@cosmicdrift/kumiko-bundled-features 0.252.0 → 0.253.0

package/src/custom-fields/entity.ts

@@ -61,15 +61,30 @@ export const fieldDefinitionEntity = createEntity({
   fields: {
     // Ziel-Entity-Name, für die dieses Field definiert wird (z.B. "property",
     // "customer"). Max 64 char passt zu Kumiko's entity-name-Convention.
-    entityName: createTextField({ required: true, maxLength: 64 }),
+    entityName: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
 
     // Field-Key (z.B. "internalNumber", "vipFlag") — kebab-case oder camelCase
     // erlaubt; UI-rendering nutzt label statt fieldKey.
-    fieldKey: createTextField({ required: true, maxLength: 64 }),
+    fieldKey: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
 
     // Field-Type aus dem SUPPORTED_FIELD_TYPES-Set. Validiert via Zod im
     // write-handler.
-    type: createTextField({ required: true, maxLength: 16 }),
+    type: createTextField({
+      required: true,
+      maxLength: 16,
+      personal: false,
+      reason: "technical_reference",
+    }),
 
     // Required-Flag — wird beim Entity-Write gegen den value gecheckt
     // (Stammfeld-identische Semantik, Spec-Promise Z.4).
@@ -87,6 +102,11 @@ export const fieldDefinitionEntity = createEntity({
     // defaultValue, fieldAccess, i18n-labels. Beim Write-Validation
     // dehydriert der handler dies zurück zu einer r.field.X()-Instanz und
     // nutzt deren .schema für value-Validation.
-    serializedField: createTextField({ required: true, maxLength: 65536 }),
+    serializedField: createTextField({
+      required: true,
+      maxLength: 65536,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });

package/src/data-retention/__tests__/resolver.test.ts

@@ -8,7 +8,7 @@ import { resolveRetentionPolicy } from "../resolver";
 describe("resolveRetentionPolicy — Layer-Resolution", () => {
   test("Layer 1 Entity-Default greift wenn weder Preset noch Override", () => {
     const entity = createEntity({
-      fields: { foo: createTextField() },
+      fields: { foo: createTextField({ personal: false, reason: "technical_reference" }) },
       retention: { keepFor: "30d", strategy: "hardDelete", reference: "createdAt" },
     });
 
@@ -29,7 +29,7 @@ describe("resolveRetentionPolicy — Layer-Resolution", () => {
 
   test("Layer 2 Preset überschreibt Entity-Default", () => {
     const entity = createEntity({
-      fields: { foo: createTextField() },
+      fields: { foo: createTextField({ personal: false, reason: "technical_reference" }) },
       retention: { keepFor: "7d", strategy: "hardDelete" },
     });
 
@@ -74,7 +74,9 @@ describe("resolveRetentionPolicy — Layer-Resolution", () => {
   });
 
   test("Entity ohne retention + kein Preset + kein Override → policy=null + source=none", () => {
-    const entity = createEntity({ fields: { foo: createTextField() } });
+    const entity = createEntity({
+      fields: { foo: createTextField({ personal: false, reason: "technical_reference" }) },
+    });
 
     const result = resolveRetentionPolicy({
       entityName: "ticket",
@@ -172,7 +174,7 @@ describe("resolveRetentionPolicy — override-incomplete-Guard", () => {
 describe("resolveRetentionPolicy — Edge-Cases", () => {
   test("default-Preset ist leer → fällt zurück auf entity-default", () => {
     const entity = createEntity({
-      fields: { foo: createTextField() },
+      fields: { foo: createTextField({ personal: false, reason: "technical_reference" }) },
       retention: { keepFor: "30d", strategy: "hardDelete" },
     });
 

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -28,7 +28,9 @@ import { runRetentionCleanup } from "../run-retention-cleanup";
 // hardDelete, default-reference (createdAt → alias insertedAt → Spalte inserted_at).
 const widgetEntity = createEntity({
   table: "read_c7_widget",
-  fields: { label: createTextField({ required: true }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "hardDelete" },
 });
 
