@cosmicdrift/kumiko-framework 0.252.1 → 0.254.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.252.1",
+  "version": "0.254.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -198,7 +198,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.252.1",
+    "@cosmicdrift/kumiko-types": "0.254.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -214,7 +214,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.252.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.254.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/crypto/__tests__/blind-index.test.ts

@@ -101,6 +101,7 @@ describe("computeBlindIndexValues", () => {
       ["email"],
       kms,
       { requestId: "test" },
+      { entityName: "bidx-user" },
     );
     const out = await computeBlindIndexValues({ email: stored["email"] }, ["email"]);
     expect(out["emailBidx"]).toBe(computeBlindIndex(TEST_KEY, "marc@example.com"));
@@ -116,6 +117,7 @@ describe("computeBlindIndexValues", () => {
       ["email"],
       kms,
       { requestId: "test" },
+      { entityName: "bidx-user" },
     );
     await kms.eraseKey({ kind: "user", userId: UUID_A });
     const out = await computeBlindIndexValues({ email: stored["email"] }, ["email"]);

package/src/crypto/__tests__/pii-field-encryption.test.ts

@@ -23,6 +23,7 @@ import { collectPiiSubjectFields } from "../subject-resolver";
 const UUID_A = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000a";
 const UUID_B = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000b";
 const KMS_CTX: KmsContext = { requestId: "test" };
+const ENTITY_NAME = "pii-entity";
 
 const userLikeEntity = createEntity({
   fields: {
@@ -67,7 +68,9 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
     const fields = collectPiiSubjectFields(userLikeEntity);
     const row = { id: UUID_A, email: "marc@example.com", role: "admin" };
 
-    const stored = await encryptPiiFieldValues(row, userLikeEntity, fields, kms, KMS_CTX);
+    const stored = await encryptPiiFieldValues(row, userLikeEntity, fields, kms, KMS_CTX, {
+      entityName: ENTITY_NAME,
+    });
     expect(isPiiCiphertext(stored["email"])).toBe(true);
     expect(String(stored["email"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${UUID_A}:`);
     expect(stored["role"]).toBe("admin");
@@ -88,6 +91,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["email"],
       kms,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
     const dek = await kms.getKey({ kind: "user", userId: UUID_A });
     expect(dek.length).toBe(32);
@@ -101,6 +105,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["body"],
       kms,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
     expect(String(stored["body"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${UUID_B}:`);
   });
@@ -113,7 +118,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["brandColor"],
       kms,
       KMS_CTX,
-      { tenantId: UUID_B },
+      { tenantId: UUID_B, entityName: ENTITY_NAME },
     );
     expect(String(stored["brandColor"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}tenant:${UUID_B}:`);
   });
@@ -124,6 +129,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
     const stored = await encryptPiiFieldValues(changes, commentEntity, ["body"], kms, KMS_CTX, {
       onlyKeys: ["body"],
       subjectSource: { id: UUID_A, body: "edited", authorId: UUID_B },
+      entityName: ENTITY_NAME,
     });
     expect(String(stored["body"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}user:${UUID_B}:`);
   });
@@ -137,13 +143,16 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       fields,
       kms,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
     await kms.eraseKey({ kind: "user", userId: UUID_A });
 
     const read = await decryptPiiFieldValues(stored, fields, kms, KMS_CTX);
     expect(read["email"]).toBe(PII_ERASED_SENTINEL);
 
-    const reStored = await encryptPiiFieldValues(read, userLikeEntity, fields, kms, KMS_CTX);
+    const reStored = await encryptPiiFieldValues(read, userLikeEntity, fields, kms, KMS_CTX, {
+      entityName: ENTITY_NAME,
+    });
     expect(reStored["email"]).toBe(PII_ERASED_SENTINEL);
   });
 
@@ -158,6 +167,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
         ["email"],
         kms,
         KMS_CTX,
+        { entityName: ENTITY_NAME },
       ),
     ).rejects.toThrow(/erased/);
   });
@@ -181,8 +191,11 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["email"],
       kms,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
-    const twice = await encryptPiiFieldValues(once, userLikeEntity, ["email"], kms, KMS_CTX);
+    const twice = await encryptPiiFieldValues(once, userLikeEntity, ["email"], kms, KMS_CTX, {
+      entityName: ENTITY_NAME,
+    });
     expect(twice["email"]).toBe(once["email"]);
   });
 
