@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/custom-fields/wire-for-entity.ts

@@ -1,4 +1,4 @@
-import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
+import { type DbRunner, extractTableName } from "@cosmicdrift/kumiko-framework/db";
 import {
   createJsonbField,
   type FeatureRegistrar,
@@ -6,7 +6,8 @@ import {
   type JsonbFieldDef,
   type TenantId,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { CUSTOM_FIELDS_EXTENSION } from "./constants";
+import type { StoredEvent } from "@cosmicdrift/kumiko-framework/event-store";
+import { CUSTOM_FIELDS_EXTENSION, FIELD_DEFINITION_AGGREGATE_TYPE } from "./constants";
 import {
   clearCustomFieldKey,
   removeCustomFieldKeyForTenant,
@@ -36,8 +37,9 @@ export function customFieldsField(): JsonbFieldDef {
 
 // Vollständige integration der custom-fields-Bundle für eine spezifische
 // host-entity. Eine einzige Aufruf-Stelle pro consumer registriert ALLE
-// wiring-Aspekte: extension-tracking, MSP für value-projection, postQuery-
-// hook für API-flatten, search-payload-extension für indexable customFields.
+// wiring-Aspekte: extension-tracking, MSP für value-projection, rebuild-
+// replay via extendEntityProjection, postQuery-hook für API-flatten,
+// search-payload-extension für indexable customFields.
 //
 // Consumer-side:
 //
@@ -61,15 +63,20 @@ export function customFieldsField(): JsonbFieldDef {
 //      emittiert haben. Updated entityTable.customFields jsonb über
 //      jsonb_set / jsonb-key-removal.
 //
-//   3. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
+//   3. r.extendEntityProjection — hängt dieselben apply-Handler in die
+//      implicit projection der host-entity, damit rebuildProjection die
+//      customField-Events mit-replayt. Ohne das fällt customFields bei
+//      jedem Entity-Rebuild (Schema-Migration!) auf `{}` zurück (#759).
+//
+//   4. r.entityHook("postQuery", entity, flatten-fn) — bei JEDEM Read auf
 //      diese entity wird `row.customFields` jsonb auf root-level expanded
 //      damit die API-response wie Stammfelder aussieht.
 //
-//   4. r.searchPayloadExtension(entity, contributor) — searchable
+//   5. r.searchPayloadExtension(entity, contributor) — searchable
 //      customFields-keys werden flach ins Meilisearch-Index-Doc beigetragen
 //      (F3-wiring).
 //
-//   5. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
+//   6. fieldDefinition.deleted-Event-Handler im selben MSP — bei delete
 //      einer fieldDefinition werden orphan values aus allen entity-rows
 //      entfernt (key-removal pro fieldKey).
 export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
@@ -87,86 +94,111 @@ export function wireCustomFieldsFor<TReg extends FeatureRegistrar<string>>(
   const clearedEventType = customFieldsFeature.exports.clearedEvent.name;
   const fieldDefDeletedType = customFieldsFeature.exports.fieldDefinitionDeletedEvent.name;
 
-  r.multiStreamProjection({
-    name: `custom-fields-${entityName}-projection`,
-    apply: {
-      [setEventType]: async (event, tx) => {
-        // skip: MSP feuert für ALLE aggregate-types die customField.set
-        // emittieren — wir wollen nur die unserer wired host-entity.
-        // Andere consumers haben eigene MSPs für ihre Entities.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
+  // Geteilte apply-Bodies: die MSP liefert sie live (async cursor), die
+  // entity-projection-extension replayt sie in rebuildProjection — gleiche
+  // SQL-Helper, beide idempotent. 2-Param-Signatur ist die gemeinsame
+  // Teilmenge von MultiStreamApplyFn und SingleStreamApplyFn.
+  const applyCustomFieldSet = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für ALLE aggregate-types die customField.set emittieren —
+    // wir wollen nur die unserer wired host-entity. Andere consumers haben
+    // eigene Wirings für ihre Entities.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldSetPayload; // @cast-boundary engine-payload
+
+    // skip: a value-less customField.set is an anomaly since #972 (every set
+    // carries its value; the sensitive self-projection path was removed) —
+    // warn and leave the row untouched instead of binding undefined.
+    if (payload.value === undefined) {
+      // biome-ignore lint/suspicious/noConsole: boot-adjacent correctness canary, no logger available in an apply function
+      console.warn(
+        `[custom-fields] customField.set for "${payload.fieldKey}" on ${event.aggregateType}/${event.aggregateId} has no value — skipping (value-less sets should not exist since #972).`,
+      );
+      // skip: warned above — leave the row untouched instead of binding undefined
+      return;
+    }
+
+    // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
+    // wird angelegt (create_missing=true ist default). value muss als
+    // jsonb-literal kommen.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await setCustomFieldValue(
+      tx,
+      tableName,
+      payload.fieldKey,
+      payload.value,
+      event.aggregateId,
+      event.tenantId,
+    );
+  };
+
+  const applyCustomFieldCleared = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // skip: feuert für alle aggregate-types — nur unsere host-entity
+    // verarbeiten.
+    if (event.aggregateType !== entityName) return;
+    const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
 
