@cosmicdrift/kumiko-bundled-features 0.209.0 → 0.209.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.209.0",
+  "version": "0.209.1",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -126,12 +126,12 @@
     "./step-dispatcher": "./src/step-dispatcher/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.209.0",
-    "@cosmicdrift/kumiko-framework": "0.209.0",
-    "@cosmicdrift/kumiko-headless": "0.209.0",
-    "@cosmicdrift/kumiko-renderer": "0.209.0",
-    "@cosmicdrift/kumiko-renderer-web": "0.209.0",
-    "@cosmicdrift/kumiko-types": "0.209.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.209.1",
+    "@cosmicdrift/kumiko-framework": "0.209.1",
+    "@cosmicdrift/kumiko-headless": "0.209.1",
+    "@cosmicdrift/kumiko-renderer": "0.209.1",
+    "@cosmicdrift/kumiko-renderer-web": "0.209.1",
+    "@cosmicdrift/kumiko-types": "0.209.1",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -160,6 +160,6 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.209.0"
+    "@cosmicdrift/kumiko-locale-de": "0.209.1"
   }
 }

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -1,16 +1,16 @@
-// Event-shape contract for jobRun aggregate. Pins the three domain
-// events (run-started / run-completed / run-failed) against their
-// registered schemas + the stable type-name constants. A silent rename
-// (event-type-string, aggregateType, or payload-shape) fails here
-// instead of breaking MSP consumers and audit exports.
+// Direct-write shape contract for job runs (#2243). Pins onJobStart/
+// -Complete/-Failed against the tables they write — jobRunsTable status
+// transitions and jobRunLogsTable batched log rows. A silent shape drift
+// (missing field, wrong status string) fails here instead of breaking the
+// operator UI silently.
 //
 // The jobs integration test (jobs-feature.integration.ts) covers the
-// projection side (list + detail queries). This file covers the event
-// side — complementary coverage, minimal overlap.
+// projection side (list + detail queries). This file covers the
+// write side — complementary coverage, minimal overlap.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import { createRegistry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import { createRegistry } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestDb,
@@ -20,14 +20,8 @@ import {
   unsafePushTables,
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "../events";
 import { createJobsFeature } from "../feature";
-import {
-  createJobRunLogger,
-  JOB_RUN_COMPLETED_EVENT,
-  JOB_RUN_FAILED_EVENT,
-  JOB_RUN_STARTED_EVENT,
-} from "../job-run-logger";
+import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
@@ -40,6 +34,8 @@ beforeAll(async () => {
   testRedis = await createTestRedis();
   registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  // Kept only for the negative assertion below (no jobs:event:run-* rows) —
+  // the write path itself no longer touches the event store.
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
 });
@@ -53,114 +49,102 @@ beforeEach(async () => {
   await resetTestTables(testDb.db, [eventsTable, jobRunsTable, jobRunLogsTable]);
 });
 
-describe("jobRun event shapes", () => {
-  test("event-type constants are stable strings", () => {
-    // Guard against silent rename. Tests that subscribe via string-match
-    // (MSPs written in userland, audit export tools) break without this.
-    expect(JOB_RUN_STARTED_EVENT).toBe("jobs:event:run-started");
-    expect(JOB_RUN_COMPLETED_EVENT).toBe("jobs:event:run-completed");
-    expect(JOB_RUN_FAILED_EVENT).toBe("jobs:event:run-failed");
-  });
-
-  test("onJobStart writes a run-started event on the jobRun aggregate", async () => {
+describe("jobRun direct writes", () => {
+  test("onJobStart inserts a row into jobRunsTable", async () => {
     await logger.onJobStart?.("example:job:import", "bull-42", {
       triggeredById: "u-99",
       payload: JSON.stringify({ foo: 1 }),
       attempt: 1,
     });
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
-
-    expect(events.length).toBe(1);
-    const e = events[0];
-    expect(e?.aggregateType).toBe("jobRun");
-    expect(e?.tenantId).toBe(SYSTEM_TENANT_ID);
-    // Payload round-trips through the registered schema — drift would
-    // fail parse here, not silently land on the stream.
-    expect(() => runStartedSchema.parse(e?.payload)).not.toThrow();
-    const p = runStartedSchema.parse(e?.payload);
-    expect(p.jobName).toBe("example:job:import");
-    expect(p.bullJobId).toBe("bull-42");
-    expect(p.triggeredById).toBe("u-99");
-    expect(p.attempt).toBe(1);
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-42" });
+
+    expect(runs.length).toBe(1);
+    const run = runs[0];
+    expect(run?.jobName).toBe("example:job:import");
+    expect(run?.status).toBe("running");
+    expect(run?.triggeredById).toBe("u-99");
+    expect(run?.attempt).toBe(1);
   });
 
-  test("onJobComplete writes a run-completed event with batched logs", async () => {
+  test("onJobComplete updates the row to completed with batched logs", async () => {
     await logger.onJobStart?.("example:job:export", "bull-1", {});
     await logger.onJobComplete?.("example:job:export", "bull-1", 123, [
       { level: "info", message: "started", timestamp: Temporal.Now.instant() },
       { level: "info", message: "done", timestamp: Temporal.Now.instant() },
     ]);
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-1" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("completed");
+    expect(runs[0]?.duration).toBe(123);
 
