@cosmicdrift/kumiko-bundled-features 0.208.3 → 0.209.1

package/src/delivery/handlers/log.query.ts

@@ -1,14 +1,77 @@
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { access, defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
+import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
+import { decodeCursor, encodeCursor } from "@cosmicdrift/kumiko-framework/db";
+import {
+  access,
+  definePagedQueryHandler,
+  MAX_LIST_LIMIT,
+  type NotifyPriority,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { Temporal } from "temporal-polyfill";
 import { z } from "zod";
 import { decryptStoredPii } from "../../shared";
+import type { DeliveryStatusValue } from "../constants";
 import { deliveryAttemptsTable } from "../tables";
 
-export const logQuery = defineQueryHandler({
+type DeliveryLogRow = {
+  id: string;
+  tenantId: string;
+  notificationType: string;
+  channel: string;
+  recipientId: string | null;
+  recipientAddress: string | null;
+  status: DeliveryStatusValue;
+  error: string | null;
+  priority: NotifyPriority;
+  createdAt: Temporal.Instant;
+};
+
+// Sort whitelist keyed by the DISPLAY field the client actually sends: the
+// declarative projectionList renderer marks every listed column uniformly
+// sortable and a header click sends `sort=<screen.columns[].field>`, not the
+// DB column name (see projection-list-shim.ts synthesizeProjectionEntity).
+// "recipient" is deliberately absent — it's PII decrypted per-row in
+// application code, so there is no column to ORDER BY in SQL for it.
+const DELIVERY_LOG_SORT_COLUMNS = {
+  createdAt: "createdAt",
+  type: "notificationType",
+  channel: "channel",
+  status: "status",
+} as const;
+type DeliveryLogSortField = keyof typeof DELIVERY_LOG_SORT_COLUMNS;
+
+function isDeliveryLogSortField(value: string): value is DeliveryLogSortField {
+  return value in DELIVERY_LOG_SORT_COLUMNS;
+}
+
+type DeliveryLogSortColumn = (typeof DELIVERY_LOG_SORT_COLUMNS)[DeliveryLogSortField];
+
+// createdAt round-trips through Temporal.Instant (matches how the WHERE
+// builder coerces timestamptz values — see bun-db/query.ts prepareValue);
+// every other whitelisted column is a plain text column. Keyed by the
+// PHYSICAL column, not the display alias — row only has the DB field names
+// (e.g. notificationType), never the alias (e.g. "type").
+function encodeSortCursor(column: DeliveryLogSortColumn, row: DeliveryLogRow): string {
+  if (column === "createdAt") return encodeCursor(row.createdAt.toString());
+  return encodeCursor(String(row[column]));
+}
+
+function decodeSortCursor(
+  column: DeliveryLogSortColumn,
+  cursor: string,
+): Temporal.Instant | string {
+  const decoded = decodeCursor(cursor);
+  if (column === "createdAt") return Temporal.Instant.from(decoded);
+  return decoded;
+}
+
+export const logQuery = definePagedQueryHandler({
   name: "log",
   schema: z.object({
-    limit: z.number().min(1).max(100).default(50),
+    cursor: z.string().optional(),
+    limit: z.number().int().min(1).max(MAX_LIST_LIMIT).default(50),
+    sort: z.string().optional(),
+    sortDirection: z.enum(["asc", "desc"]).optional(),
   }),
   access: { roles: access.admin },
   handler: async (query, ctx) => {
@@ -20,27 +83,61 @@ export const logQuery = defineQueryHandler({
     // tenantId, not a query filter — it returns that same unfiltered db, so
     // the explicit `where` below still does the actual tenant scoping.
     const db = ctx.systemDb.assertTenantMatch(query.user.tenantId);
-    const rows = await selectMany(
-      db,
-      deliveryAttemptsTable,
-      { tenantId: query.user.tenantId },
-      {
-        orderBy: { col: "createdAt", direction: "desc" },
-        limit: query.payload.limit,
-      },
-    );
+
+    const requestedSort = query.payload.sort;
+    const sortField: DeliveryLogSortField =
+      requestedSort !== undefined && isDeliveryLogSortField(requestedSort)
+        ? requestedSort
+        : "createdAt";
+    const sortDirection = query.payload.sortDirection ?? "desc";
+    const sortColumn = DELIVERY_LOG_SORT_COLUMNS[sortField];
+
+    const where: WhereObject = { tenantId: query.user.tenantId };
+    if (query.payload.cursor) {
+      where[sortColumn] = {
+        [sortDirection === "asc" ? "gt" : "lt"]: decodeSortCursor(sortColumn, query.payload.cursor),
+      };
+    }
+
+    const rows = await selectMany<DeliveryLogRow>(db, deliveryAttemptsTable, where, {
+      // Tie-breaker on id keeps ordering stable across pages when the sort
+      // column has duplicate values (e.g. many rows with the same status).
+      orderBy: [
+        { col: sortColumn, direction: sortDirection },
+        { col: "id", direction: "asc" },
+      ],
+      limit: query.payload.limit,
+    });
+
+    const lastRow = rows[rows.length - 1];
+    const nextCursor =
+      rows.length === query.payload.limit && lastRow ? encodeSortCursor(sortColumn, lastRow) : null;
+
     // recipientAddress is stored encrypted under the recipient's DEK (#799)
     // — decrypt for the admin log view; forgotten subjects show [[erased]].
+    // The notificationType/recipientAddress → type/recipient rename happens
+    // here, not in the client: a projectionList screen has no entity to
+    // derive a field-mapping from, so the row shape the query returns is the
+    // shape the declarative columns read directly.
     return {
       rows: await Promise.all(
         rows.map(async (row) => ({
-          ...row,
-          recipientAddress:
-            typeof row["recipientAddress"] === "string"
-              ? await decryptStoredPii(row["recipientAddress"], "recipientAddress", "delivery-log")
-              : row["recipientAddress"],
+          id: row.id,
+          tenantId: row.tenantId,
+          recipientId: row.recipientId,
+          type: row.notificationType,
+          channel: row.channel,
+          recipient:
+            row.recipientAddress !== null
+              ? await decryptStoredPii(row.recipientAddress, "recipientAddress", "delivery-log")
+              : row.recipientAddress,
+          status: row.status,
+          error: row.error,
+          priority: row.priority,
+          createdAt: row.createdAt,
         })),
       ),
+      nextCursor,
     };
   },
 });

