await readRow(propertyId)).toBeUndefined();
   });
 
@@ -413,27 +381,4 @@ describe("T1.5c: custom-fields user-data-rights through the real runners", () =>
     const cfSnippet = tenantSection?.entities.find((e) => e.entity === "property.customFields");
     expect(cfSnippet).toBeUndefined();
   });
-
-  test("forget anonymize without sensitive fields defined → all customFields kept", async () => {
-    await seedForgetUserWithMembership();
-    await seedPropertyAnonymizeOverride();
-    const propertyId = "55555555-5555-4000-8000-000000000005";
-    await defineField("nonSensitive", { type: "text" });
-    await createProperty(propertyId, "AllStay");
-    await setField(propertyId, "nonSensitive", "still-here");
-    await stack.eventDispatcher?.runOnce();
-
-    const result = await runForgetCleanup({
-      db: stack.db,
-      registry: stack.registry,
-      now: NOW(),
-    });
-    expect(result.processedUserIds).toContain(admin.id);
-
-    const row = await readRow(propertyId);
-    expect(row?.["inserted_by_id"]).toBeNull();
-    expect((row?.["custom_fields"] as Record<string, unknown>)?.["nonSensitive"]).toBe(
-      "still-here",
-    );
-  });
 });

package/src/custom-fields/db/queries/user-data-rights.ts

@@ -25,26 +25,6 @@ export async function selectCustomFieldsHostRows(
   return Array.isArray(rowsResult) ? rowsResult : [];
 }
 
-export async function stripSensitiveCustomFieldKeys(
-  db: DbRunner,
-  tableName: string,
-  userIdColumn: string,
-  sensitiveKeys: readonly string[],
-  userId: string,
-  tenantId: string,
-): Promise<void> {
-  const tbl = quoteTable(tableName);
-  const userCol = quoteColumn(userIdColumn);
-  await asRawClient(db).unsafe(
-    `UPDATE ${tbl} SET custom_fields = CASE
-       WHEN jsonb_typeof(custom_fields) = 'object' THEN custom_fields - $1::text[]
-       ELSE custom_fields
-     END
-     WHERE ${userCol} = $2 AND tenant_id = $3`,
-    [sensitiveKeys, userId, tenantId],
-  );
-}
-
 export async function selectFieldDefinitionsForEntity(
   db: DbRunner,
   entityName: string,

package/src/custom-fields/events.ts

@@ -11,16 +11,11 @@ import { z } from "zod";
 
 export const customFieldSetSchema = z.object({
   fieldKey: z.string().min(1).max(64),
-  // Optional: a `sensitive`-field set persists a VALUE-LESS event — the value is
-  // self-projected into the host row by the write handler and must never enter
-  // the immutable log. Non-sensitive sets always carry the value.
+  // Every set carries its value (custom fields hold no PII, #972) — replay
+  // reproduces the projection fully. Stays optional at the type layer only
+  // because z.unknown() is inherently optional; the apply side treats
+  // `value === undefined` as an anomaly and warns.
   value: z.unknown().optional(),
-  // Explicit protocol marker (527/1) — `value === undefined` alone is also a
-  // valid-looking "clear" shape; `_sensitive` names the reason so a future
-  // reader can't mistake one for the other. Optional so historical events
-  // (persisted before this field existed) still parse: apply-side readers
-  // keep `value === undefined` as their actual branch condition.
-  _sensitive: z.literal(true).optional(),
 });
 export type CustomFieldSetPayload = z.infer<typeof customFieldSetSchema>;
 

package/src/custom-fields/feature.ts

@@ -1,6 +1,14 @@
 // custom-fields — Tenant- + System-scoped Custom-Field-Definitions +
 // generische Custom-Field-VALUE write-handler (host-stream-events).
 //
+// **Scope: supplemental business data, NO PII (#972).** Custom fields sind
+// für tenant-spezifische Zusatzinfos (Referenznummern, Flags, Kategorien) —
+// nicht für personenbezogene Daten. Das frühere `sensitive`-Flag wurde
+// entfernt; das Schema rejected es und `parseSerializedField` wirft auf
+// Alt-Definitionen. Werte stehen vollständig im Event-Log (rebuild-safe).
+// PII gehört in Schema-Entity-Felder mit pii/userOwned/tenantOwned-
+// Annotation (Crypto-Shredding, Event-Ciphertext, Forget-Pipeline).
+//
 // **Was diese Feature liefert (B1 + B2, 2026-05-23):**
 //   1. r.entity("field-definition") — Definition-Storage (event-sourced).
 //   2. define-tenant-field / define-system-field — RBAC write-handlers für