-    expect(events.length).toBe(1);
-    const p = runCompletedSchema.parse(events[0]?.payload);
-    expect(p.duration).toBe(123);
-    expect(p.logs).toHaveLength(2);
-    expect(p.logs[0]?.level).toBe("info");
+    const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: runs[0]?.id as string });
+    expect(logs).toHaveLength(2);
+    expect(logs[0]?.level).toBe("info");
   });
 
-  test("onJobFailed writes a run-failed event with error + logs", async () => {
+  test("onJobFailed updates the row to failed with error + logs", async () => {
     await logger.onJobStart?.("example:job:fragile", "bull-9", {});
     await logger.onJobFailed?.("example:job:fragile", "bull-9", "boom", [
       { level: "error", message: "kaboom", timestamp: Temporal.Now.instant() },
     ]);
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-9" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("failed");
+    expect(runs[0]?.error).toBe("boom");
 
-    expect(events.length).toBe(1);
-    const p = runFailedSchema.parse(events[0]?.payload);
-    expect(p.error).toBe("boom");
-    expect(p.logs).toHaveLength(1);
+    const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: runs[0]?.id as string });
+    expect(logs).toHaveLength(1);
   });
 
-  test("start + complete both land on the SAME aggregate stream", async () => {
+  test("start + complete both act on the SAME row", async () => {
     await logger.onJobStart?.("example:job:stream", "bull-99", {});
     await logger.onJobComplete?.("example:job:stream", "bull-99", 10, []);
 
-    // Both events should share the same aggregateId — that's what makes
-    // the jobRun a single stream and lets ctx.loadAggregate() reduce
-    // them into a coherent state.
-    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
-
-    expect(events.length).toBe(2);
-    const ids = new Set(events.map((e) => e.aggregateId));
-    expect(ids.size).toBe(1);
+    // Exactly one row for this bullJobId — the complete-callback updated
+    // the row onJobStart created, it did not insert a second one.
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-99" });
+    expect(runs.length).toBe(1);
+    expect(runs[0]?.status).toBe("completed");
   });
 
-  test("complete/fail without a prior start skips — does not forge a jobRun stream", async () => {
-    // State-loss path: worker restart with empty cache AND no projection row for
-    // this bullJobId. Dropping the terminal event is intentional — forging an
-    // aggregate from scratch would invent a run that never started.
+  test("complete/fail without a prior start skips — does not forge a run row", async () => {
+    // State-loss path: worker restart with empty cache AND no row for this
+    // bullJobId. Dropping the terminal write is intentional — forging a
+    // row from scratch would invent a run that never started.
     await logger.onJobComplete?.("example:job:orphan", "bull-orphan-complete", 50, []);
     await logger.onJobFailed?.("example:job:orphan", "bull-orphan-failed", "boom", []);
 
-    const completed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_COMPLETED_EVENT });
-    const failed = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_FAILED_EVENT });
     const runs = await selectMany(testDb.db, jobRunsTable);
-
-    expect(completed).toHaveLength(0);
-    expect(failed).toHaveLength(0);
     expect(runs).toHaveLength(0);
   });
 
-  test("complete after cache loss recovers runId from the projection (same stream)", async () => {
-    // Simulates worker process restart: in-memory bullJobId→runId cache is gone,
-    // but the run-started projection row still has bull_job_id. A fresh logger
-    // must DB-lookup and append onto the original aggregate — not mint a second.
+  test("complete after cache loss recovers runId from jobRunsTable (same row)", async () => {
+    // Simulates worker process restart: in-memory bullJobId→runId cache is
+    // gone, but the run-started row still has bull_job_id. A fresh logger
+    // must DB-lookup and update the original row — not insert a second one.
     await logger.onJobStart?.("example:job:restart", "bull-restart-1", {});
-    const started = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
+    const started = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-restart-1" });
     expect(started).toHaveLength(1);
-    const originalAggregateId = started[0]?.aggregateId;
-    expect(originalAggregateId).toBeTruthy();
+    const originalId = started[0]?.id;
+    expect(originalId).toBeTruthy();
 
     const coldLogger = createJobRunLogger({ db: testDb.db, registry });
     await coldLogger.onJobComplete?.("example:job:restart", "bull-restart-1", 42, []);
 
-    const all = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
-    expect(all).toHaveLength(2);
-    expect(new Set(all.map((e) => e.aggregateId))).toEqual(new Set([originalAggregateId]));
-    expect(all.some((e) => e.type === JOB_RUN_COMPLETED_EVENT)).toBe(true);
+    const all = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-restart-1" });
+    expect(all).toHaveLength(1);
+    expect(all[0]?.id).toBe(originalId);
+    expect(all[0]?.status).toBe("completed");
+  });
+
+  test("no jobs:event:run-* rows ever land in the event store", async () => {
+    await logger.onJobStart?.("example:job:no-events", "bull-no-events", {});
+    await logger.onJobComplete?.("example:job:no-events", "bull-no-events", 5, []);
+
+    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(events).toHaveLength(0);
   });
 });

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -1,9 +1,9 @@
-// Event-PII on the jobs run-logger (#799): runStarted.payload can carry
-// arbitrary user data and is written via LOW-LEVEL append() (not
-// ctx.appendEvent) — exactly the path the event-PII catalog must cover.
-// With a KMS active the stored event AND the projected read-row carry
-// ciphertext under the triggering user's DEK; erasing that key makes the
-// payload unreadable ([[erased]]) without touching the append-only stream.
+// PII on the jobs run-logger, direct-write path (#2243, formerly #799):
+// run-started payload can carry arbitrary user data and is written straight
+// into jobRunsTable (no event store, no event-PII catalog — #2243 removed
+// the jobRun r.defineEvent registrations). With a KMS active the stored row
+// carries ciphertext under the triggering user's DEK; erasing that key
+// makes the payload unreadable ([[erased]]) without touching the row.
 