@@ -36,21 +38,27 @@ const widgetEntity = createEntity({
 const gadgetEntity = createEntity({
   table: "read_c7_gadget",
   softDelete: true,
-  fields: { label: createTextField({ required: true }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "softDelete" },
 });
 
 // Keine Policy → darf nie angefasst werden.
 const plainEntity = createEntity({
   table: "read_c7_plain",
-  fields: { label: createTextField({ required: true }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
 });
 
 // reference="lastSeenAt" ist Boot-valide (Framework-Timestamp-Allowlist), aber
 // die Spalte existiert auf diesem Entity nicht → Guard muss skippen.
 const staleEntity = createEntity({
   table: "read_c7_stale",
-  fields: { label: createTextField({ required: true }) },
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "is_business_data" }),
+  },
   retention: { keepFor: "30d", strategy: "hardDelete", reference: "lastSeenAt" },
 });
 

package/src/delivery/__tests__/delivery.integration.test.ts

@@ -181,9 +181,9 @@ const appFeature = defineFeature("app", (r) => {
 // Feature with CRUD entity + declarative r.notification()
 const ticketEntity = createEntity({
   fields: {
-    title: createTextField({ required: true }),
-    assigneeId: createTextField(),
-    status: createTextField({ required: true }),
+    title: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+    assigneeId: createTextField({ personal: false, reason: "pseudonymous_fk" }),
+    status: createTextField({ required: true, personal: false, reason: "technical_reference" }),
   },
 });
 const ticketTable = buildEntityTable("ticket", ticketEntity);

package/src/delivery/tables.ts

@@ -77,8 +77,12 @@ export const notificationPreferenceEntity = createEntity({
   table: "read_notification_preferences",
   fields: {
     userId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
-    notificationType: createTextField({ required: true }), // qualified name or "*"
-    channel: createTextField({ required: true }), // "inApp", "email", "push", or "*"
+    notificationType: createTextField({
+      required: true,
+      personal: false,
+      reason: "technical_reference",
+    }), // qualified name or "*"
+    channel: createTextField({ required: true, personal: false, reason: "technical_reference" }), // "inApp", "email", "push", or "*"
     enabled: createBooleanField({ default: true }),
   },
 });

package/src/document-ingest-foundation/entity.ts

@@ -35,8 +35,12 @@ export type DocumentExtractMeta = {
 export const documentExtractEntity = createEntity({
   table: "read_document_extracts",
   fields: {
-    fileRefId: createTextField({ required: true }),
-    storageKey: createTextField({ required: true }),
+    fileRefId: createTextField({ required: true, personal: false, reason: "pseudonymous_fk" }),
+    storageKey: createTextField({
+      required: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Holds the full extracted document text (PII). `personal: "tenant"`,
     // NOT `encrypted: true` (#1621): the master-key path has no erasure subject,
     // so nothing here would ever be shreddable. Tenant-subject ciphertext

package/src/feature-toggles/__tests__/feature-toggles.integration.test.ts

@@ -42,7 +42,12 @@ import { createRedisToggleSyncSignal, type RedisToggleSyncSignal } from "../togg
 const widgetEntity = createEntity({
   table: "read_widgets",
   fields: {
-    name: createTextField({ required: true, maxLength: 100 }),
+    name: createTextField({
+      required: true,
+      maxLength: 100,
+      personal: false,
+      reason: "technical_reference",
+    }),
     active: createBooleanField({ default: true }),
   },
 });
@@ -88,7 +93,12 @@ function widgetFeature(): FeatureDefinition {
 const widgetAuditEntity = createEntity({
   table: "widget_audits",
   fields: {
-    widgetName: createTextField({ required: true, maxLength: 100 }),
+    widgetName: createTextField({
+      required: true,
+      maxLength: 100,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });
 const widgetAuditTable = buildEntityTable("widget-audit", widgetAuditEntity);

