@cosmicdrift/kumiko-bundled-features 0.220.1 → 0.221.0

package/src/jobs/__tests__/jobs-events.integration.test.ts

@@ -99,6 +99,18 @@ describe("jobRun direct writes", () => {
     expect(logs).toHaveLength(1);
   });
 
+  test("rounds fractional job duration to an integer millisecond value", async () => {
+    await logger.onJobStart?.("example:job:timing", "bull-timing", {});
+    // Pass a fractional ms value directly — Temporal DurationLike.nanoseconds
+    // is absolute ns (5e8 = 500ms), not a sub-ms fraction.
+    await logger.onJobComplete?.("example:job:timing", "bull-timing", 150.5, []);
+
+    const runs = await selectMany(testDb.db, jobRunsTable, { bullJobId: "bull-timing" });
+    expect(runs).toHaveLength(1);
+    expect(Number.isInteger(runs[0]?.duration)).toBe(true);
+    expect(runs[0]?.duration).toBe(151);
+  });
+
   test("start + complete both act on the SAME row", async () => {
     await logger.onJobStart?.("example:job:stream", "bull-99", {});
     await logger.onJobComplete?.("example:job:stream", "bull-99", 10, []);

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -104,6 +104,28 @@ describe("jobs run-started payload under KMS", () => {
     expect(after["payload"]).toBe(PII_ERASED_SENTINEL);
   });
 
+  // Mirrors the log-message/error cases below: a key already erased by the
+  // time a new run starts must not blow up onJobStart itself — the run row
+  // still has to land, even if the triggering user's key is gone.
+  test("erase subject key BEFORE onJobStart: payload lands as [[erased]] instead of throwing", async () => {
+    // First run creates the subject's key — eraseKey is a no-op on an
+    // unknown subject (InMemoryKmsAdapter's tombstone contract), so the key
+    // has to exist before it can be erased.
+    await logger.onJobStart?.("app:job:export", "bull-2b", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+
+    await logger.onJobStart?.("app:job:export", "bull-2c", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-2c" });
+    expect(row?.["payload"]).toBe(PII_ERASED_SENTINEL);
+  });
+
   test("system run (no triggeredById) stays plaintext — no subject to shred", async () => {
     await logger.onJobStart?.("app:job:cron-sweep", "bull-3", {
       payload: JSON.stringify({ scope: "all" }),
@@ -204,35 +226,104 @@ describe("jobs run-completed/-failed log messages under KMS (#2247)", () => {
     expect(logs[0]?.["message"]).toBe(SECRET_LOG);
   });
 
-  // Documents a gap rather than fixing it: if the subject's key is erased
-  // between onJobStart and onJobComplete, encryptLogMessages' getOrCreateDek
-  // throws KeyErasedError — same propagate-on-erased-key behavior as
-  // onJobStart's own encryptStartedPayload (no catch there either). Here the
-  // status updateMany already ran before the log insert throws, so the run
-  // is left "completed" with its log batch dropped instead of forging a
-  // plaintext fallback. Same wedge-state class #2246 tracks (job runs stuck
-  // after abnormal termination) — not something this PR fixes.
-  test("erase subject key BEFORE onJobComplete: log encryption throws, run status already landed as completed", async () => {
+  // #2307: a key erased between onJobStart and onJobComplete no longer
+  // blows up the callback. encryptLogMessages catches KeyErasedError per
+  // log line and falls back to the sentinel (mirroring
+  // decryptPiiValueForSubject on the read side) instead of throwing and
+  // dropping the whole batch — the status updateMany already committed by
+  // this point, so a thrown error would lose the log batch for nothing.
+  test("erase subject key BEFORE onJobComplete: log message lands as [[erased]] instead of throwing", async () => {
     await logger.onJobStart?.("app:job:export", "bull-c5", {
       triggeredById: USER_ID,
       payload: SECRET_PAYLOAD,
     });
     await kms.eraseKey({ kind: "user", userId: USER_ID });
 