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
@@ -25,7 +25,7 @@ import {
 } from "@cosmicdrift/kumiko-framework/stack";
 import { resetPiiSubjectKmsForTests, resetTestTables } from "@cosmicdrift/kumiko-framework/testing";
 import { createJobsFeature } from "../feature";
-import { createJobRunLogger, JOB_RUN_STARTED_EVENT } from "../job-run-logger";
+import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 let testDb: TestDb;
@@ -39,10 +39,10 @@ const SECRET_PAYLOAD = JSON.stringify({ iban: "DE89370400440532013000" });
 beforeAll(async () => {
   testDb = await createTestDb();
   testRedis = await createTestRedis();
-  // createRegistry publishes the event-PII catalog as a module singleton —
-  // the logger's low-level append() picks it up without further wiring.
   const registry = createRegistry([createJobsFeature()]);
   await unsafePushTables(testDb.db, { jobRunsTable, jobRunLogsTable });
+  // Kept only so the "no event store involved" assertion below has a table
+  // to assert against — the write path itself never touches it.
   await createEventsTable(testDb.db);
   logger = createJobRunLogger({ db: testDb.db, registry });
 });
@@ -63,25 +63,28 @@ afterEach(() => {
 });
 
 describe("jobs run-started payload under KMS", () => {
-  test("stored event carries ciphertext payload, plaintext triggeredById", async () => {
+  test("stored row carries ciphertext payload, plaintext triggeredById — no event-store write", async () => {
     await logger.onJobStart?.("app:job:export", "bull-1", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,
       attempt: 1,
     });
 
-    const events = await selectMany(testDb.db, eventsTable, { type: JOB_RUN_STARTED_EVENT });
-    expect(events.length).toBe(1);
-    const payload = events[0]?.payload as Record<string, unknown>;
-    expect(isPiiCiphertext(payload["payload"])).toBe(true);
-    expect(String(payload["payload"])).toContain(`user:${USER_ID}`);
-    expect(payload["triggeredById"]).toBe(USER_ID);
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-1" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+    expect(String(row?.["payload"])).toContain(`user:${USER_ID}`);
+    expect(row?.["triggeredById"]).toBe(USER_ID);
 
-    const back = await decryptPiiFieldValues(payload, ["payload"], kms, { requestId: "t" });
+    const back = await decryptPiiFieldValues({ payload: row?.["payload"] }, ["payload"], kms, {
+      requestId: "t",
+    });
     expect(back["payload"]).toBe(SECRET_PAYLOAD);
+
+    const events = await selectMany(testDb.db, eventsTable, { aggregateType: "jobRun" });
+    expect(events).toHaveLength(0);
   });
 
-  test("projected read-row carries the same ciphertext; erase → [[erased]]", async () => {
+  test("erase subject key → row payload decrypts to [[erased]]", async () => {
     await logger.onJobStart?.("app:job:export", "bull-2", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,

