@c9up/station 0.1.6 → 0.1.8

package/src/StationProvider.ts

@@ -18,6 +18,7 @@
  * swallowed.
  */
 
+import { fileURLToPath } from "node:url";
 import type {
 	BaseRepository as AtlasBaseRepository,
 	ColumnMetadata,
@@ -29,11 +30,10 @@ import { setStation } from "./services/main.js";
 import type { AuditEvent, Resource, ResourceAction } from "./types.js";
 // note: AuditEvent + ResourceAction are used by the CRUD handlers below;
 // the imports stay in one block for clarity.
-import { renderNotFoundPage } from "./views/errors/404.js";
-import { renderFormPage } from "./views/form.js";
-import { renderListPage } from "./views/list.js";
-import { renderLoginPage } from "./views/login.js";
-import { renderShowPage } from "./views/show.js";
+import { buildFormViewModel } from "./views/form.js";
+import { buildListViewModel } from "./views/list.js";
+import { buildLoginViewModel } from "./views/login.js";
+import { buildShowViewModel } from "./views/show.js";
 
 /**
  * Duck-typed slice of the host's IoC container — Station MUST stay
@@ -42,7 +42,7 @@ import { renderShowPage } from "./views/show.js";
  */
 interface StationContainer {
 	singleton<T>(key: unknown, factory: () => T): void;
-	resolve<T>(key: unknown): T;
+	resolve<T>(key: unknown): Promise<T>;
 	has(key: unknown): boolean;
 }
 
@@ -70,6 +70,14 @@ interface StationHttpContext {
 		url?(): string;
 		header?(name: string): string | undefined;
 		cookie?(name: string): string | undefined;
+		/**
+		 * `true` only when the host's `@c9up/blackhole` middleware enforced +
+		 * validated CSRF for this request (a first-class ream `HttpContext`
+		 * contract). Station fail-closes every admin write route on this — a
+		 * seeded token is NOT proof of verification, so this is the ONLY signal
+		 * trusted for enforcement.
+		 */
+		csrfProtected?: boolean;
 	};
 	response: {
 		status(code: number): unknown;
@@ -107,6 +115,23 @@ interface StationHttpContext {
 		get(key: string): unknown;
 		set?(key: string, value: unknown): void;
 	};
+	/**
+	 * The request session, when the host registered ream's `SessionMiddleware`
+	 * (`ctx.session`, AdonisJS parity). Station uses only the flash surface (57.7):
+	 * on an invalid HTML write it flashes the old input + errors and redirects
+	 * back to the form, which reads them back via `flashMessages`. Undefined
+	 * when no session middleware ran — Station then falls back to an inline 422
+	 * form re-render (no session ⇒ no flash round-trip possible).
+	 */
+	session?: {
+		flash(key: string, value: unknown): void;
+		flashAll(input: Record<string, unknown>): void;
+		/**
+		 * A store, not a method — the AdonisJS shape ream now matches. Only
+		 * `all()` is needed here, so that is all the structural type asks for.
+		 */
+		flashMessages: { all(): Record<string, unknown> };
+	};
 }
 
 interface StationRouter {
@@ -150,9 +175,24 @@ interface StationRepository {
 
 interface StationQuery {
 	orderBy(column: string, direction: "asc" | "desc"): StationQuery;
-	forPage(page: number, perPage: number): StationQuery;
 	exec(): Promise<Record<string, unknown>[]>;
-	count(column?: string): Promise<number>;
+	paginate(page: number, perPage: number): Promise<StationPaginator>;
+}
+
+/**
+ * Minimal structural mirror of atlas's `Paginator` — only the surface the list
+ * handler reads. Kept structural (like `StationQuery`/`StationRepository`) so
+ * Station never couples to atlas's generic `Paginator<T>` value/type.
+ */
+interface StationPaginator {
+	all(): Record<string, unknown>[];
+	meta: {
+		total: number;
+		perPage: number;
+		currentPage: number;
+		lastPage: number;
+		firstPage: number;
+	};
 }
 
 /** Per-resource snapshot built once at `start()`, reused on every request. */
@@ -167,6 +207,18 @@ interface ResourceContext {
 	 * the mass-assignment guard drops them regardless of their column name.
 	 */
 	autoManaged: ReadonlySet<string>;
+	/**
+	 * The `@c9up/rune` validation schema derived once (57.7) from the entity's
+	 * writable column metadata — replaces the hand-rolled `filterWritableBody`.
+	 * `validateResult()` both drops non-schema keys (the mass-assignment guarantee is
+	 * now inherent — `result.data` holds only declared columns) AND type-checks
+	 * each field. Built only when a write action is mounted (create/edit); a
+	 * read-only resource leaves it `undefined`. `booleanKeys` names the checkbox
+	 * columns the handler must default to `false` when their key is absent (an
+	 * unchecked box submits nothing).
+	 */
+	writableSchema?: RuneSchema;
+	booleanKeys: ReadonlySet<string>;
 }
 