package/src/delivery/i18n.ts

@@ -3,4 +3,8 @@ type LocalizedString = { readonly en: string };
 export const DELIVERY_I18N: Readonly<Record<string, LocalizedString>> = {
   "screen:delivery-log.title": { en: "Delivery log" },
   "delivery:nav.deliveryLog": { en: "Delivery" },
+  "delivery.log.col.type": { en: "Type" },
+  "delivery.log.col.channel": { en: "Channel" },
+  "delivery.log.col.recipient": { en: "Recipient" },
+  "delivery.log.col.status": { en: "Status" },
 };

package/src/delivery/public-names.ts

@@ -14,6 +14,11 @@ export const DeliveryQueries = {
 
 export const DELIVERY_LOG_SCREEN_ID = "delivery-log" as const;
 
+// Client column-renderer registered for the delivery-log screen's status
+// column — see `screen.columns[].renderer.react.__component` in feature.ts
+// and `deliveryClient()`'s `columnRenderers` map.
+export const DELIVERY_STATUS_CELL_COMPONENT = "DeliveryStatusCell" as const;
+
 export const DeliveryErrors = {
   noRecipient: "delivery_no_recipient",
   channelFailed: "delivery_channel_failed",

package/src/delivery/web/client-plugin.tsx

@@ -1,9 +1,8 @@
 // @runtime client
-import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
 import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
-import { DELIVERY_FEATURE, DELIVERY_LOG_SCREEN_ID } from "../public-names";
-import { DeliveryLogScreen } from "./delivery-log-screen";
-import { defaultTranslations } from "./i18n";
+import { DELIVERY_FEATURE, DELIVERY_STATUS_CELL_COMPONENT } from "../public-names";
+import { DeliveryStatusCell } from "./delivery-status-cell";
 
 export type DeliveryClientOptions = {
   readonly translations?: TranslationsByLocale;
@@ -12,9 +11,9 @@ export type DeliveryClientOptions = {
 export function deliveryClient(options?: DeliveryClientOptions): ClientFeatureDefinition {
   return {
     name: DELIVERY_FEATURE,
-    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
-    components: {
-      [DELIVERY_LOG_SCREEN_ID]: DeliveryLogScreen,
+    columnRenderers: {
+      [DELIVERY_STATUS_CELL_COMPONENT]: DeliveryStatusCell,
     },
+    ...(options?.translations !== undefined && { translations: options.translations }),
   };
 }