package/src/jobs/__tests__/jobs-retention.integration.test.ts

@@ -0,0 +1,124 @@
+// Integration test for the job-run retention-cleanup job (#2243). Dispatches
+// jobs:job:retention-cleanup through the real jobRunner (setupTestStack +
+// BullMQ worker) — the same enqueue path production's cron trigger uses —
+// instead of hand-building a JobContext and casting into the handler. Each
+// test seeds a row past the active cutoff alongside one that must survive,
+// so waitFor's completion signal (the stale row's count dropping) is only
+// reached once the real dispatch has actually run; the survivor's fate is
+// decided by that same DELETE and can be asserted right after.
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import { SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  setupTestStack,
+  type TestStack,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { seedRow, waitFor } from "@cosmicdrift/kumiko-framework/testing";
+import { createJobsFeature } from "../feature";
+import { DEFAULT_JOB_RUN_RETENTION_DAYS } from "../handlers/retention-cleanup.job";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+const RETENTION_JOB = "jobs:job:retention-cleanup";
+
+let stack: TestStack | undefined;
+
+async function bootStack(retentionDays?: number): Promise<TestStack> {
+  const s = await setupTestStack({
+    features: [createJobsFeature(retentionDays !== undefined ? { retentionDays } : {})],
+    jobs: { consumerLane: "worker" },
+  });
+  await unsafePushTables(s.db, { jobRunsTable, jobRunLogsTable });
+  return s;
+}
+
+afterEach(async () => {
+  if (stack) await stack.cleanup();
+  stack = undefined;
+});
+
+function currentStack(): TestStack {
+  if (!stack) throw new Error("stack not booted");
+  return stack;
+}
+
+async function seedRun(opts: { id: string; ageDays: number }): Promise<void> {
+  const insertedAt = sql`now() - ${sql.raw(`interval '${opts.ageDays} days'`)}`;
+  await seedRow(currentStack().db, jobRunsTable, {
+    id: opts.id,
+    tenantId: SYSTEM_TENANT_ID,
+    insertedAt,
+    jobName: "example:job:retention-probe",
+    bullJobId: `bull-${opts.id}`,
+    status: "completed",
+    attempt: 1,
+    startedAt: insertedAt,
+  });
+}
+
+async function countRuns(): Promise<number> {
+  return (await selectMany(currentStack().db, jobRunsTable)).length;
+}
+
+async function countLogs(): Promise<number> {
+  return (await selectMany(currentStack().db, jobRunLogsTable)).length;
+}
+
+// Dispatches the real job through jobRunner and blocks until the queued
+// worker has actually applied it, proven by the run count reaching
+// `expectedRuns` (not merely "some time has passed").
+async function dispatchAndWaitForRunCount(expectedRuns: number): Promise<void> {
+  await currentStack().jobRunner?.dispatch(RETENTION_JOB);
+  await waitFor(async () => {
+    expect(await countRuns()).toBe(expectedRuns);
+  });
+}
+
+describe("jobs:job:retention-cleanup", () => {
+  test("default window (30d): older-than-cutoff runs go, recent ones stay", async () => {
+    stack = await bootStack();
+    await seedRun({
+      id: "11111111-1111-4111-8111-111111111111",
+      ageDays: DEFAULT_JOB_RUN_RETENTION_DAYS + 1,
+    });
+    await seedRun({ id: "22222222-2222-4222-8222-222222222222", ageDays: 1 });
+    expect(await countRuns()).toBe(2);
+
+    await dispatchAndWaitForRunCount(1);
+
+    const remaining = await selectMany(currentStack().db, jobRunsTable);
+    expect(remaining[0]?.id).toBe("22222222-2222-4222-8222-222222222222");
+  });
+
+  test("associated log rows are deleted along with their run", async () => {
+    stack = await bootStack();
+    const runId = "33333333-3333-4333-8333-333333333333";
+    const ageDays = DEFAULT_JOB_RUN_RETENTION_DAYS + 5;
+    await seedRun({ id: runId, ageDays });
+    await seedRow(currentStack().db, jobRunLogsTable, {
+      runId,
+      level: "info",
+      message: "old log line",
+      timestamp: sql`now() - ${sql.raw(`interval '${ageDays} days'`)}`,
+    });
+    expect(await countLogs()).toBe(1);
+
+    await dispatchAndWaitForRunCount(0);
+
+    expect(await countLogs()).toBe(0);
+  });
+
+  test("a custom retentionDays option is honored: past-cutoff runs go, in-window runs stay", async () => {
+    stack = await bootStack(3);
+    await seedRun({ id: "44444444-4444-4444-8444-444444444444", ageDays: 5 });
+    await seedRun({ id: "55555555-5555-4555-8555-555555555555", ageDays: 1 });
+    expect(await countRuns()).toBe(2);
+
+    await dispatchAndWaitForRunCount(1);
+
+    const remaining = await selectMany(currentStack().db, jobRunsTable);
+    expect(remaining[0]?.id).toBe("55555555-5555-4555-8555-555555555555");
+  });
+});

package/src/jobs/db/queries/retention.ts

@@ -0,0 +1,44 @@
+// Job-run retention (#2243): store_job_runs/store_job_run_logs are
+// direct-write stores now, not event-sourced projections — nothing else
+// purges them, so without this query they grow forever with the run count
+// instead of the runtime. Not the retention-cleanup executor: that executor
+// is entity/tenant-scoped and jobRun has neither (system-scoped direct-write
+// store). Each table is purged by its own timestamp column independently —
+// run_id isn't a real FK constraint (see job-run-table.ts), so there is no
+// ordering requirement between the two deletes.
+//
+// deleteManyBatched (typed query API, no raw SQL in this file) chunks each
+// delete so a large backlog doesn't hold one lock for the whole sweep.
+
+import { deleteManyBatched } from "@cosmicdrift/kumiko-framework/bun-db";
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import { jobRunLogsTable, jobRunsTable } from "../../job-run-table";
+
+const RETENTION_DELETE_BATCH_SIZE = 500;
+
+export type JobRunRetentionResult = {
+  readonly runsDeleted: number;
+  readonly logsDeleted: number;
+};
+
+export async function deleteStaleJobRuns(
+  db: DbConnection,
+  retentionDays: number,
+): Promise<JobRunRetentionResult> {
+  const cutoff = Temporal.Now.instant().subtract({ hours: retentionDays * 24 });
+
+  const logsResult = await deleteManyBatched(
+    db,
+    jobRunLogsTable,
+    { timestamp: { lt: cutoff } },
+    { limit: RETENTION_DELETE_BATCH_SIZE },
+  );
+  const runsResult = await deleteManyBatched(
+    db,
+    jobRunsTable,
+    { insertedAt: { lt: cutoff } },
+    { limit: RETENTION_DELETE_BATCH_SIZE },
+  );
+
+  return { runsDeleted: runsResult.deleted, logsDeleted: logsResult.deleted };
+}

package/src/jobs/events.ts

@@ -1,11 +1,8 @@
-// Event-payload schemas for the jobRun aggregate. Shared between
-// jobs-feature.ts (registers them via r.defineEvent and consumes them
-// in the inline-projections) and job-run-logger.ts (parses payloads
-// before low-level append() so out-of-dispatcher writes stay as
-// type-safe as ctx.appendEvent writes).
-//
-// Keeping them in a separate module avoids the circular import between
-// jobs-feature.ts (imports the logger) and job-run-logger.ts.
+// Payload schemas for the jobRun direct-write path (#2243). Pre-#2243 these
+// backed jobRun's event-store payloads (r.defineEvent + inline projections);
+// now job-run-logger.ts parses against them before writing straight into
+// jobRunsTable/jobRunLogsTable, so an out-of-dispatcher write still gets the
+// same validation guarantee ctx.appendEvent used to give it.
 
