@cosmicdrift/kumiko-bundled-features 0.209.0 → 0.210.0

package/src/jobs/feature.ts

@@ -1,16 +1,5 @@
-import { insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
-import {
-  defineApply,
-  defineFeature,
-  type FeatureDefinition,
-} from "@cosmicdrift/kumiko-framework/engine";
-import type { z } from "zod";
+import { defineFeature, type FeatureDefinition } from "@cosmicdrift/kumiko-framework/engine";
 import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID } from "./constants";
-// Event-payload schemas live in a sibling module so the logger can import
-// them without the cycle jobs-feature ↔ job-run-logger. The logger parses
-// payloads against these schemas before low-level append() — that's what
-// keeps out-of-dispatcher writes as type-safe as ctx.appendEvent.
-import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
 import { catalogQuery } from "./handlers/catalog.query";
 import { detailQuery } from "./handlers/detail.query";
 import { listQuery } from "./handlers/list.query";
@@ -19,21 +8,26 @@ import {
   projectionRebuildPayloadSchema,
 } from "./handlers/projection-rebuild.job";
 import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex-entity.job";
+import {
+  createRetentionCleanupJob,
+  DEFAULT_JOB_RUN_RETENTION_DAYS,
+} from "./handlers/retention-cleanup.job";
 import { retryWrite } from "./handlers/retry.write";
 import { triggerWrite } from "./handlers/trigger.write";
 import { JOBS_I18N } from "./i18n";
-import { parseJobInstant } from "./job-instant";
-import {
-  JOB_RUN_COMPLETED_EVENT,
-  JOB_RUN_FAILED_EVENT,
-  JOB_RUN_STARTED_EVENT,
-} from "./job-run-logger";
-import { jobRunLogsTable, jobRunLogsTableMeta, jobRunsTable } from "./job-run-table";
+import { jobRunLogsTableMeta, jobRunsTableMeta } from "./job-run-table";
+
+export type JobsFeatureOptions = {
+  // How long a job run (and its logs) stays in store_job_runs/
+  // store_job_run_logs before the daily retention-cleanup job deletes it.
+  readonly retentionDays?: number;
+};
 