package/src/feature-toggles/__tests__/registered-system-tenant.test.ts

@@ -30,7 +30,13 @@ describe("Sprint 8a: registered.query SYSTEM_TENANT_ID convention", () => {
     const observed: string[] = [];
 
     const dummy = defineFeature("dummy", (r) => {
-      r.entity("widget", createEntity({ table: "Widgets", fields: { name: createTextField() } }));
+      r.entity(
+        "widget",
+        createEntity({
+          table: "Widgets",
+          fields: { name: createTextField({ personal: false, reason: "technical_reference" }) },
+        }),
+      );
     });
 
     const runtime: GlobalFeatureToggleRuntime | null = null;

package/src/folders/__tests__/folders-parent-visibility.integration.test.ts

@@ -47,8 +47,18 @@ const projectOwnership: NonNullable<EntityDefinition["access"]> = {
 const projectEntity = createEntity({
   table: PROJECT_TABLE,
   fields: {
-    teamId: createTextField({ required: true, maxLength: 64 }),
-    name: createTextField({ required: true, maxLength: 64 }),
+    teamId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
   access: projectOwnership,
 });

package/src/folders/__tests__/folders.integration.test.ts

@@ -36,7 +36,14 @@ const foldersFeature = createFoldersFeature();
 const CREDIT_TABLE = "folders_test_credits";
 const creditEntity = createEntity({
   table: CREDIT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const hostFixturesFeature = defineFeature("folders-test-host-fixtures", (r) => {
   r.entity("credit", creditEntity);

package/src/folders/entity.ts

@@ -10,10 +10,17 @@ export const folderEntity = createEntity({
   description:
     "One folder of a tenant's hierarchical catalog: a name plus an optional parentId pointing at another folder, so the rows together form a tree whose roots have no parent.",
   fields: {
-    name: createTextField({ required: true, maxLength: 64 }),
+    // Catalog label, same reasoning as tags/entity.ts name: no author to
+    // anchor a subject key to, not user-identifying content.
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "catalog_label",
+    }),
     // Parent folder id, or absent for a root folder. No FK (event-sourced); a
     // dangling parentId renders the folder at root — folders-view guards cycles.
-    parentId: createTextField({ maxLength: 64 }),
+    parentId: createTextField({ maxLength: 64, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -38,9 +45,24 @@ export const folderAssignmentEntity = createEntity({
     "The membership row recording which folder one host entity, addressed by entityType and entityId, is filed in. At most one row exists per entity, so filing it elsewhere changes this row's folderId rather than adding a second.",
   softDelete: true,
   fields: {
-    folderId: createTextField({ required: true, maxLength: 64 }),
-    entityType: createTextField({ required: true, maxLength: 64 }),
+    folderId: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    entityType: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Host entity ids are uuid/text; 128 covers uuid plus non-uuid text keys.
-    entityId: createTextField({ required: true, maxLength: 128 }),
+    entityId: createTextField({
+      required: true,
+      maxLength: 128,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });

package/src/folders-user-data/__tests__/hooks.integration.test.ts

@@ -26,7 +26,14 @@ import { folderAssignmentExportHook } from "../hooks";
 const CREDIT_TABLE = "folders_export_test_credits";
 const creditEntity = createEntity({
   table: CREDIT_TABLE,
-  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+  fields: {
+    name: createTextField({
+      required: true,
+      maxLength: 64,
+      personal: false,
+      reason: "technical_reference",
+    }),
+  },
 });
 const hostFixturesFeature = defineFeature("folders-export-test-host-fixtures", (r) => {
   r.entity("credit", creditEntity);

package/src/form-draft/entity.ts

@@ -28,7 +28,12 @@ export const formDraftEntity = createEntity({
       personal: "ref",
       required: true,
     }),
-    draftKey: createTextField({ required: true, maxLength: FORM_DRAFT_KEY_MAX_LENGTH }),
+    draftKey: createTextField({
+      required: true,
+      maxLength: FORM_DRAFT_KEY_MAX_LENGTH,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // The blob shape is fixed by issue #1889, not left to the caller:
     // { values: Record<string, unknown>, stepIndex: number, savedAt: string }.
     // Free-form because `values` mirrors whatever fields the in-progress