 import { z } from "zod";
 

package/src/jobs/feature.ts

@@ -1,16 +1,5 @@
-import { insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  defineApply,
-  defineFeature,
-  type FeatureDefinition,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type { z } from "zod";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID } from "./constants";
-// Event-payload schemas live in a sibling module so the logger can import
-// them without the cycle jobs-feature ↔ job-run-logger. The logger parses
-// payloads against these schemas before low-level append() — that's what
-// keeps out-of-dispatcher writes as type-safe as ctx.appendEvent.
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
 import { catalogQuery } from "./handlers/catalog.query";
 import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
@@ -19,21 +8,26 @@ import {
   projectionRebuildPayloadSchema,
 } from "./handlers/projection-rebuild.job";
 import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex-entity.job";
+import {
+  createRetentionCleanupJob,
+  DEFAULT_JOB_RUN_RETENTION_DAYS,
+} from "./handlers/retention-cleanup.job";
 import { retryWrite } from "./handlers/retry.write";
 import { triggerWrite } from "./handlers/trigger.write";
 import { JOBS_I18N } from "./i18n";
-import { parseJobInstant } from "./job-instant";
-import {
-  JOB_RUN_COMPLETED_EVENT,
-  JOB_RUN_FAILED_EVENT,
-  JOB_RUN_STARTED_EVENT,
-} from "./job-run-logger";
-import { jobRunLogsTable, jobRunLogsTableMeta, jobRunsTable } from "./job-run-table";
+import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table";
+
+export type JobsFeatureOptions = {
+  // How long a job run (and its logs) stays in store_job_runs/
+  // store_job_run_logs before the daily retention-cleanup job deletes it.
+  readonly retentionDays?: number;
+};
 
-export function createJobsFeature(): FeatureDefinition {
+export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefinition {
+  const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`. Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -41,134 +35,12 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
+    r.storeTable(jobRunsTableMeta, {
+      reason: "direct_write.job_runs",
+    });
     r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
-    // Events-only aggregate: "jobRun" has no r.entity registration, because
-    // the entire lifecycle is driven by BullMQ-callback → r.defineEvent
-    // (no executor, no CRUD). The boot-validator accepts the two
-    // projections below because every apply-key is a registered
-    // domain-event.
-    // payload can carry arbitrary user data; triggeredById stays plaintext
-    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
-    // no user subject to shred.
-    r.defineEvent("run-started", runStartedSchema, {
-      piiFields: { payload: { subjectField: "triggeredById" } },
-    });
-    r.defineEvent("run-completed", runCompletedSchema);
-    r.defineEvent("run-failed", runFailedSchema);
-
-    // Inline projection: status-row in jobRunsTable. Runs in same TX as
-    // the event-append (the logger calls runProjectionsForEvent manually
-    // because the BullMQ-callback path has no dispatcher-ctx).
-    r.projection({
-      name: "job-runs",
-      source: "jobRun",
-      table: jobRunsTable,
-      apply: {
-        [JOB_RUN_STARTED_EVENT]: defineApply<z.infer<typeof runStartedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await insertOne(tx, table, {
-              id: event.aggregateId,
-              tenantId: event.tenantId,
-              version: event.version,
-              insertedAt: event.createdAt,
-              insertedById: event.metadata?.userId ?? "system",
-              jobName: p.jobName,
-              bullJobId: p.bullJobId,
-              status: p.status,
-              payload: p.payload,
-              attempt: p.attempt,
-              startedAt: parseJobInstant(p.startedAt),
-              triggeredById: p.triggeredById,
-            });
-          },
-        ),
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "completed",
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "failed",
-                error: p.error,
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-      },
-    });
-
-    // Second inline projection — same source, different table. Expands
-    // the batched logs array from completed/failed events into N rows
-    // per run in jobRunLogsTable.
-    r.projection({
-      name: "job-run-logs",
-      source: "jobRun",
-      table: jobRunLogsTable,
-      apply: {
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx) => {
-            const p = event.payload;
-            // skip: empty log batch — the worker ran silent. No child rows
-            // to insert; the completed-event alone already updated the run's
-            // status via the sibling job-runs projection.
-            if (p.logs.length === 0) return;
-            await insertMany(
-              tx,
-              jobRunLogsTable,
-              p.logs.map((log) => ({
-                runId: event.aggregateId,
-                level: log.level,
-                message: log.message,
-                timestamp: parseJobInstant(log.timestamp),
-              })),
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(async (event, tx) => {
-          const p = event.payload;
-          // skip: empty log batch — the worker ran silent (mirror of completed)
-          if (p.logs.length === 0) return;
-          await insertMany(
-            tx,
-            jobRunLogsTable,
-            p.logs.map((log) => ({
-              runId: event.aggregateId,
-              level: log.level,
-              message: log.message,
-              timestamp: parseJobInstant(log.timestamp),
-            })),
-          );
-        }),
-      },
-    });
 
     // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
     r.job(
@@ -187,6 +59,14 @@ export function createJobsFeature(): FeatureDefinition {
       reindexEntityJob,
     );
 
+    // store_job_runs/store_job_run_logs are direct-write, unbounded-growth
+    // stores (#2243) — nothing else purges them.
+    r.job(
+      "retention-cleanup",
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
+      createRetentionCleanupJob(retentionDays),
+    );
+
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),

package/src/jobs/handlers/retention-cleanup.job.ts

@@ -0,0 +1,21 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { deleteStaleJobRuns } from "../db/queries/retention";
+
+// Single source for the retention window — change here, nowhere else.
+export const DEFAULT_JOB_RUN_RETENTION_DAYS = 30;
+
+export function createRetentionCleanupJob(retentionDays: number): JobHandlerFn {
+  return async (_payload, ctx) => {
+    if (!ctx.db) {
+      throw new InternalError({
+        message:
+          "[jobs:retention-cleanup] ctx.db missing — job context requires a database connection.",
+      });
+    }
+    const db = ctx.db as DbConnection; // @cast-boundary db-operator (matches sibling cron jobs)
+    const result = await deleteStaleJobRuns(db, retentionDays);
+    ctx.log?.info?.(`[jobs:retention-cleanup] complete: ${JSON.stringify(result)}`);
+  };
+}

package/src/jobs/index.ts

@@ -1,4 +1,4 @@
-export { createJobsFeature } from "./feature";
+export { createJobsFeature, type JobsFeatureOptions } from "./feature";
 export type { JobRunLoggerCallbacks } from "./job-run-logger";
 export { createJobRunLogger } from "./job-run-logger";
 export type { JobLogLevel, JobRunStatus } from "./job-run-table";

package/src/jobs/job-run-logger.ts

@@ -1,27 +1,26 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { append, getStreamVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import type { JobLogEntry, JobMeta, JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
-import { runProjectionsForEvent } from "@cosmicdrift/kumiko-framework/pipeline";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
-import { jobRunsTable } from "./job-run-table";
+import { parseJobInstant } from "./job-instant";
+import { jobRunLogsTable, jobRunsTable } from "./job-run-table";
 
-// ES job-run lifecycle:
-//   - onJobStart  → jobs:event:run-started   (first append, version 0→1)
-//   - onJobComplete → jobs:event:run-completed (append at current version,
-//                     payload carries the batched logs)
-//   - onJobFailed   → jobs:event:run-failed    (same shape as completed + error)
+// Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
+// straight into jobRunsTable / jobRunLogsTable instead of appending to the
+// event store and replaying through inline projections. Pre-#2243 every run
+// left two permanent `kumiko_events` rows that nothing else ever replayed
+// or MSP-subscribed to — in two production apps that was ~99% of all
+// events. Same tables, same shape, no event stream in between.
 //
 // BullMQ callbacks don't carry a tenantId (jobs are cross-tenant). We
 // anchor every run on SYSTEM_TENANT_ID — mirrors how config system-scope
-// rows use the sentinel. The stream still works per-run because
-// aggregate_id is a fresh UUID per run.
-
-export const JOB_RUN_STARTED_EVENT = "jobs:event:run-started" as const;
-export const JOB_RUN_COMPLETED_EVENT = "jobs:event:run-completed" as const;
-export const JOB_RUN_FAILED_EVENT = "jobs:event:run-failed" as const;
+// rows use the sentinel.
 
 export type JobRunLoggerOptions = {
   readonly db: DbConnection;
@@ -45,18 +44,40 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
+// The run-started payload can carry arbitrary user data; triggeredById
+// names its owning user. No event-PII catalog involved (#2243 removed the
+// jobRun r.defineEvent registrations, so there is nothing to catalog) —
+// the subject is known statically, so we encrypt directly. A null subject
+// (system cron runs, recipient-less triggers) stays plaintext: there is no
+// user key to shred, mirroring the previous event-pii catalog's own skip
+// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+async function encryptStartedPayload(
+  payload: string | null,
+  triggeredById: string | null,
+): Promise<string | null> {
+  if (payload === null || triggeredById === null) return payload;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return payload;
+  return encryptPiiValueForSubject(
+    kms,
+    { kind: "user", userId: triggeredById },
+    payload,
+    { requestId: "jobs:job-run-logger" },
+    "payload",
+  );
+}
+
 export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks {
-  const { db, registry } = opts;
+  const { db } = opts;
 
-  // bullJobId → aggregate uuid. BullMQ hands us the bullJobId on every
-  // callback, but our aggregate stream is keyed by a fresh UUID we mint
-  // on start. The cache threads that UUID from onJobStart through to
-  // onJobComplete/onJobFailed so the completion-event lands on the same
-  // stream as the start-event.
+  // bullJobId → run uuid. BullMQ hands us the bullJobId on every callback,
+  // but the run row is keyed by a fresh UUID we mint on start. The cache
+  // threads that UUID from onJobStart through to onJobComplete/onJobFailed
+  // so the completion-write lands on the same row as the start-write.
   //
   // Bounded cache (LRU-ish with TTL) — worker-crash between start and
   // complete would otherwise leak entries. DB-lookup recovers evicted
-  // entries via bull_job_id on the projection.
+  // entries via bull_job_id on jobRunsTable.
   type CacheEntry = { readonly runId: string; readonly expiresAt: number };
   const runIdByBullJobId = new Map<string, CacheEntry>();
 