-        // skip: sensitive fields self-project in the write handler (see
-        // set-custom-field) and persist a value-less event so PII never enters
-        // the log. Such events arrive here with value === undefined — skipping
-        // is correct both live (the handler already wrote the row) and on replay
-        // (the value is intentionally gone, the accepted rebuild-loss).
-        if (payload.value === undefined) return;
+    // jsonb minus operator (`-`) entfernt key aus jsonb-object.
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    await clearCustomFieldKey(tx, tableName, payload.fieldKey, event.aggregateId, event.tenantId);
+  };
 
-        // jsonb_set: setze key auf value. Wenn key noch nicht existiert →
-        // wird angelegt (create_missing=true ist default). value muss als
-        // jsonb-literal kommen.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await setCustomFieldValue(
-          tx,
-          tableName,
-          payload.fieldKey,
-          payload.value,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [clearedEventType]: async (event, tx) => {
-        // skip: MSP feuert für alle aggregate-types — nur unsere host-entity
-        // verarbeiten.
-        if (event.aggregateType !== entityName) return;
-        const payload = event.payload as CustomFieldClearedPayload; // @cast-boundary engine-payload
+  const applyFieldDefinitionDeleted = async (event: StoredEvent, tx: DbRunner): Promise<void> => {
+    // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
+    // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
+    // entity falls die deleted-fieldDef für diese entity galt.
+    const payload = event.payload as {
+      entityName: string;
+      fieldKey: string;
+      tenantId?: TenantId;
+    }; // @cast-boundary engine-payload
+    // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
+    // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
+    // ihre Rows.
+    if (payload.entityName !== entityName) return;
 
-        // jsonb minus operator (`-`) entfernt key aus jsonb-object.
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        await clearCustomFieldKey(
-          tx,
-          tableName,
-          payload.fieldKey,
-          event.aggregateId,
-          event.tenantId,
-        );
-      },
-      [fieldDefDeletedType]: async (event, tx) => {
-        // fieldDefinition.deleted fires nur einmal pro fieldDef-delete
-        // (NICHT per-entity). Wir entfernen den key aus ALLEN rows der host-
-        // entity falls die deleted-fieldDef für diese entity galt.
-        const payload = event.payload as {
-          entityName: string;
-          fieldKey: string;
-          tenantId?: TenantId;
-        }; // @cast-boundary engine-payload
-        // skip: fieldDefinition.deleted feuert für ALLE fieldDefs cross-entity;
-        // nur wenn die deleted-fieldDef diese host-entity betraf, cleanen wir
-        // ihre Rows.
-        if (payload.entityName !== entityName) return;
+    const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
+    // Scope cleanup to the deleted definition's owning tenant. System-scope
+    // definitions apply to every tenant → cascade across all rows; tenant-
+    // scope deletions must only touch that tenant's rows, else deleting one
+    // tenant's field strips the same kebab key from every tenant (data loss).
+    // Fallback to the event's stream tenantId for events appended before the
+    // payload carried tenantId.
+    const defTenantId = payload.tenantId ?? event.tenantId;
+    if (isSystemTenant(defTenantId)) {
+      await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
+    } else {
+      await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
+    }
+  };
+
+  r.multiStreamProjection({
+    name: `custom-fields-${entityName}-projection`,
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
+    },
+  });
 