 /** Lazy-imported `@c9up/atlas` value surface. */
@@ -175,6 +227,117 @@ interface AtlasModule {
 	getColumnMetadata: (entity: unknown) => ReadonlyArray<ColumnMetadata>;
 	getPrimaryKey: (entity: unknown) => string | undefined;
 	getDateColumnConfig: (entity: unknown) => Record<string, DateColumnConfig>;
+	/** Relation propertyKeys — excluded from the writable schema (never columns). */
+	getRelationMetadata: (
+		entity: unknown,
+	) => ReadonlyArray<{ propertyKey: string }>;
+	/** `@SoftDeletes()` present ⇒ the `deletedAt` column is framework-owned. */
+	hasSoftDeletes: (entity: unknown) => boolean;
+}
+
+// ── @c9up/rune structural surface (57.7) ───────────────────────────────────
+// Station consumes rune EXACTLY like atlas: a tolerant dynamic
+// `import("@c9up/rune")` (never a static value import — banned by
+// `tests/unit/no-rune-static-import.test.ts`). The runtime object is typed by
+// these LOCAL structural interfaces (like `AtlasModule` / `StationRepository`),
+// so Station couples to rune's *shape*, not its generic types — zero
+// `import ... from "@c9up/rune"`, `import type` included, keeps the schema
+// derivation tsc-safe and fully decoupled.
+
+/** A rune `RuleChain` — only the builders the derivation calls. */
+interface RuneRuleChain {
+	optional(): RuneRuleChain;
+	nullable(): RuneRuleChain;
+	parse(fn: (value: unknown) => unknown): RuneRuleChain;
+}
+
+/** rune's `rules` factory — the constructors Station maps columns to. */
+interface RuneRules {
+	string(): RuneRuleChain;
+	number(): RuneRuleChain;
+	boolean(): RuneRuleChain;
+	/** Type-free chain — a structural (`json`/`jsonb`) column that must accept objects/arrays. */
+	any(): RuneRuleChain;
+}
+
+/** A single rune `ValidationError`. */
+interface RuneValidationError {
+	field: string;
+	rule: string;
+	message: string;
+	index?: number;
+	meta?: Record<string, unknown>;
+}
+
+/** Result of `schema.validateResult()` — synchronous, never throws. */
+type RuneValidationResult =
+	| {
+			valid: true;
+			errors: ReadonlyArray<RuneValidationError>;
+			data: Record<string, unknown>;
+	  }
+	| {
+			valid: false;
+			errors: ReadonlyArray<RuneValidationError>;
+			data?: undefined;
+	  };
+
+/**
+ * A built rune schema — only the result-based check is consumed.
+ *
+ * `validateResult`, NOT `validate`: rune reserves `validate()` for the VineJS
+ * contract (async, throwing). Reading `.valid` off a Promise gives `undefined`,
+ * so keeping the old name would have made every admin write fail closed with an
+ * empty error list.
+ */
+interface RuneSchema {
+	validateResult(data: unknown): RuneValidationResult;
+}
+
+/** Lazy-imported `@c9up/rune` value surface (mirror `AtlasModule`). */
+interface RuneModule {
+	schema(fields: Record<string, RuneRuleChain>): RuneSchema;
+	rules: RuneRules;
+}
+
+/**
+ * Minimal slice of the host's SHARED inker renderer — the `"inker"` container
+ * alias `InkerProvider` binds. Station consumes inker EXACTLY the way it
+ * consumes `@c9up/warden`: resolved through the container, never a static OR
+ * dynamic `import "@c9up/inker"` in `src/` (57.1/D5). Following the AdonisJS
+ * package-views pattern (Edge `edge.mount(name, dir)` + `namespace::template`),
+ * Station mounts its package `templates/` as a named disk (`mount("station",
+ * dir)`) on this shared renderer and renders `station::…`. `renderToString`'s
+ * `ctx` carries the per-request store the inker helpers read: the form + login
+ * views thread the real `ctx.store` (57.3/D3) so `{{ csrfField() }}` reaches the
+ * token; the 404/list/show views call no helpers, so the store is inert there.
+ */
+interface InkerViewRenderer {
+	mount(diskName: string, dir: string): void;
+	renderToString(
+		ctx: object,
+		name: string,
+		data: Readonly<Record<string, unknown>>,
+	): Promise<string>;
+}
+
+/**
+ * Runtime shape check for the resolved `"inker"` binding. `container.has("inker")`
+ * only proves the token is registered — a null/partial/mis-registered value would
+ * otherwise slip through `#resolveViewRenderer` and blow up as a raw `TypeError`
+ * at `renderer.mount(...)` during boot, defeating the actionable fail-loud gate
+ * (57.1 review). Guarding here turns a null/non-conforming binding into the same
+ * clear "not usable" boot error, with the specific reason chained as `cause`.
+ */
+function isInkerViewRenderer(value: unknown): value is InkerViewRenderer {
+	return (
+		typeof value === "object" &&
+		value !== null &&
+		"mount" in value &&
+		typeof value.mount === "function" &&
+		"renderToString" in value &&
+		typeof value.renderToString === "function"
+	);
 }
 
 /**
@@ -296,7 +459,7 @@ let authWarnEmitted = false;
 let perPageClampWarned = false;
 let seedPermsWarned = false;
 let missingAuditWarned = false;
-let csrfWarnEmitted = false;
+let csrfBlockedWarned = false;
 
 /** @internal Reset module-level flags between tests. */
 export function resetStationProviderFlags(): void {
@@ -304,9 +467,28 @@ export function resetStationProviderFlags(): void {
 	perPageClampWarned = false;
 	seedPermsWarned = false;
 	missingAuditWarned = false;
-	csrfWarnEmitted = false;
+	csrfBlockedWarned = false;
+}
+
+/**
+ * Stable fingerprint for a failed `station::errors/404` render, used to log each
+ * distinct failure MODE once per provider instance rather than once per request.
+ * Keys on the error `code`/`name` ONLY — never the message, which can embed the
+ * request-controlled `id` and would let attacker traffic inflate the log past
+ * the very bound this mechanism exists to hold.
+ */
+function notFoundFailFingerprint(cause: unknown): string {
+	if (!(cause instanceof Error)) return "non-error";
+	if ("code" in cause && typeof cause.code === "string") return cause.code;
+	return cause.name;
 }
 
+/**
+ * Hard cap on distinct 404-render failure modes logged per instance, so an
+ * unforeseen unbounded error-code space still cannot inflate the log or memory.
+ */
+const NOT_FOUND_RENDER_FAIL_CAP = 32;
+
 const TIMESTAMP_PROPERTY_KEYS: ReadonlySet<string> = new Set([
 	"createdAt",
 	"updatedAt",
@@ -319,33 +501,70 @@ const TIMESTAMP_COLUMN_NAMES: ReadonlySet<string> = new Set([
 ]);
 
