@cosmicdrift/kumiko-bundled-features 1.0.0 → 2.0.0

package/src/jobs/__tests__/jobs-security.integration.test.ts

@@ -0,0 +1,108 @@
+// Security integration tests for jobs operator HTTP surface.
+// Real HTTP via setupTestStack — no mocks.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { defineFeature, type SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafePushTables,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { rolesOf } from "@cosmicdrift/kumiko-framework/testing";
+import { createConfigFeature } from "../../config/feature";
+import {
+  JOB_RUN_DETAIL_SCREEN_ID,
+  JOB_RUNS_SCREEN_ID,
+  JobHandlers,
+  JobQueries,
+} from "../constants";
+import { createJobsFeature } from "../feature";
+import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
+
+const SYSTEM_ADMIN_ROLES = ["SystemAdmin"] as const;
+
+const noopJobFeature = defineFeature("jobs-sec-app", (r) => {
+  r.job("ping", { trigger: { manual: true } }, async () => {});
+});
+
+let stack: TestStack;
+
+const systemAdmin = TestUsers.systemAdmin;
+const tenantAdmin: SessionUser = createTestUser({ id: 3, roles: ["TenantAdmin"] });
+const regularUser: SessionUser = createTestUser({ id: 4, roles: ["User"] });
+
+beforeAll(async () => {
+  stack = await setupTestStack({
+    features: [createConfigFeature(), noopJobFeature, createJobsFeature()],
+  });
+  await unsafePushTables(stack.db, { jobRunsTable, jobRunLogsTable });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("access matrix: jobs operator surface is SystemAdmin-only", () => {
+  test("list, detail, trigger, retry handlers share SystemAdmin", () => {
+    const roles = [...SYSTEM_ADMIN_ROLES];
+    expect(rolesOf(stack.registry.getQueryHandler(JobQueries.list)?.access)).toEqual(roles);
+    expect(rolesOf(stack.registry.getQueryHandler(JobQueries.details)?.access)).toEqual(roles);
+    expect(rolesOf(stack.registry.getWriteHandler(JobHandlers.trigger)?.access)).toEqual(roles);
+    expect(rolesOf(stack.registry.getWriteHandler(JobHandlers.retry)?.access)).toEqual(roles);
+  });
+
+  test("job screens match SystemAdmin handler access", () => {
+    const jobs = createJobsFeature();
+    for (const id of [JOB_RUNS_SCREEN_ID, JOB_RUN_DETAIL_SCREEN_ID] as const) {
+      const screen = jobs.screens[id];
+      if (screen && "access" in screen && screen.access && "roles" in screen.access) {
+        expect(screen.access.roles).toEqual(SYSTEM_ADMIN_ROLES);
+      }
+    }
+  });
+});
+
+describe("non-SystemAdmin denied jobs HTTP surface", () => {
+  test("TenantAdmin 403 on list, detail, trigger", async () => {
+    for (const fn of [
+      () => stack.http.query(JobQueries.list, {}, tenantAdmin),
+      () =>
+        stack.http.query(
+          JobQueries.details,
+          { runId: "00000000-0000-4000-8000-000000000099" },
+          tenantAdmin,
+        ),
+      () =>
+        stack.http.write(JobHandlers.trigger, { jobName: "jobs-sec-app:job:ping" }, tenantAdmin),
+    ] as const) {
+      const res = await fn();
+      expect(res.status).toBe(403);
+    }
+  });
+
+  test("regular User 403 on list and trigger", async () => {
+    expect((await stack.http.query(JobQueries.list, {}, regularUser)).status).toBe(403);
+    expect(
+      (
+        await stack.http.write(
+          JobHandlers.trigger,
+          { jobName: "jobs-sec-app:job:ping" },
+          regularUser,
+        )
+      ).status,
+    ).toBe(403);
+  });
+});
+
+describe("SystemAdmin can use jobs queries", () => {
+  test("empty list is OK", async () => {
+    const res = await stack.http.queryOk<{ rows: readonly unknown[] }>(
+      JobQueries.list,
+      {},
+      systemAdmin,
+    );
+    expect(Array.isArray(res.rows)).toBe(true);
+  });
+});

