@cosmicdrift/kumiko-bundled-features 0.220.0 → 0.221.0

package/src/file-derivatives/feature.ts

@@ -33,6 +33,10 @@ const FEATURE_NAME = "file-derivatives";
 // a name list here "for safety" — see #1985.
 const VARIANT_NAME_RE = /^[a-zA-Z0-9_-]{1,64}$/;
 
+/** Host → tenantId for the anonymous media route.
+ *  MUST be cheap/synchronous (in-memory map or cached lookup): it runs
+ *  *before* the query-handler rate limit, so a DB round-trip here is an
+ *  unthrottled DoS surface for anonymous callers rotating Host headers (#1977). */
 export type PublicVariantResolveApexTenant = (
   host: string,
 ) => Promise<TenantId | null> | TenantId | null;
@@ -42,7 +46,8 @@ export type FileDerivativesOptions = {
    *  Without this option, neither the httpRoute NOR the `publicVariant`
    *  query is registered — it is unreachable via the httpRoute path and via
    *  the generic `/api` query dispatch. Existing consumers that only need
-   *  `ctx.derivatives` are unaffected. */
+   *  `ctx.derivatives` are unaffected. See {@link PublicVariantResolveApexTenant}
+   *  for the in-memory/sync contract. */
   readonly resolveApexTenant?: PublicVariantResolveApexTenant;
   /** Base path of the public variant route. Default "/media". */
   readonly basePath?: string;
@@ -112,12 +117,10 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
     // dispatch even when the httpRoute below isn't mounted, bypassing the
     // "tenantId comes from the host, never the payload" invariant that only
     // `resolveApexTenant` enforces.
-    const queries: { publicVariant?: ReturnType<typeof r.queryHandler> } = {};
-
     if (opts.resolveApexTenant) {
       const resolveApexTenant = opts.resolveApexTenant;
 
-      queries.publicVariant = r.queryHandler(publicVariantQuery);
+      r.queryHandler(publicVariantQuery);
 
       r.httpRoute({
         method: "GET",
@@ -180,8 +183,6 @@ export function createFileDerivativesFeature(opts: FileDerivativesOptions = {}):
         },
       });
     }
-
-    return { queries };
   });
 }
 

package/src/file-provider-s3/feature.ts

@@ -52,9 +52,8 @@ export const fileProviderS3Feature = defineFeature(FEATURE_NAME, (r) => {
   r.requires("file-foundation");
 
   const secretAccessKey = r.secret("s3.secretAccessKey", {
-    label: { de: "S3 Secret Access Key", en: "S3 Secret Access Key" },
+    label: { en: "S3 Secret Access Key" },
     hint: {
-      de: "Privater Teil des S3-Schlüsselpaares. Bei Hetzner Object Storage 'Secret Key', bei AWS S3 'Secret Access Key'.",
       en: "Private half of the S3 key pair. Hetzner calls it 'Secret Key', AWS calls it 'Secret Access Key'.",
     },
     redact: (plaintext) => {

package/src/form-draft/__tests__/cleanup.integration.test.ts

@@ -165,15 +165,14 @@ async function dispatchCleanup(): Promise<void> {
 
 describe("form-draft cleanup job", () => {
   // FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY (cleanup.job.ts) is a hardcoded
-  // literal that must match the qualified name r.config({ keys: {
-  // retentionDays: ... } }) derives internally in feature.ts — nothing
-  // else ties the two together, so a rename of the `retentionDays` config
-  // key there would silently desync them. This recomputes the derivation
-  // and fails loudly if that ever happens.
-  test("FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY matches the qualified name feature.ts derives for retentionDays", () => {
-    expect(FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY).toBe(
-      qn(toKebab(FORM_DRAFT_FEATURE_NAME), "config", toKebab("retentionDays")),
+  // literal that must match a key actually registered by formDraftFeature.
+  // Assert against the feature's configKeys (not a hand-rebuilt qn string),
+  // so renaming the key in feature.ts without updating the constant fails.
+  test("FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY is among formDraftFeature registered config keys", () => {
+    const registered = Object.keys(formDraftFeature.configKeys ?? {}).map((key) =>
+      qn(toKebab(FORM_DRAFT_FEATURE_NAME), "config", toKebab(key)),
     );
+    expect(registered).toContain(FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY);
   });
 