-        const tableName = extractTableName(entityTable, "custom-fields/wire-for-entity");
-        // Scope cleanup to the deleted definition's owning tenant. System-scope
-        // definitions apply to every tenant → cascade across all rows; tenant-
-        // scope deletions must only touch that tenant's rows, else deleting one
-        // tenant's field strips the same kebab key from every tenant (data loss).
-        // Fallback to the event's stream tenantId for events appended before the
-        // payload carried tenantId.
-        const defTenantId = payload.tenantId ?? event.tenantId;
-        if (isSystemTenant(defTenantId)) {
-          await removeCustomFieldKeyFromAllTenants(tx, tableName, payload.fieldKey);
-        } else {
-          await removeCustomFieldKeyForTenant(tx, tableName, payload.fieldKey, defTenantId);
-        }
-      },
+  // Rebuild-wiring (#759): ohne das replayt rebuildProjection nur die
+  // entity-lifecycle-Events und resettet jede customFields-jsonb auf ihr
+  // Default `{}` — die Werte existieren ausschließlich als customField.set/
+  // .cleared-Events. set/cleared reiten auf dem HOST-entity-Stream
+  // (aggregateType = entityName, von source schon abgedeckt);
+  // fieldDefinition.deleted lebt auf dem "field-definition"-Stream und
+  // kommt deshalb als extra source dazu.
+  r.extendEntityProjection(entityName, {
+    sources: [FIELD_DEFINITION_AGGREGATE_TYPE],
+    apply: {
+      [setEventType]: applyCustomFieldSet,
+      [clearedEventType]: applyCustomFieldCleared,
+      [fieldDefDeletedType]: applyFieldDefinitionDeleted,
     },
   });
 
   // postQuery-hook: flatten row.customFields jsonb auf root-level der
   // API-response. Spec-Promise Z.4 "indistinguishable von Stammfeldern".
-  r.entityHook("postQuery", entityName, async ({ rows }) => ({
+  r.hook("postQuery", { allOf: entityName }, async ({ rows }) => ({
     rows: rows.map((row) => {
       const customFields = row["customFields"];
       if (customFields && typeof customFields === "object" && !Array.isArray(customFields)) {

package/src/custom-fields/wire-user-data-rights.ts

@@ -1,18 +1,9 @@
 // T1.5c — user-data-rights wiring for custom-fields.
 
 import { extractTableName } from "@cosmicdrift/kumiko-framework/db";
-import type { UserDataDeleteHook, UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
-import {
-  EXT_USER_DATA,
-  EXT_USER_DATA_ORDER,
-  type FeatureRegistrar,
-} from "@cosmicdrift/kumiko-framework/engine";
-import {
-  selectCustomFieldsHostRows,
-  selectFieldDefinitionsForEntity,
-  stripSensitiveCustomFieldKeys,
-} from "./db/queries/user-data-rights";
-import { isFieldDefinitionRow, parseSerializedField } from "./lib/parse-serialized-field";
+import type { UserDataExportHook } from "@cosmicdrift/kumiko-framework/engine";
+import { EXT_USER_DATA, type FeatureRegistrar } from "@cosmicdrift/kumiko-framework/engine";
+import { selectCustomFieldsHostRows } from "./db/queries/user-data-rights";
 
 export interface WireCustomFieldsUserDataRightsOptions {
   readonly entityName: string;
@@ -36,14 +27,8 @@ function asCustomFieldsHostRow(value: unknown): CustomFieldsHostRow | null {
   return { id: value.id, customFields: Object.fromEntries(Object.entries(cf)) };
 }
 
-// The anonymize strip filters rows by `WHERE userIdColumn = userId`. A host
-// anonymize hook on the SAME entity that nulls that column (e.g. inserted_by_id
-// = NULL) would, if it ran first, leave the strip matching 0 rows → sensitive
-// jsonb PII silently retained (DSGVO Art. 17 violation). A negative order makes
-// runForgetCleanup run this strip before any default-order (0) owner-nulling
-// hook, independent of feature registration order.
-const ORDER_REDACT_BEFORE_OWNER_MUTATION = EXT_USER_DATA_ORDER.REDACT_BEFORE_OWNER;
-
+// Export-only wiring: custom fields hold supplemental business data, not PII
+// (#972) — there is nothing to redact on user-forget, only Art. 20 export.
 export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<string>>(
   r: TReg,
   opts: WireCustomFieldsUserDataRightsOptions,
@@ -71,42 +56,8 @@ export function wireCustomFieldsUserDataRightsFor<TReg extends FeatureRegistrar<
     return { entity: `${opts.entityName}.customFields`, rows: snippetRows };
   };
 