package/src/inbound-mail-foundation/entities.ts

@@ -34,13 +34,23 @@ import {
 export const mailAccountEntity = createEntity({
   table: "read_mail_accounts",
   fields: {
-    provider: createTextField({ required: true, maxLength: 50 }),
-    authMethod: createTextField({ required: true, maxLength: 30 }),
+    provider: createTextField({
+      required: true,
+      maxLength: 50,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    authMethod: createTextField({
+      required: true,
+      maxLength: 30,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // null = tenant-geteiltes Postfach (info@), gesetzt = persönliches
     // Postfach dieses Users. Sichtbarkeits-Filter in den list-queries:
     // Owner + TenantAdmin (Compliance); KEIN Crypto-Subject-Wechsel in
     // V1 (Subject bleibt Tenant, siehe Header).
-    ownerUserId: createTextField({ maxLength: 36 }),
+    ownerUserId: createTextField({ maxLength: 36, personal: false, reason: "pseudonymous_fk" }),
     // Tenant-authored mailbox label, not a person's name.
     displayName: createTextField({
       maxLength: 200,
@@ -49,8 +59,13 @@ export const mailAccountEntity = createEntity({
     }),
     // Postfach-Adresse — PII des Tenants.
     address: createTextField({ required: true, maxLength: 1000, personal: "tenant", find: "none" }),
-    status: createTextField({ required: true, maxLength: 30 }),
-    watchState: createTextField({ maxLength: 100 }),
+    status: createTextField({
+      required: true,
+      maxLength: 30,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    watchState: createTextField({ maxLength: 100, personal: false, reason: "technical_reference" }),
     connectedAt: createTimestampField({ required: true }),
   },
 });
@@ -61,13 +76,28 @@ export const mailAccountEntity = createEntity({
 export const inboundMessageEntity = createEntity({
   table: "read_inbound_messages",
   fields: {
-    accountId: createTextField({ required: true, maxLength: 36 }),
+    accountId: createTextField({
+      required: true,
+      maxLength: 36,
+      personal: false,
+      reason: "technical_reference",
+    }),
     // Scope-Vererbung vom Account zum Ingest-Zeitpunkt — Messages eines
     // persönlichen Postfachs sind nur für den Owner (+ TenantAdmin)
     // sichtbar, ohne Join auf read_mail_accounts.
-    ownerUserId: createTextField({ maxLength: 36 }),
-    messageIdHeader: createTextField({ required: true, maxLength: 500 }),
-    threadKey: createTextField({ required: true, maxLength: 500 }),
+    ownerUserId: createTextField({ maxLength: 36, personal: false, reason: "pseudonymous_fk" }),
+    messageIdHeader: createTextField({
+      required: true,
+      maxLength: 500,
+      personal: false,
+      reason: "technical_reference",
+    }),
+    threadKey: createTextField({
+      required: true,
+      maxLength: 500,
+      personal: false,
+      reason: "technical_reference",
+    }),
     from: createTextField({ required: true, maxLength: 2000, personal: "tenant", find: "none" }),
     // JSON-stringified string[] — als Ganzes encrypted.
     to: createTextField({ maxLength: 8000, personal: "tenant", find: "none" }),
@@ -75,8 +105,8 @@ export const inboundMessageEntity = createEntity({
     subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     snippet: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     receivedAt: createTimestampField({ required: true }),
-    bodyRef: createTextField({ maxLength: 500 }),
-    scope: createTextField({ maxLength: 200 }),
+    bodyRef: createTextField({ maxLength: 500, personal: false, reason: "technical_reference" }),
+    scope: createTextField({ maxLength: 200, personal: false, reason: "technical_reference" }),
   },
 });
 
