@cosmicdrift/kumiko-bundled-features 0.208.3 → 0.209.1

package/src/jobs/__tests__/jobs-retention.integration.test.ts

@@ -0,0 +1,124 @@
+// Integration test for the job-run retention-cleanup job (#2243). Dispatches
+// jobs:job:retention-cleanup through the real jobRunner (setupTestStack +
+// BullMQ worker) — the same enqueue path production's cron trigger uses —
+// instead of hand-building a JobContext and casting into the handler. Each
+// test seeds a row past the active cutoff alongside one that must survive,
+// so waitFor's completion signal (the stale row's count dropping) is only
+// reached once the real dispatch has actually run; the survivor's fate is
+// decided by that same DELETE and can be asserted right after.
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, waitFor } from "@cosmicdrift/kumiko-framework/testing";
+import { createJobsFeature } from "../feature";
+import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../handlers/retention-cleanup.job";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+const RETENTION_JOB = "jobs:job:retention-cleanup";
+
+let stack: TestStack | undefined;
+
+async function bootStack(retentionDays?: number): Promise<TestStack> {
+  const s = await setupTestStack({
+    features: [createJobsFeature(retentionDays !== undefined ? { retentionDays } : {})],
+    jobs: { consumerLane: "worker" },
+  });
+  await unsafePushTables(s.db, { jobRunsTable, jobRunLogsTable });
+  return s;
+}
+
+afterEach(async () => {
+  if (stack) await stack.cleanup();
+  stack = undefined;
+});
+
+function currentStack(): TestStack {
+  if (!stack) throw new Error("stack not booted");
+  return stack;
+}
+
+async function seedRun(opts: { id: string; ageDays: number }): Promise<void> {
+  const insertedAt = sql`now() - ${sql.raw(`interval '${opts.ageDays} days'`)}`;
+  await seedRow(currentStack().db, jobRunsTable, {
+    id: opts.id,
+    tenantId: SYSTEM_TENANT_ID,
+    insertedAt,
+    jobName: "example:job:retention-probe",
+    bullJobId: `bull-${opts.id}`,
+    status: "completed",
+    attempt: 1,
+    startedAt: insertedAt,
+  });
+}
+
+async function countRuns(): Promise<number> {
+  return (await selectMany(currentStack().db, jobRunsTable)).length;
+}
+
+async function countLogs(): Promise<number> {
+  return (await selectMany(currentStack().db, jobRunLogsTable)).length;
+}
+
+// Dispatches the real job through jobRunner and blocks until the queued
+// worker has actually applied it, proven by the run count reaching
+// `expectedRuns` (not merely "some time has passed").
+async function dispatchAndWaitForRunCount(expectedRuns: number): Promise<void> {
+  await currentStack().jobRunner?.dispatch(RETENTION_JOB);
+  await waitFor(async () => {
+    expect(await countRuns()).toBe(expectedRuns);
+  });
+}
+
+describe("jobs:job:retention-cleanup", () => {
+  test("default window (30d): older-than-cutoff runs go, recent ones stay", async () => {
+    stack = await bootStack();
+    await seedRun({
+      id: "11111111-1111-4111-8111-111111111111",
+      ageDays: DEFAULT_JOB_RUN_RETENTION_DAYS + 1,
+    });
+    await seedRun({ id: "22222222-2222-4222-8222-222222222222", ageDays: 1 });
+    expect(await countRuns()).toBe(2);
+
+    await dispatchAndWaitForRunCount(1);
+
+    const remaining = await selectMany(currentStack().db, jobRunsTable);
+    expect(remaining[0]?.id).toBe("22222222-2222-4222-8222-222222222222");
+  });
+
+  test("associated log rows are deleted along with their run", async () => {
+    stack = await bootStack();
+    const runId = "33333333-3333-4333-8333-333333333333";
+    const ageDays = DEFAULT_JOB_RUN_RETENTION_DAYS + 5;
+    await seedRun({ id: runId, ageDays });
+    await seedRow(currentStack().db, jobRunLogsTable, {
+      runId,
+      level: "info",
+      message: "old log line",
+      timestamp: sql`now() - ${sql.raw(`interval '${ageDays} days'`)}`,
+    });
+    expect(await countLogs()).toBe(1);
+
+    await dispatchAndWaitForRunCount(0);
+
+    expect(await countLogs()).toBe(0);
+  });
+
+  test("a custom retentionDays option is honored: past-cutoff runs go, in-window runs stay", async () => {
+    stack = await bootStack(3);
+    await seedRun({ id: "44444444-4444-4444-8444-444444444444", ageDays: 5 });
+    await seedRun({ id: "55555555-5555-4555-8555-555555555555", ageDays: 1 });
+    expect(await countRuns()).toBe(2);
+
+    await dispatchAndWaitForRunCount(1);
+
+    const remaining = await selectMany(currentStack().db, jobRunsTable);
+    expect(remaining[0]?.id).toBe("55555555-5555-4555-8555-555555555555");
+  });
+});