   test("deletes a draft older than the default retention window, leaves a fresh one alone", async () => {

package/src/form-draft/handlers/cleanup.job.ts

@@ -6,7 +6,11 @@
 // Chunked DELETE (default 1000/batch) keeps lock durations bounded, mirror
 // of sessions/handlers/cleanup.job.ts.
 
-import { createTenantDb, type DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEventStoreExecutor,
+  createTenantDb,
+  type DbConnection,
+} from "@cosmicdrift/kumiko-framework/db";
 import {
   type AppContext,
   access,
@@ -19,11 +23,16 @@ import {
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { fileRefEntity, fileRefsTable } from "@cosmicdrift/kumiko-framework/files";
 import { type StaleDraftRow, selectStaleDraftsBatch } from "../db/queries/cleanup";
-import { filterOwnedStorageKeys } from "../db/queries/owned-file-refs";
+import { filterOwnedFileRefs } from "../db/queries/owned-file-refs";
 import { formDraftExecutor } from "../executor";
 import { collectDraftFileRefKeys, releaseDraftFileRefs } from "../release-file-refs";
 
+const fileRefExecutor = createEventStoreExecutor(fileRefsTable, fileRefEntity, {
+  entityName: "fileRef",
+});
+
 export const FORM_DRAFT_RETENTION_DAYS_CONFIG_KEY = "form-draft:config:retention-days";
 export const FORM_DRAFT_DEFAULT_RETENTION_DAYS = 30;
 const DEFAULT_BATCH_SIZE = 1000;
@@ -48,27 +57,15 @@ async function releaseRowFileRefs(
   // skip: no FileRefs in this row's blob — nothing to release.
   if (keys.length === 0) return;
   if (!fileProviderResolver) {
-    // skip: no resolver wired (files feature not mounted) — row still
-    // gets deleted below, but its FileRefs leak as storage orphans.
     log?.warn?.(
       `[form-draft:cleanup] tenant=${row.tenantId} has ${keys.length} FileRef(s) but no _fileProviderResolver is wired — row will be deleted without releasing storage`,
     );
-    // skip: warning already logged above — nothing more to do for this row.
+    // skip: no provider wired — cannot release storage; row deletion proceeds anyway.
     return;
   }
 
-  // Only storageKeys with a real file_refs row owned by this row's draft
-  // owner are releasable — `draft.values` is free-form JSON the owning user
-  // controls, so an unverified key could target someone else's file (see
-  // db/queries/owned-file-refs.ts). Not wrapped in try/catch: a query
-  // failure here (pool exhaustion, missing table) is a real error, not the
-  // "no provider resolvable" case below — let it propagate so the job retries.
-  //
-  // Create-mode draftKey (`${screenId}:new:${draftId}`) mints its draftId
-  // lazily on the first step-change — a file uploaded before that exists
-  // predates the draft row, so the insertedAt filter must not apply.
   const isCreateMode = row.draftKey.includes(":new:");
-  const ownedKeys = await filterOwnedStorageKeys(
+  const ownedRefs = await filterOwnedFileRefs(
     db,
     row.tenantId,
     row.ownerId,
@@ -76,10 +73,23 @@ async function releaseRowFileRefs(
     row.insertedAt,
     isCreateMode,
   );
-
+  const systemUser = createSystemUser(row.tenantId);
+  const tenantDb = createTenantDb(db, row.tenantId, "system");
+  for (const ref of ownedRefs) {
+    const forgetResult = await fileRefExecutor.forget({ id: ref.id }, systemUser, tenantDb);
+    if (!forgetResult.isSuccess) {
+      log?.warn?.(
+        `[form-draft:cleanup] fileRef.forget failed for id=${ref.id} tenant=${row.tenantId}`,
+      );
+    }
+  }
   try {
     const provider = await fileProviderResolver(row.tenantId);
-    await releaseDraftFileRefs(ownedKeys, (key) => provider.delete(key), log);
+    await releaseDraftFileRefs(
+      ownedRefs.map((ref) => ref.storageKey),
+      (key) => provider.delete(key),
+      log,
+    );
   } catch (err) {
     log?.warn?.(
       `[form-draft:cleanup] no file provider resolvable for tenant=${row.tenantId} — FileRefs NOT released (row still deleted): ${err instanceof Error ? err.message : String(err)}`,
@@ -132,9 +142,9 @@ async function deleteStaleDraftsBatch(
 }
 