-    let threw = false;
-    try {
-      await logger.onJobComplete?.("app:job:export", "bull-c5", 5, [
-        { level: "info", message: SECRET_LOG, timestamp: Temporal.Now.instant() },
-      ]);
-    } catch {
-      threw = true;
-    }
-    expect(threw).toBe(true);
+    await logger.onJobComplete?.("app:job:export", "bull-c5", 5, [
+      { level: "info", message: SECRET_LOG, timestamp: Temporal.Now.instant() },
+    ]);
 
     const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId: "bull-c5" });
     expect(row?.["status"]).toBe("completed");
     const logs = await selectMany(testDb.db, jobRunLogsTable, { runId: await runIdFor("bull-c5") });
-    expect(logs).toHaveLength(0);
+    expect(logs).toHaveLength(1);
+    expect(logs[0]?.["message"]).toBe(PII_ERASED_SENTINEL);
+  });
+});
+
+// #2307: onJobFailed's `error` argument was the one plaintext leak left in
+// this table — encryptLogMessages already encrypted logs[].message under
+// the same triggeredById, but the sibling `error` column (same underlying
+// string in job-runner.ts, since it pushes errorMsg into both the log
+// batch and the onJobFailed argument) stayed plaintext. Same subject, same
+// encrypt-under-DEK treatment, same skip rules as the logs above.
+describe("jobs run-failed error column under KMS (#2307)", () => {
+  const SECRET_ERROR = "export failed for iban DE89370400440532013000";
+
+  async function runIdFor(bullJobId: string): Promise<string> {
+    const row = await fetchOne(testDb.db, jobRunsTable, { bullJobId });
+    return String(row?.["id"]);
+  }
+
+  test("onJobFailed: stored error column is ciphertext, decrypts to original", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e1", { triggeredById: USER_ID });
+    await logger.onJobFailed?.("app:job:export", "bull-e1", SECRET_ERROR, []);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e1") });
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+    expect(String(row?.["error"])).toContain(`user:${USER_ID}`);
+
+    const back = await decryptPiiFieldValues({ error: row?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(back["error"]).toBe(SECRET_ERROR);
+  });
+
+  test("erase subject key after write → error column decrypts to [[erased]]", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e2", { triggeredById: USER_ID });
+    await logger.onJobFailed?.("app:job:export", "bull-e2", SECRET_ERROR, []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e2") });
+
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+    const after = await decryptPiiFieldValues({ error: row?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(after["error"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  // Mirrors the log-message case above: a key erased between onJobStart and
+  // onJobFailed must not blow up the failure callback — the run's own
+  // failure still has to land, even if the triggering user's key is gone.
+  test("erase subject key BEFORE onJobFailed: error column lands as [[erased]] instead of throwing", async () => {
+    // payload creates the subject's key during onJobStart — eraseKey is a
+    // no-op on an unknown subject (InMemoryKmsAdapter's tombstone contract),
+    // so the key has to exist before it can be erased.
+    await logger.onJobStart?.("app:job:export", "bull-e3", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+
+    await logger.onJobFailed?.("app:job:export", "bull-e3", SECRET_ERROR, []);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e3") });
+    expect(row?.["status"]).toBe("failed");
+    expect(row?.["error"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("system run (no triggeredById) → error column stays plaintext", async () => {
+    await logger.onJobStart?.("app:job:cron-sweep", "bull-e4", {});
+    await logger.onJobFailed?.("app:job:cron-sweep", "bull-e4", "plain sweep failure", []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e4") });
+    expect(row?.["error"]).toBe("plain sweep failure");
+  });
+
+  test("without a KMS the error column stays plaintext (rollout mode)", async () => {
+    await logger.onJobStart?.("app:job:export", "bull-e5", { triggeredById: USER_ID });
+    resetPiiSubjectKmsForTests();
+    await logger.onJobFailed?.("app:job:export", "bull-e5", SECRET_ERROR, []);
+    const row = await fetchOne(testDb.db, jobRunsTable, { id: await runIdFor("bull-e5") });
+    expect(row?.["error"]).toBe(SECRET_ERROR);
   });
 });
 
