@cosmicdrift/kumiko-framework 0.249.0 → 0.250.0

package/src/jobs/__tests__/job-write-as.integration.test.ts

@@ -0,0 +1,206 @@
+// framework#2585 — JobContext.writeAs.
+//
+// `hasAccess` has no system bypass, so before writeAs existed a job could
+// only write as its own systemUser (roles: ["system"]) and every write
+// handler gated on concrete roles was unreachable from a job: the dispatch
+// came back access_denied and the only signal was a failed job. These tests
+// pin both halves — ctx.write against a role-gated handler is still denied,
+// and ctx.writeAs(actor) reaches the same handler and attributes the event
+// to the actor rather than to SYSTEM.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { ROLES } from "../../auth/roles";
+import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
+import { asRawClient } from "../../db/query";
+import { createRegistry, defineFeature, type SessionUser, type WriteResult } from "../../engine";
+import { createWorkerEntrypoint } from "../../entrypoint";
+import { createArchivedStreamsTable, createEventsTable } from "../../event-store";
+import { createEventConsumerStateTable } from "../../pipeline";
+import { createTestRedis, type TestRedis } from "../../stack";
+import { waitFor } from "../../testing";
+import { createJobRunner } from "../job-runner";
+
+const ADMIN_USER_ID = "11111111-1111-4111-8111-111111111111";
+
+type ProbeOutcome = { readonly isSuccess: boolean; readonly errorCode: string | undefined };
+
+const writeOutcomes: ProbeOutcome[] = [];
+const writeAsOutcomes: ProbeOutcome[] = [];
+const writeAsFailures: string[] = [];
+
+function recordOutcome(sink: ProbeOutcome[], result: WriteResult): void {
+  sink.push({
+    isSuccess: result.isSuccess,
+    errorCode: result.isSuccess ? undefined : result.error.code,
+  });
+}
+
+const writeAsProbeFeature = defineFeature("writeAsProbe", (r) => {
+  const noted = r.defineEvent("adminNoted", z.object({ note: z.string() }), {
+    piiFields: "none",
+    version: 1,
+  });
+
+  r.writeHandler(
+    "adminNote",
+    z.object({ note: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: crypto.randomUUID(),
+        aggregateType: "write-as-probe-note",
+        type: noted.name,
+        payload: { note: event.payload.note },
+      });
+      return { isSuccess: true as const, data: { note: event.payload.note } };
+    },
+    { access: { roles: [ROLES.TenantAdmin] } },
+  );
+
+  r.job("writeAsSystem", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const result = await ctx.write("write-as-probe:write:admin-note", {
+      note: payload["note"] as string, // @cast-boundary dynamic-key
+    });
+    recordOutcome(writeOutcomes, result);
+  });
+
+  r.job("writeAsActor", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const actor: SessionUser = {
+      id: payload["actorId"] as string, // @cast-boundary dynamic-key
+      tenantId: ctx.systemUser.tenantId,
+      roles: [ROLES.TenantAdmin],
+    };
+    try {
+      const result = await ctx.writeAs(actor, "write-as-probe:write:admin-note", {
+        note: payload["note"] as string, // @cast-boundary dynamic-key
+      });
+      recordOutcome(writeAsOutcomes, result);
+    } catch (error) {
+      writeAsFailures.push(error instanceof Error ? error.message : String(error));
+      throw error;
+    }
+  });
+});
+
+const JWT = "job-write-as-test-secret-must-be-32-chars!";
+
+let testDb: BunTestDb;
+let testRedis: TestRedis;
+
+beforeAll(async () => {
+  [testDb, testRedis] = await Promise.all([createTestDb(), createTestRedis()]);
+  await createEventsTable(testDb.db);