 export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
-  if (!ctx.db || !ctx.registry) {
+  if (!ctx.db) {
     throw new InternalError({
-      message: "[form-draft:cleanup] ctx.db + ctx.registry required (JobContext incomplete)",
+      message: "[form-draft:cleanup] ctx.db required (JobContext incomplete)",
     });
   }
   const db = ctx.db as DbConnection;
@@ -163,6 +173,7 @@ export const cleanupDraftsJob: JobHandlerFn = async (_payload, ctx) => {
 
   let deleted = 0;
   while (true) {
+    if (ctx.signal?.aborted) break;
     const batch = await selectStaleDraftsBatch(db, retentionDays, DEFAULT_BATCH_SIZE);
     if (batch.length === 0) break;
 

package/src/form-draft/handlers/discard.write.ts

@@ -66,17 +66,17 @@ export const discardDraftWrite = defineWriteHandler({
         existing.insertedAt,
         isCreateMode,
       );
-      const refsByStorageKey = new Map(ownedRefs.map((ref) => [ref.storageKey, ref]));
+      // Fail-closed erase of file_refs rows FIRST (outside the best-effort
+      // storage-hygiene loop). releaseDraftFileRefs swallows per-key errors
+      // by design — routing forget through it would report discarded:true
+      // while leaving the row behind (#1922 / review #2009).
+      for (const ref of ownedRefs) {
+        const forgetResult = await fileRefExecutor.forget({ id: ref.id }, event.user, ctx.db);
+        if (!forgetResult.isSuccess) return forgetResult;
+      }
       await releaseDraftFileRefs(
         ownedRefs.map((ref) => ref.storageKey),
         async (key) => {
-          // Hard-erase via the executor first (fileRef.forgotten — row +
-          // event, rebuild-safe), then the binary. A raw provider.delete()
-          // alone left the file_refs row behind forever (kumiko-framework
-          // review #1922): no event, no projection update, the row just
-          // pointed at a storage key that no longer existed.
-          const ref = refsByStorageKey.get(key);
-          if (ref !== undefined) await fileRefExecutor.forget({ id: ref.id }, event.user, ctx.db);
           await files.ref(key).delete();
         },
         ctx.log,

package/src/inbound-mail-foundation/__tests__/watch-supervisor.integration.test.ts