package/src/custom-fields/handlers/set-custom-field.write.ts

@@ -1,9 +1,7 @@
-import { buildEntityTable, extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import type { WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
 import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
 import { DEFAULT_VALUE_WRITE_ROLES } from "../constants";
-import { setCustomFieldValue } from "../db/queries/projection";
 import { customFieldsFeature } from "../feature";
 import { fieldWriteAccessDeniedRoles, loadFieldDefinition } from "../lib/field-access";
 import { buildCustomFieldValueSchema } from "../lib/value-schema";
@@ -88,55 +86,16 @@ export const setCustomFieldHandler: WriteHandlerDef = {
       }
     }
 
-    // PII (`sensitive: true` definition): self-project the value here —
-    // synchronously, from the in-memory value — exactly like the entity executor
-    // does for sensitive entity fields. The persisted customField.set event then
-    // omits the value, so PII never enters the immutable event log; the existing
-    // user-data-rights strip of the projection erases it durably. Trade-off: a
-    // projection rebuild replays the value-less event and the MSP skips it (see
-    // wire-for-entity), so the value is gone — identical to a sensitive entity
-    // field. The host table isn't known to this generic handler, so resolve it
-    // per-stack via the registry (no module-global state).
-    const sensitive = loaded.field.sensitive === true;
-    if (sensitive) {
-      const entity = ctx.registry.getEntity(payload.entityName);
-      if (!entity) {
-        // Fail closed: without the host table we cannot self-project, and must
-        // NOT fall back to writing the value into the event log.
-        return failUnprocessable("custom_field_host_unresolved", {
-          entityName: payload.entityName,
-        });
-      }
-      // Resolves the same canonical table name the MSP/postQuery use (the table
-      // NAME, not the drizzle object). Holds unless a host entity is wired with
-      // a custom backing table whose name diverges from its definition — rare,
-      // and the MSP path makes the same assumption.
-      const tableName = extractTableName(
-        buildEntityTable(payload.entityName, entity),
-        "custom-fields/set-custom-field",
-      );
-      await setCustomFieldValue(
-        ctx.db.raw,
-        tableName,
-        payload.fieldKey,
-        payload.value,
-        payload.entityId,
-        event.user.tenantId,
-      );
-    }
-
     // Emit customField.set on host-aggregate stream. unsafeAppendEvent
     // (statt strict appendEvent) weil event-type-map keine cross-feature-
     // augmentation für diesen event-typ hat — wir nutzen den qualified
-    // string-namen direkt. Sensitive fields persist a value-less event (the
-    // value was self-projected above and must stay out of the log).
+    // string-namen direkt. Der Wert steht IMMER im Event (custom fields
+    // tragen keine PII, #972) — Replay reproduziert die Projection voll.
     await ctx.unsafeAppendEvent({
       aggregateId: payload.entityId,
       aggregateType: payload.entityName,
       type: customFieldsFeature.exports.setEvent.name,
-      payload: sensitive
-        ? { fieldKey: payload.fieldKey, _sensitive: true as const }
-        : { fieldKey: payload.fieldKey, value: payload.value },
+      payload: { fieldKey: payload.fieldKey, value: payload.value },
     });
 
     return {

package/src/custom-fields/handlers/update-tenant-field.write.ts

@@ -3,7 +3,6 @@ import { failNotFound, failUnprocessable } from "@cosmicdrift/kumiko-framework/e
 import { fieldDefinitionAggregateId } from "../aggregate-id";
 import { fieldDefinitionExecutor } from "../executor";
 import { buildFieldDefinitionColumns } from "../lib/field-definition-row";
-import { parseSerializedField } from "../lib/parse-serialized-field";
 import { type UpdateFieldPayload, updateFieldPayloadSchema } from "../schemas";
 