@@ -194,6 +207,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["email"],
       kms,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
     expect(stored["email"]).toBeNull();
 
@@ -203,7 +217,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["email"],
       kms,
       KMS_CTX,
-      { onlyKeys: ["role"] },
+      { onlyKeys: ["role"], entityName: ENTITY_NAME },
     );
     expect(skipped["email"]).toBe("a@b.c");
   });
@@ -211,7 +225,9 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
   test("non-string pii value throws", async () => {
     const kms = new InMemoryKmsAdapter();
     await expect(
-      encryptPiiFieldValues({ id: UUID_A, email: 42 }, userLikeEntity, ["email"], kms, KMS_CTX),
+      encryptPiiFieldValues({ id: UUID_A, email: 42 }, userLikeEntity, ["email"], kms, KMS_CTX, {
+        entityName: ENTITY_NAME,
+      }),
     ).rejects.toThrow(/must be a string/);
   });
 
@@ -223,6 +239,7 @@ describe("encryptPiiFieldValues / decryptPiiFieldValues", () => {
       ["email"],
       kmsA,
       KMS_CTX,
+      { entityName: ENTITY_NAME },
     );
     const kmsB = new InMemoryKmsAdapter();
     await expect(decryptPiiFieldValues(stored, ["email"], kmsB, KMS_CTX)).rejects.toBeInstanceOf(
@@ -248,7 +265,9 @@ describe("tenant-owned field encryption (kumiko-platform#457)", () => {
     expect(fields).toEqual(["iban"]);
 
     const row = { id: UUID_A, tenantId: UUID_B, iban: "DE89370400440532013000" };
-    const stored = await encryptPiiFieldValues(row, brandingWithAccess, fields, kms, KMS_CTX);
+    const stored = await encryptPiiFieldValues(row, brandingWithAccess, fields, kms, KMS_CTX, {
+      entityName: ENTITY_NAME,
+    });
     expect(isPiiCiphertext(stored["iban"])).toBe(true);
     expect(String(stored["iban"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}tenant:${UUID_B}:`);
 
@@ -266,7 +285,9 @@ describe("tenant-owned field encryption (kumiko-platform#457)", () => {
     });
     const fields = collectPiiSubjectFields(brandingWithAccess);
     const row = { id: UUID_A, tenantId: UUID_B, iban: "DE89370400440532013000" };
-    const stored = await encryptPiiFieldValues(row, brandingWithAccess, fields, kms, KMS_CTX);
+    const stored = await encryptPiiFieldValues(row, brandingWithAccess, fields, kms, KMS_CTX, {
+      entityName: ENTITY_NAME,
+    });
 
     // Erasure is subject-keyed, not field-flag-keyed — kms.eraseKey doesn't
     // know or care about the field's `personal` annotation, just the subject.

package/src/crypto/__tests__/subject-key-record.test.ts

@@ -76,9 +76,9 @@ describe("record subject key round-trip", () => {
 
 describe("resolveSubjectForField: recordOwned fail-closed", () => {
   test("recordOwned field without opts.entityName throws", () => {
-    expect(() => resolveSubjectForField(recordEntity, "body", { id: UUID_A })).toThrow(
-      SubjectResolutionError,
-    );
+    expect(() =>
+      resolveSubjectForField(recordEntity, "body", { id: UUID_A }, { entityName: "" }),
+    ).toThrow(SubjectResolutionError);
   });
 
   test("recordOwned field with row missing id throws", () => {

package/src/crypto/__tests__/subject-resolver.test.ts

@@ -38,31 +38,50 @@ const brandingEntity = createEntity({
 
 const UUID_A = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000a";
 const UUID_B = "6b2f4a0e-1c9d-4f3a-9d2e-00000000000b";
+const ENTITY_NAME = "resolver-entity";
 
 describe("resolveSubjectForField", () => {
   test("pii: true → the entity row itself is the user subject", () => {
-    const subject = resolveSubjectForField(userLikeEntity, "email", { id: UUID_A });
+    const subject = resolveSubjectForField(
+      userLikeEntity,
+      "email",
+      { id: UUID_A },
+      {
+        entityName: ENTITY_NAME,
+      },
+    );
     expect(subject).toEqual({ kind: "user", userId: UUID_A });
   });
 