+  await createArchivedStreamsTable(testDb.db);
+  await createEventConsumerStateTable(testDb.db);
+});
+
+afterAll(async () => {
+  await Promise.all([testDb.cleanup(), testRedis.cleanup()]);
+});
+
+function redisUrl(): string {
+  return `redis://${testRedis.redis.options.host}:${testRedis.redis.options.port}/${testRedis.redis.options.db}`;
+}
+
+function uniquePrefix(label: string): string {
+  return `${label}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+
+async function notesFor(note: string): Promise<Array<{ created_by: string }>> {
+  const rows = await asRawClient(testDb.db).unsafe<{ created_by: string }>(
+    `SELECT created_by FROM kumiko_events
+      WHERE type = 'write-as-probe:event:admin-noted' AND payload->>'note' = $1`,
+    [note],
+  );
+  return [...rows];
+}
+
+describe("JobContext.writeAs reaches a role-gated write handler (framework#2585)", () => {
+  test("ctx.write is denied — the job's systemUser carries no TenantAdmin role", async () => {
+    writeOutcomes.length = 0;
+    const worker = createWorkerEntrypoint({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl: redisUrl(),
+      queueNamePrefix: uniquePrefix("job-write-as-denied"),
+    });
+
+    await worker.start();
+    try {
+      await worker.jobRunner.dispatch("write-as-probe:job:write-as-system", {
+        note: "system attempt",
+      });
+
+      await waitFor(() => {
+        expect(writeOutcomes.length).toBe(1);
+      });
+      expect(writeOutcomes[0]?.isSuccess).toBe(false);
+      expect(writeOutcomes[0]?.errorCode).toBe("access_denied");
+      expect(await notesFor("system attempt")).toHaveLength(0);
+    } finally {
+      await worker.stop();
+    }
+  });
+
+  test("ctx.writeAs(actor) commits and attributes the event to the actor", async () => {
+    writeAsOutcomes.length = 0;
+    const worker = createWorkerEntrypoint({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      jwtSecret: JWT,
+      redisUrl: redisUrl(),
+      queueNamePrefix: uniquePrefix("job-write-as-allowed"),
+    });
+
+    await worker.start();
+    try {
+      await worker.jobRunner.dispatch("write-as-probe:job:write-as-actor", {
+        note: "actor attempt",
+        actorId: ADMIN_USER_ID,
+      });
+
+      await waitFor(() => {
+        expect(writeAsOutcomes.length).toBe(1);
+      });
+      expect(writeAsOutcomes[0]?.isSuccess).toBe(true);
+
+      const rows = await notesFor("actor attempt");
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.created_by).toBe(ADMIN_USER_ID);
+    } finally {
+      await worker.stop();
+    }
+  });
+});
+
+describe("JobContext.writeAs before attachDispatcher()", () => {
+  test("throws the same not-attached stub ctx.write does", async () => {
+    writeAsFailures.length = 0;
+    const runner = createJobRunner({
+      registry: createRegistry([writeAsProbeFeature]),
+      context: { db: testDb.db, redis: testRedis.redis },
+      redisUrl: redisUrl(),
+      consumerLane: "worker",
+      queueNamePrefix: uniquePrefix("job-write-as-bare"),
+    });
+
+    await runner.start();
+    try {
+      await runner.dispatch("write-as-probe:job:write-as-actor", {
+        note: "should never land",
+        actorId: ADMIN_USER_ID,
+      });
+
+      await waitFor(() => {
+        expect(writeAsFailures.length).toBe(1);
+      });
+      expect(writeAsFailures[0]).toContain(
+        "JobContext.writeAs called before dispatcher attached — call attachDispatcher() first",
+      );
+      expect(await notesFor("should never land")).toHaveLength(0);
+    } finally {
+      await runner.stop();
+    }
+  });
+});