@@ -242,7 +333,7 @@ describe("jobs run-completed/-failed log messages under KMS (#2247)", () => {
 // jobs:query:details HTTP handler so a regression in those eleven lines
 // (wrong AAD field name, log-array key access, the row/log spread) fails a
 // test instead of shipping ciphertext to the job-run detail screen.
-describe("jobs:query:details decrypts log messages end-to-end (#2247)", () => {
+describe("jobs:query:details decrypts log messages and error end-to-end (#2247, #2307)", () => {
   let detailStack: TestStack;
   let detailLogger: ReturnType<typeof createJobRunLogger>;
 
@@ -293,4 +384,51 @@ describe("jobs:query:details decrypts log messages end-to-end (#2247)", () => {
     expect(result.logs).toHaveLength(1);
     expect(result.logs[0]?.message).toBe(SECRET_DETAIL_LOG);
   });
+
+  test("jobs:query:details returns plaintext error even though the stored row is ciphertext", async () => {
+    const SECRET_DETAIL_ERROR = "export failed for iban DE89370400440532013000";
+    await detailLogger.onJobStart?.("app:job:export", "bull-detail-2", {
+      triggeredById: DETAIL_USER_ID,
+    });
+    await detailLogger.onJobFailed?.("app:job:export", "bull-detail-2", SECRET_DETAIL_ERROR, []);
+
+    const row = await fetchOne(detailStack.db, jobRunsTable, { bullJobId: "bull-detail-2" });
+    const runId = String(row?.["id"]);
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+
+    const result = await detailStack.http.queryOk<{ error: string }>(
+      JobQueries.details,
+      { runId },
+      TestUsers.systemAdmin,
+    );
+
+    expect(result.error).toBe(SECRET_DETAIL_ERROR);
+  });
+
+  test("jobs:query:list returns plaintext payload + error even though the stored row is ciphertext", async () => {
+    const SECRET_LIST_ERROR = "export failed for iban DE89370400440532013000";
+    // Distinct jobName + filter — this describe block's beforeEach swaps in a
+    // brand-new KMS per test, so earlier tests' rows are still in this
+    // shared table but encrypted under keys the current KMS instance no
+    // longer holds. An unfiltered list() would sweep those up too and fail
+    // to decrypt them.
+    const jobName = "app:job:export-list-pii-test";
+    await detailLogger.onJobStart?.(jobName, "bull-detail-3", {
+      triggeredById: DETAIL_USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await detailLogger.onJobFailed?.(jobName, "bull-detail-3", SECRET_LIST_ERROR, []);
+
+    const row = await fetchOne(detailStack.db, jobRunsTable, { bullJobId: "bull-detail-3" });
+    expect(isPiiCiphertext(row?.["payload"])).toBe(true);
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+
+    const result = await detailStack.http.queryOk<{
+      rows: readonly { id: string; payload: string | null; error: string | null }[];
+    }>(JobQueries.list, { jobName, limit: 50 }, TestUsers.systemAdmin);
+
+    const listed = result.rows.find((r) => r.id === String(row?.["id"]));
+    expect(listed?.payload).toBe(SECRET_PAYLOAD);
+    expect(listed?.error).toBe(SECRET_LIST_ERROR);
+  });
 });

package/src/jobs/feature.ts

@@ -56,7 +56,7 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     // Framework-provided rebuild job — available whenever `jobs` is composed; enqueueProjectionRebuild dispatches it.
     r.job(
       "projectionRebuild",
-      { trigger: { manual: true }, schema: projectionRebuildPayloadSchema },
+      { trigger: { manual: true }, concurrency: "skip", schema: projectionRebuildPayloadSchema },
       projectionRebuildJob,
     );
 