   test("pii self-subject stringifies serial ids", () => {
-    const subject = resolveSubjectForField(userLikeEntity, "email", { id: 42 });
+    const subject = resolveSubjectForField(
+      userLikeEntity,
+      "email",
+      { id: 42 },
+      {
+        entityName: ENTITY_NAME,
+      },
+    );
     expect(subject).toEqual({ kind: "user", userId: "42" });
   });
 
   test("userOwned → subject comes from the owner reference field", () => {
-    const subject = resolveSubjectForField(commentEntity, "body", {
-      id: UUID_A,
-      authorId: UUID_B,
-    });
+    const subject = resolveSubjectForField(
+      commentEntity,
+      "body",
+      { id: UUID_A, authorId: UUID_B },
+      { entityName: ENTITY_NAME },
+    );
     expect(subject).toEqual({ kind: "user", userId: UUID_B });
   });
 
   test("tenantOwned → subject from the row's tenantId column", () => {
-    const subject = resolveSubjectForField(brandingEntity, "brandColor", {
-      id: UUID_A,
-      tenantId: UUID_B,
-    });
+    const subject = resolveSubjectForField(
+      brandingEntity,
+      "brandColor",
+      { id: UUID_A, tenantId: UUID_B },
+      { entityName: ENTITY_NAME },
+    );
     expect(subject).toEqual({ kind: "tenant", tenantId: UUID_B });
   });
 
@@ -71,37 +90,44 @@ describe("resolveSubjectForField", () => {
       brandingEntity,
       "brandColor",
       { id: UUID_A },
-      { tenantId: UUID_B },
+      { tenantId: UUID_B, entityName: ENTITY_NAME },
     );
     expect(subject).toEqual({ kind: "tenant", tenantId: UUID_B });
   });
 
   test("unannotated field → null (stays plaintext)", () => {
-    expect(resolveSubjectForField(userLikeEntity, "role", { id: UUID_A })).toBeNull();
+    expect(
+      resolveSubjectForField(userLikeEntity, "role", { id: UUID_A }, { entityName: ENTITY_NAME }),
+    ).toBeNull();
   });
 
   test("empty owner reference throws instead of silently falling back to plaintext", () => {
-    expect(() => resolveSubjectForField(commentEntity, "body", { id: UUID_A })).toThrow(
-      SubjectResolutionError,
-    );
+    expect(() =>
+      resolveSubjectForField(commentEntity, "body", { id: UUID_A }, { entityName: ENTITY_NAME }),
+    ).toThrow(SubjectResolutionError);
   });
 
   test("tenantOwned without any tenant scope throws", () => {
-    expect(() => resolveSubjectForField(brandingEntity, "brandColor", { id: UUID_A })).toThrow(
-      SubjectResolutionError,
-    );
+    expect(() =>
+      resolveSubjectForField(
+        brandingEntity,
+        "brandColor",
+        { id: UUID_A },
+        { entityName: ENTITY_NAME },
+      ),
+    ).toThrow(SubjectResolutionError);
   });
 
   test("pii row without id throws", () => {
-    expect(() => resolveSubjectForField(userLikeEntity, "email", {})).toThrow(
-      SubjectResolutionError,
-    );
+    expect(() =>
+      resolveSubjectForField(userLikeEntity, "email", {}, { entityName: ENTITY_NAME }),
+    ).toThrow(SubjectResolutionError);
   });
 
   test("unknown field name throws", () => {
-    expect(() => resolveSubjectForField(userLikeEntity, "nope", { id: UUID_A })).toThrow(
-      SubjectResolutionError,
-    );
+    expect(() =>
+      resolveSubjectForField(userLikeEntity, "nope", { id: UUID_A }, { entityName: ENTITY_NAME }),
+    ).toThrow(SubjectResolutionError);
   });
 });
 

package/src/crypto/pii-field-encryption.ts

@@ -160,7 +160,7 @@ export interface EncryptPiiOptions {
   // carry a pii field without its ownerField — the merged row still has it).
   readonly subjectSource?: Record<string, unknown>;
   // Canonical registry entity name — required to resolve recordOwned fields.
-  readonly entityName?: string;
+  readonly entityName: string;
 }
 