@@ -106,7 +127,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       // Parse against the registered schema so out-of-dispatcher writes
       // get the same validation guarantee as ctx.appendEvent. A shape
       // drift between feature + logger fails loudly at the source
-      // instead of silently landing on the events-table.
+      // instead of silently landing on the table.
       const payload = runStartedSchema.parse({
         jobName,
         bullJobId,
@@ -116,16 +137,19 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         startedAt: Temporal.Now.instant().toString(),
         attempt: meta.attempt ?? 1,
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
+      const encryptedPayload = await encryptStartedPayload(payload.payload, payload.triggeredById);
+      await insertOne(db, jobRunsTable, {
+        id: runId,
         tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: 0,
-        type: JOB_RUN_STARTED_EVENT,
-        payload,
-        metadata: { userId: "system" },
+        insertedById: "system",
+        jobName: payload.jobName,
+        bullJobId: payload.bullJobId,
+        status: payload.status,
+        payload: encryptedPayload,
+        attempt: payload.attempt,
+        startedAt: parseJobInstant(payload.startedAt),
+        triggeredById: payload.triggeredById,
       });
-      await runProjectionsForEvent(event, registry, db);
     },
 
     onJobComplete: async (
@@ -137,10 +161,9 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       const runId = await resolveRunId(bullJobId);
       // skip: state loss between start + complete (worker restart, cache
       // evicted AND DB has no matching bull_job_id). Rare edge case; we
-      // drop the completion event rather than forging a jobRun aggregate
-      // from scratch — forensics still has the original BullMQ lifecycle.
+      // drop the completion write rather than forging a run row from
+      // scratch — forensics still has the original BullMQ lifecycle.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
       const payload = runCompletedSchema.parse({
         duration,
         finishedAt: Temporal.Now.instant().toString(),
@@ -150,16 +173,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_COMPLETED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "completed",
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: Temporal.Now.instant(),
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — the worker ran silent. No child rows to
+      // insert; the status update above already recorded completion.
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
 
@@ -171,13 +210,11 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
     ) => {
       const runId = await resolveRunId(bullJobId);
       // skip: same rare state-loss case as in onJobComplete — drop the
-      // failure event rather than forge a jobRun aggregate from scratch.
+      // failure write rather than forge a run row from scratch.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
-      // Read started_at off the projection so we can compute duration
+      // Read started_at off the row so we can compute duration
       // symmetrically to onJobComplete (which gets duration from the
-      // worker). The projection already has started_at from the
-      // run-started inline-apply.
+      // worker). The row already has started_at from onJobStart.
       const row = await fetchOne<{ startedAt: Temporal.Instant }>(db, jobRunsTable, { id: runId });
       const now = Temporal.Now.instant();
       const duration = row ? Number(now.since(row.startedAt).total({ unit: "millisecond" })) : 0;
@@ -191,16 +228,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_FAILED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "failed",
+          error: payload.error,
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: now,
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — mirror of onJobComplete
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
   };

package/src/jobs/job-run-table.ts

@@ -1,6 +1,6 @@
 import {
-  buildEntityTable,
   defineUnmanagedTable,
+  deriveEntityTableMeta,
   type EntityTableMeta,
   instant,
   table as pgTable,
@@ -17,28 +17,29 @@ import {
 export type JobRunStatus = "queued" | "running" | "completed" | "failed";
 export type JobLogLevel = "info" | "warn" | "error";
 
-// jobRun is a system-scoped events-only aggregate: every job execution is
-// its own stream, driven entirely by BullMQ-callbacks (onJobStart /
-// -Complete / -Failed) via the low-level append() path. Three domain-
-// events cover the lifecycle:
-//   - `jobs:event:run-started`   (when BullMQ picks a job off its queue)
-//   - `jobs:event:run-completed` (duration + batched log entries)
-//   - `jobs:event:run-failed`    (error + duration + batched log entries)
+// jobRun is a system-scoped direct-write store (#2243): every job execution
+// writes straight into jobRunsTable / jobRunLogsTable from the BullMQ
+// callbacks (onJobStart / -Complete / -Failed, see job-run-logger.ts) —
+// no event-store detour. Pre-#2243 this was an events-only aggregate
+// replayed through two inline projections; that generated two permanent
+// `kumiko_events` rows per run for data that is itself already the
+// system of record (no other consumer replays or MSP-subscribes to it).
 //
-// Logs ride the completed/failed event as an array — "Option B" from the
-// design discussion: one event per run instead of N events per log line,
-// no log duplication across status transitions. The inline projection
-// expands the batch into N rows in jobRunLogsTable, keeping the pre-ES
-// detail-query-shape intact.
+// Logs are batched onto the completed/failed callback as an array —
+// "Option B" from the original design discussion: one write per run
+// instead of one write per log line, no log duplication across status
+// transitions. job-run-logger.ts expands the batch into N rows in
+// jobRunLogsTable.
 //
-// Entity-derived table — Phase 3b of drizzle-replacement. Earlier this was
-// a hand-written pgTable; the entity-form is the single source for both
-// the drizzle-table (query API) and the future EntityTableMeta-based
-// migration generator. status/$type<JobRunStatus> ist nicht im entity-
-// schema modelliert — Drizzle's column-type ist text mit CHECK-Constraint
-// als App-Boundary (gleicher Pattern wie template-resolver kind/scope).
+// Entity-derived table (query API + migration meta share one field
+// definition). status/$type<JobRunStatus> is not modeled in the entity
+// schema — the column type is text, with the status union enforced at the
+// app boundary (same pattern as template-resolver kind/scope).
+// `table: "store_job_runs"` (not `read_*`) because this is no longer a
+// rebuildable projection — `defineUnmanagedTable`/`deriveEntityTableMeta`
+// reject the `read_` prefix for `source: "unmanaged"` (#1208/#1220).
 export const jobRunEntity = createEntity({
-  table: "read_job_runs",
+  table: "store_job_runs",
   fields: {
     jobName: createTextField({ required: true }),
     bullJobId: createTextField({ required: true }),
@@ -53,7 +54,14 @@ export const jobRunEntity = createEntity({
   },
 });
 