package/src/jobs/db/queries/retention.ts

@@ -0,0 +1,44 @@
+// Job-run retention (#2243): store_job_runs/store_job_run_logs are
+// direct-write stores now, not event-sourced projections — nothing else
+// purges them, so without this query they grow forever with the run count
+// instead of the runtime. Not the retention-cleanup executor: that executor
+// is entity/tenant-scoped and jobRun has neither (system-scoped direct-write
+// store). Each table is purged by its own timestamp column independently —
+// run_id isn't a real FK constraint (see job-run-table.ts), so there is no
+// ordering requirement between the two deletes.
+//
+// deleteManyBatched (typed query API, no raw SQL in this file) chunks each
+// delete so a large backlog doesn't hold one lock for the whole sweep.
+
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { jobRunLogsTable, jobRunsTable } from "../../job-run-table";
+
+const RETENTION_DELETE_BATCH_SIZE = 500;
+
+export type JobRunRetentionResult = {
+  readonly runsDeleted: number;
+  readonly logsDeleted: number;
+};
+
+export async function deleteStaleJobRuns(
+  db: DbConnection,
+  retentionDays: number,
+): Promise<JobRunRetentionResult> {
+  const cutoff = Temporal.Now.instant().subtract({ hours: retentionDays * 24 });
+
+  const logsResult = await deleteManyBatched(
+    db,
+    jobRunLogsTable,
+    { timestamp: { lt: cutoff } },
+    { limit: RETENTION_DELETE_BATCH_SIZE },
+  );
+  const runsResult = await deleteManyBatched(
+    db,
+    jobRunsTable,
+    { insertedAt: { lt: cutoff } },
+    { limit: RETENTION_DELETE_BATCH_SIZE },
+  );
+
+  return { runsDeleted: runsResult.deleted, logsDeleted: logsResult.deleted };
+}

package/src/jobs/events.ts

@@ -1,11 +1,8 @@
-// Event-payload schemas for the jobRun aggregate. Shared between
-// jobs-feature.ts (registers them via r.defineEvent and consumes them
-// in the inline-projections) and job-run-logger.ts (parses payloads
-// before low-level append() so out-of-dispatcher writes stay as
-// type-safe as ctx.appendEvent writes).
-//
-// Keeping them in a separate module avoids the circular import between
-// jobs-feature.ts (imports the logger) and job-run-logger.ts.
+// Payload schemas for the jobRun direct-write path (#2243). Pre-#2243 these
+// backed jobRun's event-store payloads (r.defineEvent + inline projections);
+// now job-run-logger.ts parses against them before writing straight into
+// jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the
+// same validation guarantee ctx.appendEvent used to give it.
 
 import { z } from "zod";
 