 export async function encryptPiiFieldValues(
@@ -169,7 +169,7 @@ export async function encryptPiiFieldValues(
   piiFields: readonly string[],
   kms: LocalKeyKmsAdapter,
   kmsCtx: KmsContext,
-  opts: EncryptPiiOptions = {},
+  opts: EncryptPiiOptions,
 ): Promise<Record<string, unknown>> {
   if (piiFields.length === 0) return row;
   const only = opts.onlyKeys ? new Set(opts.onlyKeys) : null;
@@ -187,8 +187,8 @@ export async function encryptPiiFieldValues(
       throw new Error(`PII field "${name}" must be a string, got ${typeof value}`);
     }
     const subject = resolveSubjectForField(entity, name, subjectSource, {
+      entityName: opts.entityName,
       ...(opts.tenantId !== undefined && { tenantId: opts.tenantId }),
-      ...(opts.entityName !== undefined && { entityName: opts.entityName }),
     });
     // skip: collectPiiSubjectFields only yields annotated fields — null is unreachable, kept as a type guard
     if (subject === null) continue;

package/src/crypto/subject-resolver.ts

@@ -21,7 +21,7 @@ export interface ResolveSubjectOptions {
   readonly tenantId?: TenantId;
   // Canonical source is the registry entity name (executor `entityName` /
   // event `aggregate_type`) — required to resolve recordOwned fields.
-  readonly entityName?: string;
+  readonly entityName: string;
 }
 
 function nonEmptyString(value: unknown): string | null {
@@ -101,7 +101,7 @@ export function resolveSubjectForField(
   entity: EntityDefinition,
   fieldName: string,
   row: Record<string, unknown>,
-  opts: ResolveSubjectOptions = {},
+  opts: ResolveSubjectOptions,
 ): SubjectId | null {
   const field = entity.fields[fieldName];
   if (!field) throw new SubjectResolutionError(fieldName, "field is not defined on the entity");

package/src/db/__tests__/eagerload.integration.test.ts

@@ -147,9 +147,14 @@ beforeAll(async () => {
     email: "grace@acme.test",
     iban: "DE12345",
   };
-  const piiEncrypted = await encryptPiiFieldValues(plainContact, contactEntity, ["email"], kms, {
-    requestId: "test",
-  });
+  const piiEncrypted = await encryptPiiFieldValues(
+    plainContact,
+    contactEntity,
+    ["email"],
+    kms,
+    { requestId: "test" },
+    { entityName: "contact" },
+  );
   const encrypted = await encryptEntityFieldValues(
     piiEncrypted,
     collectEncryptedFieldNames(contactEntity),
@@ -170,6 +175,7 @@ beforeAll(async () => {
     ["email"],
     kms,
     { requestId: "test" },
+    { entityName: "owned-contact" },
   );
   const ownedEncrypted = await encryptEntityFieldValues(
     ownedPiiEncrypted,

package/src/db/queries/backfill-pii.ts

@@ -6,8 +6,12 @@
 // them in place, per field, under the owning subject's DEK:
 //
 //   - entity lifecycle events (<entity>.created/updated/deleted/forgotten/
-//     restored) for every entity with PII subject annotations
-//   - custom events from the event-PII catalog (r.defineEvent piiFields)
+//     restored) for every entity with PII subject annotations — generic over
+//     subject kind (user/tenant/record, fw#2790), since it goes through the
+//     same collectPiiSubjectFields/resolveSubjectForField the live write
+//     path uses
+//   - custom events from the event-PII catalog (r.defineEvent piiFields) —
+//     user-subject only, see the note at its call site (fw#2801)
 //
 // Already-forgotten subjects must NOT get a fresh key minted for their old
 // plaintext — three erased-detection layers write [[erased]] instead:
@@ -282,6 +286,8 @@ export async function backfillEventPiiEncryption(
       for (const [field, spec] of Object.entries(catalogFields)) {
         const subjectId = payload[spec.subjectField];
         if (typeof subjectId !== "string" || subjectId.length === 0) continue;
+        // Catalog entries only ever resolve a user subject — a tenant/record
+        // subject in a custom event is not backfillable today (fw#2801).
         const outcome = await encryptField(payload, field, { kind: "user", userId: subjectId });
         bump(outcome);
       }