@@ -569,4 +569,64 @@ describe("watch-supervisor — multi-worker watch coordination (#1719)", () => {
       await supervisorB.stop();
     }
   });
+
+  test("losing the lease (renew fails) tears down the local watcher and lets the peer take over", async () => {
+    const admin = adminFor(4202);
+    const accountId = await connectSharedAccount(admin);
+    const lock = createDistributedLock(stack.redis.redis, "test-watch-lease-lost:");
+    const a = makeWatchIngestCounter();
+    const b = makeWatchIngestCounter();
+    const supervisorA = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: a.dispatchWrite,
+      lock,
+      watchLeaseTtlSeconds: 1,
+      pollIntervalMs: 60_000,
+    });
+    const supervisorB = createInboundMailSupervisor({
+      providerCtx: { registry: stack.registry },
+      db,
+      dispatchWrite: b.dispatchWrite,
+      lock,
+      watchLeaseTtlSeconds: 1,
+      pollIntervalMs: 60_000,
+    });
+
+    try {
+      await supervisorA.start();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      // B's own start() polls too but must not claim the watch lease — A
+      // already holds it. Priming `running` here (rather than only calling
+      // pollOnce() later) mirrors the "peer takes over" test above.
+      await supervisorB.start();
+
+      // Simulate the lease expiring behind A's back (Redis TTL lapse, or an
+      // operator flushing the key) by deleting it directly. A's next renew
+      // heartbeat (`lock.renew`, every ttl/3) then finds a token mismatch,
+      // reports failure, and must tear down A's local IDLE connection.
+      await stack.redis.redis.del(`test-watch-lease-lost:${accountId}`);
+
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(false);
+      });
+
+      await supervisorB.pollOnce();
+      await waitFor(() => {
+        expect(isWatching(accountId)).toBe(true);
+      });
+
+      await seedInboundMessage(accountId, rawMsg({ providerMessageId: "mw-lost-1" }));
+      await waitFor(() => {
+        expect(b.watchIngestCount()).toBe(1);
+      });
+      expect(a.watchIngestCount()).toBe(0);
+    } finally {
+      await supervisorA.stop();
+      await supervisorB.stop();
+    }
+  });
 });

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -99,6 +99,18 @@ describe("jobRun direct writes", () => {
     expect(logs).toHaveLength(1);
   });
 
+  test("rounds fractional job duration to an integer millisecond value", async () => {
+    await logger.onJobStart?.("example:job:timing", "bull-timing", {});
+    // Pass a fractional ms value directly — Temporal DurationLike.nanoseconds
+    // is absolute ns (5e8 = 500ms), not a sub-ms fraction.
+    await logger.onJobComplete?.("example:job:timing", "bull-timing", 150.5, []);
+
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-timing" });
+    expect(runs).toHaveLength(1);
+    expect(Number.isInteger(runs[0]?.duration)).toBe(true);
+    expect(runs[0]?.duration).toBe(151);
+  });
+
   test("start + complete both act on the SAME row", async () => {
     await logger.onJobStart?.("example:job:stream", "bull-99", {});
     await logger.onJobComplete?.("example:job:stream", "bull-99", 10, []);

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -104,6 +104,28 @@ describe("jobs run-started payload under KMS", () => {
     expect(after["payload"]).toBe(PII_ERASED_SENTINEL);
   });
 
+  // Mirrors the log-message/error cases below: a key already erased by the
+  // time a new run starts must not blow up onJobStart itself — the run row
+  // still has to land, even if the triggering user's key is gone.
+  test("erase subject key BEFORE onJobStart: payload lands as [[erased]] instead of throwing", async () => {
+    // First run creates the subject's key — eraseKey is a no-op on an
+    // unknown subject (InMemoryKmsAdapter's tombstone contract), so the key
+    // has to exist before it can be erased.
+    await logger.onJobStart?.("app:job:export", "bull-2b", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+
+    await logger.onJobStart?.("app:job:export", "bull-2c", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-2c" });
+    expect(row?.["payload"]).toBe(PII_ERASED_SENTINEL);
+  });
+
   test("system run (no triggeredById) stays plaintext — no subject to shred", async () => {
     await logger.onJobStart?.("app:job:cron-sweep", "bull-3", {
       payload: JSON.stringify({ scope: "all" }),
@@ -204,35 +226,104 @@ describe("jobs run-completed/-failed log messages under KMS (#2247)", () => {
     expect(logs[0]?.["message"]).toBe(SECRET_LOG);
   });
 