package/src/jobs/feature.ts

@@ -1,16 +1,5 @@
-import { insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  defineApply,
-  defineFeature,
-  type FeatureDefinition,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type { z } from "zod";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID } from "./constants";
-// Event-payload schemas live in a sibling module so the logger can import
-// them without the cycle jobs-feature ↔ job-run-logger. The logger parses
-// payloads against these schemas before low-level append() — that's what
-// keeps out-of-dispatcher writes as type-safe as ctx.appendEvent.
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
 import { catalogQuery } from "./handlers/catalog.query";
 import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
@@ -19,21 +8,26 @@ import {
   projectionRebuildPayloadSchema,
 } from "./handlers/projection-rebuild.job";
 import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex-entity.job";
+import {
+  createRetentionCleanupJob,
+  DEFAULT_JOB_RUN_RETENTION_DAYS,
+} from "./handlers/retention-cleanup.job";
 import { retryWrite } from "./handlers/retry.write";
 import { triggerWrite } from "./handlers/trigger.write";
 import { JOBS_I18N } from "./i18n";
-import { parseJobInstant } from "./job-instant";
-import {
-  JOB_RUN_COMPLETED_EVENT,
-  JOB_RUN_FAILED_EVENT,
-  JOB_RUN_STARTED_EVENT,
-} from "./job-run-logger";
-import { jobRunLogsTable, jobRunLogsTableMeta, jobRunsTable } from "./job-run-table";
+import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table";
+
+export type JobsFeatureOptions = {
+  // How long a job run (and its logs) stays in store_job_runs/
+  // store_job_run_logs before the daily retention-cleanup job deletes it.
+  readonly retentionDays?: number;
+};
 
-export function createJobsFeature(): FeatureDefinition {
+export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefinition {
+  const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`. Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -41,134 +35,12 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
+    r.storeTable(jobRunsTableMeta, {
+      reason: "direct_write.job_runs",
+    });
     r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
-    // Events-only aggregate: "jobRun" has no r.entity registration, because
-    // the entire lifecycle is driven by BullMQ-callback → r.defineEvent
-    // (no executor, no CRUD). The boot-validator accepts the two
-    // projections below because every apply-key is a registered
-    // domain-event.
-    // payload can carry arbitrary user data; triggeredById stays plaintext
-    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
-    // no user subject to shred.
-    r.defineEvent("run-started", runStartedSchema, {
-      piiFields: { payload: { subjectField: "triggeredById" } },
-    });
-    r.defineEvent("run-completed", runCompletedSchema);
-    r.defineEvent("run-failed", runFailedSchema);
-
-    // Inline projection: status-row in jobRunsTable. Runs in same TX as
-    // the event-append (the logger calls runProjectionsForEvent manually
-    // because the BullMQ-callback path has no dispatcher-ctx).
-    r.projection({
-      name: "job-runs",
-      source: "jobRun",
-      table: jobRunsTable,
-      apply: {
-        [JOB_RUN_STARTED_EVENT]: defineApply<z.infer<typeof runStartedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await insertOne(tx, table, {
-              id: event.aggregateId,
-              tenantId: event.tenantId,
-              version: event.version,
-              insertedAt: event.createdAt,
-              insertedById: event.metadata?.userId ?? "system",
-              jobName: p.jobName,
-              bullJobId: p.bullJobId,
-              status: p.status,
-              payload: p.payload,
-              attempt: p.attempt,
-              startedAt: parseJobInstant(p.startedAt),
-              triggeredById: p.triggeredById,
-            });
-          },
-        ),
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "completed",
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "failed",
-                error: p.error,
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-      },
-    });
-
-    // Second inline projection — same source, different table. Expands
-    // the batched logs array from completed/failed events into N rows
-    // per run in jobRunLogsTable.
-    r.projection({
-      name: "job-run-logs",
-      source: "jobRun",
-      table: jobRunLogsTable,
-      apply: {
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx) => {
-            const p = event.payload;
-            // skip: empty log batch — the worker ran silent. No child rows
-            // to insert; the completed-event alone already updated the run's
-            // status via the sibling job-runs projection.
-            if (p.logs.length === 0) return;
-            await insertMany(
-              tx,
-              jobRunLogsTable,
-              p.logs.map((log) => ({
-                runId: event.aggregateId,
-                level: log.level,
-                message: log.message,
-                timestamp: parseJobInstant(log.timestamp),
-              })),
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(async (event, tx) => {
-          const p = event.payload;
-          // skip: empty log batch — the worker ran silent (mirror of completed)
-          if (p.logs.length === 0) return;
-          await insertMany(
-            tx,
-            jobRunLogsTable,
-            p.logs.map((log) => ({
-              runId: event.aggregateId,
-              level: log.level,
-              message: log.message,
-              timestamp: parseJobInstant(log.timestamp),
-            })),
-          );
-        }),
-      },
-    });
 
     // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
     r.job(
@@ -187,6 +59,14 @@ export function createJobsFeature(): FeatureDefinition {
       reindexEntityJob,
     );
 
+    // store_job_runs/store_job_run_logs are direct-write, unbounded-growth
+    // stores (#2243) — nothing else purges them.
+    r.job(
+      "retention-cleanup",
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
+      createRetentionCleanupJob(retentionDays),
+    );
+
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),

package/src/jobs/handlers/retention-cleanup.job.ts

@@ -0,0 +1,21 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { deleteStaleJobRuns } from "../db/queries/retention";
+
+// Single source for the retention window — change here, nowhere else.
+export const DEFAULT_JOB_RUN_RETENTION_DAYS = 30;
+
+export function createRetentionCleanupJob(retentionDays: number): JobHandlerFn {
+  return async (_payload, ctx) => {
+    if (!ctx.db) {
+      throw new InternalError({
+        message:
+          "[jobs:retention-cleanup] ctx.db missing — job context requires a database connection.",
+      });
+    }
+    const db = ctx.db as DbConnection; // @cast-boundary db-operator (matches sibling cron jobs)
+    const result = await deleteStaleJobRuns(db, retentionDays);
+    ctx.log?.info?.(`[jobs:retention-cleanup] complete: ${JSON.stringify(result)}`);
+  };
+}

package/src/jobs/index.ts

@@ -1,4 +1,4 @@
-export { createJobsFeature } from "./feature";
+export { createJobsFeature, type JobsFeatureOptions } from "./feature";
 export type { JobRunLoggerCallbacks } from "./job-run-logger";
 export { createJobRunLogger } from "./job-run-logger";
 export type { JobLogLevel, JobRunStatus } from "./job-run-table";

package/src/jobs/job-run-logger.ts

@@ -1,27 +1,26 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { append, getStreamVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import type { JobLogEntry, JobMeta, JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
-import { runProjectionsForEvent } from "@cosmicdrift/kumiko-framework/pipeline";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
-import { jobRunsTable } from "./job-run-table";
+import { parseJobInstant } from "./job-instant";
+import { jobRunLogsTable, jobRunsTable } from "./job-run-table";
 
-// ES job-run lifecycle:
-//   - onJobStart  → jobs:event:run-started   (first append, version 0→1)
-//   - onJobComplete → jobs:event:run-completed (append at current version,
-//                     payload carries the batched logs)
-//   - onJobFailed   → jobs:event:run-failed    (same shape as completed + error)
+// Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
+// straight into jobRunsTable / jobRunLogsTable instead of appending to the
+// event store and replaying through inline projections. Pre-#2243 every run
+// left two permanent `kumiko_events` rows that nothing else ever replayed
+// or MSP-subscribed to — in two production apps that was ~99% of all
+// events. Same tables, same shape, no event stream in between.
 //
 // BullMQ callbacks don't carry a tenantId (jobs are cross-tenant). We
 // anchor every run on SYSTEM_TENANT_ID — mirrors how config system-scope
-// rows use the sentinel. The stream still works per-run because
-// aggregate_id is a fresh UUID per run.
-
-export const JOB_RUN_STARTED_EVENT = "jobs:event:run-started" as const;
-export const JOB_RUN_COMPLETED_EVENT = "jobs:event:run-completed" as const;
-export const JOB_RUN_FAILED_EVENT = "jobs:event:run-failed" as const;
+// rows use the sentinel.
 
 export type JobRunLoggerOptions = {
   readonly db: DbConnection;
@@ -45,18 +44,40 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
+// The run-started payload can carry arbitrary user data; triggeredById
+// names its owning user. No event-PII catalog involved (#2243 removed the
+// jobRun r.defineEvent registrations, so there is nothing to catalog) —
+// the subject is known statically, so we encrypt directly. A null subject
+// (system cron runs, recipient-less triggers) stays plaintext: there is no
+// user key to shred, mirroring the previous event-pii catalog's own skip
+// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+async function encryptStartedPayload(
+  payload: string | null,
+  triggeredById: string | null,
+): Promise<string | null> {
+  if (payload === null || triggeredById === null) return payload;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return payload;
+  return encryptPiiValueForSubject(
+    kms,
+    { kind: "user", userId: triggeredById },
+    payload,
+    { requestId: "jobs:job-run-logger" },
+    "payload",
+  );
+}
+
 export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks {
-  const { db, registry } = opts;
+  const { db } = opts;
 