package/src/jobs/job-runner.ts

@@ -144,9 +144,9 @@ export type JobRunner = {
     payload: Record<string, unknown>,
     user?: SessionUser,
   ): Promise<void>;
-  // Wires JobContext.write/queryAs to the real dispatcher — called once at
-  // boot, after the dispatcher exists (job-runner construction happens
-  // before it). Before this runs, JobContext.write/queryAs throw.
+  // Wires JobContext.write/writeAs/queryAs to the real dispatcher — called
+  // once at boot, after the dispatcher exists (job-runner construction happens
+  // before it). Before this runs, JobContext.write/writeAs/queryAs throw.
   attachDispatcher(ref: DispatchWriteRef): void;
 };
 
@@ -362,7 +362,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
   // at job-execution time (after start()), so it is always defined by then.
   let selfRunner: JobRunner | undefined;
   // Set by attachDispatcher() once the boot-level dispatcher exists.
-  // JobContext.write/queryAs throw until this is set — see JobContext doc.
+  // JobContext.write/writeAs/queryAs throw until this is set — see JobContext doc.
   let dispatchWriteRef: DispatchWriteRef | undefined;
 
   // Counts active + waiting jobs with this name for this tenant across
@@ -581,6 +581,14 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
         }
         return dispatchWriteRef.write(jobSystemUser, qn, payload);
       },
+      writeAs: (user: SessionUser, qn: string, payload: unknown) => {
+        if (!dispatchWriteRef) {
+          throw new Error(
+            "JobContext.writeAs called before dispatcher attached — call attachDispatcher() first",
+          );
+        }
+        return dispatchWriteRef.write(user, qn, payload);
+      },
       queryAs: (user: SessionUser, qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
           throw new Error(

package/src/pipeline/__tests__/archive-stream.integration.test.ts

@@ -32,7 +32,9 @@ const itemTable = buildEntityTable("arch-item", itemEntity);
 const archFeature = defineFeature("archtest", (r) => {
   r.entity("arch-item", itemEntity);
 
-  const labelChanged = r.defineEvent("label-changed", z.object({ label: z.string() }));
+  const labelChanged = r.defineEvent("label-changed", z.object({ label: z.string() }), {
+    piiFields: "none",
+  });
 
   const executor = createEventStoreExecutor(itemTable, itemEntity, {
     entityName: "arch-item",

package/src/pipeline/__tests__/causation-chain.integration.test.ts

@@ -54,7 +54,9 @@ const applyObservations: ReqCtxSnapshot[] = [];
 const causationFeature = defineFeature("causation", (r) => {
   r.entity("causation-order", orderEntity);
 
-  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }));
+  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }), {
+    piiFields: "none",
+  });
 
   const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
     entityName: "causation-order",

package/src/pipeline/__tests__/domain-events-projections.integration.test.ts

@@ -58,7 +58,9 @@ const shippingFeature = defineFeature("shipping", (r) => {
   r.entity("domain-shipment", shipmentEntity);
 
   // Domain event. Qualified name is "shipping:event:billed".
-  const shipmentBilled = r.defineEvent("billed", z.object({ cost: z.number() }));
+  const shipmentBilled = r.defineEvent("billed", z.object({ cost: z.number() }), {
+    piiFields: "none",
+  });
 
   r.projection({
     name: "shipment-billing",

package/src/pipeline/__tests__/event-define-event-strict.integration.test.ts

@@ -34,14 +34,18 @@ let foreignEventName = "";
 // emit this from one of its handlers — Sprint-E cross-feature-ownership
 // guard must reject it at the append site.
 const neighborFeature = defineFeature("neighbor", (r) => {
-  const foreign = r.defineEvent("neighbor.signal", z.object({ userId: z.uuid() }));
+  const foreign = r.defineEvent("neighbor.signal", z.object({ userId: z.uuid() }), {
+    piiFields: "none",
+  });
   foreignEventName = foreign.name;
 });
 
 const emitterFeature = defineFeature("emitter", (r) => {
   r.entity("widget", sharedWidgetEntity);
 
-  const welcome = r.defineEvent("user.welcomed", z.object({ userId: z.uuid(), email: z.email() }));
+  const welcome = r.defineEvent("user.welcomed", z.object({ userId: z.uuid(), email: z.email() }), {
+    piiFields: "none",
+  });
   welcomeEventName = welcome.name;
 
   r.writeHandler(

package/src/pipeline/__tests__/fetch-for-writing.integration.test.ts

@@ -31,8 +31,12 @@ const cartTable = buildEntityTable("f4wCart", cartEntity);
 const cartFeature = defineFeature("f4w", (r) => {
   r.entity("f4wCart", cartEntity);
 