-  const deleteHook: UserDataDeleteHook = async (ctx, strategy) => {
-    // skip: delete strategy removes rows wholesale — custom-field redaction N/A.
-    if (strategy === "delete") return;
-    const sensitiveKeys = await loadSensitiveFieldKeys(ctx.db, ctx.tenantId, opts.entityName);
-    // skip: no sensitive custom fields configured for this entity.
-    if (sensitiveKeys.length === 0) return;
-
-    await stripSensitiveCustomFieldKeys(
-      ctx.db,
-      tableName,
-      opts.userIdColumn,
-      sensitiveKeys,
-      ctx.userId,
-      ctx.tenantId,
-    );
-  };
-
   // biome-ignore lint/correctness/useHookAtTopLevel: r.useExtension is a registrar API, not a React hook.
   r.useExtension(EXT_USER_DATA, opts.entityName, {
     export: exportHook,
-    delete: deleteHook,
-    order: ORDER_REDACT_BEFORE_OWNER_MUTATION,
   });
 }
-
-async function loadSensitiveFieldKeys(
-  db: Parameters<UserDataExportHook>[0]["db"],
-  tenantId: string,
-  entityName: string,
-): Promise<string[]> {
-  const rows = await selectFieldDefinitionsForEntity(db, entityName, tenantId);
-  const keys: string[] = [];
-  for (const raw of rows) {
-    if (!isFieldDefinitionRow(raw)) continue;
-    const parsed = parseSerializedField(raw.serialized_field);
-    if (parsed?.sensitive === true) keys.push(raw.field_key);
-  }
-  return keys;
-}

package/src/data-retention/__tests__/parse-override.test.ts

@@ -1,13 +1,16 @@
-import { describe, expect, spyOn, test } from "bun:test";
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
 import { parseRetentionOverrideOrNull } from "../_internal/parse-override";
 
-// parseRetentionOverrideOrNull is the read boundary for a tenant's stored
-// data-retention override (DSGVO-relevant policy in a config column). It must
-// never let a corrupt or schema-violating value reach the retention decision:
-// invalid JSON and schema drift both collapse to null (the resolver then falls
-// back to preset/entity defaults) AND surface one operator warning. The schema
-// itself is covered by override-schema.test.ts — this pins the parser's
-// defensive wrapping: empty guard, no-throw on corruption, drop-not-leak on drift.
+// A mid-test assertion throw skips the trailing `warn.mockRestore()` in that
+// test, leaving the spy live for every test after it (551/1) — this backstop
+// restores unconditionally regardless of how the test exited.
+afterEach(() => {
+  const warn = console.warn as unknown as { mockRestore?: () => void };
+  warn.mockRestore?.();
+});
+
+// DSGVO invariant: corrupt or schema-drifted overrides collapse to null +
+// warn, never leak through (schema itself is covered by override-schema.test.ts).
 
 const parse = (raw: string | null) => parseRetentionOverrideOrNull(raw, "tenant-1", "test");
 
@@ -31,26 +34,24 @@ describe("parseRetentionOverrideOrNull", () => {
   });
 
   test("corrupt JSON returns null without throwing", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(() => parse("{not json")).not.toThrow();
     expect(parse("{not json")).toBeNull();
-    warn.mockRestore();
   });
 
   test("JSON that parses but violates the schema is dropped to null — never leaked through", () => {
-    const warn = spyOn(console, "warn").mockImplementation(() => {});
+    spyOn(console, "warn").mockImplementation(() => {});
     expect(parse('{"strategy":"delete"}')).toBeNull(); // enum drift
     expect(parse('{"keepFor":"30days"}')).toBeNull(); // keepFor format drift
     expect(parse('{"keepFor":42}')).toBeNull(); // wrong type
     expect(parse('{"unknownKey":1}')).toBeNull(); // strict() rejects extra keys
-    warn.mockRestore();
   });
 
   test("each dropped value surfaces exactly one operator warning", () => {
     const warn = spyOn(console, "warn").mockImplementation(() => {});
     parse("{not json");
+    expect(warn).toHaveBeenCalledTimes(1);
     parse('{"strategy":"delete"}');
     expect(warn).toHaveBeenCalledTimes(2);
-    warn.mockRestore();
   });
 });

package/src/data-retention/__tests__/retention-cleanup.integration.test.ts

@@ -55,10 +55,9 @@ const staleEntity = createEntity({
 });
 