-  // bullJobId → aggregate uuid. BullMQ hands us the bullJobId on every
-  // callback, but our aggregate stream is keyed by a fresh UUID we mint
-  // on start. The cache threads that UUID from onJobStart through to
-  // onJobComplete/onJobFailed so the completion-event lands on the same
-  // stream as the start-event.
+  // bullJobId → run uuid. BullMQ hands us the bullJobId on every callback,
+  // but the run row is keyed by a fresh UUID we mint on start. The cache
+  // threads that UUID from onJobStart through to onJobComplete/onJobFailed
+  // so the completion-write lands on the same row as the start-write.
   //
   // Bounded cache (LRU-ish with TTL) — worker-crash between start and
   // complete would otherwise leak entries. DB-lookup recovers evicted
-  // entries via bull_job_id on the projection.
+  // entries via bull_job_id on jobRunsTable.
   type CacheEntry = { readonly runId: string; readonly expiresAt: number };
   const runIdByBullJobId = new Map<string, CacheEntry>();
 
@@ -106,7 +127,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       // Parse against the registered schema so out-of-dispatcher writes
       // get the same validation guarantee as ctx.appendEvent. A shape
       // drift between feature + logger fails loudly at the source
-      // instead of silently landing on the events-table.
+      // instead of silently landing on the table.
       const payload = runStartedSchema.parse({
         jobName,
         bullJobId,
@@ -116,16 +137,19 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         startedAt: Temporal.Now.instant().toString(),
         attempt: meta.attempt ?? 1,
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
+      const encryptedPayload = await encryptStartedPayload(payload.payload, payload.triggeredById);
+      await insertOne(db, jobRunsTable, {
+        id: runId,
         tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: 0,
-        type: JOB_RUN_STARTED_EVENT,
-        payload,
-        metadata: { userId: "system" },
+        insertedById: "system",
+        jobName: payload.jobName,
+        bullJobId: payload.bullJobId,
+        status: payload.status,
+        payload: encryptedPayload,
+        attempt: payload.attempt,
+        startedAt: parseJobInstant(payload.startedAt),
+        triggeredById: payload.triggeredById,
       });
-      await runProjectionsForEvent(event, registry, db);
     },
 
     onJobComplete: async (
@@ -137,10 +161,9 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       const runId = await resolveRunId(bullJobId);
       // skip: state loss between start + complete (worker restart, cache
       // evicted AND DB has no matching bull_job_id). Rare edge case; we
-      // drop the completion event rather than forging a jobRun aggregate
-      // from scratch — forensics still has the original BullMQ lifecycle.
+      // drop the completion write rather than forging a run row from
+      // scratch — forensics still has the original BullMQ lifecycle.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
       const payload = runCompletedSchema.parse({
         duration,
         finishedAt: Temporal.Now.instant().toString(),
@@ -150,16 +173,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_COMPLETED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "completed",
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: Temporal.Now.instant(),
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — the worker ran silent. No child rows to
+      // insert; the status update above already recorded completion.
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
 
@@ -171,13 +210,11 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
     ) => {
       const runId = await resolveRunId(bullJobId);
       // skip: same rare state-loss case as in onJobComplete — drop the
-      // failure event rather than forge a jobRun aggregate from scratch.
+      // failure write rather than forge a run row from scratch.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
-      // Read started_at off the projection so we can compute duration
+      // Read started_at off the row so we can compute duration
       // symmetrically to onJobComplete (which gets duration from the
-      // worker). The projection already has started_at from the
-      // run-started inline-apply.
+      // worker). The row already has started_at from onJobStart.
       const row = await fetchOne<{ startedAt: Temporal.Instant }>(db, jobRunsTable, { id: runId });
       const now = Temporal.Now.instant();
       const duration = row ? Number(now.since(row.startedAt).total({ unit: "millisecond" })) : 0;
@@ -191,16 +228,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_FAILED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "failed",
+          error: payload.error,
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: now,
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — mirror of onJobComplete
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
   };