-  // Documents a gap rather than fixing it: if the subject's key is erased
-  // between onJobStart and onJobComplete, encryptLogMessages' getOrCreateDek
-  // throws KeyErasedError — same propagate-on-erased-key behavior as
-  // onJobStart's own encryptStartedPayload (no catch there either). Here the
-  // status updateMany already ran before the log insert throws, so the run
-  // is left "completed" with its log batch dropped instead of forging a
-  // plaintext fallback. Same wedge-state class #2246 tracks (job runs stuck
-  // after abnormal termination) — not something this PR fixes.
-  test("erase subject key BEFORE onJobComplete: log encryption throws, run status already landed as completed", async () => {
+  // #2307: a key erased between onJobStart and onJobComplete no longer
+  // blows up the callback. encryptLogMessages catches KeyErasedError per
+  // log line and falls back to the sentinel (mirroring
+  // decryptPiiValueForSubject on the read side) instead of throwing and
+  // dropping the whole batch — the status updateMany already committed by
+  // this point, so a thrown error would lose the log batch for nothing.
+  test("erase subject key BEFORE onJobComplete: log message lands as [[erased]] instead of throwing", async () => {
     await logger.onJobStart?.("app:job:export", "bull-c5", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,
     });
     await kms.eraseKey({ kind: "user", userId: USER_ID });
 
-    let threw = false;
-    try {
-      await logger.onJobComplete?.("app:job:export", "bull-c5", 5, [
-        { level: "info", message: SECRET_LOG, timestamp: Temporal.Now.instant() },
-      ]);
-    } catch {
-      threw = true;
-    }
-    expect(threw).toBe(true);
+    await logger.onJobComplete?.("app:job:export", "bull-c5", 5, [
+      { level: "info", message: SECRET_LOG, timestamp: Temporal.Now.instant() },
+    ]);
 
     const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-c5" });
     expect(row?.["status"]).toBe("completed");
     const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: await runIdFor("bull-c5") });
-    expect(logs).toHaveLength(0);
+    expect(logs).toHaveLength(1);
+    expect(logs[0]?.["message"]).toBe(PII_ERASED_SENTINEL);
+  });
+});
+
+// #2307: onJobFailed's `error` argument was the one plaintext leak left in
+// this table — encryptLogMessages already encrypted logs[].message under
+// the same triggeredById, but the sibling `error` column (same underlying
+// string in job-runner.ts, since it pushes errorMsg into both the log
+// batch and the onJobFailed argument) stayed plaintext. Same subject, same
+// encrypt-under-DEK treatment, same skip rules as the logs above.
+describe("jobs run-failed error column under KMS (#2307)", () => {
+  const SECRET_ERROR = "export failed for iban DE89370400440532013000";
+
+  async function runIdFor(bullJobId: string): Promise<string> {
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId });
+    return String(row?.["id"]);
+  }
+
+  test("onJobFailed: stored error column is ciphertext, decrypts to original", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e1", { triggeredById: USER_ID });
+    await logger.onJobFailed?.("app:job:export", "bull-e1", SECRET_ERROR, []);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e1") });
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+    expect(String(row?.["error"])).toContain(`user:${USER_ID}`);
+
+    const back = await decryptPiiFieldValues({ error: row?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(back["error"]).toBe(SECRET_ERROR);
+  });
+
+  test("erase subject key after write → error column decrypts to [[erased]]", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e2", { triggeredById: USER_ID });
+    await logger.onJobFailed?.("app:job:export", "bull-e2", SECRET_ERROR, []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e2") });
+
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+    const after = await decryptPiiFieldValues({ error: row?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(after["error"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  // Mirrors the log-message case above: a key erased between onJobStart and
+  // onJobFailed must not blow up the failure callback — the run's own
+  // failure still has to land, even if the triggering user's key is gone.
+  test("erase subject key BEFORE onJobFailed: error column lands as [[erased]] instead of throwing", async () => {
+    // payload creates the subject's key during onJobStart — eraseKey is a
+    // no-op on an unknown subject (InMemoryKmsAdapter's tombstone contract),
+    // so the key has to exist before it can be erased.
+    await logger.onJobStart?.("app:job:export", "bull-e3", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+
+    await logger.onJobFailed?.("app:job:export", "bull-e3", SECRET_ERROR, []);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e3") });
+    expect(row?.["status"]).toBe("failed");
+    expect(row?.["error"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("system run (no triggeredById) → error column stays plaintext", async () => {
+    await logger.onJobStart?.("app:job:cron-sweep", "bull-e4", {});
+    await logger.onJobFailed?.("app:job:cron-sweep", "bull-e4", "plain sweep failure", []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e4") });
+    expect(row?.["error"]).toBe("plain sweep failure");
+  });
+
+  test("without a KMS the error column stays plaintext (rollout mode)", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e5", { triggeredById: USER_ID });
+    resetPiiSubjectKmsForTests();
+    await logger.onJobFailed?.("app:job:export", "bull-e5", SECRET_ERROR, []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e5") });
+    expect(row?.["error"]).toBe(SECRET_ERROR);
   });
 });
 