-  const itemAdded = r.defineEvent("itemAdded", z.object({ sku: z.string(), qty: z.number() }));
-  const checkedOut = r.defineEvent("checkedOut", z.object({ totalCents: z.number() }));
+  const itemAdded = r.defineEvent("itemAdded", z.object({ sku: z.string(), qty: z.number() }), {
+    piiFields: "none",
+  });
+  const checkedOut = r.defineEvent("checkedOut", z.object({ totalCents: z.number() }), {
+    piiFields: "none",
+  });
 
   const cartExecutor = createEventStoreExecutor(cartTable, cartEntity, {
     entityName: "f4wCart",

package/src/pipeline/__tests__/job-trigger-consumer.integration.test.ts

@@ -30,7 +30,9 @@ const FILE_REF_CREATED = entityEventName("fileRef", "created");
 const processedItems: Array<{ readonly fileRefId: string }> = [];
 
 const jobTriggerFixtureFeature = defineFeature("job-trigger-fixture", (r) => {
-  r.defineEvent("item-requested", z.object({ fileRefId: z.string().min(1) }));
+  r.defineEvent("item-requested", z.object({ fileRefId: z.string().min(1) }), {
+    piiFields: "none",
+  });
 
   // Mirrors document-ingest-foundation's request-ingest MSP exactly: reacts
   // to fileRef.created, appends a NEW event via unsafeAppendEvent — no

package/src/pipeline/__tests__/load-aggregate-query.integration.test.ts

@@ -46,6 +46,7 @@ const asOfFeature = defineFeature("asoftest", (r) => {
     "approved",
     z.object({ amount: z.number().int(), approvedBy: z.string() }),
     {
+      piiFields: "none",
       version: 2,
       migrations: [
         {

package/src/pipeline/__tests__/msp-multi-hop.integration.test.ts

@@ -42,9 +42,11 @@ const confirmLoadCounts: number[] = [];
 const mmhFeature = defineFeature("mmh", (r) => {
   r.entity("mmh-order", orderEntity);
 
-  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }));
-  const confirmed = r.defineEvent("confirmed", z.object({ orderId: z.uuid() }));
-  const shipped = r.defineEvent("shipped", z.object({ orderId: z.uuid() }));
+  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }), { piiFields: "none" });
+  const confirmed = r.defineEvent("confirmed", z.object({ orderId: z.uuid() }), {
+    piiFields: "none",
+  });
+  const shipped = r.defineEvent("shipped", z.object({ orderId: z.uuid() }), { piiFields: "none" });
 
   const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
     entityName: "mmh-order",

package/src/pipeline/__tests__/msp-rebuild.integration.test.ts

@@ -72,14 +72,17 @@ const feature = defineFeature("mspreb", (r) => {
   const invoiceBilled = r.defineEvent(
     "invoice-billed",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const paymentReceived = r.defineEvent(
     "payment-received",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const escalationTriggered = r.defineEvent(
     "escalation-triggered",
     z.object({ customer: z.uuid() }),
+    { piiFields: "none" },
   );
 
   // 1) Main rebuildable MSP — table materialized from two event types.

package/src/pipeline/__tests__/multi-stream-projection.integration.test.ts

@@ -56,10 +56,12 @@ const mspFeature = defineFeature("msptest", (r) => {
   const shipmentBilled = r.defineEvent(
     "shipment-billed",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
   const refundIssued = r.defineEvent(
     "refund-issued",
     z.object({ customer: z.uuid(), cents: z.number().int() }),
+    { piiFields: "none" },
   );
 
   r.multiStreamProjection({

package/src/pipeline/__tests__/rebuild-poison-quarantine.integration.test.ts

@@ -110,7 +110,9 @@ const MSP_EVENT_SHORT = "poison-noted";
 const feature = defineFeature("poisontest", (r) => {
   r.entity("poison-item", itemEntity);
   r.projection(poisonProjection);
-  const noted = r.defineEvent(MSP_EVENT_SHORT, z.object({ groupId: z.uuid(), name: z.string() }));
+  const noted = r.defineEvent(MSP_EVENT_SHORT, z.object({ groupId: z.uuid(), name: z.string() }), {
+    piiFields: "none",
+  });
   r.multiStreamProjection({
     name: "poison-msp-counter",
     table: mspCounterTable,