 /**
- * Mass-assignment guard. Only accepts keys that are:
- *   1. A declared `@Column` propertyKey on the resource entity, AND
- *   2. Not the primary key (DB-managed), AND
- *   3. Not a framework-managed timestamp. Two signals, both honoured:
- *      (a) the Lucid-style auto flag — `@column.dateTime({ autoCreate })` /
- *          `{ autoUpdate }` (passed in via `autoManaged`); this is the
- *          authoritative one and catches custom-named timestamp columns
- *          (e.g. `registeredAt`) the name list below would miss, AND
- *      (b) the conventional name fallback (created_at / updated_at /
- *          deleted_at) for plain `@Column` timestamps declared without the
- *          auto flag.
+ * Column `type` strings mapped to a numeric rune rule (mirrors form.ts input
+ * inference). `bigint` is deliberately EXCLUDED: coercing it through `Number()`
+ * silently loses precision above `Number.MAX_SAFE_INTEGER`, so a bigint column
+ * validates as a string (its exact submitted digits reach atlas intact).
+ */
+const NUMBER_COLUMN_TYPES: ReadonlySet<string> = new Set(["integer", "number"]);
+
+/**
+ * Structural column `type` strings — validated with `rules.any()` so a JSON/XHR
+ * client can submit an object/array (a `rules.string()` would reject it, a
+ * regression vs. the pre-57.7 pass-through `filterWritableBody`).
+ */
+const JSON_COLUMN_TYPES: ReadonlySet<string> = new Set(["json", "jsonb"]);
+
+/**
+ * True when at least one resource mounts a write action that maps a request
+ * body onto columns (create / edit). `destroy` needs no body validation. This
+ * is the AC7 predicate: it decides whether `@c9up/rune` is REQUIRED at boot —
+ * exported so `agnostic-peers-missing.test.ts` can pin the decision directly
+ * (the dynamic-import-absent path can't be simulated inside vitest, exactly as
+ * for atlas — see that file's header).
+ */
+export function resourcesNeedValidation(
+	resources: ReadonlyArray<Resource>,
+): boolean {
+	return resources.some(
+		(r) => r.actions.includes("create") || r.actions.includes("edit"),
+	);
+}
+
+/**
+ * Derive a `@c9up/rune` validation schema (57.7) from an entity's writable
+ * column metadata — the structural replacement for the hand-rolled
+ * `filterWritableBody`. The mass-assignment guarantee is now INHERENT:
+ * `schema.validateResult()` returns only declared-column keys, so unknown body keys
+ * (`role`, `passwordHash`, PK, timestamps) are dropped automatically — no
+ * explicit filtering pass.
  *
- * The `_method` synthetic field from browser-form method-overrides is
- * dropped automatically because it never matches a column propertyKey.
+ * Excluded, exactly as the old guard did: the primary key, framework-managed
+ * timestamps (both the Lucid-style `autoManaged` flag AND the `created_at /
+ * updated_at / deleted_at` name convention) — plus, new in 57.7, relations and
+ * the soft-delete column (`excludedProps`). Metadata is read column-by-column,
+ * NEVER `in` on an instance (`@Column() declare` makes `in` always false —
+ * mirror `BaseRepository.#hydrate`).
  *
- * Returning a fresh object — never the caller's reference — so a
- * downstream mutation can't poison the audit snapshot.
+ * Per-column rule mapping tolerates the form-post wire shape (values arrive as
+ * strings — rune does NOT coerce): booleans `.parse(isCheckedValue)`, numbers
+ * `.parse` string→Number (NaN falls through to a type error), everything else
+ * `rules.string()`. `.parse`/`.optional`/`.nullable` force rune's TS path, so
+ * no native `.node` is touched.
+ *
+ * Returns the built schema plus the set of boolean columns — the handler
+ * default-fills an ABSENT boolean key to `false` before validating (an
+ * unchecked checkbox submits nothing; this preserves the old edit-clears-box
+ * behaviour).
  */
-/** @internal Exported for unit tests — the mass-assignment + checkbox coercion guard. */
-export function filterWritableBody(
-	body: Record<string, unknown>,
+export function deriveWritableSchema(
 	columns: ReadonlyArray<ColumnMetadata>,
 	pkColumn: string,
 	autoManaged: ReadonlySet<string>,
-): Record<string, unknown> {
-	const writable: Record<string, unknown> = {};
-	const validKeys = new Set<string>();
+	excludedProps: ReadonlySet<string>,
+	rune: RuneModule,
+): { schema: RuneSchema; booleanKeys: ReadonlySet<string> } {
+	const fields: Record<string, RuneRuleChain> = {};
 	const booleanKeys = new Set<string>();
 	for (const c of columns) {
 		if (c.propertyKey === pkColumn) continue;
@@ -353,28 +572,208 @@ export function filterWritableBody(
 		if (TIMESTAMP_PROPERTY_KEYS.has(c.propertyKey)) continue;
 		const snake = c.propertyKey.replace(/([A-Z])/g, "_$1").toLowerCase();
 		if (TIMESTAMP_COLUMN_NAMES.has(snake)) continue;
-		validKeys.add(c.propertyKey);
-		if ((c.type ?? "").toString().toLowerCase() === "boolean") {
+		if (excludedProps.has(c.propertyKey)) continue;
+		const type = (c.type ?? "").toString().toLowerCase();
+		if (type === "boolean") {
+			// Checkbox: the handler pre-fills an absent key to `false`, so every
+			// boolean is always present here → required, no `.optional()`.
 			booleanKeys.add(c.propertyKey);
+			fields[c.propertyKey] = rune.rules.boolean().parse(isCheckedValue);
+			continue;
+		}
+		// A column is required iff the model declares neither nullability nor a
+		// default. DB-side defaults (serial, `DEFAULT`) are invisible to metadata
+		// (documented residual limitation — see story Dev Notes); the PK, the
+		// common serial case, is already excluded above.
+		const required = c.nullable !== true && c.default === undefined;
+		let chain: RuneRuleChain = NUMBER_COLUMN_TYPES.has(type)
+			? rune.rules.number().parse(parseNumeric)
+			: JSON_COLUMN_TYPES.has(type)
+				? rune.rules.any()
+				: rune.rules.string();
+		if (!required) {
+			chain = chain.optional();
+			if (c.nullable === true) chain = chain.nullable();
 		}
+		fields[c.propertyKey] = chain;
 	}
-	// Boolean columns render as checkboxes: an unchecked box submits NOTHING, so
-	// derive every boolean from presence/value. Otherwise an unchecked box can
-	// never clear a previously-true column on edit, and a checked box would store
-	// the raw string "1" instead of a real boolean.
+	return { schema: rune.schema(fields), booleanKeys };
+}
+
+/**
+ * Validate a request body against a derived schema (57.7). Default-fills any
+ * ABSENT boolean column to `false` first (unchecked checkbox = no submission),
+ * preserving the old `filterWritableBody` checkbox semantics, then runs rune's
+ * synchronous, never-throwing `validateResult()`. On success `result.data` holds only
+ * declared-column keys (mass-assignment inherent). Exported for the unit tests
+ * that pin the coercion CRUX.
+ */
+export function validateWritableBody(
+	schema: RuneSchema,
+	booleanKeys: ReadonlySet<string>,
+	body: Record<string, unknown>,
+): RuneValidationResult {
+	const input: Record<string, unknown> = { ...body };
 	for (const key of booleanKeys) {
-		writable[key] = isCheckedValue(body[key]);
+		if (!(key in input)) input[key] = false;
 	}
-	for (const [key, value] of Object.entries(body)) {
-		if (!validKeys.has(key)) continue;
-		if (booleanKeys.has(key)) continue; // already derived above
-		writable[key] = value;
+	return schema.validateResult(input);
+}
+
+/**
+ * Form-post number coercion: string→Number, NaN falls through to a type error.
+ * `null`/`undefined` pass through untouched so rune's optional/nullable handling
+ * applies (never `Number(null) === 0`), and a blank/whitespace-only string —
+ * a cleared optional field — becomes `null` (treated as absent) rather than a
+ * fabricated `0`.
+ */
+function parseNumeric(value: unknown): unknown {
+	if (value === null || value === undefined) return value;
+	if (typeof value === "string") {
+		const trimmed = value.trim();
+		if (trimmed === "") return null;
+		const n = Number(trimmed);
+		return Number.isNaN(n) ? value : n;
+	}
+	const n = Number(value);
+	return Number.isNaN(n) ? value : n;
+}
+
+/**
+ * Collapse rune's flat `ValidationError[]` to one message per top-level field
+ * for the HTML form re-render (`form.inker` keys errors by column propertyKey).
+ * The `_root` non-object error (a body that isn't a record — never happens for
+ * a parsed form post) is skipped.
+ */
+function fieldErrors(
+	errors: ReadonlyArray<RuneValidationError>,
+): Record<string, string> {
+	const out: Record<string, string> = {};
+	for (const e of errors) {
+		if (e.field === "_root") continue;
+		// Collapse a nested VineJS-style path (`profile.name`) to its top-level
+		// key — `form.ts` keys errors by column propertyKey. `split` always yields
+		// a non-empty array, so `[0]` is a string (no fallback needed).
+		const key = e.field.split(".")[0];
+		if (!(key in out)) out[key] = e.message;
 	}
-	return writable;
+	return out;
 }
 