package/src/engine/boot-validator/__tests__/record-owned.test.ts

@@ -0,0 +1,56 @@
+// fw#2809 — a recordOwned field is encrypted under `record:<entity>:<id>`
+// (kms-adapter-types.ts) and forgetSubject's subjectIdSchema validates that
+// id as a UUID (crypto-shredding/handlers/forget-subject.write.ts). An
+// idType: "serial" entity would encrypt such a field but could never satisfy
+// a forget-subject request for it — the boot guard catches that combination
+// before it ships.
+
+import { describe, expect, test } from "bun:test";
+import { defineFeature } from "../../define-feature";
+import { createEntity, createTextField } from "../../factories";
+import type { FeatureDefinition } from "../../types";
+import { validateRecordOwnedSubjects } from "../record-owned";
+
+function featureWith(
+  idType: "serial" | "uuid" | undefined,
+  withRecordOwnedField: boolean,
+): FeatureDefinition {
+  return defineFeature("notes", (r) => {
+    r.entity(
+      "note",
+      createEntity({
+        table: "fw2809_guard_notes",
+        idType,
+        fields: {
+          body: withRecordOwnedField
+            ? createTextField({ personal: { of: "id" }, find: "none" })
+            : createTextField(),
+        },
+      }),
+    );
+  });
+}
+
+describe("validateRecordOwnedSubjects", () => {
+  test("idType: 'serial' + recordOwned field fails the boot, naming entity and field", () => {
+    const feature = featureWith("serial", true);
+    expect(() => validateRecordOwnedSubjects(feature)).toThrow(/Feature notes/);
+    expect(() => validateRecordOwnedSubjects(feature)).toThrow(/"note"/);
+    expect(() => validateRecordOwnedSubjects(feature)).toThrow(/"body"/);
+  });
+
+  test("idType: 'uuid' + recordOwned field boots fine", () => {
+    const feature = featureWith("uuid", true);
+    expect(() => validateRecordOwnedSubjects(feature)).not.toThrow();
+  });
+
+  test("idType omitted (default uuid) + recordOwned field boots fine", () => {
+    const feature = featureWith(undefined, true);
+    expect(() => validateRecordOwnedSubjects(feature)).not.toThrow();
+  });
+
+  test("idType: 'serial' without any recordOwned field boots fine", () => {
+    const feature = featureWith("serial", false);
+    expect(() => validateRecordOwnedSubjects(feature)).not.toThrow();
+  });
+});

package/src/engine/boot-validator/index.ts

@@ -52,6 +52,7 @@ import {
 } from "./projection-list-screens";
 import { validateQueryOutputColumns } from "./query-output-columns";
 import { validateQueryRefs } from "./query-refs";
+import { validateRecordOwnedSubjects } from "./record-owned";
 import {
   collectScreenQns,
   collectScreensByShortId,
@@ -174,6 +175,7 @@ export function validateBoot(
     if (validateEncryptedFields(feature)) hasEncryptedFields = true;
     if (validateFileFields(feature)) hasFileFields = true;
     validatePiiAndRetention(feature);
+    validateRecordOwnedSubjects(feature);
     validateApiExposureMatching(feature, allExposedApis, featureMap);
     validateEmbeddedFields(feature, featureMap);
     validateMultiSelectFields(feature);

package/src/engine/boot-validator/record-owned.ts

@@ -0,0 +1,22 @@
+import type { FeatureDefinition } from "../types";
+import type { ResolvedPiiFlags } from "../types/fields";
+
+// A recordOwned field is encrypted under `record:<entity>:<id>` (kms-adapter-types.ts)
+// and forgetSubject's subjectIdSchema requires that id to be a UUID
+// (crypto-shredding/handlers/forget-subject.write.ts) — an entity with
+// idType: "serial" would encrypt the field but could never satisfy a
+// forget-subject request for it.
+export function validateRecordOwnedSubjects(feature: FeatureDefinition): void {
+  for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
+    if (entity.idType !== "serial") continue;
+
+    for (const [fieldName, field] of Object.entries(entity.fields)) {
+      const annot = field as ResolvedPiiFlags; // @cast-boundary schema-walk
+      if (annot.recordOwned !== true) continue;
+
+      throw new Error(
+        `[Feature ${feature.name}] entity "${entityName}" field "${fieldName}" is recordOwned but the entity declares idType: "serial" — the record subject key is "record:${entityName}:<id>" and forgetSubject validates that id as a UUID, so this field would be encrypted but could never be shredded. Set idType: "uuid" on entity "${entityName}", or give field "${fieldName}" a different personal stance (personal: "self" / "tenant" / { of: "<field>" }).`,
+      );
+    }
+  }
+}

package/src/event-store/__tests__/backfill-pii.integration.test.ts

@@ -20,6 +20,7 @@ import {
   isPiiCiphertext,
   KeyNotFoundError,
   PgKmsAdapter,
+  PII_CIPHERTEXT_PREFIX,
   PII_ERASED_SENTINEL,
 } from "../../crypto";
 import { applyEntityEvent } from "../../db/apply-entity-event";
@@ -72,6 +73,20 @@ const notesFeature = defineFeature("notes", (r) => {
   r.entity("note", noteEntity);
 });
 