package/src/pipeline/__tests__/search-consumer-named-events.integration.test.ts

@@ -0,0 +1,260 @@
+// #2765 — named domain events (r.defineEvent, not created/updated/restored/
+// deleted/forgotten) on an entity with searchable fields must still reach
+// the search index. The event payload only carries the named event's own
+// field slice, so the consumer reads the live projection row instead.
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { asRawClient, buildEntityTable, createEventStoreExecutor, createTenantDb } from "../../db";
+import { createEntity, createTextField, defineFeature } from "../../engine";
+import {
+  resetEventStore,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "../../stack";
+import { SEARCH_CONSUMER_NAME } from "../system-hooks";
+
+const noteEntity = createEntity({
+  table: "read_named_search_notes",
+  fields: {
+    label: createTextField({ required: true, maxLength: 100, searchable: true }),
+  },
+  softDelete: true,
+});
+const noteTable = buildEntityTable("note", noteEntity);
+
+// No DDL table for this one — proves the searchable-fields gate runs
+// before any query, not after a failed one.
+const ghostEntity = createEntity({
+  table: "read_named_search_ghosts",
+  fields: {
+    note: createTextField({ required: true, maxLength: 50 }),
+  },
+});
+
+const ROW_LABEL = "row-projection-value";
+
+const namedSearchFeature = defineFeature("named-search", (r) => {
+  r.entity("note", noteEntity);
+  r.entity("ghost", ghostEntity);
+
+  const relabeled = r.defineEvent("relabeled", z.object({ label: z.string() }), {
+    piiFields: "none",
+  });
+  const poked = r.defineEvent("poked", z.object({}), { piiFields: "none" });
+
+  r.writeHandler(
+    "note:relabel",
+    z.object({ id: z.uuid(), label: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: event.payload.id,
+        aggregateType: "note",
+        type: relabeled.name,
+        payload: { label: event.payload.label },
+      });
+      // Bypasses the executor on purpose (raw SQL, not updateMany — the
+      // executor-built table is write-locked to the executor) so the row
+      // ends up with a value distinct from the event payload above. Proves
+      // the search consumer reads the row, not the payload.
+      await asRawClient(ctx.db).unsafe(
+        `UPDATE read_named_search_notes SET label = $1 WHERE id = $2`,
+        [ROW_LABEL, event.payload.id],
+      );
+      return { isSuccess: true as const, data: { id: event.payload.id } };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.writeHandler(
+    "ghost:poke",
+    z.object({ id: z.uuid() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: event.payload.id,
+        aggregateType: "ghost",
+        type: poked.name,
+        payload: {},
+      });
+      return { isSuccess: true as const, data: { id: event.payload.id } };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+});
+
+let stack: TestStack;
+const admin = TestUsers.admin;
+
+function noteExecutor() {
+  return createEventStoreExecutor(noteTable, noteEntity, {
+    entityName: "note",
+    searchAdapter: stack.search,
+  });
+}
+
+function tenantDb() {
+  return createTenantDb(stack.db, admin.tenantId, "system");
+}
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [namedSearchFeature] });
+  await unsafeCreateEntityTable(stack.db, noteEntity, "note");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(async () => {
+  await resetEventStore(stack, ["read_named_search_notes"]);
+});
+
+describe("search consumer: named domain events (#2765)", () => {
+  test("named event on a searchable entity indexes from the projection row, not the payload", async () => {
+    const created = await noteExecutor().create({ label: "original-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+    await stack.eventDispatcher?.runOnce();
+
+    const beforeHits = await stack.search.search(admin.tenantId, "original-label", {
+      filterType: "note",
+    });
+    expect(beforeHits.some((h) => String(h.entityId) === id)).toBe(true);
+
+    await stack.http.writeOk(
+      "named-search:write:note:relabel",
+      { id, label: "payload-label-should-not-be-indexed" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    const payloadHits = await stack.search.search(
+      admin.tenantId,
+      "payload-label-should-not-be-indexed",
+      { filterType: "note" },
+    );
+    expect(payloadHits).toHaveLength(0);
+
+    const rowHits = await stack.search.search(admin.tenantId, ROW_LABEL, { filterType: "note" });
+    expect(rowHits.some((h) => String(h.entityId) === id)).toBe(true);
+  });
+
+  test("named event on an entity without searchable fields triggers no query and no index", async () => {