-export function createJobsFeature(): FeatureDefinition {
+export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefinition {
+  const retentionDays = options.retentionDays ?? DEFAULT_JOB_RUN_RETENTION_DAYS;
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution writes directly into `store_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows) from the BullMQ callbacks — no event stream in between (#2243). A daily `retention-cleanup` job deletes runs (and their logs) older than `retentionDays`. Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list`, `jobs:query:details`, and `jobs:query:catalog` (manual jobs) for the operator UI.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -41,134 +35,12 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
+    r.storeTable(jobRunsTableMeta, {
+      reason: "direct_write.job_runs",
+    });
     r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
-    // Events-only aggregate: "jobRun" has no r.entity registration, because
-    // the entire lifecycle is driven by BullMQ-callback → r.defineEvent
-    // (no executor, no CRUD). The boot-validator accepts the two
-    // projections below because every apply-key is a registered
-    // domain-event.
-    // payload can carry arbitrary user data; triggeredById stays plaintext
-    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
-    // no user subject to shred.
-    r.defineEvent("run-started", runStartedSchema, {
-      piiFields: { payload: { subjectField: "triggeredById" } },
-    });
-    r.defineEvent("run-completed", runCompletedSchema);
-    r.defineEvent("run-failed", runFailedSchema);
-
-    // Inline projection: status-row in jobRunsTable. Runs in same TX as
-    // the event-append (the logger calls runProjectionsForEvent manually
-    // because the BullMQ-callback path has no dispatcher-ctx).
-    r.projection({
-      name: "job-runs",
-      source: "jobRun",
-      table: jobRunsTable,
-      apply: {
-        [JOB_RUN_STARTED_EVENT]: defineApply<z.infer<typeof runStartedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await insertOne(tx, table, {
-              id: event.aggregateId,
-              tenantId: event.tenantId,
-              version: event.version,
-              insertedAt: event.createdAt,
-              insertedById: event.metadata?.userId ?? "system",
-              jobName: p.jobName,
-              bullJobId: p.bullJobId,
-              status: p.status,
-              payload: p.payload,
-              attempt: p.attempt,
-              startedAt: parseJobInstant(p.startedAt),
-              triggeredById: p.triggeredById,
-            });
-          },
-        ),
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "completed",
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(
-          async (event, tx, table) => {
-            const p = event.payload;
-            await updateMany(
-              tx,
-              table,
-              {
-                status: "failed",
-                error: p.error,
-                duration: p.duration,
-                finishedAt: parseJobInstant(p.finishedAt),
-                version: event.version,
-                modifiedAt: event.createdAt,
-                modifiedById: event.metadata?.userId ?? "system",
-              },
-              { id: event.aggregateId },
-            );
-          },
-        ),
-      },
-    });
-
-    // Second inline projection — same source, different table. Expands
-    // the batched logs array from completed/failed events into N rows
-    // per run in jobRunLogsTable.
-    r.projection({
-      name: "job-run-logs",
-      source: "jobRun",
-      table: jobRunLogsTable,
-      apply: {
-        [JOB_RUN_COMPLETED_EVENT]: defineApply<z.infer<typeof runCompletedSchema>>(
-          async (event, tx) => {
-            const p = event.payload;
-            // skip: empty log batch — the worker ran silent. No child rows
-            // to insert; the completed-event alone already updated the run's
-            // status via the sibling job-runs projection.
-            if (p.logs.length === 0) return;
-            await insertMany(
-              tx,
-              jobRunLogsTable,
-              p.logs.map((log) => ({
-                runId: event.aggregateId,
-                level: log.level,
-                message: log.message,
-                timestamp: parseJobInstant(log.timestamp),
-              })),
-            );
-          },
-        ),
-        [JOB_RUN_FAILED_EVENT]: defineApply<z.infer<typeof runFailedSchema>>(async (event, tx) => {
-          const p = event.payload;
-          // skip: empty log batch — the worker ran silent (mirror of completed)
-          if (p.logs.length === 0) return;
-          await insertMany(
-            tx,
-            jobRunLogsTable,
-            p.logs.map((log) => ({
-              runId: event.aggregateId,
-              level: log.level,
-              message: log.message,
-              timestamp: parseJobInstant(log.timestamp),
-            })),
-          );
-        }),
-      },
-    });
 
     // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
     r.job(
@@ -187,6 +59,14 @@ export function createJobsFeature(): FeatureDefinition {
       reindexEntityJob,
     );
 
+    // store_job_runs/store_job_run_logs are direct-write, unbounded-growth
+    // stores (#2243) — nothing else purges them.
+    r.job(
+      "retention-cleanup",
+      { trigger: { cron: "0 3 * * *" }, concurrency: "skip" },
+      createRetentionCleanupJob(retentionDays),
+    );
+
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),

package/src/jobs/handlers/retention-cleanup.job.ts

@@ -0,0 +1,21 @@
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { deleteStaleJobRuns } from "../db/queries/retention";
+
+// Single source for the retention window — change here, nowhere else.
+export const DEFAULT_JOB_RUN_RETENTION_DAYS = 30;
+
+export function createRetentionCleanupJob(retentionDays: number): JobHandlerFn {
+  return async (_payload, ctx) => {
+    if (!ctx.db) {
+      throw new InternalError({
+        message:
+          "[jobs:retention-cleanup] ctx.db missing — job context requires a database connection.",
+      });
+    }
+    const db = ctx.db as DbConnection; // @cast-boundary db-operator (matches sibling cron jobs)
+    const result = await deleteStaleJobRuns(db, retentionDays);
+    ctx.log?.info?.(`[jobs:retention-cleanup] complete: ${JSON.stringify(result)}`);
+  };
+}

package/src/jobs/index.ts

@@ -1,4 +1,4 @@
-export { createJobsFeature } from "./feature";
+export { createJobsFeature, type JobsFeatureOptions } from "./feature";
 export type { JobRunLoggerCallbacks } from "./job-run-logger";
 export { createJobRunLogger } from "./job-run-logger";
 export type { JobLogLevel, JobRunStatus } from "./job-run-table";