 // update-tenant-field — TenantAdmin ersetzt den Stand einer bestehenden
@@ -60,32 +59,6 @@ export const updateTenantFieldHandler: WriteHandlerDef = {
       });
     }
 
-    // `sensitive` is immutable. Flipping it on an existing field would leave a
-    // GDPR hole: a non-sensitive→sensitive switch can't retroactively erase the
-    // values already written to host rows by past sets (set-custom-field only
-    // routes the PII-safe path at write time). To change sensitivity, delete +
-    // re-define (the honest cut — same rationale as the type guard above).
-    //
-    // 527/2 — even that "honest cut" is incomplete: it clears the projection
-    // row, but kumiko_events is immutable, so historical customField.set
-    // events from the field's non-sensitive era keep their plaintext values
-    // in the log forever. There is no event-payload redaction mechanism for
-    // this today (EventStoreExecutor.forget() hard-deletes a projection row
-    // and is rebuild-safe, but doesn't touch or redact past event payloads).
-    // A tenant that genuinely needs those values erased needs an operator-run
-    // data-retention pass over the raw event log — not something this
-    // handler, or delete-and-redefine, can give them.
-    const currentSensitive = parseSerializedField(existing["serializedField"])?.sensitive === true;
-    const requestedSensitive = payload.serializedField.sensitive === true;
-    if (currentSensitive !== requestedSensitive) {
-      return failUnprocessable("field_sensitive_immutable", {
-        entityName: payload.entityName,
-        fieldKey: payload.fieldKey,
-        currentSensitive,
-        requestedSensitive,
-      });
-    }
-
     // entityName/fieldKey sind die Identität — nicht Teil der changes.
     const {
       entityName: _entityName,

package/src/custom-fields/lib/parse-serialized-field.ts

@@ -8,8 +8,8 @@
 // across the bundle.
 //
 // All structured `serializedField`-keys recognised today (`fieldAccess`,
-// `sensitive`, `retention`) live on this shape. New keys go here so the
-// other call-sites can read them via the typed result instead of re-parsing.
+// `retention`) live on this shape. New keys go here so the other call-sites
+// can read them via the typed result instead of re-parsing.
 
 import { parseJsonSafe } from "@cosmicdrift/kumiko-framework/utils";
 
@@ -19,7 +19,6 @@ export interface SerializedFieldShape {
     readonly read?: ReadonlyArray<string>;
     readonly write?: ReadonlyArray<string>;
   };
-  readonly sensitive?: boolean;
   readonly retention?: {
     readonly keepFor: string;
     readonly strategy: "delete" | "anonymize";
@@ -41,7 +40,16 @@ function isShape(v: unknown): v is SerializedFieldShape {
  */
 export function parseSerializedField(raw: unknown): SerializedFieldShape | null {
   const parsed = typeof raw === "string" ? parseJsonSafe<unknown>(raw, null) : raw;
-  return isShape(parsed) ? parsed : null;
+  if (!isShape(parsed)) return null;
+  // Fail loud instead of silently dropping the key: a stored definition with
+  // `sensitive` predates #972 and its PII expectations (event-log exclusion,
+  // forget-strip) no longer hold — the field must be recreated.
+  if ("sensitive" in parsed) {
+    throw new Error(
+      "custom-field definition contains the removed `sensitive` key (#972) — custom fields don't support PII. Recreate the field without it; model personal data as a schema entity field with a pii annotation.",
+    );
+  }
+  return parsed;
 }
 
 export interface FieldDefinitionRow {

package/src/custom-fields/lib/value-schema.ts

@@ -86,6 +86,6 @@ export function buildCustomFieldValueSchema(parsedField: unknown): z.ZodTypeAny
 