+// personal: { of: "id" } → recordOwned (kumiko-framework#2786): the row
+// itself is the subject, not a user/tenant reachable via an owner field.
+// fw#2790 — this fixture proves the pre-existing generic backfill already
+// covers the record subject kind for lifecycle events, no new code needed.
+const surveyEntity = createEntity({
+  fields: {
+    answer: createTextField({ personal: { of: "id" }, find: "none" }),
+  },
+});
+const surveyTable = buildEntityTable("survey", surveyEntity);
+const surveyFeature = defineFeature("survey", (r) => {
+  r.entity("survey", surveyEntity);
+});
+
 let testDb: TestDb;
 let registry: Registry;
 let kms: InMemoryKmsAdapter;
@@ -96,10 +111,11 @@ async function appendPlain(
 
 beforeAll(async () => {
   testDb = await createTestDb();
-  registry = createRegistry([crmFeature, mailerFeature, notesFeature]);
+  registry = createRegistry([crmFeature, mailerFeature, notesFeature, surveyFeature]);
   await createEventsTable(testDb.db);
   await unsafeCreateEntityTable(testDb.db, contactEntity, "contact");
   await unsafeCreateEntityTable(testDb.db, noteEntity, "note");
+  await unsafeCreateEntityTable(testDb.db, surveyEntity, "survey");
 });
 
 afterAll(async () => {
@@ -111,6 +127,7 @@ beforeEach(async () => {
   await raw.unsafe(`TRUNCATE "kumiko_events" RESTART IDENTITY`);
   await raw.unsafe(`TRUNCATE "${contactTable.tableName}"`);
   await raw.unsafe(`TRUNCATE "${noteTable.tableName}"`);
+  await raw.unsafe(`TRUNCATE "${surveyTable.tableName}"`);
   // Plaintext era: NO KMS while the legacy events are appended.
   resetPiiSubjectKmsForTests();
   resetBlindIndexKeyForTests();
@@ -590,6 +607,104 @@ describe("backfillEventPiiEncryption: owner-resolution chain (fw#2266)", () => {
   });
 });
 