@@ -66,7 +66,12 @@ export function createJobsFeature(options: JobsFeatureOptions = {}): FeatureDefi
     // too, not just cron).
     r.job(
       "reindexEntity",
-      { trigger: { manual: true }, perTenant: true, schema: reindexEntityPayloadSchema },
+      {
+        trigger: { manual: true },
+        perTenant: true,
+        concurrency: "skip",
+        schema: reindexEntityPayloadSchema,
+      },
       reindexEntityJob,
     );
 

package/src/jobs/handlers/detail.query.ts

@@ -2,9 +2,14 @@ import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
+// Matches job-run-logger.ts's KMS_POOL_CONCURRENCY / the tenant handlers'
+// KMS_POOL_CONCURRENCY — bounds concurrent decrypt calls against the KMS
+// adapter's connection pool.
+const KMS_POOL_CONCURRENCY = 4;
+
 export const detailQuery = defineQueryHandler({
   name: "details",
   // Post-ES: runId is the uuid aggregate-id of the jobRun event-stream.
@@ -30,6 +35,12 @@ export const detailQuery = defineQueryHandler({
       row["payload"] = await decryptStoredPii(row["payload"], "payload", "job-run-detail");
     }
 
+    // error is stored encrypted under the triggering user's DEK (#2307),
+    // same mechanism as row.payload above.
+    if (typeof row["error"] === "string") {
+      row["error"] = await decryptStoredPii(row["error"], "error", "job-run-detail");
+    }
+
     const logs = await selectMany(
       db,
       jobRunLogsTable,
@@ -40,16 +51,16 @@ export const detailQuery = defineQueryHandler({
     );
 
     // message is stored encrypted under the triggering user's DEK (#2247),
-    // same mechanism as row.payload above.
-    const decryptedLogs = await Promise.all(
-      logs.map(async (log) => {
-        if (typeof log["message"] !== "string") return log;
-        return {
-          ...log,
-          message: await decryptStoredPii(log["message"], "message", "job-run-detail-log"),
-        };
-      }),
-    );
+    // same mechanism as row.payload above. Bounded concurrency (#2307) —
+    // unbounded Promise.all would fire one decrypt per log line at once
+    // against the KMS adapter's pool.
+    const decryptedLogs = await mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => {
+      if (typeof log["message"] !== "string") return log;
+      return {
+        ...log,
+        message: await decryptStoredPii(log["message"], "message", "job-run-detail-log"),
+      };
+    });
 
     return { ...row, logs: decryptedLogs };
   },

package/src/jobs/handlers/list.query.ts

@@ -2,12 +2,23 @@ import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { z } from "zod";
-import { decryptStoredPii } from "../../shared";
+import { decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
 
-async function decryptRunPayload<T extends Record<string, unknown>>(row: T): Promise<T> {
-  if (typeof row["payload"] !== "string") return row;
-  return { ...row, payload: await decryptStoredPii(row["payload"], "payload", "job-runs") };
+const KMS_POOL_CONCURRENCY = 4;
+
+async function decryptRunRow<T extends Record<string, unknown>>(row: T): Promise<T> {
+  let result = row;
+  if (typeof result["payload"] === "string") {
+    result = {
+      ...result,
+      payload: await decryptStoredPii(result["payload"], "payload", "job-runs"),
+    };
+  }
+  if (typeof result["error"] === "string") {
+    result = { ...result, error: await decryptStoredPii(result["error"], "error", "job-runs") };
+  }
+  return result;
 }
 
 export const listQuery = defineQueryHandler({
@@ -32,7 +43,7 @@ export const listQuery = defineQueryHandler({
       orderBy: { col: "id", direction: "desc" },
       limit: query.payload.limit ?? 50,
     });
-    // payload is stored encrypted under the triggering user's DEK (#799).
-    return { rows: await Promise.all(rows.map(decryptRunPayload)) };
+    // payload/error are stored encrypted under the triggering user's DEK (#799, #2307).
+    return { rows: await mapWithConcurrency(rows, KMS_POOL_CONCURRENCY, decryptRunRow) };
   },
 });