@@ -242,7 +333,7 @@ describe("jobs run-completed/-failed log messages under KMS (#2247)", () => {
 // jobs:query:details HTTP handler so a regression in those eleven lines
 // (wrong AAD field name, log-array key access, the row/log spread) fails a
 // test instead of shipping ciphertext to the job-run detail screen.
-describe("jobs:query:details decrypts log messages end-to-end (#2247)", () => {
+describe("jobs:query:details decrypts log messages and error end-to-end (#2247, #2307)", () => {
   let detailStack: TestStack;
   let detailLogger: ReturnType<typeof createJobRunLogger>;
 
@@ -293,4 +384,51 @@ describe("jobs:query:details decrypts log messages end-to-end (#2247)", () => {
     expect(result.logs).toHaveLength(1);
     expect(result.logs[0]?.message).toBe(SECRET_DETAIL_LOG);
   });
+
+  test("jobs:query:details returns plaintext error even though the stored row is ciphertext", async () => {
+    const SECRET_DETAIL_ERROR = "export failed for iban DE89370400440532013000";
+    await detailLogger.onJobStart?.("app:job:export", "bull-detail-2", {
+      triggeredById: DETAIL_USER_ID,
+    });
+    await detailLogger.onJobFailed?.("app:job:export", "bull-detail-2", SECRET_DETAIL_ERROR, []);
+
+    const row = await fetchOne(detailStack.db, jobRunsTable, { bullJobId: "bull-detail-2" });
+    const runId = String(row?.["id"]);
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+
+    const result = await detailStack.http.queryOk<{ error: string }>(
+      JobQueries.details,
+      { runId },
+      TestUsers.systemAdmin,
+    );
+
+    expect(result.error).toBe(SECRET_DETAIL_ERROR);
+  });
+
+  test("jobs:query:list returns plaintext payload + error even though the stored row is ciphertext", async () => {
+    const SECRET_LIST_ERROR = "export failed for iban DE89370400440532013000";
+    // Distinct jobName + filter — this describe block's beforeEach swaps in a
+    // brand-new KMS per test, so earlier tests' rows are still in this
+    // shared table but encrypted under keys the current KMS instance no
+    // longer holds. An unfiltered list() would sweep those up too and fail
+    // to decrypt them.
+    const jobName = "app:job:export-list-pii-test";
+    await detailLogger.onJobStart?.(jobName, "bull-detail-3", {
+      triggeredById: DETAIL_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await detailLogger.onJobFailed?.(jobName, "bull-detail-3", SECRET_LIST_ERROR, []);
+
+    const row = await fetchOne(detailStack.db, jobRunsTable, { bullJobId: "bull-detail-3" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+
+    const result = await detailStack.http.queryOk<{
+      rows: readonly { id: string; payload: string | null; error: string | null }[];
+    }>(JobQueries.list, { jobName, limit: 50 }, TestUsers.systemAdmin);
+
+    const listed = result.rows.find((r) => r.id === String(row?.["id"]));
+    expect(listed?.payload).toBe(SECRET_PAYLOAD);
+    expect(listed?.error).toBe(SECRET_LIST_ERROR);
+  });
 });

package/src/jobs/feature.ts

@@ -56,7 +56,7 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
     r.job(
       "projectionRebuild",
-      { trigger: { manual: true }, schema: projectionRebuildPayloadSchema },
+      { trigger: { manual: true }, concurrency: "skip", schema: projectionRebuildPayloadSchema },
       projectionRebuildJob,
     );
 