+// fw#2790 — "Altbestand: Freitext-Klartext in kumiko_events". #2596 added
+// the recordOwned ("record") subject kind for row-scoped free text with no
+// user/tenant owner. Nothing in this file's resolution path (subject-
+// resolver.ts / pii-field-encryption.ts) special-cases subject kind, so the
+// expectation is that this backfill already covers it for lifecycle events
+// with zero new code — these tests pin that down rather than assume it.
+describe("backfillEventPiiEncryption: record subject (kumiko-framework#2786)", () => {
+  test("encrypts a lifecycle payload under record:<entity>:<id>, not user:<id>", async () => {
+    const s1 = generateId();
+    await appendPlain(s1, "survey", "survey.created", { id: s1, answer: "plaintext answer" });
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+
+    expect(result.failures).toEqual([]);
+    expect(result.updatedEvents).toBe(1);
+    expect(result.encryptedFields).toBe(1);
+    // Neither owner-resolution fallback is needed: the subject is the row's
+    // own id, always present on the event — stage 2/3 stay unused.
+    expect(result.ownerFromProjection).toBe(0);
+    expect(result.erasedUnresolvable).toBe(0);
+
+    const events = await loadAggregate(testDb.db, s1, TENANT);
+    const created = events[0]?.payload as Record<string, unknown>;
+    expect(isPiiCiphertext(created["answer"])).toBe(true);
+    // Exact prefix, not just "contains": the entity segment must be the
+    // registry name forget-subject resolves ("survey"), not the table name
+    // or a divergent aggregate_type — a wrong segment here would make the
+    // ciphertext unreachable by record-forget (fw#2790).
+    expect(String(created["answer"])).toStartWith(`${PII_CIPHERTEXT_PREFIX}record:survey:${s1}:`);
+    expect(String(created["answer"])).not.toContain(`user:${s1}`);
+  });
+
+  test("encrypts changes+previous on an update the same way", async () => {
+    const s2 = generateId();
+    await appendPlain(s2, "survey", "survey.created", { id: s2, answer: "first" });
+    await appendPlain(
+      s2,
+      "survey",
+      "survey.updated",
+      { changes: { answer: "second" }, previous: { id: s2, answer: "first" } },
+      1,
+    );
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(result.failures).toEqual([]);
+    expect(result.updatedEvents).toBe(2);
+
+    const events = await loadAggregate(testDb.db, s2, TENANT);
+    const updated = events[1]?.payload as {
+      changes: Record<string, unknown>;
+      previous: Record<string, unknown>;
+    };
+    expect(String(updated.changes["answer"])).toStartWith(
+      `${PII_CIPHERTEXT_PREFIX}record:survey:${s2}:`,
+    );
+    expect(String(updated.previous["answer"])).toStartWith(
+      `${PII_CIPHERTEXT_PREFIX}record:survey:${s2}:`,
+    );
+  });
+
+  test("a pre-KMS-forgotten row gets [[erased]], not a fresh record key", async () => {
+    const s3 = generateId();
+    await appendPlain(s3, "survey", "survey.created", { id: s3, answer: "secret" });
+    await appendPlain(
+      s3,
+      "survey",
+      "survey.forgotten",
+      { previous: { id: s3, answer: "secret" } },
+      1,
+    );
+
+    armKms();
+    const result = await backfillEventPiiEncryption(testDb.db, registry);
+
+    expect(result.failures).toEqual([]);
+    expect(result.erasedFields).toBe(2);
+    const events = await loadAggregate(testDb.db, s3, TENANT);
+    const created = events[0]?.payload as Record<string, unknown>;
+    expect(created["answer"]).toBe(PII_ERASED_SENTINEL);
+    const forgotten = events[1]?.payload as { previous: Record<string, unknown> };
+    expect(forgotten.previous["answer"]).toBe(PII_ERASED_SENTINEL);
+  });
+
+  test("idempotent: a second run touches nothing", async () => {
+    const s4 = generateId();
+    await appendPlain(s4, "survey", "survey.created", { id: s4, answer: "once" });
+
+    armKms();
+    const first = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(first.updatedEvents).toBe(1);
+    const second = await backfillEventPiiEncryption(testDb.db, registry);
+    expect(second.updatedEvents).toBe(0);
+    expect(second.failures).toEqual([]);
+  });
+});
+
 describe("backfillEventPiiEncryption: raw jsonb column type (fw#2253)", () => {
   // The UPDATE used to wrap outcome.payload in JSON.stringify before handing
   // it to the ::jsonb cast — Bun.SQL already serializes objects, so the

package/src/event-store/__tests__/perf.integration.test.ts

@@ -13,7 +13,10 @@
 // are the ceiling.
 //
 // Runs isolated in the `event-store-perf` CI job (test:integration:perf:eventstore,
-// #1940) — gate on p95 for typical latency; p99 keeps a separate tail budget for checkpoint/fsync spikes.
+// #1940) — gate on p95 for typical latency; p99 keeps a separate tail budget for
+// residual scheduling noise. CI's Postgres container runs with fsync/synchronous_commit/
+// full_page_writes off (#2798) — it exists only to be measured and thrown away, so these
+// numbers aren't comparable to a default-config local container.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
@@ -98,12 +101,14 @@ describe("event-store performance — Gate A", () => {
     const p50 = percentile(samples, 0.5);
     const p95 = percentile(samples, 0.95);
     const p99 = percentile(samples, 0.99);
+    const over30 = samples.filter((s) => s >= 30).length;
+    const top5 = samples.slice(-5).map((s) => s.toFixed(1));
     console.log(
-      `  Write-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200)`,
+      `  Write-latency: p50=${p50.toFixed(2)}ms, p95=${p95.toFixed(2)}ms, p99=${p99.toFixed(2)}ms (n=200) over30=${over30} top5=${top5}`,
     );
 
     expect(p95).toBeLessThan(30);
-    // Tail budget: absorbs cold-checkpoint/fsync spikes (observed up to 102ms at p50=1.2ms) while still catching order-of-magnitude regressions.
+    // Tail budget: absorbs residual runner scheduling noise while still catching order-of-magnitude regressions.
     expect(p99).toBeLessThan(250);
   });