package/src/jobs/job-run-logger.ts

@@ -2,15 +2,24 @@ import { fetchOne, insertMany, insertOne, updateMany } from "@cosmicdrift/kumiko
 import {
   configuredPiiSubjectKms,
   encryptPiiValueForSubject,
+  KeyErasedError,
+  type LocalKeyKmsAdapter,
+  PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
 import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
 import { type Registry, SYSTEM_TENANT_ID } from "@cosmicdrift/kumiko-framework/engine";
 import type { JobLogEntry, JobMeta, JobRunnerOptions } from "@cosmicdrift/kumiko-framework/jobs";
 import { generateId } from "@cosmicdrift/kumiko-framework/utils";
+import { mapWithConcurrency } from "../shared";
 import { runCompletedSchema, runFailedSchema, runStartedSchema } from "./events";
 import { parseJobInstant } from "./job-instant";
 import { jobRunLogsTable, jobRunsTable } from "./job-run-table";
 
+// Matches PgKmsAdapter's default pool size (see tenant/handlers/*.query.ts) —
+// bounds concurrent getOrCreateDek calls so a large log batch doesn't claim
+// every connection in the pool.
+const KMS_POOL_CONCURRENCY = 4;
+
 // Direct-write job-run log (#2243): onJobStart/-Complete/-Failed write
 // straight into jobRunsTable / jobRunLogsTable instead of appending to the
 // event store and replaying through inline projections. Pre-#2243 every run
@@ -44,27 +53,32 @@ const DEFAULT_CACHE_MAX_ENTRIES = 10_000;
 // to DB-lookup if actually needed.
 const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 
-// The run-started payload can carry arbitrary user data; triggeredById
-// names its owning user. No event-PII catalog involved (#2243 removed the
-// jobRun r.defineEvent registrations, so there is nothing to catalog) —
-// the subject is known statically, so we encrypt directly. A null subject
-// (system cron runs, recipient-less triggers) stays plaintext: there is no
-// user key to shred, mirroring the previous event-pii catalog's own skip
-// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
-async function encryptStartedPayload(
-  payload: string | null,
-  triggeredById: string | null,
-): Promise<string | null> {
-  if (payload === null || triggeredById === null) return payload;
-  const kms = configuredPiiSubjectKms();
-  if (!kms) return payload;
-  return encryptPiiValueForSubject(
-    kms,
-    { kind: "user", userId: triggeredById },
-    payload,
-    { requestId: "jobs:job-run-logger" },
-    "payload",
-  );
+// Same per-subject encryption as encryptFailureError/encryptStartedPayload,
+// applied to a single value — shared so payload/message/error all go
+// through the identical erased-key fallback. A key erased right before (or
+// between) any of these callbacks must not blow up the write (status is
+// already committed by the time logs/error land): fall back to the
+// sentinel like decryptPiiValueForSubject does on the read side, instead of
+// throwing and dropping the rest of the batch — or, for onJobStart, the
+// whole run row.
+async function encryptOrSentinel(
+  kms: LocalKeyKmsAdapter,
+  subjectUserId: string,
+  value: string,
+  field: string,
+): Promise<string> {
+  try {
+    return await encryptPiiValueForSubject(
+      kms,
+      { kind: "user", userId: subjectUserId },
+      value,
+      { requestId: "jobs:job-run-logger" },
+      field,
+    );
+  } catch (e) {
+    if (!(e instanceof KeyErasedError)) throw e;
+    return PII_ERASED_SENTINEL;
+  }
 }
 