 // blockDelete = Aufbewahrungspflicht (HGB/DSGVO-Presets: invoice/booking/
-// contract). Der Cleanup-Job muss diese Rows IGNORIEREN — nur user-forget
-// darf sie anonymisieren. Ein Regress im switch-Default oder im blockDelete-
-// Case, der sie trotzdem löscht, wäre schwerwiegender als ein verpasstes
-// hardDelete (Aufbewahrungspflicht-Verletzung statt nur "zu spät aufgeräumt").
+// contract). Während keepFor muss der Cleanup diese Rows IGNORIEREN (löschen
+// wäre eine Aufbewahrungspflicht-Verletzung); NACH Ablauf laufen die
+// anonymize-Feld-Funktionen — Row bleibt, Personen-Bezug raus (fields.ts).
 const retainedEntity = createEntity({
   table: "read_c7_retained",
   fields: {
@@ -67,12 +66,33 @@ const retainedEntity = createEntity({
   retention: { keepFor: "30d", strategy: "blockDelete" },
 });
 
+// anonymize-Strategie: label wird nach Ablauf ueberschrieben, note traegt
+// keine anonymize-Funktion und muss unangetastet bleiben (Geschaeftsdaten).
+const anonEntity = createEntity({
+  table: "read_c7_anon",
+  fields: {
+    label: createTextField({ required: true, anonymize: () => "[ANONYMIZED]" }),
+    note: createTextField({ allowPlaintext: "is-business-data" }),
+  },
+  retention: { keepFor: "30d", strategy: "anonymize" },
+});
+
+// anonymize-Strategie OHNE anonymize-Felder — der Runner kann nichts tun und
+// muss das als skip melden statt still nichts zu tun.
+const bareEntity = createEntity({
+  table: "read_c7_bare",
+  fields: { label: createTextField({ required: true, allowPlaintext: "is-business-data" }) },
+  retention: { keepFor: "30d", strategy: "anonymize" },
+});
+
 const c7Feature = defineFeature("c7-retention-fixtures", (r) => {
   r.entity("c7-widget", widgetEntity);
   r.entity("c7-gadget", gadgetEntity);
   r.entity("c7-plain", plainEntity);
   r.entity("c7-stale", staleEntity);
   r.entity("c7-retained", retainedEntity);
+  r.entity("c7-anon", anonEntity);
+  r.entity("c7-bare", bareEntity);
 });
 
 const noopLogger: JobContext["log"] = {
@@ -102,6 +122,8 @@ beforeAll(async () => {
     plainEntity,
     staleEntity,
     retainedEntity,
+    anonEntity,
+    bareEntity,
   ]) {
     await unsafeCreateEntityTable(stack.db, e);
   }
@@ -144,6 +166,8 @@ beforeEach(async () => {
     "read_c7_plain",
     "read_c7_stale",
     "read_c7_retained",
+    "read_c7_anon",
+    "read_c7_bare",
   ]) {
     await asRawClient(stack.db).unsafe(`DELETE FROM ${t}`);
   }
@@ -244,8 +268,9 @@ describe("runRetentionCleanup :: real postgres", () => {
     expect(await labels("read_c7_widget", T1)).toEqual(["fresh-via-handler"]);
   });
 
-  test("blockDelete: past-cutoff rows are never touched by the cleanup job", async () => {
-    await seed("read_c7_retained", T1, "should-survive", pastIso);
+  test("blockDelete: within keepFor untouched, after expiry anonymized — row NEVER deleted", async () => {
+    await seed("read_c7_retained", T1, "in-hold", withinIso);
+    await seed("read_c7_retained", T1, "hold-expired", pastIso);
 
     const result = await runRetentionCleanup({
       db: stack.db,
@@ -255,9 +280,121 @@ describe("runRetentionCleanup :: real postgres", () => {
       now,
     });
 