+    const id = crypto.randomUUID();
+    // Ghost has no DDL table — if the consumer queried it anyway, runOnce()
+    // would reject instead of completing (relation does not exist).
+    await stack.http.writeOk("named-search:write:ghost:poke", { id }, admin);
+    const result = await stack.eventDispatcher?.runOnce();
+    expect(result?.byConsumer[SEARCH_CONSUMER_NAME]?.failed).toBe(0);
+
+    const hits = await stack.search.search(admin.tenantId, "poked", { filterType: "ghost" });
+    expect(hits).toHaveLength(0);
+  });
+
+  test("named event with no live projection row removes the index entry", async () => {
+    const created = await noteExecutor().create({ label: "vanishing-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = String(created.data.id);
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "vanishing-label", { filterType: "note" })).some(
+        (h) => String(h.entityId) === id,
+      ),
+    ).toBe(true);
+
+    // Hard-delete the row directly, bypassing executor.forget — simulates a
+    // projection row that's simply gone, distinct from the deleted/forgotten
+    // verb path covered by the regression test below.
+    await asRawClient(stack.db).unsafe(`DELETE FROM read_named_search_notes WHERE id = $1`, [id]);
+
+    await stack.http.writeOk("named-search:write:note:relabel", { id, label: "irrelevant" }, admin);
+    await stack.eventDispatcher?.runOnce();
+
+    const after = await stack.search.search(admin.tenantId, "vanishing-label", {
+      filterType: "note",
+    });
+    expect(after.some((h) => String(h.entityId) === id)).toBe(false);
+  });
+
+  test("named event on a soft-deleted entity does not resurrect the index entry", async () => {
+    const created = await noteExecutor().create({ label: "soft-deleted-label" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = created.data.id;
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (
+        await stack.search.search(admin.tenantId, "soft-deleted-label", { filterType: "note" })
+      ).some((h) => String(h.entityId) === String(id)),
+    ).toBe(true);
+
+    const deleted = await noteExecutor().delete({ id }, admin, tenantDb());
+    if (!deleted.isSuccess) throw new Error("delete failed");
+    await stack.eventDispatcher?.runOnce();
+
+    // The row still physically exists (isDeleted: true) — a plain fetchOne
+    // without the soft-delete filter would find it and re-index it.
+    await stack.http.writeOk(
+      "named-search:write:note:relabel",
+      { id: String(id), label: "irrelevant" },
+      admin,
+    );
+    await stack.eventDispatcher?.runOnce();
+
+    const after = await stack.search.search(admin.tenantId, ROW_LABEL, { filterType: "note" });
+    expect(after.some((h) => String(h.entityId) === String(id))).toBe(false);
+  });
+
+  test("created/updated/restored/deleted/forgotten still index/remove as before (regression)", async () => {
+    const created = await noteExecutor().create({ label: "crud-created" }, admin, tenantDb());
+    if (!created.isSuccess) throw new Error("create failed");
+    const id = created.data.id;
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-created", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const updated = await noteExecutor().update(
+      { id, changes: { label: "crud-updated" } },
+      admin,
+      tenantDb(),
+      { skipOptimisticLock: true },
+    );
+    if (!updated.isSuccess) throw new Error("update failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const deleted = await noteExecutor().delete({ id }, admin, tenantDb());
+    if (!deleted.isSuccess) throw new Error("delete failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(false);
+
+    const restored = await noteExecutor().restore({ id }, admin, tenantDb());
+    if (!restored.isSuccess) throw new Error("restore failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(true);
+
+    const forgotten = await noteExecutor().forget({ id }, admin, tenantDb());
+    if (!forgotten.isSuccess) throw new Error("forget failed");
+    await stack.eventDispatcher?.runOnce();
+    expect(
+      (await stack.search.search(admin.tenantId, "crud-updated", { filterType: "note" })).some(
+        (h) => String(h.entityId) === String(id),
+      ),
+    ).toBe(false);
+  });
+});

package/src/pipeline/__tests__/try-append-event.integration.test.ts

@@ -50,7 +50,9 @@ const admin = TestUsers.admin;
 
 const tryAppendFeature = defineFeature("tae", (r) => {
   r.entity("taeMarker", markerEntity);
-  const appended = r.defineEvent("appended", z.object({ note: z.string() }));
+  const appended = r.defineEvent("appended", z.object({ note: z.string() }), {
+    piiFields: "none",
+  });
 
   r.writeHandler(
     "doc:try-append",