-export const jobRunsTable = buildEntityTable("job-run", jobRunEntity);
+// Plain EntityTableMeta, NOT a branded EntityTable (buildEntityTable would
+// mark it executor-only): job-run is an unmanaged direct-write store, so
+// onJobStart/-Complete/-Failed need to write via ctx.db/insertOne directly
+// (same pattern as sessions/schema/user-session.ts).
+export const jobRunsTable: EntityTableMeta = deriveEntityTableMeta("job-run", jobRunEntity, {
+  source: "unmanaged",
+});
+export const jobRunsTableMeta = jobRunsTable;
 
 // Child projection keyed by the jobRun aggregate id. Pre-ES used a serial
 // PK + integer runId; post-ES runId is still exposed but now holds the
@@ -68,13 +76,13 @@ export const jobRunLogsTable = pgTable("store_job_run_logs", {
   timestamp: instant("timestamp").notNull(),
 });
 
-// **Unmanaged table** — bewusst KEIN createEntity. Begründung:
-//   - serial PK (kein uuid) — pre-ES legacy, kompatibilität mit existing rows
-//   - KEIN tenant_id — child-Tabelle von jobRun, tenant-context lebt am parent
-//   - keine base-columns (kein version/inserted_at/inserted_by_id) — append-
-//     only log, kein in-place-update, keine Audit-Spalten gewünscht
-// pgTable bleibt source-of-truth für Query-API; Phase 4 leitet das pgTable
-// aus dieser Meta ab.
+// **Unmanaged table** — deliberately no createEntity. Reasoning:
+//   - serial PK (not uuid) — pre-ES legacy, compatible with existing rows
+//   - no tenant_id — child table of jobRun, tenant context lives on the parent
+//   - no base columns (no version/inserted_at/inserted_by_id) — append-only
+//     log, no in-place update, no audit columns needed
+// pgTable stays the source of truth for the query API; this meta mirrors it
+// for migration generation.
 export const jobRunLogsTableMeta: EntityTableMeta = defineUnmanagedTable({
   tableName: "store_job_run_logs",
   columns: [

package/src/user-data-rights/feature.ts

@@ -134,8 +134,8 @@ export type UserDataRightsOptions = {
 };
 
 export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): FeatureDefinition {
-  // One-shot operator warning (the export cron fires every minute — warn once
-  // per process, not every run). Lives in the factory scope so the cron closure
+  // One-shot operator warning (the export cron fires daily — warn once per
+  // process, not every run). Lives in the factory scope so the cron closure
   // shares it across runs.
   let warnedMissingExportUrl = false;
   return defineFeature("user-data-rights", (r) => {
@@ -401,7 +401,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // S2.U3 Atom 3b — Worker fuer Async Export-Pipeline. Cron-getriggert.
     r.job(
       "run-export-jobs",
-      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
       async (_payload, ctx) => {
         if (!ctx.db || !ctx.registry) {
           throw new Error(
@@ -488,7 +488,7 @@ export function createUserDataRightsFeature(opts: UserDataRightsOptions = {}): F
     // — Art.17 wuerde nie ausgefuehrt.
     r.job(
       "run-forget-cleanup",
-      { trigger: { cron: "0 * * * * *" }, concurrency: "skip" },
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
       async (_payload, ctx) => {
         if (!ctx.db || !ctx.registry) {
           throw new Error(

package/src/user-data-rights-defaults/__tests__/bundled-entities.userdata-hooks.integration.test.ts

@@ -401,7 +401,7 @@ describe("delivery-attempt userData-hooks (#799)", () => {
 describe("job-run userData-hooks (#799)", () => {
   async function seedRun(id: string, triggeredById: string | null): Promise<void> {
     await asRawClient(full.db).unsafe(
-      `INSERT INTO read_job_runs
+      `INSERT INTO store_job_runs
          (id, tenant_id, job_name, bull_job_id, status, payload, attempt, started_at, triggered_by_id)
        VALUES ($1::uuid, $2, 'app:job:export', $3, 'completed', '{"scope":"mine"}', 1, now(), $4)`,
       [id, TENANT_A, `bull-${id}`, triggeredById],