-/** A checkbox/boolean field is true only for its checked submissions. */
+/** Session flash key under which the per-field validation errors are stashed (AdonisJS `flashMessages.errors` parity). */
+const FLASH_ERRORS_KEY = "errors";
+
+/** Column propertyKeys whose values are secrets — never flashed to the session nor echoed back into HTML (AdonisJS parity). */
+const SENSITIVE_KEY_RE = /password|passwd|secret|token|apikey/i;
+
+/**
+ * The subset of a submitted body safe to re-surface on a validation error:
+ * declared columns only — so `_csrf`, `_method`, and any mass-assignment /
+ * arbitrary key are dropped from the flash store — minus sensitive fields (a
+ * password is never written to the session nor reflected into the re-rendered
+ * form). An empty result lets the caller fall back to the existing `row`.
+ */
+function flashableInput(
+	submitted: Record<string, unknown>,
+	columns: ReadonlyArray<ColumnMetadata>,
+): Record<string, unknown> {
+	const out: Record<string, unknown> = {};
+	for (const c of columns) {
+		if (SENSITIVE_KEY_RE.test(c.propertyKey)) continue;
+		if (c.propertyKey in submitted)
+			out[c.propertyKey] = submitted[c.propertyKey];
+	}
+	return out;
+}
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) {
+		return false;
+	}
+	return Object.values(value).every((v) => typeof v === "string");
+}
+
+/**
+ * Read flashed old input + per-field errors for a form `GET` re-render after a
+ * failed write redirected back (57.7, AdonisJS PRG). Returns `{}` when nothing
+ * was flashed (a normal GET) — the form then renders from `row`/empty as usual.
+ * `values` is restricted to declared column keys so the flashed `errors` bag (or
+ * any other flashed key) never leaks into a field value.
+ */
+function readFlash(
+	ctx: StationHttpContext,
+	columns: ReadonlyArray<ColumnMetadata>,
+): {
+	values?: Record<string, unknown>;
+	errors?: Record<string, string>;
+} {
+	const flashed = ctx.session?.flashMessages.all() ?? {};
+	if (Object.keys(flashed).length === 0) return {};
+	const values: Record<string, unknown> = {};
+	for (const c of columns) {
+		// `errors` is reserved for the per-field error bag — a column literally
+		// named `errors` must not receive that object as its field value.
+		if (c.propertyKey === FLASH_ERRORS_KEY) continue;
+		if (c.propertyKey in flashed)
+			values[c.propertyKey] = flashed[c.propertyKey];
+	}
+	const rawErrors = flashed[FLASH_ERRORS_KEY];
+	return {
+		values: Object.keys(values).length > 0 ? values : undefined,
+		errors: isStringRecord(rawErrors) ? rawErrors : undefined,
+	};
+}
+
+/**
+ * Same-origin / relative check for a `Referer` — replicates ream's
+ * `RedirectBuilder.back()` open-redirect guard (Station consumes the response
+ * through its own `redirect(url)` seam and can't reach ream's builder). A
+ * relative path is trusted; an absolute URL only when its origin matches the
+ * request URL. Anything else is untrusted → the caller uses its safe fallback.
+ */
+function isSameOriginReferer(referer: string, requestUrl?: string): boolean {
+	// A relative path is trusted only when it starts with a single "/" and
+	// contains no backslash: browsers normalise "\\" to "/", so "/\\evil.com"
+	// becomes the protocol-relative "//evil.com" that a lone `!startsWith("//")`
+	// check would let through.
+	if (
+		referer.startsWith("/") &&
+		!referer.startsWith("//") &&
+		!referer.includes("\\")
+	) {
+		return true;
+	}
+	if (requestUrl === undefined) return false;
+	try {
+		return new URL(referer).origin === new URL(requestUrl).origin;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * `redirect().back()` over Station's `redirect(url)` seam (57.7): prefer a
+ * trusted same-origin `Referer`, else the caller's `fallback` (the form URL) —
+ * the same behaviour as ream's `RedirectBuilder.back(fallback)`, open-redirect
+ * safe.
+ */
+function redirectBack(ctx: StationHttpContext, fallback: string): void {
+	const referer = ctx.request.header?.("referer");
+	const target =
+		typeof referer === "string" &&
+		isSameOriginReferer(referer, ctx.request.url?.())
+			? referer
+			: fallback;
+	ctx.response.redirect(target);
+}
+
+/**
+ * A checkbox/boolean field is true only for its checked submissions. Duplicate
+ * keys (a hidden `0` companion + the checkbox `1`) arrive as an array — the box
+ * is checked if ANY submitted value is a checked token (the checkbox wins).
+ */
 function isCheckedValue(value: unknown): boolean {
+	if (Array.isArray(value)) return value.some(isCheckedValue);
 	return value === true || value === "1" || value === "on" || value === "true";
 }
 
@@ -422,8 +821,24 @@ function snapshotEntity(
 }
 let auditCloneWarnEmitted = false;
 
+/**
+ * Filesystem path to the `.inker` templates Station ships inside the
+ * package (57.1, D3). Resolved from `import.meta.url` so the SAME path
+ * holds src-run (dev, `exports` → `./src/StationProvider.ts`) and dist-run
+ * (published, `./dist/StationProvider.js`) — `templates/` is a sibling of
+ * both `src/` and `dist/`. `fileURLToPath` (not `URL.pathname`) so a repo
+ * path containing spaces or reserved characters decodes correctly.
+ */
+const TEMPLATES_ROOT = fileURLToPath(new URL("../templates/", import.meta.url));
+
 export default class StationProvider {
 	#contexts: Map<Resource, ResourceContext> = new Map();
+	#viewRenderer: InkerViewRenderer | undefined;
+	/**
+	 * Distinct 404-render failure modes already logged (fingerprints), scoped
+	 * per instance so one provider's fault never suppresses another's.
+	 */
+	#notFoundRenderFailCauses = new Set<string>();
 	#started = false;
 	// 54.7 auth state — populated when warden is wired AND
 	// StationConfig.requireAuth is true (default when warden is present).
@@ -454,14 +869,14 @@ export default class StationProvider {
 	async boot(): Promise<void> {
 		// Force-resolve so `setStation` runs even if no preload touches the
 		// singleton. Mirrors AuroraProvider.boot().
-		this.app.container.resolve<ResourceRegistry>(ResourceRegistry);
+		await this.app.container.resolve<ResourceRegistry>(ResourceRegistry);
 	}
 
 	async start(): Promise<void> {
 		if (this.#started) return;
 
 		const registry =
-			this.app.container.resolve<ResourceRegistry>(ResourceRegistry);
+			await this.app.container.resolve<ResourceRegistry>(ResourceRegistry);
 		const resources = registry.all();
 		if (resources.length === 0) return;
 