package/src/delivery/web/delivery-status-cell.tsx

@@ -0,0 +1,26 @@
+// @runtime client
+// Column-renderer for the delivery-log screen's status column, registered
+// via `deliveryClient()`'s `columnRenderers` map (screen.columns[].renderer
+// in feature.ts). The list frame itself is the generic declarative
+// projectionList renderer — only this one cell stays TSX.
+
+import type { ColumnRendererProps } from "@cosmicdrift/kumiko-renderer";
+import { StatusBadge, type StatusTone } from "@cosmicdrift/kumiko-renderer-web";
+import type { ReactNode } from "react";
+import { DeliveryStatus } from "../public-names";
+
+const STATUS_TONE: Readonly<Record<string, StatusTone>> = {
+  [DeliveryStatus.sent]: "ok",
+  [DeliveryStatus.failed]: "bad",
+  [DeliveryStatus.queued]: "muted",
+  [DeliveryStatus.skipped]: "muted",
+};
+
+export function DeliveryStatusCell({ row }: ColumnRendererProps): ReactNode {
+  const status = typeof row["status"] === "string" ? row["status"] : "";
+  return (
+    <StatusBadge tone={STATUS_TONE[status] ?? "muted"} testId="delivery-status-cell">
+      {status}
+    </StatusBadge>
+  );
+}

package/src/delivery/web/index.ts

@@ -1,3 +1,3 @@
 // @runtime client
 export { type DeliveryClientOptions, deliveryClient } from "./client-plugin";
-export { DeliveryLogScreen } from "./delivery-log-screen";
+export { DeliveryStatusCell } from "./delivery-status-cell";

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -1,16 +1,16 @@
-// Event-shape contract for jobRun aggregate. Pins the three domain
-// events (run-started / run-completed / run-failed) against their
-// registered schemas + the stable type-name constants. A silent rename
-// (event-type-string, aggregateType, or payload-shape) fails here
-// instead of breaking MSP consumers and audit exports.
+// Direct-write shape contract for job runs (#2243). Pins onJobStart/
+// -Complete/-Failed against the tables they write — jobRunsTable status
+// transitions and jobRunLogsTable batched log rows. A silent shape drift
+// (missing field, wrong status string) fails here instead of breaking the
+// operator UI silently.
 //
 // The jobs integration test (jobs-feature.integration.ts) covers the
-// projection side (list + detail queries). This file covers the event
-// side — complementary coverage, minimal overlap.
+// projection side (list + detail queries). This file covers the
+// write side — complementary coverage, minimal overlap.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestDb,
@@ -20,14 +20,8 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "../events";
 import { createJobsFeature } from "../feature";
-import {
-  createJobRunLogger,
-  JOB_RUN_COMPLETED_EVENT,
-  JOB_RUN_FAILED_EVENT,
-  JOB_RUN_STARTED_EVENT,
-} from "../job-run-logger";
+import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
@@ -40,6 +34,8 @@ beforeAll(async () => {
   testRedis = await createTestRedis();
   registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  // Kept only for the negative assertion below (no jobs:event:run-* rows) —
+  // the write path itself no longer touches the event store.
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
 });
@@ -53,114 +49,102 @@ beforeEach(async () => {
   await resetTestTables(testDb.db, [eventsTable, jobRunsTable, jobRunLogsTable]);
 });
 
-describe("jobRun event shapes", () => {
-  test("event-type constants are stable strings", () => {
-    // Guard against silent rename. Tests that subscribe via string-match
-    // (MSPs written in userland, audit export tools) break without this.
-    expect(JOB_RUN_STARTED_EVENT).toBe("jobs:event:run-started");
-    expect(JOB_RUN_COMPLETED_EVENT).toBe("jobs:event:run-completed");
-    expect(JOB_RUN_FAILED_EVENT).toBe("jobs:event:run-failed");
-  });
-
-  test("onJobStart writes a run-started event on the jobRun aggregate", async () => {
+describe("jobRun direct writes", () => {
+  test("onJobStart inserts a row into jobRunsTable", async () => {
     await logger.onJobStart?.("example:job:import", "bull-42", {
       triggeredById: "u-99",
       payload: JSON.stringify({ foo: 1 }),
       attempt: 1,
     });
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
-
-    expect(events.length).toBe(1);
-    const e = events[0];
-    expect(e?.aggregateType).toBe("jobRun");
-    expect(e?.tenantId).toBe(SYSTEM_TENANT_ID);
-    // Payload round-trips through the registered schema — drift would
-    // fail parse here, not silently land on the stream.
-    expect(() => runStartedSchema.parse(e?.payload)).not.toThrow();
-    const p = runStartedSchema.parse(e?.payload);
-    expect(p.jobName).toBe("example:job:import");
-    expect(p.bullJobId).toBe("bull-42");
-    expect(p.triggeredById).toBe("u-99");
-    expect(p.attempt).toBe(1);
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-42" });
+
+    expect(runs.length).toBe(1);
+    const run = runs[0];
+    expect(run?.jobName).toBe("example:job:import");
+    expect(run?.status).toBe("running");
+    expect(run?.triggeredById).toBe("u-99");
+    expect(run?.attempt).toBe(1);
   });
 