package/src/jobs/job-run-logger.ts

@@ -1,27 +1,26 @@
-import { fetchOne } from "@cosmicdrift/kumiko-framework/bun-db";
+import { fetchOne, insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  configuredPiiSubjectKms,
+  encryptPiiValueForSubject,
+} from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
-import { append, getStreamVersion } from "@cosmicdrift/kumiko-framework/event-store";
 import type { JobLogEntry, JobMeta, JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
-import { runProjectionsForEvent } from "@cosmicdrift/kumiko-framework/pipeline";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
-import { jobRunsTable } from "./job-run-table";
+import { parseJobInstant } from "./job-instant";
+import { jobRunLogsTable, jobRunsTable } from "./job-run-table";
 
-// ES job-run lifecycle:
-//   - onJobStart  → jobs:event:run-started   (first append, version 0→1)
-//   - onJobComplete → jobs:event:run-completed (append at current version,
-//                     payload carries the batched logs)
-//   - onJobFailed   → jobs:event:run-failed    (same shape as completed + error)
+// Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
+// straight into jobRunsTable / jobRunLogsTable instead of appending to the
+// event store and replaying through inline projections. Pre-#2243 every run
+// left two permanent `kumiko_events` rows that nothing else ever replayed
+// or MSP-subscribed to — in two production apps that was ~99% of all
+// events. Same tables, same shape, no event stream in between.
 //
 // BullMQ callbacks don't carry a tenantId (jobs are cross-tenant). We
 // anchor every run on SYSTEM_TENANT_ID — mirrors how config system-scope
-// rows use the sentinel. The stream still works per-run because
-// aggregate_id is a fresh UUID per run.
-
-export const JOB_RUN_STARTED_EVENT = "jobs:event:run-started" as const;
-export const JOB_RUN_COMPLETED_EVENT = "jobs:event:run-completed" as const;
-export const JOB_RUN_FAILED_EVENT = "jobs:event:run-failed" as const;
+// rows use the sentinel.
 
 export type JobRunLoggerOptions = {
   readonly db: DbConnection;
@@ -45,18 +44,40 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
+// The run-started payload can carry arbitrary user data; triggeredById
+// names its owning user. No event-PII catalog involved (#2243 removed the
+// jobRun r.defineEvent registrations, so there is nothing to catalog) —
+// the subject is known statically, so we encrypt directly. A null subject
+// (system cron runs, recipient-less triggers) stays plaintext: there is no
+// user key to shred, mirroring the previous event-pii catalog's own skip
+// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+async function encryptStartedPayload(
+  payload: string | null,
+  triggeredById: string | null,
+): Promise<string | null> {
+  if (payload === null || triggeredById === null) return payload;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return payload;
+  return encryptPiiValueForSubject(
+    kms,
+    { kind: "user", userId: triggeredById },
+    payload,
+    { requestId: "jobs:job-run-logger" },
+    "payload",
+  );
+}
+
 export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks {
-  const { db, registry } = opts;
+  const { db } = opts;
 
-  // bullJobId → aggregate uuid. BullMQ hands us the bullJobId on every
-  // callback, but our aggregate stream is keyed by a fresh UUID we mint
-  // on start. The cache threads that UUID from onJobStart through to
-  // onJobComplete/onJobFailed so the completion-event lands on the same
-  // stream as the start-event.
+  // bullJobId → run uuid. BullMQ hands us the bullJobId on every callback,
+  // but the run row is keyed by a fresh UUID we mint on start. The cache
+  // threads that UUID from onJobStart through to onJobComplete/onJobFailed
+  // so the completion-write lands on the same row as the start-write.
   //
   // Bounded cache (LRU-ish with TTL) — worker-crash between start and
   // complete would otherwise leak entries. DB-lookup recovers evicted
-  // entries via bull_job_id on the projection.
+  // entries via bull_job_id on jobRunsTable.
   type CacheEntry = { readonly runId: string; readonly expiresAt: number };
   const runIdByBullJobId = new Map<string, CacheEntry>();
 