package/src/jobs/__tests__/reindex-entity-job.integration.test.ts

@@ -0,0 +1,169 @@
+// #1215: the `jobs` feature registers `reindexEntity` as a manual + perTenant
+// job. perTenant jobs fan out through a BullMQ wrapper that needs
+// `getActiveTenantIds` (job-runner.ts) — setupTestStack's jobRunner doesn't
+// wire that, so this calls the exported handler directly with a constructed
+// context instead of going through jobRunner.dispatch(), same as
+// inbound-mail-foundation's retention job test calls its sweep function
+// directly rather than round-tripping through the queue.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import {
+  buildEntityTable,
+  createEventStoreExecutor,
+  createTenantDb,
+} from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type JobContext,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { bridgeStub } from "@cosmicdrift/kumiko-framework/testing";
+import { createJobsFeature } from "../feature";
+import { reindexEntityJob } from "../handlers/reindex-entity.job";
+
+// Resolved job name — operators trigger this via jobs:write:trigger with
+// { jobName: "jobs:job:reindex-entity", payload: { entity: "..." } }.
+const REINDEX_ENTITY_JOB = "jobs:job:reindex-entity";
+
+const widgetEntity = createEntity({
+  table: "read_reindex_job_widgets",
+  fields: {
+    name: createTextField({ required: true, searchable: true }),
+  },
+});
+
+const widgetTable = buildEntityTable("widget", widgetEntity);
+
+const widgetFeature = defineFeature("reindex-job-test", (r) => {
+  r.entity("widget", widgetEntity);
+});
+
+let stack: TestStack;
+const admin = TestUsers.admin;
+
+const noopLogger: JobContext["log"] = {
+  info() {},
+  warn() {},
+  error() {},
+  debug() {},
+  child() {
+    return noopLogger;
+  },
+};
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [widgetFeature, createJobsFeature()] });
+  await unsafeCreateEntityTable(stack.db, widgetEntity);
+  await createEventsTable(stack.db);
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+describe("jobs feature: reindexEntity registration", () => {
+  test("registers reindexEntity as jobs:job:reindex-entity — the name jobs:write:trigger dispatches by", () => {
+    const job = stack.registry.getJob(REINDEX_ENTITY_JOB);
+    expect(job).toBeDefined();
+    expect(job?.handler).toBe(reindexEntityJob);
+    expect(job?.perTenant).toBe(true);
+    expect(job?.trigger).toEqual({ manual: true });
+  });
+});
+
+describe("reindexEntityJob", () => {
+  test("indexes rows for the tenant resolved from ctx.systemUser", async () => {
+    const executor = createEventStoreExecutor(widgetTable, widgetEntity, { entityName: "widget" });
+    const tenantDb = createTenantDb(stack.db, admin.tenantId, "system");
+    const created = await executor.create({ name: "Job Backfillable Widget" }, admin, tenantDb);
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    // No stack.eventDispatcher.runOnce() — row was never indexed live.
+    const preResults = await stack.search.search(admin.tenantId, "backfillable", {
+      filterType: "widget",
+    });
+    expect(preResults).toHaveLength(0);
+
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      searchAdapter: stack.search,
+      systemUser: admin,
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await reindexEntityJob({ entity: "widget" }, ctx);
+
+    const postResults = await stack.search.search(admin.tenantId, "backfillable", {
+      filterType: "widget",
+    });
+    expect(postResults.some((r) => r.entityId === created.data.id)).toBe(true);
+  });
+
+  test("the job is registered under REINDEX_ENTITY_JOB and its handler indexes", async () => {
+    // Honest scope: this still hand-builds JobContext (same as
+    // retention-cleanup's handler test) rather than going through
+    // jobRunner.dispatch() — it does NOT cover the dispatch chain's own
+    // ctx-resolution/guard logic, only that registry.getJob(REINDEX_ENTITY_JOB)
+    // resolves to a handler and that handler indexes correctly when called
+    // with a well-formed ctx. A bug in dispatch()'s ctx-resolution itself
+    // (e.g. a systemUser that isn't wired through) would be invisible here,
+    // same as in the two direct-call tests above.
+    const executor = createEventStoreExecutor(widgetTable, widgetEntity, { entityName: "widget" });
+    const tenantDb = createTenantDb(stack.db, admin.tenantId, "system");
+    const created = await executor.create({ name: "Registry-Resolved Widget" }, admin, tenantDb);
+    if (!created.isSuccess) throw new Error("seed failed");
+
+    const preResults = await stack.search.search(admin.tenantId, "registry-resolved", {
+      filterType: "widget",
+    });
+    expect(preResults).toHaveLength(0);
+
+    const job = stack.registry.getJob(REINDEX_ENTITY_JOB);
+    expect(job).toBeDefined();
+    if (!job) return;
+
+    const ctx: JobContext = {
+      db: stack.db,
+      registry: stack.registry,
+      searchAdapter: stack.search,
+      systemUser: admin,
+      log: noopLogger,
+      triggeredBy: null,
+      ...bridgeStub(),
+    };
+    await job.handler({ entity: "widget" }, ctx);
+
+    const postResults = await stack.search.search(admin.tenantId, "registry-resolved", {
+      filterType: "widget",
+    });
+    expect(postResults.some((r) => r.entityId === created.data.id)).toBe(true);
+  });
+
+  test("skips silently when no tenant is resolvable (fan-out misfire)", async () => {
+    await expect(
+      reindexEntityJob(
+        { entity: "widget" },
+        { db: stack.db, registry: stack.registry, searchAdapter: stack.search },
+      ),
+    ).resolves.toBeUndefined();
+  });
+
+  test("throws when ctx.searchAdapter is missing", async () => {
+    await expect(
+      reindexEntityJob(
+        { entity: "widget" },
+        { db: stack.db, registry: stack.registry, systemUser: admin },
+      ),
+    ).rejects.toThrow(/searchAdapter/);
+  });
+});