@@ -85,7 +115,12 @@ export const inboundMessageEntity = createEntity({
 export const mailThreadEntity = createEntity({
   table: "read_mail_threads",
   fields: {
-    threadKey: createTextField({ required: true, maxLength: 500 }),
+    threadKey: createTextField({
+      required: true,
+      maxLength: 500,
+      personal: false,
+      reason: "technical_reference",
+    }),
     subject: createTextField({ maxLength: 4000, personal: "tenant", find: "none" }),
     lastMessageAt: createTimestampField({ required: true }),
     messageCount: createNumberField({ required: true, integer: true }),
@@ -123,16 +158,22 @@ export const syncCursorEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
     scope: createTextField({
       required: true,
       maxLength: 200,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
     cursor: createTextField({
       required: true,
       maxLength: 2000,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
     updatedAt: createTimestampField({
       required: true,
@@ -153,11 +194,15 @@ export const seenMessageEntity = createEntity({
       required: true,
       maxLength: 36,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
     providerMessageId: createTextField({
       required: true,
       maxLength: 500,
       access: { write: access.privileged },
+      personal: false,
+      reason: "technical_reference",
     }),
     seenAt: createTimestampField({
       required: true,

package/src/jobs/__tests__/jobs-pii-kms.integration.test.ts

@@ -14,7 +14,12 @@ import {
   isPiiCiphertext,
   PII_ERASED_SENTINEL,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import { createRegistry, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
+import { sql } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createRegistry,
+  defineFeature,
+  SYSTEM_TENANT_ID,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable, eventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestDb,
@@ -29,9 +34,12 @@ import {
 import {
   resetPiiSubjectKmsForTests,
   resetTestTables,
+  seedRow,
   sleep,
 } from "@cosmicdrift/kumiko-framework/testing";
+import { generateId } from "@cosmicdrift/kumiko-framework/utils";
 import { JobHandlers, JobQueries } from "../constants";
+import { markStaleJobRunsFailed, STALE_JOB_RUN_ERROR } from "../db/queries/stale-run-sweep";
 import { createJobsFeature } from "../feature";
 import { createJobRunLogger } from "../job-run-logger";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
@@ -331,6 +339,108 @@ describe("jobs run-failed error column under KMS (#2307)", () => {
   });
 });
 