@@ -106,7 +127,7 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       // Parse against the registered schema so out-of-dispatcher writes
       // get the same validation guarantee as ctx.appendEvent. A shape
       // drift between feature + logger fails loudly at the source
-      // instead of silently landing on the events-table.
+      // instead of silently landing on the table.
       const payload = runStartedSchema.parse({
         jobName,
         bullJobId,
@@ -116,16 +137,19 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         startedAt: Temporal.Now.instant().toString(),
         attempt: meta.attempt ?? 1,
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
+      const encryptedPayload = await encryptStartedPayload(payload.payload, payload.triggeredById);
+      await insertOne(db, jobRunsTable, {
+        id: runId,
         tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: 0,
-        type: JOB_RUN_STARTED_EVENT,
-        payload,
-        metadata: { userId: "system" },
+        insertedById: "system",
+        jobName: payload.jobName,
+        bullJobId: payload.bullJobId,
+        status: payload.status,
+        payload: encryptedPayload,
+        attempt: payload.attempt,
+        startedAt: parseJobInstant(payload.startedAt),
+        triggeredById: payload.triggeredById,
       });
-      await runProjectionsForEvent(event, registry, db);
     },
 
     onJobComplete: async (
@@ -137,10 +161,9 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
       const runId = await resolveRunId(bullJobId);
       // skip: state loss between start + complete (worker restart, cache
       // evicted AND DB has no matching bull_job_id). Rare edge case; we
-      // drop the completion event rather than forging a jobRun aggregate
-      // from scratch — forensics still has the original BullMQ lifecycle.
+      // drop the completion write rather than forging a run row from
+      // scratch — forensics still has the original BullMQ lifecycle.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
       const payload = runCompletedSchema.parse({
         duration,
         finishedAt: Temporal.Now.instant().toString(),
@@ -150,16 +173,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_COMPLETED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "completed",
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: Temporal.Now.instant(),
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — the worker ran silent. No child rows to
+      // insert; the status update above already recorded completion.
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
 
@@ -171,13 +210,11 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
     ) => {
       const runId = await resolveRunId(bullJobId);
       // skip: same rare state-loss case as in onJobComplete — drop the
-      // failure event rather than forge a jobRun aggregate from scratch.
+      // failure write rather than forge a run row from scratch.
       if (!runId) return;
-      const currentVersion = await getStreamVersion(db, runId, SYSTEM_TENANT_ID);
-      // Read started_at off the projection so we can compute duration
+      // Read started_at off the row so we can compute duration
       // symmetrically to onJobComplete (which gets duration from the
-      // worker). The projection already has started_at from the
-      // run-started inline-apply.
+      // worker). The row already has started_at from onJobStart.
       const row = await fetchOne<{ startedAt: Temporal.Instant }>(db, jobRunsTable, { id: runId });
       const now = Temporal.Now.instant();
       const duration = row ? Number(now.since(row.startedAt).total({ unit: "millisecond" })) : 0;
@@ -191,16 +228,32 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
-      const event = await append(db, {
-        aggregateId: runId,
-        aggregateType: "jobRun",
-        tenantId: SYSTEM_TENANT_ID,
-        expectedVersion: currentVersion,
-        type: JOB_RUN_FAILED_EVENT,
-        payload,
-        metadata: { userId: "system" },
-      });
-      await runProjectionsForEvent(event, registry, db);
+      await updateMany(
+        db,
+        jobRunsTable,
+        {
+          status: "failed",
+          error: payload.error,
+          duration: payload.duration,
+          finishedAt: parseJobInstant(payload.finishedAt),
+          modifiedAt: now,
+          modifiedById: "system",
+        },
+        { id: runId },
+      );
+      // skip: empty log batch — mirror of onJobComplete
+      if (payload.logs.length > 0) {
+        await insertMany(
+          db,
+          jobRunLogsTable,
+          payload.logs.map((log) => ({
+            runId,
+            level: log.level,
+            message: log.message,
+            timestamp: parseJobInstant(log.timestamp),
+          })),
+        );
+      }
       runIdByBullJobId.delete(bullJobId); // immediate cleanup on terminal callback
     },
   };

package/src/jobs/job-run-table.ts

@@ -1,6 +1,6 @@
 import {
-  buildEntityTable,
   defineUnmanagedTable,
+  deriveEntityTableMeta,
   type EntityTableMeta,
   instant,
   table as pgTable,
@@ -17,28 +17,29 @@ import {
 export type JobRunStatus = "queued" | "running" | "completed" | "failed";
 export type JobLogLevel = "info" | "warn" | "error";
 