package/src/jobs/constants.ts

@@ -1,4 +1,5 @@
-// Feature name
+// @runtime client
+// Feature name + qualified names for server handlers and web screens.
 export const JOBS_FEATURE = "jobs" as const;
 
 // Qualified write handler names (QN format: scope:type:name)
@@ -19,3 +20,9 @@ export const JobErrors = {
   notFound: "not_found",
   onlyFailedCanRetry: "only_failed_jobs_can_be_retried",
 } as const;
+
+/** SystemAdmin job-runs list. Nav: `jobs:screen:job-runs`. */
+export const JOB_RUNS_SCREEN_ID = "job-runs" as const;
+
+/** Run detail — route entityId is the run uuid. Nav: `jobs:screen:job-run-detail`. */
+export const JOB_RUN_DETAIL_SCREEN_ID = "job-run-detail" as const;

package/src/jobs/feature.ts

@@ -5,6 +5,7 @@ import {
   type FeatureDefinition,
 } from "@cosmicdrift/kumiko-framework/engine";
 import type { z } from "zod";
+import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID } from "./constants";
 // Event-payload schemas live in a sibling module so the logger can import
 // them without the cycle jobs-feature ↔ job-run-logger. The logger parses
 // payloads against these schemas before low-level append() — that's what
@@ -16,8 +17,11 @@ import {
   projectionRebuildJob,
   projectionRebuildPayloadSchema,
 } from "./handlers/projection-rebuild.job";
+import { reindexEntityJob, reindexEntityPayloadSchema } from "./handlers/reindex-entity.job";
 import { retryWrite } from "./handlers/retry.write";
 import { triggerWrite } from "./handlers/trigger.write";
+import { JOBS_I18N } from "./i18n";
+import { parseJobInstant } from "./job-instant";
 import {
   JOB_RUN_COMPLETED_EVENT,
   JOB_RUN_FAILED_EVENT,
@@ -28,7 +32,7 @@ import { jobRunLogsTable, jobRunLogsTableMeta, jobRunsTable } from "./job-run-ta
 export function createJobsFeature(): FeatureDefinition {
   return defineFeature("jobs", (r) => {
     r.describe(
-      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `read_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list` and `jobs:query:details` for the operator UI.",
+      "Persistence and operator tooling for background jobs registered via `r.job(...)`. Every job execution appends `run-started`, `run-completed`, and `run-failed` events to the `jobRun` aggregate stream, which two inline projections materialize into `read_job_runs` (current status + duration) and `store_job_run_logs` (per-line log rows). Exposes `jobs:write:trigger` (manual run) and `jobs:write:retry` (operator retry of a failed run), plus `jobs:query:list` and `jobs:query:details` for the operator UI.",
     );
     r.uiHints({
       displayLabel: "Jobs · Audit & Operator UI",
@@ -36,7 +40,7 @@ export function createJobsFeature(): FeatureDefinition {
       recommended: false,
     });
     r.systemScope();
-    r.unmanagedTable(jobRunLogsTableMeta, {
+    r.storeTable(jobRunLogsTableMeta, {
       reason: "read_side.job_run_logs",
     });
     // Events-only aggregate: "jobRun" has no r.entity registration, because
@@ -44,7 +48,12 @@ export function createJobsFeature(): FeatureDefinition {
     // (no executor, no CRUD). The boot-validator accepts the two
     // projections below because every apply-key is a registered
     // domain-event.
-    r.defineEvent("run-started", runStartedSchema);
+    // payload can carry arbitrary user data; triggeredById stays plaintext
+    // (pseudonymous fk). System runs (triggeredById null) stay plaintext —
+    // no user subject to shred.
+    r.defineEvent("run-started", runStartedSchema, {
+      piiFields: { payload: { subjectField: "triggeredById" } },
+    });
     r.defineEvent("run-completed", runCompletedSchema);
     r.defineEvent("run-failed", runFailedSchema);
 