-  test("onJobComplete writes a run-completed event with batched logs", async () => {
+  test("onJobComplete updates the row to completed with batched logs", async () => {
     await logger.onJobStart?.("example:job:export", "bull-1", {});
     await logger.onJobComplete?.("example:job:export", "bull-1", 123, [
       { level: "info", message: "started", timestamp: Temporal.Now.instant() },
       { level: "info", message: "done", timestamp: Temporal.Now.instant() },
     ]);
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-1" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("completed");
+    expect(runs[0]?.duration).toBe(123);
 
-    expect(events.length).toBe(1);
-    const p = runCompletedSchema.parse(events[0]?.payload);
-    expect(p.duration).toBe(123);
-    expect(p.logs).toHaveLength(2);
-    expect(p.logs[0]?.level).toBe("info");
+    const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: runs[0]?.id as string });
+    expect(logs).toHaveLength(2);
+    expect(logs[0]?.level).toBe("info");
   });
 
-  test("onJobFailed writes a run-failed event with error + logs", async () => {
+  test("onJobFailed updates the row to failed with error + logs", async () => {
     await logger.onJobStart?.("example:job:fragile", "bull-9", {});
     await logger.onJobFailed?.("example:job:fragile", "bull-9", "boom", [
       { level: "error", message: "kaboom", timestamp: Temporal.Now.instant() },
     ]);
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-9" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("failed");
+    expect(runs[0]?.error).toBe("boom");
 
-    expect(events.length).toBe(1);
-    const p = runFailedSchema.parse(events[0]?.payload);
-    expect(p.error).toBe("boom");
-    expect(p.logs).toHaveLength(1);
+    const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: runs[0]?.id as string });
+    expect(logs).toHaveLength(1);
   });
 
-  test("start + complete both land on the SAME aggregate stream", async () => {
+  test("start + complete both act on the SAME row", async () => {
     await logger.onJobStart?.("example:job:stream", "bull-99", {});
     await logger.onJobComplete?.("example:job:stream", "bull-99", 10, []);
 
-    // Both events should share the same aggregateId — that's what makes
-    // the jobRun a single stream and lets ctx.loadAggregate() reduce
-    // them into a coherent state.
-    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
-
-    expect(events.length).toBe(2);
-    const ids = new Set(events.map((e) => e.aggregateId));
-    expect(ids.size).toBe(1);
+    // Exactly one row for this bullJobId — the complete-callback updated
+    // the row onJobStart created, it did not insert a second one.
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-99" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("completed");
   });
 
-  test("complete/fail without a prior start skips — does not forge a jobRun stream", async () => {
-    // State-loss path: worker restart with empty cache AND no projection row for
-    // this bullJobId. Dropping the terminal event is intentional — forging an
-    // aggregate from scratch would invent a run that never started.
+  test("complete/fail without a prior start skips — does not forge a run row", async () => {
+    // State-loss path: worker restart with empty cache AND no row for this
+    // bullJobId. Dropping the terminal write is intentional — forging a
+    // row from scratch would invent a run that never started.
     await logger.onJobComplete?.("example:job:orphan", "bull-orphan-complete", 50, []);
     await logger.onJobFailed?.("example:job:orphan", "bull-orphan-failed", "boom", []);
 
-    const completed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
-    const failed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
     const runs = await selectMany(testDb.db, jobRunsTable);
-
-    expect(completed).toHaveLength(0);
-    expect(failed).toHaveLength(0);
     expect(runs).toHaveLength(0);
   });
 