-// jobRun is a system-scoped events-only aggregate: every job execution is
-// its own stream, driven entirely by BullMQ-callbacks (onJobStart /
-// -Complete / -Failed) via the low-level append() path. Three domain-
-// events cover the lifecycle:
-//   - `jobs:event:run-started`   (when BullMQ picks a job off its queue)
-//   - `jobs:event:run-completed` (duration + batched log entries)
-//   - `jobs:event:run-failed`    (error + duration + batched log entries)
+// jobRun is a system-scoped direct-write store (#2243): every job execution
+// writes straight into jobRunsTable / jobRunLogsTable from the BullMQ
+// callbacks (onJobStart / -Complete / -Failed, see job-run-logger.ts) —
+// no event-store detour. Pre-#2243 this was an events-only aggregate
+// replayed through two inline projections; that generated two permanent
+// `kumiko_events` rows per run for data that is itself already the
+// system of record (no other consumer replays or MSP-subscribes to it).
 //
-// Logs ride the completed/failed event as an array — "Option B" from the
-// design discussion: one event per run instead of N events per log line,
-// no log duplication across status transitions. The inline projection
-// expands the batch into N rows in jobRunLogsTable, keeping the pre-ES
-// detail-query-shape intact.
+// Logs are batched onto the completed/failed callback as an array —
+// "Option B" from the original design discussion: one write per run
+// instead of one write per log line, no log duplication across status
+// transitions. job-run-logger.ts expands the batch into N rows in
+// jobRunLogsTable.
 //
-// Entity-derived table — Phase 3b of drizzle-replacement. Earlier this was
-// a hand-written pgTable; the entity-form is the single source for both
-// the drizzle-table (query API) and the future EntityTableMeta-based
-// migration generator. status/$type<JobRunStatus> ist nicht im entity-
-// schema modelliert — Drizzle's column-type ist text mit CHECK-Constraint
-// als App-Boundary (gleicher Pattern wie template-resolver kind/scope).
+// Entity-derived table (query API + migration meta share one field
+// definition). status/$type<JobRunStatus> is not modeled in the entity
+// schema — the column type is text, with the status union enforced at the
+// app boundary (same pattern as template-resolver kind/scope).
+// `table: "store_job_runs"` (not `read_*`) because this is no longer a
+// rebuildable projection — `defineUnmanagedTable`/`deriveEntityTableMeta`
+// reject the `read_` prefix for `source: "unmanaged"` (#1208/#1220).
 export const jobRunEntity = createEntity({
-  table: "read_job_runs",
+  table: "store_job_runs",
   fields: {
     jobName: createTextField({ required: true }),
     bullJobId: createTextField({ required: true }),
@@ -53,7 +54,14 @@ export const jobRunEntity = createEntity({
   },
 });
 
-export const jobRunsTable = buildEntityTable("job-run", jobRunEntity);
+// Plain EntityTableMeta, NOT a branded EntityTable (buildEntityTable would
+// mark it executor-only): job-run is an unmanaged direct-write store, so
+// onJobStart/-Complete/-Failed need to write via ctx.db/insertOne directly
+// (same pattern as sessions/schema/user-session.ts).
+export const jobRunsTable: EntityTableMeta = deriveEntityTableMeta("job-run", jobRunEntity, {
+  source: "unmanaged",
+});
+export const jobRunsTableMeta = jobRunsTable;
 
 // Child projection keyed by the jobRun aggregate id. Pre-ES used a serial
 // PK + integer runId; post-ES runId is still exposed but now holds the
@@ -68,13 +76,13 @@ export const jobRunLogsTable = pgTable("store_job_run_logs", {
   timestamp: instant("timestamp").notNull(),
 });
 