@@ -70,7 +79,7 @@ export function createJobsFeature(): FeatureDefinition {
               status: p.status,
               payload: p.payload,
               attempt: p.attempt,
-              startedAt: Temporal.Instant.from(p.startedAt),
+              startedAt: parseJobInstant(p.startedAt),
               triggeredById: p.triggeredById,
             });
           },
@@ -84,7 +93,7 @@ export function createJobsFeature(): FeatureDefinition {
               {
                 status: "completed",
                 duration: p.duration,
-                finishedAt: Temporal.Instant.from(p.finishedAt),
+                finishedAt: parseJobInstant(p.finishedAt),
                 version: event.version,
                 modifiedAt: event.createdAt,
                 modifiedById: event.metadata?.userId ?? "system",
@@ -103,7 +112,7 @@ export function createJobsFeature(): FeatureDefinition {
                 status: "failed",
                 error: p.error,
                 duration: p.duration,
-                finishedAt: Temporal.Instant.from(p.finishedAt),
+                finishedAt: parseJobInstant(p.finishedAt),
                 version: event.version,
                 modifiedAt: event.createdAt,
                 modifiedById: event.metadata?.userId ?? "system",
@@ -137,7 +146,7 @@ export function createJobsFeature(): FeatureDefinition {
                 runId: event.aggregateId,
                 level: log.level,
                 message: log.message,
-                timestamp: Temporal.Instant.from(log.timestamp),
+                timestamp: parseJobInstant(log.timestamp),
               })),
             );
           },
@@ -153,7 +162,7 @@ export function createJobsFeature(): FeatureDefinition {
               runId: event.aggregateId,
               level: log.level,
               message: log.message,
-              timestamp: Temporal.Instant.from(log.timestamp),
+              timestamp: parseJobInstant(log.timestamp),
             })),
           );
         }),
@@ -167,6 +176,16 @@ export function createJobsFeature(): FeatureDefinition {
       projectionRebuildJob,
     );
 
+    // Retroactive search backfill (#1206/#1215) — manual + perTenant, so one
+    // `jobs:write:trigger` call with { entity } fans out to every active
+    // tenant (job-runner.ts perTenant dispatch applies to manual triggers
+    // too, not just cron).
+    r.job(
+      "reindexEntity",
+      { trigger: { manual: true }, perTenant: true, schema: reindexEntityPayloadSchema },
+      reindexEntityJob,
+    );
+
     const handlers = {
       trigger: r.writeHandler(triggerWrite),
       retry: r.writeHandler(retryWrite),
@@ -177,6 +196,31 @@ export function createJobsFeature(): FeatureDefinition {
       detail: r.queryHandler(detailQuery),
     };
 