 // Same per-subject encryption as encryptStartedPayload, applied to each
@@ -74,7 +88,8 @@ async function encryptStartedPayload(
 // field name and must match the field passed to decryptStoredPii on read
 // (detail.query.ts) or decrypt fails loud. Same skip rules as the payload:
 // null subject (system/cron runs) and absent KMS (rollout mode) both stay
-// plaintext.
+// plaintext. Bounded concurrency (#2307) — unbounded Promise.all would fire
+// one getOrCreateDek per log line at once against the KMS adapter's pool.
 async function encryptLogMessages<T extends { readonly message: string }>(
   logs: readonly T[],
   triggeredById: string | null,
@@ -82,18 +97,40 @@ async function encryptLogMessages<T extends { readonly message: string }>(
   if (triggeredById === null) return [...logs];
   const kms = configuredPiiSubjectKms();
   if (!kms) return [...logs];
-  return Promise.all(
-    logs.map(async (log) => ({
-      ...log,
-      message: await encryptPiiValueForSubject(
-        kms,
-        { kind: "user", userId: triggeredById },
-        log.message,
-        { requestId: "jobs:job-run-logger" },
-        "message",
-      ),
-    })),
-  );
+  return mapWithConcurrency(logs, KMS_POOL_CONCURRENCY, async (log) => ({
+    ...log,
+    message: await encryptOrSentinel(kms, triggeredById, log.message, "message"),
+  }));
+}
+
+// Mirrors encryptFailureError for the failure-path `error` column (#2307):
+// stored alongside logs[].message under the same triggering user's DEK, so
+// a log/error pair from the same failed run decrypt together or erase
+// together.
+async function encryptFailureError(error: string, triggeredById: string | null): Promise<string> {
+  if (triggeredById === null) return error;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return error;
+  return encryptOrSentinel(kms, triggeredById, error, "error");
+}
+
+// The run-started payload can carry arbitrary user data; triggeredById
+// names its owning user. No event-PII catalog involved (#2243 removed the
+// jobRun r.defineEvent registrations, so there is nothing to catalog) —
+// the subject is known statically, so we encrypt directly. A null subject
+// (system cron runs, recipient-less triggers) stays plaintext: there is no
+// user key to shred, mirroring the previous event-pii catalog's own skip
+// rule. Absent KMS adapter stays plaintext too (rollout mode, unchanged).
+// A key already erased by the time the trigger lands (#2307) must not fail
+// the whole run-start write — sentinel like the log/error paths.
+async function encryptStartedPayload(
+  payload: string | null,
+  triggeredById: string | null,
+): Promise<string | null> {
+  if (payload === null || triggeredById === null) return payload;
+  const kms = configuredPiiSubjectKms();
+  if (!kms) return payload;
+  return encryptOrSentinel(kms, triggeredById, payload, "payload");
 }
 
 export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallbacks {
@@ -225,7 +262,11 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
         jobRunsTable,
         {
           status: "completed",
-          duration: payload.duration,
+          // Clear stale-sweep error if the run finished after being marked failed.
+          error: null,
+          // integer column — match onJobFailed's Math.round so fractional
+          // BullMQ timings don't trip Postgres integer syntax.
+          duration: Math.round(payload.duration),
           finishedAt: parseJobInstant(payload.finishedAt),
           modifiedAt: Temporal.Now.instant(),
           modifiedById: "system",
@@ -279,12 +320,13 @@ export function createJobRunLogger(opts: JobRunLoggerOptions): JobRunLoggerCallb
           timestamp: l.timestamp.toString(),
         })),
       });
+      const encryptedError = await encryptFailureError(payload.error, triggeredById);
       await updateMany(
         db,
         jobRunsTable,
         {
           status: "failed",
-          error: payload.error,
+          error: encryptedError,
           duration: payload.duration,
           finishedAt: parseJobInstant(payload.finishedAt),
           modifiedAt: now,

package/src/jobs/web/job-run-detail-screen.tsx

@@ -83,7 +83,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "loading") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Text variant="small">{t("jobs.detail.loading")}</Text>
       </FormScreenShell>
     );
@@ -91,7 +91,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "missing") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Banner variant="error">{t("jobs.detail.missing")}</Banner>
       </FormScreenShell>
     );
@@ -99,7 +99,7 @@ export function JobRunDetailScreen(): ReactNode {
 
   if (state.kind === "error") {
     return (
-      <FormScreenShell testId="job-run-detail-screen">
+      <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl">
         <Banner variant="error">{state.message}</Banner>
       </FormScreenShell>
     );
@@ -108,7 +108,7 @@ export function JobRunDetailScreen(): ReactNode {
   const { run } = state;
 