-// **Unmanaged table** — bewusst KEIN createEntity. Begründung:
-//   - serial PK (kein uuid) — pre-ES legacy, kompatibilität mit existing rows
-//   - KEIN tenant_id — child-Tabelle von jobRun, tenant-context lebt am parent
-//   - keine base-columns (kein version/inserted_at/inserted_by_id) — append-
-//     only log, kein in-place-update, keine Audit-Spalten gewünscht
-// pgTable bleibt source-of-truth für Query-API; Phase 4 leitet das pgTable
-// aus dieser Meta ab.
+// **Unmanaged table** — deliberately no createEntity. Reasoning:
+//   - serial PK (not uuid) — pre-ES legacy, compatible with existing rows
+//   - no tenant_id — child table of jobRun, tenant context lives on the parent
+//   - no base columns (no version/inserted_at/inserted_by_id) — append-only
+//     log, no in-place update, no audit columns needed
+// pgTable stays the source of truth for the query API; this meta mirrors it
+// for migration generation.
 export const jobRunLogsTableMeta: EntityTableMeta = defineUnmanagedTable({
   tableName: "store_job_run_logs",
   columns: [

package/src/ledger/entity.ts

@@ -41,11 +41,12 @@ export const transactionEntity = createEntity({
   fields: {
     date: createDateField({ required: true }),
     // Journal narration ("Miete Januar", "Storno: …") is accounting data, not
-    // user-generated PII → allowPlaintext silences the user-content heuristic.
+    // user-generated PII → `personal: false` silences the user-content heuristic.
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     // For a Storno entry this points at the reversed transaction's id.
     reference: createTextField({ maxLength: 120 }),
@@ -79,7 +80,8 @@ export const scheduleEntity = createEntity({
     description: createTextField({
       required: true,
       maxLength: 200,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
     startDate: createDateField({ required: true }),
     // Absent → open-ended (projects to the window's end).

package/src/managed-pages/screens/branding-screen.ts

@@ -42,7 +42,8 @@ export function createBrandingSettingsScreen(opts: {
       description: createTextField({
         maxLength: 500,
         multiline: { rows: 3 },
-        allowPlaintext: "is-business-data",
+        personal: false,
+        reason: "is_business_data",
       }),
       siteUrl: createTextField({ maxLength: 2000, format: "url" }),
       accentColor: createTextField({ maxLength: 9 }),

package/src/managed-pages/table.ts

@@ -26,9 +26,10 @@ export const pageEntity = createEntity({
     body: createTextField({
       multiline: { rows: 16 },
       maxLength: 100_000,
-      allowPlaintext: "is-business-data",
+      personal: false,
+      reason: "is_business_data",
     }),
-    description: createTextField({ maxLength: 500, allowPlaintext: "is-business-data" }),
+    description: createTextField({ maxLength: 500, personal: false, reason: "is_business_data" }),
     ogImage: createTextField({ maxLength: 2000 }),
     published: createBooleanField({ default: false }),
   },

package/src/notes-history/entity.ts

@@ -15,8 +15,9 @@ import {
 // registered (see feature.ts). A correction is a new entry, not an edit —
 // that is the whole point of a note *history* instead of the single
 // overwritable textarea this bundle replaces (solon#13). GDPR erasure of the
-// author still works without a delete path: `body` is `userOwned` (crypto-
-// shredding on the author's subject key), not `pii` on the entity itself.
+// author still works without a delete path: `body` is `personal: { of:
+// "authorId" }` (crypto-shredding on the author's subject key), not
+// `personal: "self"` on the entity itself.
 export const noteEntryEntity = createEntity({
   table: "read_note_entries",
   fields: {
@@ -27,11 +28,14 @@ export const noteEntryEntity = createEntity({
     // ctx.user.id (see feature.ts), so a note can't be authored as someone
     // else. subjectRef feeds the GDPR-hook-coverage boot guard (it's a plain
     // FK into `user`, not content of its own).
-    authorId: createTextField({ subjectRef: true }),
+    authorId: createTextField({
+      personal: "ref",
+    }),
     body: createLongTextField({
       required: true,
       maxLength: 20_000,
-      userOwned: { ownerField: "authorId" },
+      personal: { of: "authorId" },
+      find: "none",
     }),
   },
 });