+    const systemAdminAccess = { roles: ["SystemAdmin"] as const };
+
+    r.translations({ keys: JOBS_I18N });
+
+    r.screen({
+      id: JOB_RUNS_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "JobRunsScreen" } },
+      access: systemAdminAccess,
+    });
+    r.screen({
+      id: JOB_RUN_DETAIL_SCREEN_ID,
+      type: "custom",
+      renderer: { react: { __component: "JobRunDetailScreen" } },
+      listScreenId: JOB_RUNS_SCREEN_ID,
+      access: systemAdminAccess,
+    });
+    r.nav({
+      id: "job-runs",
+      label: "jobs:nav.jobRuns",
+      icon: "list",
+      screen: "jobs:screen:job-runs",
+      order: 10,
+    });
+
     return { handlers, queries };
   });
 }

package/src/jobs/handlers/detail.query.ts

@@ -1,6 +1,7 @@
 import { fetchOne, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { jobRunLogsTable, jobRunsTable } from "../job-run-table";
 
 export const detailQuery = defineQueryHandler({
@@ -18,6 +19,11 @@ export const detailQuery = defineQueryHandler({
 
     if (!row) return null;
 
+    // payload is stored encrypted under the triggering user's DEK (#799).
+    if (typeof row["payload"] === "string") {
+      row["payload"] = await decryptStoredPii(row["payload"], "payload", "job-run-detail");
+    }
+
     const logs = await selectMany(
       db,
       jobRunLogsTable,

package/src/jobs/handlers/list.query.ts

@@ -1,8 +1,14 @@
 import { selectMany, type WhereObject } from "@cosmicdrift/kumiko-framework/bun-db";
 import { defineQueryHandler } from "@cosmicdrift/kumiko-framework/engine";
 import { z } from "zod";
+import { decryptStoredPii } from "../../shared";
 import { jobRunsTable } from "../job-run-table";
 
+async function decryptRunPayload<T extends Record<string, unknown>>(row: T): Promise<T> {
+  if (typeof row["payload"] !== "string") return row;
+  return { ...row, payload: await decryptStoredPii(row["payload"], "payload", "job-runs") };
+}
+
 export const listQuery = defineQueryHandler({
   name: "list",
   schema: z.object({
@@ -19,6 +25,7 @@ export const listQuery = defineQueryHandler({
       orderBy: { col: "id", direction: "desc" },
       limit: query.payload.limit ?? 50,
     });
-    return { rows };
+    // payload is stored encrypted under the triggering user's DEK (#799).
+    return { rows: await Promise.all(rows.map(decryptRunPayload)) };
   },
 });

package/src/jobs/handlers/projection-rebuild.job.ts

@@ -6,10 +6,15 @@ import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
 import { rebuildProjection } from "@cosmicdrift/kumiko-framework/pipeline";
 import { z } from "zod";
 
-export const projectionRebuildPayloadSchema = z.object({ projection: z.string().min(1) });
+export const projectionRebuildPayloadSchema = z.object({
+  projection: z.string().min(1),
+  // Quarantine mode (#760): skip + dead-letter poison events instead of
+  // failing the whole rebuild. Operator opt-in per run.
+  skipApplyErrors: z.boolean().optional(),
+});
 
 export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
-  const { projection } = projectionRebuildPayloadSchema.parse(rawPayload);
+  const { projection, skipApplyErrors } = projectionRebuildPayloadSchema.parse(rawPayload);
   if (!ctx.db) {
     throw new InternalError({
       message:
@@ -23,8 +28,13 @@ export const projectionRebuildJob: JobHandlerFn = async (rawPayload, ctx): Promi
     });
   }
   const db = ctx.db as DbConnection; // @cast-boundary db-operator
-  const result = await rebuildProjection(projection, { db, registry: ctx.registry });
+  const result = await rebuildProjection(projection, {
+    db,
+    registry: ctx.registry,
+    ...(skipApplyErrors === true && { errorPolicy: { skipApplyErrors: true } }),
+  });
   ctx.log?.info?.(
-    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events in ${result.durationMs}ms`,
+    `[jobs:projection-rebuild] rebuilt ${projection}: ${result.eventsProcessed} events` +
+      `${result.eventsSkipped > 0 ? ` (${result.eventsSkipped} quarantined)` : ""} in ${result.durationMs}ms`,
   );
 };