@@ -475,27 +890,54 @@ export default class StationProvider {
 		// peer is a degraded-host signal: #loadPeers returns null → silent stop.
 		const peers = await this.#loadPeers();
 		if (!peers) return;
-		const { router, atlas } = peers;
+		const { router, atlas, rune } = peers;
+
+		// 57.7 fail-closed: a write-capable admin (create/edit) validates + guards
+		// mass-assignment through a rune-derived schema. If atlas is present (CRUD
+		// is live) but `@c9up/rune` is NOT installed, refuse to boot rather than
+		// silently accept unvalidated bodies — there is NO fallback to the deleted
+		// key-filter (`feedback_security_first`). Read-only admins need no rune.
+		if (rune === null && resourcesNeedValidation(resources)) {
+			throw new Error(
+				"[station] @c9up/rune is required to validate admin write forms (create/edit) but is not installed. Add @c9up/rune (a Station peer dependency) — Station will NOT fall back to unvalidated mass-assignment. See https://ream.dev/modules/station#mass-assignment.",
+			);
+		}
+
+		// Phase 1a2 — resolve the SHARED inker renderer (AdonisJS/Edge parity)
+		// and mount Station's package templates as the `station` disk. Unlike
+		// warden (whose absence keeps the open dev-preview path), a view engine
+		// is a HARD render requirement (D2): once an admin surface exists there
+		// is no page without it. Fail LOUD at boot when @c9up/inker is not wired
+		// — mirrors #resolveDb's loud-on-missing posture — rather than degrade
+		// silently or 500 on the first request.
+		const renderer = await this.#resolveViewRenderer();
+		// Mount once: `station::<template>` now resolves to this package's
+		// templates/ dir on the host's single inker engine (edge.mount parity).
+		renderer.mount("station", TEMPLATES_ROOT);
+		this.#viewRenderer = renderer;
 
 		// Phase 1b — wire the warden auth gate (or warn-once when it stays open).
-		this.#configureAuth(userConfig);
+		await this.#configureAuth(userConfig);
 
 		// Phase 2 — build per-resource context ONCE. `#resolveDb()` is
 		// loud: if the host installed `@c9up/atlas` but didn't register
 		// `@c9up/atlas/provider` in `reamrc.ts`, AC11's "surface
 		// AtlasProvider misconfiguration" intent kicks in.
-		const db = this.#resolveDb();
+		const db = await this.#resolveDb();
 		for (const resource of resources) {
-			this.#contexts.set(resource, buildResourceContext(resource, db, atlas));
+			this.#contexts.set(
+				resource,
+				buildResourceContext(resource, db, atlas, rune),
+			);
 		}
 
-		// 56.5 + 54.6 + CSRF boot-time warn-onces. We surface the "auth
-		// wired but no permissions seeded", "no audit sink", and "no CSRF
-		// check" gaps loud-and-once so a half-wired install can't ship to
-		// prod without operators noticing.
+		// 56.5 + 54.6 boot-time warn-onces. We surface the "auth wired but no
+		// permissions seeded" and "no audit sink" gaps loud-and-once so a
+		// half-wired install can't ship to prod without operators noticing.
+		// (CSRF is no longer a boot-time warn — enforcement is request-time and
+		// honest now: every write route fail-closes on `ctx.request.csrfProtected`.)
 		this.#warnSeedPermissionsOnce(resources);
 		this.#warnAuditGapsOnce(resources);
-		this.#warnCsrfGapOnce(resources);
 
 		// Phase 3 — route registration. The router proxy may still throw
 		// "Router accessed before initialization" on first property access
@@ -527,28 +969,177 @@ export default class StationProvider {
 	async #loadPeers(): Promise<{
 		router: StationRouter;
 		atlas: AtlasModule;
+		rune: RuneModule | null;
 	} | null> {
 		if (!this.app.container.has("router")) return null;
-		const router = this.app.container.resolve<StationRouter>("router");
+		const router = await this.app.container.resolve<StationRouter>("router");
 		try {
 			const atlas = loadBearingCast<AtlasModule>(await import("@c9up/atlas"));
-			return { router, atlas };
+			// rune is loaded here but its ABSENCE is NOT a degraded-host signal the
+			// way atlas's is: atlas-missing ⇒ no CRUD at all (silent stop), whereas
+			// rune-missing while a write resource IS mounted is a fail-CLOSED
+			// misconfiguration (start() throws loud — see below). So `#loadRune`
+			// swallows only module-not-found → null; start() decides whether that
+			// null is fatal.
+			const rune = await this.#loadRune();
+			return { router, atlas, rune };
 		} catch (err) {
 			if (isModuleNotFound(err)) return null;
 			throw err;
 		}
 	}
 