@@ -66,7 +66,12 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     // too, not just cron).
     r.job(
       "reindexEntity",
-      { trigger: { manual: true }, perTenant: true, schema: reindexEntityPayloadSchema },
+      {
+        trigger: { manual: true },
+        perTenant: true,
+        concurrency: "skip",
+        schema: reindexEntityPayloadSchema,
+      },
       reindexEntityJob,
     );
 

package/src/jobs/handlers/detail.query.ts

@@ -2,9 +2,14 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
+// Matches job-run-logger.ts's KMS_POOL_CONCURRENCY / the tenant handlers'
+// KMS_POOL_CONCURRENCY — bounds concurrent decrypt calls against the KMS
+// adapter's connection pool.
+const KMS_POOL_CONCURRENCY = 4;
+
 export const detailQuery = defineQueryHandler({
   name: "details",
   // Post-ES: runId is the uuid aggregate-id of the jobRun event-stream.
@@ -30,6 +35,12 @@ export const detailQuery = defineQueryHandler({
       row["payload"] = await decryptStoredPii(row["payload"], "payload", "job-run-detail");
     }
 
+    // error is stored encrypted under the triggering user's DEK (#2307),
+    // same mechanism as row.payload above.
+    if (typeof row["error"] === "string") {
+      row["error"] = await decryptStoredPii(row["error"], "error", "job-run-detail");
+    }
+
     const logs = await selectMany(
       db,
       jobRunLogsTable,
@@ -40,16 +51,16 @@ export const detailQuery = defineQueryHandler({
     );
 
     // message is stored encrypted under the triggering user's DEK (#2247),
-    // same mechanism as row.payload above.
-    const decryptedLogs = await Promise.all(
-      logs.map(async (log) => {
-        if (typeof log["message"] !== "string") return log;
-        return {
-          ...log,
-          message: await decryptStoredPii(log["message"], "message", "job-run-detail-log"),
-        };
-      }),
-    );
+    // same mechanism as row.payload above. Bounded concurrency (#2307) —
+    // unbounded Promise.all would fire one decrypt per log line at once
+    // against the KMS adapter's pool.
+    const decryptedLogs = await mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => {
+      if (typeof log["message"] !== "string") return log;
+      return {
+        ...log,
+        message: await decryptStoredPii(log["message"], "message", "job-run-detail-log"),
+      };
+    });
 
     return { ...row, logs: decryptedLogs };
   },

package/src/jobs/handlers/list.query.ts

@@ -2,12 +2,23 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
 
-async function decryptRunPayload<T extends Record<string, unknown>>(row: T): Promise<T> {
-  if (typeof row["payload"] !== "string") return row;
-  return { ...row, payload: await decryptStoredPii(row["payload"], "payload", "job-runs") };
+const KMS_POOL_CONCURRENCY = 4;
+
+async function decryptRunRow<T extends Record<string, unknown>>(row: T): Promise<T> {
+  let result = row;
+  if (typeof result["payload"] === "string") {
+    result = {
+      ...result,
+      payload: await decryptStoredPii(result["payload"], "payload", "job-runs"),
+    };
+  }
+  if (typeof result["error"] === "string") {
+    result = { ...result, error: await decryptStoredPii(result["error"], "error", "job-runs") };
+  }
+  return result;
 }
 
 export const listQuery = defineQueryHandler({
@@ -32,7 +43,7 @@ export const listQuery = defineQueryHandler({
       orderBy: { col: "id", direction: "desc" },
       limit: query.payload.limit ?? 50,
     });
-    // payload is stored encrypted under the triggering user's DEK (#799).
-    return { rows: await Promise.all(rows.map(decryptRunPayload)) };
+    // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
+    return { rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow) };
   },
 });