package/src/jobs/handlers/reindex-entity.job.ts

@@ -0,0 +1,49 @@
+// Manual, perTenant backfill job (#1206/#1215) — indexes existing rows for
+// an entity that only got `searchable: true` after rows already existed.
+// perTenant fan-out (job-runner.ts) also applies to a manual dispatch, not
+// just cron: one `jobs:write:trigger` call with { entity } re-runs once per
+// active tenant.
+
+import type { DbConnection } from "@cosmicdrift/kumiko-framework/db";
+import type { JobHandlerFn } from "@cosmicdrift/kumiko-framework/engine";
+import { InternalError } from "@cosmicdrift/kumiko-framework/errors";
+import { reindexEntity } from "@cosmicdrift/kumiko-framework/search";
+import { z } from "zod";
+
+export const reindexEntityPayloadSchema = z.object({
+  entity: z.string().min(1),
+});
+
+export const reindexEntityJob: JobHandlerFn = async (rawPayload, ctx): Promise<void> => {
+  const { entity } = reindexEntityPayloadSchema.parse(rawPayload);
+  if (!ctx.db) {
+    throw new InternalError({
+      message: "[jobs:reindex-entity] ctx.db missing — job context requires a database connection.",
+    });
+  }
+  if (!ctx.registry) {
+    throw new InternalError({
+      message: "[jobs:reindex-entity] ctx.registry missing — job context requires the registry.",
+    });
+  }
+  if (!ctx.searchAdapter) {
+    throw new InternalError({
+      message:
+        "[jobs:reindex-entity] ctx.searchAdapter missing — mount a search adapter to run this job.",
+    });
+  }
+  // perTenant fan-out — the job-runner enqueues one child run per active
+  // tenant with _tenantId set; a run without one (e.g. misconfigured
+  // manual dispatch outside the fan-out) has nothing scoped to reindex.
+  const tenantId = ctx.systemUser?.tenantId ?? ctx._tenantId;
+  if (tenantId === undefined) {
+    // skip: fired without a perTenant fan-out tenant — nothing scoped to reindex
+    return;
+  }
+  const db = ctx.db as DbConnection; // @cast-boundary db-operator
+  const result = await reindexEntity(db, ctx.registry, ctx.searchAdapter, entity, tenantId);
+  ctx.log?.info?.(
+    `[jobs:reindex-entity] tenant=${tenantId} reindexed ${entity}: ${result.indexedRows}/${result.scannedRows} rows indexed` +
+      `${result.failures.length > 0 ? ` (${result.failures.length} failed)` : ""}`,
+  );
+};

package/src/jobs/i18n.ts

@@ -0,0 +1,37 @@
+// @runtime client
+// Server + client i18n for jobs operator screens.
+
+type LocalizedString = { readonly de: string; readonly en: string };
+
+export const JOBS_I18N: Readonly<Record<string, LocalizedString>> = {
+  "screen:job-runs.title": { de: "Job-Läufe", en: "Job runs" },
+  "screen:job-run-detail.title": { de: "Job-Lauf", en: "Job run" },
+  "jobs:nav.jobRuns": { de: "Jobs", en: "Jobs" },
+  "jobs.runs.title": { de: "Job-Läufe", en: "Job runs" },
+  "jobs.runs.loading": { de: "Lade Läufe…", en: "Loading runs…" },
+  "jobs.runs.empty": { de: "Keine Job-Läufe.", en: "No job runs." },
+  "jobs.runs.open": { de: "Details", en: "Details" },
+  "jobs.runs.filter.status": { de: "Status", en: "Status" },
+  "jobs.runs.filter.all": { de: "Alle", en: "All" },
+  "jobs.runs.filter.completed": { de: "Abgeschlossen", en: "Completed" },
+  "jobs.runs.filter.failed": { de: "Fehlgeschlagen", en: "Failed" },
+  "jobs.runs.filter.running": { de: "Läuft", en: "Running" },
+  "jobs.runs.filter.queued": { de: "Wartend", en: "Queued" },
+  "jobs.runs.col.job": { de: "Job", en: "Job" },
+  "jobs.runs.col.status": { de: "Status", en: "Status" },
+  "jobs.runs.col.started": { de: "Gestartet", en: "Started" },
+  "jobs.runs.col.duration": { de: "Dauer (ms)", en: "Duration (ms)" },
+  "jobs.detail.loading": { de: "Lade Details…", en: "Loading details…" },
+  "jobs.detail.missing": { de: "Lauf nicht gefunden.", en: "Run not found." },
+  "jobs.detail.field.job": { de: "Job", en: "Job" },
+  "jobs.detail.field.status": { de: "Status", en: "Status" },
+  "jobs.detail.field.id": { de: "Run-ID", en: "Run ID" },
+  "jobs.detail.field.started": { de: "Gestartet", en: "Started" },
+  "jobs.detail.field.finished": { de: "Beendet", en: "Finished" },
+  "jobs.detail.field.duration": { de: "Dauer (ms)", en: "Duration (ms)" },
+  "jobs.detail.field.error": { de: "Fehler", en: "Error" },
+  "jobs.detail.logs": { de: "Logs", en: "Logs" },
+  "jobs.detail.logs.empty": { de: "Keine Log-Zeilen.", en: "No log lines." },
+  "jobs.detail.retry": { de: "Erneut ausführen", en: "Retry" },
+  "jobs.detail.retrying": { de: "Wird erneut gestartet…", en: "Retrying…" },
+};