   // @cast-boundary serialized-field is the dehydrated r.field.X() output =
   // a FieldDefinition; fieldToZod reads only its type-specific keys (the
-  // extra fieldAccess/sensitive/retention/label keys are ignored).
+  // extra fieldAccess/retention/label keys are ignored).
   return fieldToZod(fieldDef as unknown as FieldDefinition, currencies);
 }

package/src/custom-fields/schemas.ts

@@ -33,18 +33,14 @@ export type CustomFieldAccess = z.infer<typeof customFieldAccessSchema>;
 //   money:    { type: "money", required: false, currency: "EUR" }
 //   embedded: { type: "embedded", required: false, schema: { ... } }
 //
-// `fieldAccess` (T1.5b) and `sensitive` (T1.5c) are the structured keys
-// recognised by the handlers / user-data-rights wiring. Everything else
-// stays loose pending B2's per-type discriminated-union.
+// `fieldAccess` (T1.5b) is the structured key recognised by the handlers.
+// Everything else stays loose pending B2's per-type discriminated-union —
+// EXCEPT `sensitive`, which is explicitly rejected below: custom fields
+// carry supplemental business data only, PII support was removed (#972).
 const serializedFieldSchema = z
   .looseObject({
     type: fieldTypeSchema,
     fieldAccess: customFieldAccessSchema,
-    // `sensitive: true` marks the field as PII — the user-data-rights
-    // wiring (wireCustomFieldsUserDataRightsFor) removes its value from
-    // the host row's customFields jsonb on user-forget when the strategy
-    // is "anonymize". Non-sensitive fields are untouched.
-    sensitive: z.boolean().optional(),
     // `retention` (T1.5d): per-field expiry. The retention-cron strips
     // values whose host-row `modified_at` is older than `keepFor`. Strategy
     // `delete` removes the key from the customFields jsonb; `anonymize`
@@ -59,7 +55,11 @@ const serializedFieldSchema = z
       })
       .optional(),
   })
-  .refine((v) => typeof v["type"] === "string", "serializedField must have a string `type`");
+  .refine((v) => typeof v["type"] === "string", "serializedField must have a string `type`")
+  .refine(
+    (v) => !("sensitive" in v),
+    "custom fields don't support PII — `sensitive` was removed (#972). Model personal data as a schema entity field with a pii/userOwned/tenantOwned annotation instead.",
+  );
 
 // i18n-labels — `{ de: "...", en: "...", ... }`. Mindestens ein Eintrag.
 const labelSchema = z.record(z.string().min(2).max(8), z.string().min(1));

package/src/custom-fields/wire-for-entity.ts

@@ -105,22 +105,15 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
     if (event.aggregateType !== entityName) return;
     const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
 
-    // skip: sensitive fields self-project in the write handler (see
-    // set-custom-field) and persist a value-less event so PII never enters
-    // the log. Skipping is correct both live (the handler already wrote the
-    // row) and on replay (the value is intentionally gone, the accepted
-    // rebuild-loss). `value === undefined` stays the actual branch condition
-    // (historical events predate `_sensitive`) — the warning below is a
-    // canary (527/1): a NEW event missing both means something emitted a
-    // value-less customField.set outside the sensitive-field path.
+    // skip: a value-less customField.set is an anomaly since #972 (every set
+    // carries its value; the sensitive self-projection path was removed) —
+    // warn and leave the row untouched instead of binding undefined.
     if (payload.value === undefined) {
-      if (payload._sensitive !== true) {
-        // biome-ignore lint/suspicious/noConsole: boot-adjacent correctness canary, no logger available in an apply function
-        console.warn(
-          `[custom-fields] customField.set for "${payload.fieldKey}" on ${event.aggregateType}/${event.aggregateId} has no value and no _sensitive marker — skipping, but this event didn't come from the known sensitive-field path.`,
-        );
-      }
-      // skip: value-less set, handled above (warned if unexpectedly so)
+      // biome-ignore lint/suspicious/noConsole: boot-adjacent correctness canary, no logger available in an apply function
+      console.warn(
+        `[custom-fields] customField.set for "${payload.fieldKey}" on ${event.aggregateType}/${event.aggregateId} has no value — skipping (value-less sets should not exist since #972).`,
+      );
+      // skip: warned above — leave the row untouched instead of binding undefined
       return;
     }