feat: sample sensitive columns progressively

frontend/src/api/catalog-databases.ts

@@ -134,14 +134,15 @@ export interface SensitivityReviewItem {
   version: number;
   currentSensitive: boolean;
   sensitive: boolean;
-  assessment: "sensitive" | "non_sensitive" | "unknown";
+  assessment: "sensitive" | "non_sensitive";
   evidence: Array<{
-    kind: "metadata" | "content" | "length" | "ner" | "coverage";
+    kind: "metadata" | "content" | "length" | "ner" | "coverage" | "type";
     ruleId: string;
     label?: string;
     confidence?: number;
   }>;
   observedValues: number;
+  coverage: "metadata" | "complete" | "sampled" | "no_values";
 }
 
 export interface SensitivityAnalysisResult {

frontend/src/api/client.test.ts

@@ -149,6 +149,7 @@ test.each([
   ["catalog_table_not_found", "One or more selected catalog tables were not found."],
   ["sensitivity_source_unavailable", "The database content could not be read for sensitivity analysis. No assessments were applied."],
   ["sensitivity_analysis_timeout", "Sensitivity analysis reached its time limit. No assessments were applied."],
+  ["sensitivity_analysis_interrupted", "Sensitivity analysis was interrupted before completion. No assessments were applied."],
   ["sensitive_data_suggestion_history_request_invalid", "Sensitivity analysis history parameters are invalid."],
   ["sensitive_data_suggestion_history_failed", "Sensitivity analysis history could not be loaded."],
   ["sensitive_data_suggestion_run_not_found", "The sensitivity analysis run was not found."],

frontend/src/api/client.ts

@@ -28,6 +28,7 @@ const safeErrorCodes = new Set([
   "sensitive_data_suggestion_no_columns",
   "sensitivity_source_unavailable",
   "sensitivity_analysis_timeout",
+  "sensitivity_analysis_interrupted",
   "sensitive_data_suggestion_failed",
   "sensitive_data_suggestion_history_request_invalid",
   "sensitive_data_suggestion_history_failed",
@@ -94,6 +95,7 @@ const localCodeMessages: Record<string, string> = {
   sensitive_data_suggestion_no_columns: "The selected scope contains no catalog columns to assess.",
   sensitivity_source_unavailable: "The database content could not be read for sensitivity analysis. No assessments were applied.",
   sensitivity_analysis_timeout: "Sensitivity analysis reached its time limit. No assessments were applied.",
+  sensitivity_analysis_interrupted: "Sensitivity analysis was interrupted before completion. No assessments were applied.",
   sensitive_data_suggestion_failed: "Sensitivity analysis failed before review. No changes were applied.",
   sensitive_data_suggestion_history_request_invalid: "Sensitivity analysis history parameters are invalid.",
   sensitive_data_suggestion_history_failed: "Sensitivity analysis history could not be loaded.",

frontend/src/shell/DatabaseManagementPage.test.tsx

@@ -167,7 +167,7 @@ function makeSensitivityAnalysisRun(
     databaseId: "11111111-1111-4111-8111-111111111111",
     engine: "local",
     modelId: null,
-    policyVersion: "sensitivity-v1",
+    policyVersion: "sensitivity-v2",
     scope: "selected_columns",
     status: "completed",
     total: 2,
@@ -2081,6 +2081,7 @@ test("requests database-level sensitivity analysis for the only selected databas
           assessment: "sensitive",
           evidence: [{ kind: "content", ruleId: "pii.email" }],
           observedValues: 1,
+          coverage: "sampled",
         }],
       });
     }),
@@ -2162,6 +2163,7 @@ test("requests sensitivity analysis only for selected tables", async () => {
           assessment: "sensitive",
           evidence: [{ kind: "metadata", ruleId: "metadata.health" }],
           observedValues: 0,
+          coverage: "metadata",
         }],
       });
     }),
@@ -2236,6 +2238,7 @@ test("allows a human downgrade and saves only explicit sensitivity changes", asy
               assessment: "sensitive",
               evidence: [{ kind: "content", ruleId: "pii.email" }],
               observedValues: 1,
+              coverage: "sampled",
             },
             {
               columnId: nameColumn.id,
@@ -2246,8 +2249,9 @@ test("allows a human downgrade and saves only explicit sensitivity changes", asy
               currentSensitive: true,
               sensitive: false,
               assessment: "non_sensitive",
-              evidence: [],
+              evidence: [{ kind: "coverage", ruleId: "coverage.complete" }],
               observedValues: 2,
+              coverage: "complete",
             },
           ],
         });

frontend/src/shell/database-management/SensitiveDataReviewDrawer.test.tsx

@@ -21,6 +21,7 @@ const suggestions: SensitivityReviewItem[] = [
     assessment: "sensitive",
     evidence: [{ kind: "content", ruleId: "pii.email" }],
     observedValues: 1,
+    coverage: "sampled",
   },
   {
     columnId: "22222222-2222-4222-8222-222222222222",
@@ -33,6 +34,7 @@ const suggestions: SensitivityReviewItem[] = [
     assessment: "sensitive",
     evidence: [{ kind: "metadata", ruleId: "metadata.health" }],
     observedValues: 0,
+    coverage: "metadata",
   },
 ];
 

frontend/src/shell/database-management/SensitiveDataReviewDrawer.tsx

@@ -183,7 +183,7 @@ export function SensitiveDataReviewDrawer({
                           ? suggestion.evidence.map((item) => item.label
                             ? `${item.ruleId} (${item.label}${item.confidence === undefined ? "" : ` ${Math.round(item.confidence * 100)}%`})`
                             : item.ruleId).join(", ")
-                          : "no sensitive match"}. Observed values: {suggestion.observedValues}.
+                          : "no sensitive match"}. Coverage: {suggestion.coverage.replace("_", " ")}. Observed values: {suggestion.observedValues}.
                       </p>
                     </div>
                     <span className={`rounded px-2 py-0.5 text-[11px] font-semibold ${changedFromCurrent ? "bg-amber-500/12 text-amber-800 dark:text-amber-300" : "bg-muted text-muted-foreground"}`}>

frontend/src/shell/database-management/SensitivityAnalysisHistoryDrawer.tsx

@@ -145,7 +145,7 @@ export function SensitivityAnalysisHistoryDrawer({
     ["total", "Total columns"],
     ["suggestedSensitive", "Sensitive"],
     ["suggestedNonSensitive", "Not sensitive"],
-    ["unknown", "Unknown"],
+    ["unknown", "Unprocessed"],
   ] as const;
   return (
     <FleetLedgerDrawer