package/src/jobs/job-instant.ts

@@ -0,0 +1,9 @@
+import { Temporal } from "temporal-polyfill";
+
+// kumiko-framework#1525: the five value-position Temporal.Instant.from
+// call sites in feature.ts live inside defineApply callbacks with no
+// exported seam, so this thin wrapper gives the ambient-global-independence
+// regression test something to import directly.
+export function parseJobInstant(iso: string): Temporal.Instant {
+  return Temporal.Instant.from(iso);
+}

package/src/jobs/job-run-table.ts

@@ -45,10 +45,10 @@ export const jobRunEntity = createEntity({
     status: createTextField({ required: true }),
     payload: createTextField(),
     error: createTextField(),
-    attempt: createNumberField({ required: true, default: 1 }),
+    attempt: createNumberField({ required: true, default: 1, integer: true }),
     startedAt: createTimestampField({ required: true }),
     finishedAt: createTimestampField(),
-    duration: createNumberField(),
+    duration: createNumberField({ integer: true }),
     triggeredById: createTextField(),
   },
 });
@@ -60,7 +60,7 @@ export const jobRunsTable = buildEntityTable("job-run", jobRunEntity);
 // uuid of the parent jobRun. Existing detail-query callers treat it as an
 // opaque identifier, so the type-switch is backward-compatible at the
 // query surface.
-export const jobRunLogsTable = pgTable("read_job_run_logs", {
+export const jobRunLogsTable = pgTable("store_job_run_logs", {
   id: serial("id").primaryKey(),
   runId: text("run_id").notNull(),
   level: text("level").notNull().$type<JobLogLevel>(),
@@ -76,7 +76,7 @@ export const jobRunLogsTable = pgTable("read_job_run_logs", {
 // pgTable bleibt source-of-truth für Query-API; Phase 4 leitet das pgTable
 // aus dieser Meta ab.
 export const jobRunLogsTableMeta: EntityTableMeta = defineUnmanagedTable({
-  tableName: "read_job_run_logs",
+  tableName: "store_job_run_logs",
   columns: [
     { name: "id", pgType: "serial", notNull: true, primaryKey: true },
     { name: "run_id", pgType: "text", notNull: true },

package/src/jobs/web/client-plugin.tsx

@@ -0,0 +1,22 @@
+// @runtime client
+import { mergeTranslations, type TranslationsByLocale } from "@cosmicdrift/kumiko-renderer";
+import type { ClientFeatureDefinition } from "@cosmicdrift/kumiko-renderer-web";
+import { JOB_RUN_DETAIL_SCREEN_ID, JOB_RUNS_SCREEN_ID, JOBS_FEATURE } from "../constants";
+import { defaultTranslations } from "./i18n";
+import { JobRunDetailScreen } from "./job-run-detail-screen";
+import { JobRunsScreen } from "./job-runs-screen";
+
+export type JobsClientOptions = {
+  readonly translations?: TranslationsByLocale;
+};
+
+export function jobsClient(options?: JobsClientOptions): ClientFeatureDefinition {
+  return {
+    name: JOBS_FEATURE,
+    translations: mergeTranslations(defaultTranslations, options?.translations ?? {}),
+    components: {
+      [JOB_RUNS_SCREEN_ID]: JobRunsScreen,
+      [JOB_RUN_DETAIL_SCREEN_ID]: JobRunDetailScreen,
+    },
+  };
+}