   return (
-    <FormScreenShell testId="job-run-detail-screen" className="flex flex-col gap-6">
+    <FormScreenShell testId="job-run-detail-screen" maxWidth="3xl" className="flex flex-col gap-6">
       <Card slots={{ title: run.jobName }}>
         <dl className="grid gap-3 text-sm">
           <div>

package/src/mail-transport-smtp/feature.ts

@@ -62,9 +62,8 @@ export const mailTransportSmtpFeature = defineFeature(FEATURE_NAME, (r) => {
 
   // Provider-secret. Sensitive: redact-helper for admin-UI display.
   const password = r.secret("smtp.password", {
-    label: { de: "SMTP-Passwort", en: "SMTP password" },
+    label: { en: "SMTP password" },
     hint: {
-      de: "Login-Passwort am SMTP-Server. Bei Brevo/Postmark/SES heißt es 'API key' bzw. 'SMTP credentials'.",
       en: "Login password at the SMTP server. Brevo/Postmark/SES call it 'API key' or 'SMTP credentials'.",
     },
     redact: (plaintext) => {

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -109,7 +109,8 @@ describe("notes-history integration — add + list", () => {
     // Same guard as authorId above: addNotePayloadSchema doesn't accept an
     // authorName field, so a smuggled value never survives to the write —
     // the name (once stamped) can only come from the caller's own session.
-    expect(rows[0]?.["authorName"]).not.toBe("Fake Display Name");
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.["authorName"]).toBeNull();
   });
 
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {

package/src/notes-history/__tests__/notes-section.test.tsx

@@ -58,6 +58,8 @@ const AUTHOR_NAME = "Jamie Vance";
 const INSERTED_AT = "2026-08-21T12:28:41.580Z";
 const NOTE_BODY = "Vertragsunterlagen per Post verschickt.";
 
+const PII_ERASED_SENTINEL = "[[erased]]";
+
 const NOTE_ROWS: readonly NoteRowFixture[] = [
   {
     id: "note-1",
@@ -77,6 +79,15 @@ const NOTE_ROWS: readonly NoteRowFixture[] = [
     body: "Legacy entry predating authorName.",
     insertedAt: "2026-07-01T09:00:00.000Z",
   },
+  {
+    id: "note-3",
+    entityType: "contact",
+    entityId: "contact-1",
+    authorId: "03c2466d-9314-98a6-a761-a5827a611301",
+    authorName: PII_ERASED_SENTINEL,
+    body: "Note whose author was crypto-shredded.",
+    insertedAt: "2026-06-15T08:00:00.000Z",
+  },
 ];
 
 function makeDispatcher(): Dispatcher {
@@ -146,7 +157,7 @@ describe("NotesSection — entry display", () => {
     expect(metaEl.textContent).toContain(AUTHOR_NAME);
   });
 
-  test("a null authorName (legacy row, or shredded author) renders the placeholder", async () => {
+  test("a null authorName (legacy row) renders the placeholder", async () => {
     const view = renderSection();
     await waitFor(() => {
       if (view.queryByTestId("notes-section-row-note-2-meta") === null) {
@@ -157,6 +168,18 @@ describe("NotesSection — entry display", () => {
     expect(metaEl.textContent).toContain("Unknown author");
   });
 
+  test("a shredded authorName sentinel renders the placeholder, never [[erased]]", async () => {
+    const view = renderSection();
+    await waitFor(() => {
+      if (view.queryByTestId("notes-section-row-note-3-meta") === null) {
+        throw new Error("row not rendered yet");
+      }
+    });
+    const metaEl = view.getByTestId("notes-section-row-note-3-meta");
+    expect(metaEl.textContent).toContain("Unknown author");
+    expect(metaEl.textContent).not.toContain(PII_ERASED_SENTINEL);
+  });
+
   test("date renders formatted, never the raw ISO timestamp", async () => {
     const view = renderSection();
     await waitFor(() => {