-    expect(await labels("read_c7_retained", T1)).toEqual(["should-survive"]);
+    // Beide Rows physisch da — blockDelete darf NIE loeschen.
+    expect((await labels("read_c7_retained", T1)).sort()).toEqual(["[ANONYMIZED]", "in-hold"]);
     expect(result.hardDeleted).toBe(0);
     expect(result.softDeleted).toBe(0);
-    expect(result.anonymizeDeferred).not.toContain("c7-retained");
+    expect(result.anonymized).toBe(1);
+  });
+
+  test("anonymize: expired row gets field functions applied, other fields + fresh rows untouched", async () => {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'old-pii', 'business-note', $2::timestamptz)`,
+      [T1, pastIso],
+    );
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'fresh-pii', 'fresh-note', $2::timestamptz)`,
+      [T1, withinIso],
+    );
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(result.anonymized).toBe(1);
+    const rows = (await asRawClient(stack.db).unsafe(
+      `SELECT label, note FROM read_c7_anon WHERE tenant_id = $1 ORDER BY note`,
+      [T1],
+    )) as { label: string; note: string }[];
+    expect(rows).toEqual([
+      { label: "[ANONYMIZED]", note: "business-note" }, // PII raus, Geschaeftsdaten bleiben
+      { label: "fresh-pii", note: "fresh-note" }, // innerhalb keepFor: unangetastet
+    ]);
+  });
+
+  test("anonymize is idempotent: second run appends ZERO events (no daily event spam)", async () => {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, 'old-pii', 'n', $2::timestamptz)`,
+      [T1, pastIso],
+    );
+
+    const first = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+    expect(first.anonymized).toBe(1);
+
+    const eventsAfterFirst = (await asRawClient(stack.db).unsafe(
+      `SELECT count(*)::int AS n FROM kumiko_events`,
+    )) as { n: number }[];
+
+    const second = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+    expect(second.anonymized).toBe(0);
+
+    const eventsAfterSecond = (await asRawClient(stack.db).unsafe(
+      `SELECT count(*)::int AS n FROM kumiko_events`,
+    )) as { n: number }[];
+    expect(eventsAfterSecond[0]?.n).toBe(eventsAfterFirst[0]?.n);
+  });
+
+  test("anonymize converges under batchLimit=1: cursor pages past already-anonymized rows", async () => {
+    for (const label of ["a-pii", "b-pii", "c-pii"]) {
+      await asRawClient(stack.db).unsafe(
+        `INSERT INTO read_c7_anon (tenant_id, label, note, inserted_at) VALUES ($1, $2, $3, $4::timestamptz)`,
+        [T1, label, `note-${label}`, pastIso],
+      );
+    }
+
+    const run = () =>
+      runRetentionCleanup({
+        db: stack.db,
+        registry: stack.registry,
+        tenantId: T1,
+        tenantPreset: null,
+        now,
+        batchLimit: 1,
+      });
+
+    expect((await run()).anonymized).toBe(1);
+    expect((await run()).anonymized).toBe(1); // Cursor muss ueber die erledigte Row hinweg
+    expect((await run()).anonymized).toBe(1);
+    expect((await run()).anonymized).toBe(0); // konvergiert
+
+    const rows = (await asRawClient(stack.db).unsafe(
+      `SELECT label FROM read_c7_anon WHERE tenant_id = $1`,
+      [T1],
+    )) as { label: string }[];
+    expect(rows.map((r) => r.label)).toEqual(["[ANONYMIZED]", "[ANONYMIZED]", "[ANONYMIZED]"]);
+  });
+
+  test("anonymize strategy without anonymize fields → skipped with reason, rows untouched", async () => {
+    await seed("read_c7_bare", T1, "survives", pastIso);
+
+    const result = await runRetentionCleanup({
+      db: stack.db,
+      registry: stack.registry,
+      tenantId: T1,
+      tenantPreset: null,
+      now,
+    });
+
+    expect(await labels("read_c7_bare", T1)).toEqual(["survives"]);
+    expect(result.skipped).toContainEqual({
+      entityName: "c7-bare",
+      reason: "missing_anonymize_fields",
+    });
   });
 });

package/src/data-retention/feature.ts

@@ -104,10 +104,10 @@ export function createDataRetentionFeature(): FeatureDefinition {
           tenantPreset,
           now: T.Now.instant(),
         });
-        if (result.anonymizeDeferred.length > 0 || result.skipped.length > 0) {
-          // biome-ignore lint/suspicious/noConsole: operator-visibility for deferred/skipped entities
+        if (result.skipped.length > 0) {
+          // biome-ignore lint/suspicious/noConsole: operator-visibility for skipped entities
           console.warn(
-            `[data-retention:retention-cleanup] tenant=${tenantId} anonymizeDeferred=${result.anonymizeDeferred.join(",") || "-"} skipped=${result.skipped.map((s) => `${s.entityName}:${s.reason}`).join(",") || "-"}`,
+            `[data-retention:retention-cleanup] tenant=${tenantId} skipped=${result.skipped.map((s) => `${s.entityName}:${s.reason}`).join(",")}`,
           );
         }
       },