+	/**
+	 * Tolerantly load `@c9up/rune` (57.7) — the SAME seam as `@c9up/atlas`
+	 * (dynamic module import, module-not-found → null, real error re-thrown).
+	 * Returning null does NOT degrade the host: the caller fails loud only when
+	 * a write-capable resource actually needs the validator (AC7, fail-closed).
+	 */
+	async #loadRune(): Promise<RuneModule | null> {
+		try {
+			return loadBearingCast<RuneModule>(await import("@c9up/rune"));
+		} catch (err) {
+			if (isModuleNotFound(err)) return null;
+			throw err;
+		}
+	}
+
+	/**
+	 * Resolve the host's shared inker renderer from the container (the `"inker"`
+	 * alias `InkerProvider` binds) — the AdonisJS package-views pattern (57.1,
+	 * D1/D2). A view engine is mandatory once an admin surface exists, so an
+	 * unbound or not-yet-ready `"inker"` throws a clear, actionable error at
+	 * boot (mirrors `#resolveDb`'s loud-on-missing), rather than a silent
+	 * degrade or a runtime 500. Consumed via the container only — never a
+	 * static or dynamic `import "@c9up/inker"` (D5), exactly like warden.
+	 */
+	async #resolveViewRenderer(): Promise<InkerViewRenderer> {
+		if (!this.app.container.has("inker")) {
+			throw new Error(
+				"[station] register @c9up/inker (InkerProvider) to render admin views",
+			);
+		}
+		try {
+			const resolved = await this.app.container.resolve<unknown>("inker");
+			if (!isInkerViewRenderer(resolved)) {
+				throw new Error(
+					'the "inker" binding is not a usable view renderer (missing mount/renderToString)',
+				);
+			}
+			return resolved;
+		} catch (cause) {
+			throw new Error(
+				"[station] @c9up/inker is registered but not usable — it must fully boot (InkerProvider + its rosetta/router peers) before Station, and resolve to a real view renderer. See `cause` for the specific reason.",
+				{ cause },
+			);
+		}
+	}
+
+	/**
+	 * Render Station's 404 page through the shared inker renderer (57.1).
+	 * Builds the same data the retired `renderNotFoundPage` composed and
+	 * renders the `station::errors/404` template (the package's mounted disk);
+	 * inker's `{{ }}` auto-escaping replaces the hand-rolled escaper for
+	 * this view. `slug` is `encodeURIComponent`-safe (no HTML-special output)
+	 * so its auto-escape is a no-op in the back-link `href`. The 404 uses no
+	 * inker helpers, so a minimal render ctx is sufficient.
+	 */
+	async #renderNotFound(
+		ctx: StationHttpContext,
+		resource: Resource,
+		id: string,
+	): Promise<string> {
+		if (this.#viewRenderer === undefined) {
+			throw new Error("[station] view engine not initialised");
+		}
+		const renderCtx = {
+			request: ctx.request,
+			response: ctx.response,
+			store: new Map<string, unknown>(),
+			locale: "en",
+		};
+		try {
+			return await this.#viewRenderer.renderToString(
+				renderCtx,
+				"station::errors/404",
+				{
+					title: "Not Found",
+					id,
+					label: resource.label,
+					labelLower: resource.label.toLowerCase(),
+					slug: encodeURIComponent(resource.name),
+				},
+			);
+		} catch (cause) {
+			// The error page itself failed to render (missing/faulty template,
+			// fs fault, parse error). A not-found must never escalate into a 500:
+			// fall back to a minimal, dependency-free static body. `id` is
+			// request-controlled, so it is HTML-escaped here. The fault is logged
+			// so a persistent deploy misconfig (unpublished templates/, corrupt
+			// station::layout) is not silently swallowed — but once per failure
+			// MODE per instance, not once per request: a durably-broken template
+			// on a 404-sprayed endpoint must not turn attacker traffic into
+			// unbounded log volume, while a genuinely new failure mode still
+			// surfaces its `cause`. The fingerprint keys on code/name only (never
+			// the request-controlled message) and is capped, so both stay bounded.
+			const fingerprint = notFoundFailFingerprint(cause);
+			if (
+				this.#notFoundRenderFailCauses.size < NOT_FOUND_RENDER_FAIL_CAP &&
+				!this.#notFoundRenderFailCauses.has(fingerprint)
+			) {
+				this.#notFoundRenderFailCauses.add(fingerprint);
+				console.error(
+					`[station] failed to render station::errors/404 (${fingerprint}) — serving the minimal fallback page; repeats of this failure mode are suppressed this instance`,
+					cause,
+				);
+			}
+			return `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Not Found</title></head><body><h1>404 — Not Found</h1><p>No ${escapeMin(resource.label)} matches <code>${escapeMin(id)}</code>.</p></body></html>`;
+		}
+	}
+
+	/**
+	 * Render a Station template through the shared inker renderer (57.2). Builds
+	 * the same minimal render ctx as `#renderNotFound` (the list/show views use
+	 * no inker helpers) and delegates escaping to inker's `{{ }}`. Used by the
+	 * list + show handlers. Unlike the retired hand-rolled builders — pure
+	 * `(input) => string` functions that could only throw on their own logic —
+	 * this path can additionally fault on template lookup, fs, or parse errors.
+	 * Such a fault propagates to the root error boundary as a 500, which is the
+	 * correct outcome on the success path: a broken list/show template is a real
+	 * server error and must not be masked as a degraded 200. (`#renderNotFound`
+	 * wraps its render in a static fallback only because a not-found is already
+	 * an error response that must never escalate into a 500.)
+	 */
+	async #renderView(
+		ctx: StationHttpContext,
+		name: string,
+		data: Readonly<Record<string, unknown>>,
+	): Promise<string> {
+		if (this.#viewRenderer === undefined) {
+			throw new Error("[station] view engine not initialised");
+		}
+		// Thread the real per-request store (57.3/D3) so the als-backed inker
+		// helpers — `csrfField()` on the form/login views — read the token. Inert
+		// for list/show, whose templates call no helpers.
+		const renderCtx = {
+			request: ctx.request,
+			response: ctx.response,
+			store: ctx.store ?? new Map<string, unknown>(),
+			locale: "en",
+		};
+		return await this.#viewRenderer.renderToString(renderCtx, name, data);
+	}
+
 	/**
 	 * Wire the warden auth gate from the `station` config block. When warden is
 	 * not installed/bound the gate stays open and a one-time warning is emitted.
 	 */
-	#configureAuth(userConfig: StationConfig): void {
+	async #configureAuth(userConfig: StationConfig): Promise<void> {
 		const wardenWanted = userConfig.requireAuth !== false;
 		if (wardenWanted) {
 			try {
 				this.#authManager =
-					this.app.container.resolve<WardenAuthManager>("auth");
+					await this.app.container.resolve<WardenAuthManager>("auth");
 				this.#authConfig = {
 					requireAuth: true,
 					requireRole: userConfig.requireRole,
@@ -671,23 +1262,6 @@ export default class StationProvider {
 		);
 	}
 
-	#warnCsrfGapOnce(resources: ReadonlyArray<Resource>): void {
-		if (csrfWarnEmitted) return;
-		const writeActions: ReadonlyArray<ResourceAction> = [
-			"create",
-			"edit",
-			"destroy",
-		];
-		const writeEnabled = resources.some((r) =>
-			r.actions.some((a) => writeActions.includes(a)),
-		);
-		if (!writeEnabled) return;
-		csrfWarnEmitted = true;
-		console.warn(
-			"[station] Write-enabled resources are mounted but Station does NOT enforce CSRF at the handler level. Wire @c9up/blackhole (csrf: true) or an equivalent middleware in start/kernel.ts BEFORE production — a missing CSRF check on /admin/<resource>/:id POST allows cross-site form submission to mutate rows under any logged-in user's session.",
-		);
-	}
-
 	#warnAuditGapsOnce(resources: ReadonlyArray<Resource>): void {
 		if (missingAuditWarned) return;
 		const writeActions: ReadonlyArray<ResourceAction> = [
@@ -721,6 +1295,89 @@ export default class StationProvider {
 		return ctx;
 	}
 
+	/**
+	 * The derived rune schema for a write handler (57.7). Present by construction
+	 * — start() fail-closes at boot when a write action is mounted without
+	 * `@c9up/rune` — so an undefined here is an internal invariant break; throw
+	 * loud (fail-closed) rather than silently accept an unvalidated body.
+	 */
+	#requireWritableSchema(resource: Resource): RuneSchema {
+		const { writableSchema } = this.#requireContext(resource);
+		if (writableSchema === undefined) {
+			throw new Error(
+				`[station] No validation schema for ${resource.entity.name} — @c9up/rune must be installed to accept admin writes.`,
+			);
+		}
+		return writableSchema;
+	}
+
+	/**
+	 * Fail-closed response for invalid write input (57.7, AC4). Content-negotiated:
+	 *
+	 *  - **JSON/XHR** → `422` with `{ error, code: "E_VALIDATION_ERROR", messages }`
+	 *    (Adonis/Vine parity — API clients get the machine-readable errors).
+	 *  - **HTML with a session** → the AdonisJS web idiom (PRG): flash the old
+	 *    input + per-field errors, then `redirect().back()` to the form `GET`,
+	 *    which re-reads the flash and re-renders with values + errors. No inline
+	 *    body — the browser lands on a fresh form (no re-POST on refresh).
+	 *  - **HTML without a session** → graceful fallback: re-render the form inline
+	 *    at `422` so the errors are never silently lost when no `SessionMiddleware`
+	 *    ran. (`row` supplies the id/action on EDIT; undefined keeps CREATE mode.)
+	 *
+	 * `redirect().back()` semantics are replicated over Station's `redirect(url)`
+	 * seam ({@link redirectBack}) with the same same-origin guard ream's
+	 * `RedirectBuilder.back()` uses — `formUrl` is the safe fallback.
+	 */
+	async #denyValidation(
+		ctx: StationHttpContext,
+		resource: Resource,
+		submitted: Record<string, unknown>,
+		errors: ReadonlyArray<RuneValidationError>,
+		formUrl: string,
+		row?: Readonly<Record<string, unknown>>,
+	): Promise<void> {
+		if (wantsJsonResponse(ctx)) {
+			ctx.response.status(422);
+			// AdonisJS/VineJS parity: `{ errors: [{ field, rule, message }] }` —
+			// the same shape ream's own `E_VALIDATION_ERROR` handler emits.
+			ctx.response.json({
+				errors: errors.map((e) => ({
+					field: e.field,
+					rule: e.rule,
+					message: e.message,
+				})),
+			});
+			return;
+		}
+		// Echo only declared, non-sensitive columns back to the form — never
+		// `_csrf`, secrets, or mass-assignment keys (both the flash store and the
+		// re-rendered HTML). An empty result falls back to `row`.
+		const { columns, pkColumn } = this.#requireContext(resource);
+		const safe = flashableInput(submitted, columns);
+		if (ctx.session !== undefined) {
+			// AdonisJS PRG: flash old input + errors, redirect back to the form.
+			ctx.session.flashAll(safe);
+			ctx.session.flash(FLASH_ERRORS_KEY, fieldErrors(errors));
+			redirectBack(ctx, formUrl);
+			return;
+		}
+		// No session middleware — fall back to an inline 422 re-render so the
+		// submitted values + errors are still shown rather than silently dropped.
+		const vm = buildFormViewModel({
+			resource,
+			columns,
+			pkColumn,
+			row,
+			values: Object.keys(safe).length > 0 ? safe : undefined,
+			errors: fieldErrors(errors),
+			csrfEnabled: ctx.store?.get("csrfToken") != null,
+		});
+		ctx.response.status(422);
+		const html = await this.#renderView(ctx, "station::form", vm);
+		ctx.response.type("text/html; charset=utf-8");
+		ctx.response.send(html);
+	}
+
 	#buildListHandler(
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
@@ -745,32 +1402,36 @@ export default class StationProvider {
 				);
 			}
 