+// markStaleJobRunsFailed (stale-run-sweep.ts) is a second, separate writer
+// of the `error` column outside onJobFailed's per-row encrypt above — a
+// crash-recovery batch sweep that can match many rows belonging to
+// different triggering users in one pass. It must encrypt `error` per row
+// under each row's own subject instead of writing STALE_JOB_RUN_ERROR in
+// the clear, or a live KMS would leave plaintext sitting next to
+// ciphertext siblings and detail.query.ts's decrypt would fail loud on it.
+describe("jobs stale-run sweep error column under KMS", () => {
+  async function seedStaleRunning(triggeredById?: string): Promise<string> {
+    const id = generateId();
+    await seedRow(testDb.db, jobRunsTable, {
+      id,
+      tenantId: SYSTEM_TENANT_ID,
+      insertedById: "system",
+      jobName: "app:job:export",
+      bullJobId: `bull-${id}`,
+      status: "running",
+      attempt: 1,
+      startedAt: sql`now() - interval '48 hours'`,
+      ...(triggeredById !== undefined ? { triggeredById } : {}),
+    });
+    return id;
+  }
+
+  test("stale row's error is stored as ciphertext under its own triggering user, not the sentinel", async () => {
+    const id = await seedStaleRunning(USER_ID);
+
+    const result = await markStaleJobRunsFailed(testDb.db, 24);
+    expect(result.runsMarkedFailed).toBe(1);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id });
+    expect(row?.["status"]).toBe("failed");
+    expect(isPiiCiphertext(row?.["error"])).toBe(true);
+    expect(String(row?.["error"])).toContain(`user:${USER_ID}`);
+
+    const back = await decryptPiiFieldValues({ error: row?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(back["error"]).toBe(STALE_JOB_RUN_ERROR);
+  });
+
+  test("two stale rows from different users each decrypt under their own key", async () => {
+    const OTHER_USER_ID = "u-pii-stale-other";
+    const idA = await seedStaleRunning(USER_ID);
+    const idB = await seedStaleRunning(OTHER_USER_ID);
+
+    const result = await markStaleJobRunsFailed(testDb.db, 24);
+    expect(result.runsMarkedFailed).toBe(2);
+
+    const rowA = await fetchOne(testDb.db, jobRunsTable, { id: idA });
+    const rowB = await fetchOne(testDb.db, jobRunsTable, { id: idB });
+    expect(String(rowA?.["error"])).toContain(`user:${USER_ID}`);
+    expect(String(rowB?.["error"])).toContain(`user:${OTHER_USER_ID}`);
+
+    const backB = await decryptPiiFieldValues({ error: rowB?.["error"] }, ["error"], kms, {
+      requestId: "t",
+    });
+    expect(backB["error"]).toBe(STALE_JOB_RUN_ERROR);
+  });
+
+  test("erase subject key before the sweep runs → error lands as the erased sentinel, sweep still succeeds", async () => {
+    // Create the subject's key first — eraseKey is a no-op on an unknown
+    // subject (InMemoryKmsAdapter's tombstone contract), same as the
+    // onJobFailed case above. A payload is required here: onJobStart only
+    // touches the KMS (creating the subject's key) when there's a payload
+    // to encrypt (see encryptStartedPayload's null short-circuit).
+    await logger.onJobStart?.("app:job:export", "bull-warm-key", {
+      triggeredById: USER_ID,
+      payload: SECRET_PAYLOAD,
+    });
+    await kms.eraseKey({ kind: "user", userId: USER_ID });
+
+    const id = await seedStaleRunning(USER_ID);
+
+    const result = await markStaleJobRunsFailed(testDb.db, 24);
+    expect(result.runsMarkedFailed).toBe(1);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id });
+    expect(row?.["status"]).toBe("failed");
+    expect(row?.["error"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("system-triggered stale row (no triggeredById) keeps a plaintext error", async () => {
+    const id = await seedStaleRunning();
+
+    await markStaleJobRunsFailed(testDb.db, 24);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id });
+    expect(row?.["error"]).toBe(STALE_JOB_RUN_ERROR);
+  });
+
+  test("without a KMS the error column stays plaintext (rollout mode)", async () => {
+    const id = await seedStaleRunning(USER_ID);
+    resetPiiSubjectKmsForTests();
+
+    await markStaleJobRunsFailed(testDb.db, 24);
+
+    const row = await fetchOne(testDb.db, jobRunsTable, { id });
+    expect(row?.["error"]).toBe(STALE_JOB_RUN_ERROR);
+  });
+});
+
 // The suite above proves the write side (row is ciphertext) and decrypts by
 // calling decryptPiiFieldValues directly in the test body — neither touches
 // detail.query.ts's own decrypt wrapper. This block dispatches the real

package/src/jobs/__tests__/projection-rebuild-job.integration.test.ts

@@ -49,8 +49,8 @@ import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 const itemEntity = createEntity({
   table: "read_rebuild_items",
   fields: {
-    groupId: createTextField({ required: true }),
-    name: createTextField({ required: true }),
+    groupId: createTextField({ required: true, personal: false, reason: "technical_reference" }),
+    name: createTextField({ required: true, personal: false, reason: "technical_reference" }),
   },
 });
 const itemTable = buildEntityTable("rebuild-item", itemEntity);

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -38,7 +38,12 @@ const REINDEX_ENTITY_JOB = "jobs:job:reindex-entity";
 const widgetEntity = createEntity({
   table: "read_reindex_job_widgets",
   fields: {
-    name: createTextField({ required: true, searchable: true }),
+    name: createTextField({
+      required: true,
+      searchable: true,
+      personal: false,
+      reason: "technical_reference",
+    }),
   },
 });