-  test("complete after cache loss recovers runId from the projection (same stream)", async () => {
-    // Simulates worker process restart: in-memory bullJobId→runId cache is gone,
-    // but the run-started projection row still has bull_job_id. A fresh logger
-    // must DB-lookup and append onto the original aggregate — not mint a second.
+  test("complete after cache loss recovers runId from jobRunsTable (same row)", async () => {
+    // Simulates worker process restart: in-memory bullJobId→runId cache is
+    // gone, but the run-started row still has bull_job_id. A fresh logger
+    // must DB-lookup and update the original row — not insert a second one.
     await logger.onJobStart?.("example:job:restart", "bull-restart-1", {});
-    const started = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    const started = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-restart-1" });
     expect(started).toHaveLength(1);
-    const originalAggregateId = started[0]?.aggregateId;
-    expect(originalAggregateId).toBeTruthy();
+    const originalId = started[0]?.id;
+    expect(originalId).toBeTruthy();
 
     const coldLogger = createJobRunLogger({ db: testDb.db, registry });
     await coldLogger.onJobComplete?.("example:job:restart", "bull-restart-1", 42, []);
 
-    const all = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
-    expect(all).toHaveLength(2);
-    expect(new Set(all.map((e) => e.aggregateId))).toEqual(new Set([originalAggregateId]));
-    expect(all.some((e) => e.type === JOB_RUN_COMPLETED_EVENT)).toBe(true);
+    const all = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-restart-1" });
+    expect(all).toHaveLength(1);
+    expect(all[0]?.id).toBe(originalId);
+    expect(all[0]?.status).toBe("completed");
+  });
+
+  test("no jobs:event:run-* rows ever land in the event store", async () => {
+    await logger.onJobStart?.("example:job:no-events", "bull-no-events", {});
+    await logger.onJobComplete?.("example:job:no-events", "bull-no-events", 5, []);
+
+    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(events).toHaveLength(0);
   });
 });

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -1,9 +1,9 @@
-// Event-PII on the jobs run-logger (#799): runStarted.payload can carry
-// arbitrary user data and is written via LOW-LEVEL append() (not
-// ctx.appendEvent) — exactly the path the event-PII catalog must cover.
-// With a KMS active the stored event AND the projected read-row carry
-// ciphertext under the triggering user's DEK; erasing that key makes the
-// payload unreadable ([[erased]]) without touching the append-only stream.
+// PII on the jobs run-logger, direct-write path (#2243, formerly #799):
+// run-started payload can carry arbitrary user data and is written straight
+// into jobRunsTable (no event store, no event-PII catalog — #2243 removed
+// the jobRun r.defineEvent registrations). With a KMS active the stored row
+// carries ciphertext under the triggering user's DEK; erasing that key
+// makes the payload unreadable ([[erased]]) without touching the row.
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -25,7 +25,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createJobsFeature } from "../feature";
-import { createJobRunLogger, JOB_RUN_STARTED_EVENT } from "../job-run-logger";
+import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
@@ -39,10 +39,10 @@ const SECRET_PAYLOAD = JSON.stringify({ iban: "DE89370400440532013000" });
 beforeAll(async () => {
   testDb = await createTestDb();
   testRedis = await createTestRedis();
-  // createRegistry publishes the event-PII catalog as a module singleton —
-  // the logger's low-level append() picks it up without further wiring.
   const registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  // Kept only so the "no event store involved" assertion below has a table
+  // to assert against — the write path itself never touches it.
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
 });
@@ -63,25 +63,28 @@ afterEach(() => {
 });
 
 describe("jobs run-started payload under KMS", () => {
-  test("stored event carries ciphertext payload, plaintext triggeredById", async () => {
+  test("stored row carries ciphertext payload, plaintext triggeredById — no event-store write", async () => {
     await logger.onJobStart?.("app:job:export", "bull-1", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,
       attempt: 1,
     });
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
-    expect(events.length).toBe(1);
-    const payload = events[0]?.payload as Record<string, unknown>;
-    expect(isPiiCiphertext(payload["payload"])).toBe(true);
-    expect(String(payload["payload"])).toContain(`user:${USER_ID}`);
-    expect(payload["triggeredById"]).toBe(USER_ID);
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-1" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+    expect(String(row?.["payload"])).toContain(`user:${USER_ID}`);
+    expect(row?.["triggeredById"]).toBe(USER_ID);
 
-    const back = await decryptPiiFieldValues(payload, ["payload"], kms, { requestId: "t" });
+    const back = await decryptPiiFieldValues({ payload: row?.["payload"] }, ["payload"], kms, {
+      requestId: "t",
+    });
     expect(back["payload"]).toBe(SECRET_PAYLOAD);
+
+    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(events).toHaveLength(0);
   });
 
-  test("projected read-row carries the same ciphertext; erase → [[erased]]", async () => {
+  test("erase subject key → row payload decrypts to [[erased]]", async () => {
     await logger.onJobStart?.("app:job:export", "bull-2", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,