-			const total = await repo.query().count();
-			const lastPage = Math.max(1, Math.ceil(total / perPage));
-			if (page > lastPage && total > 0) {
+			// De-hand-rolled (57.5): atlas `paginate()` runs the parallel
+			// COUNT(*) + LIMIT/OFFSET data fetch in one call and owns the
+			// `lastPage = ceil(total/perPage)` math Station used to duplicate.
+			// Station keeps only the `MAX_PER_PAGE` clamp (above) and the
+			// redirect-to-last-page wrapper — atlas floors perPage to ≥1 but
+			// does not cap it.
+			const result = await repo
+				.query()
+				.orderBy(pkColumn, "desc")
+				.paginate(page, perPage);
+			if (page > result.meta.lastPage && result.meta.total > 0) {
 				// Never render an empty page when one exists — redirect to the
 				// last real page so the user lands on something useful.
 				ctx.response.redirect(
-					`/admin/${resource.name}?page=${lastPage}&perPage=${perPage}`,
+					`/admin/${resource.name}?page=${result.meta.lastPage}&perPage=${perPage}`,
 				);
 				return;
 			}
 
-			const rows = await repo
-				.query()
-				.orderBy(pkColumn, "desc")
-				.forPage(page, perPage)
-				.exec();
-			const html = renderListPage({
+			const viewModel = buildListViewModel({
 				resource,
-				rows,
+				rows: result.all(),
 				columns,
 				pkColumn,
-				page,
-				perPage,
-				total,
-				lastPage,
+				page: result.meta.currentPage,
+				perPage: result.meta.perPage,
+				total: result.meta.total,
+				lastPage: result.meta.lastPage,
 			});
+			const html = await this.#renderView(ctx, "station::list", viewModel);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(html);
 		};
@@ -791,17 +1452,19 @@ export default class StationProvider {
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
+				const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
 				ctx.response.status(404);
 				ctx.response.type("text/html; charset=utf-8");
-				ctx.response.send(renderNotFoundPage({ resource, id }));
+				ctx.response.send(notFoundHtml);
 				return;
 			}
-			const html = renderShowPage({
+			const viewModel = buildShowViewModel({
 				resource,
 				row,
 				columns,
 				pkColumn,
 			});
+			const html = await this.#renderView(ctx, "station::show", viewModel);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(html);
 		};
@@ -818,12 +1481,18 @@ export default class StationProvider {
 				deny(ctx);
 				return;
 			}
-			const html = renderFormPage({
+			// 57.7 — after a failed create redirected back (PRG), the flash carries
+			// the old input + per-field errors; re-populate + surface them.
+			const { values, errors } = readFlash(ctx, columns);
+			const vm = buildFormViewModel({
 				resource,
 				columns,
 				pkColumn,
-				hiddenInputs: csrfHiddenInputs(ctx),
+				values,
+				errors,
+				csrfEnabled: ctx.store?.get("csrfToken") != null,
 			});
+			const html = await this.#renderView(ctx, "station::form", vm);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(html);
 		};
@@ -833,7 +1502,15 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { repo, pkColumn, columns, autoManaged } =
+			// Fail-close: reject a request whose CSRF was not enforced+validated
+			// (blackhole unwired / csrf:false / route excepted) BEFORE any auth or
+			// DB work — no 404-vs-403 oracle to a forged request. A seeded token is
+			// not proof; only `csrfProtected === true` is (AC4/AC7).
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
+			const { repo, pkColumn, columns, booleanKeys } =
 				this.#requireContext(resource);
 			if (
 				!(await authorizeAction(resource, "create", ctx, this.#authManager))
@@ -842,14 +1519,23 @@ export default class StationProvider {
 				return;
 			}
 			const body = await readBody(ctx);
-			// Mass-assignment guard: only `@Column`-declared properties make
-			// it through to repo.create(). An attacker who POSTs
-			// `{ role: "admin" }` or `{ passwordHash: "x" }` against a
-			// resource that doesn't declare those columns has the keys
-			// silently dropped here. PK + framework timestamps are always
-			// excluded — they're decided by the DB / hooks, not the caller.
-			const filtered = filterWritableBody(body, columns, pkColumn, autoManaged);
-			const created = await repo.create(filtered);
+			// 57.7 — validate + mass-assignment guard in one pass. `result.data`
+			// holds ONLY declared-column keys, so an attacker's `{ role: "admin" }`
+			// / `{ passwordHash: "x" }` / PK / timestamps are never present (dropped
+			// by the schema, not a separate filter), and each field is type-checked.
+			// Invalid input fail-closes with a 422 BEFORE any repository write (AC4).
+			const result = validateWritableBody(
+				this.#requireWritableSchema(resource),
+				booleanKeys,
+				body,
+			);
+			if (!result.valid) {
+				// PRG fallback URL = the create form (AdonisJS `redirect().back()`).
+				const formUrl = `/admin/${encodeURIComponent(resource.name)}/new`;
+				await this.#denyValidation(ctx, resource, body, result.errors, formUrl);
+				return;
+			}
+			const created = await repo.create(result.data);
 			await emitAudit(resource, {
 				action: "create",
 				resource: resource.name,
@@ -875,18 +1561,26 @@ export default class StationProvider {
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
+				const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
 				ctx.response.status(404);
 				ctx.response.type("text/html; charset=utf-8");
-				ctx.response.send(renderNotFoundPage({ resource, id }));
+				ctx.response.send(notFoundHtml);
 				return;
 			}
-			const html = renderFormPage({
+			// 57.7 — after a failed update redirected back (PRG), the flash carries
+			// the submitted values + errors; they win over the DB `row` so the user
+			// sees what they typed. A normal edit GET has no flash → fields from row.
+			const { values, errors } = readFlash(ctx, columns);
+			const vm = buildFormViewModel({
 				resource,
 				columns,
 				pkColumn,
 				row,
-				hiddenInputs: csrfHiddenInputs(ctx),
+				values,
+				errors,
+				csrfEnabled: ctx.store?.get("csrfToken") != null,
 			});
+			const html = await this.#renderView(ctx, "station::form", vm);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(html);
 		};
@@ -896,7 +1590,12 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
-			const { repo, pkColumn, columns, autoManaged } =
+			// Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
+			const { repo, pkColumn, columns, booleanKeys } =
 				this.#requireContext(resource);
 			// Authorize before the existence check (no 404-vs-403 oracle).
 			if (!(await authorizeAction(resource, "edit", ctx, this.#authManager))) {
@@ -906,24 +1605,43 @@ export default class StationProvider {
 			const id = ctx.params.id ?? "";
 			const entity = await repo.find(id);
 			if (entity === null) {
+				const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
 				ctx.response.status(404);
 				ctx.response.type("text/html; charset=utf-8");
-				ctx.response.send(renderNotFoundPage({ resource, id }));
+				ctx.response.send(notFoundHtml);
 				return;
 			}
 			const body = await readBody(ctx);
+			// 57.7 — validate BEFORE any snapshot or mutation (AC4). On failure the
+			// entity is untouched (no `setProp`, no `save`), so a bad edit never
+			// poisons the audit diff nor emits a success event; the form re-renders
+			// 422 with the submitted values + per-field errors (the existing entity
+			// still supplies the id/action).
+			const result = validateWritableBody(
+				this.#requireWritableSchema(resource),
+				booleanKeys,
+				body,
+			);
+			if (!result.valid) {
+				// PRG fallback URL = this row's edit form (AdonisJS `redirect().back()`).
+				const formUrl = `/admin/${encodeURIComponent(resource.name)}/${encodeURIComponent(id)}/edit`;
+				await this.#denyValidation(
+					ctx,
+					resource,
+					body,
+					result.errors,
+					formUrl,
+					entity,
+				);
+				return;
+			}
 			// Snapshot BEFORE the mutation runs so the audit diff is
 			// meaningful (entity is a BaseEntity; its dirty-tracking
-			// would shadow the original values after setProp).
+			// would shadow the original values after setProp). `result.data`
+			// holds only declared, type-checked columns — the mass-assignment
+			// guarantee (PK / timestamps / unknown keys dropped) is inherent.
 			const beforeSnapshot = snapshotEntity(entity, columns);
-			// Mass-assignment guard: filterWritableBody drops every key
-			// that isn't an `@Column`-declared property, plus the PK and
-			// any framework timestamps (created_at / updated_at /
-			// deleted_at). An attacker who POSTs `{ role: "admin" }` to
-			// a resource without that column has the field silently
-			// dropped instead of overwriting the entity.
-			const writable = filterWritableBody(body, columns, pkColumn, autoManaged);
-			for (const [key, value] of Object.entries(writable)) {
+			for (const [key, value] of Object.entries(result.data)) {
 				entity.setProp(key, value);
 			}
 			await repo.save(entity);
@@ -952,6 +1670,14 @@ export default class StationProvider {
 		const updateHandler = this.#buildUpdateHandler(resource);
 		const destroyHandler = this.#buildDestroyHandler(resource);
 		return async (ctx) => {
+			// Fail-close on CSRF before reading the body (see #buildCreateHandler).
+			// The PUT/DELETE branches delegate to already-guarded handlers, but the
+			// unsupported-override 405 branch would otherwise do work on a forged
+			// request and leak a 403-vs-405 oracle — guard the entrypoint too.
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
 			const body = await readBody(ctx);
 			const override = String(body._method ?? "").toUpperCase();
 			if (override === "PUT" || override === "PATCH") {
@@ -974,6 +1700,11 @@ export default class StationProvider {
 		resource: Resource,
 	): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx) => {
+			// Fail-close on CSRF before any auth/DB work (see #buildCreateHandler).
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
 			const { repo, pkColumn, columns } = this.#requireContext(resource);
 			// Authorize before the existence check (no 404-vs-403 oracle).
 			if (
@@ -985,9 +1716,10 @@ export default class StationProvider {
 			const id = ctx.params.id ?? "";
 			const row = await repo.find(id);
 			if (row === null) {
+				const notFoundHtml = await this.#renderNotFound(ctx, resource, id);
 				ctx.response.status(404);
 				ctx.response.type("text/html; charset=utf-8");
-				ctx.response.send(renderNotFoundPage({ resource, id }));
+				ctx.response.send(notFoundHtml);
 				return;
 			}
 			const before = snapshotEntity(row, columns);
@@ -1004,9 +1736,9 @@ export default class StationProvider {
 		};
 	}
 
-	#resolveDb(): unknown {
+	async #resolveDb(): Promise<unknown> {
 		try {
-			return this.app.container.resolve<unknown>("db");
+			return await this.app.container.resolve<unknown>("db");
 		} catch (cause) {
 			throw new Error(
 				`[station] No 'db' connection registered. Did you register @c9up/atlas/provider in reamrc.ts?`,
@@ -1187,11 +1919,12 @@ export default class StationProvider {
 			}
 			const qs = ctx.request.qs();
 			const errorParam = qs.error;
-			const html = renderLoginPage({
+			const vm = buildLoginViewModel({
 				action: this.#authConfig.loginPath,
 				error: typeof errorParam === "string" ? errorParam : undefined,
-				hiddenInputs: csrfHiddenInputs(ctx),
+				csrfEnabled: ctx.store?.get("csrfToken") != null,
 			});
+			const html = await this.#renderView(ctx, "station::login", vm);
 			ctx.response.type("text/html; charset=utf-8");
 			ctx.response.send(html);
 		};
@@ -1205,6 +1938,13 @@ export default class StationProvider {
 	 */
 	#buildLoginPostHandler(): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx: StationHttpContext): Promise<void> => {
+			// Fail-close on CSRF first — a forged login POST is refused before any
+			// AuthManager work (see #buildCreateHandler). Login is open by design
+			// (no auth gate), so CSRF is the sole pre-check here.
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
 			const manager = this.#authManager;
 			if (manager === undefined) {
 				ctx.response.status(500);
@@ -1216,12 +1956,13 @@ export default class StationProvider {
 			const email = typeof body.email === "string" ? body.email.trim() : "";
 			const password = typeof body.password === "string" ? body.password : "";
 			if (email.length === 0 || password.length === 0) {
-				const html = renderLoginPage({
+				const vm = buildLoginViewModel({
 					action: this.#authConfig.loginPath,
 					email,
 					error: "Email and password are both required.",
-					hiddenInputs: csrfHiddenInputs(ctx),
+					csrfEnabled: ctx.store?.get("csrfToken") != null,
 				});
+				const html = await this.#renderView(ctx, "station::login", vm);
 				ctx.response.status(400);
 				ctx.response.type("text/html; charset=utf-8");
 				ctx.response.send(html);
@@ -1234,12 +1975,13 @@ export default class StationProvider {
 			const token =
 				typeof result.user?.token === "string" ? result.user.token : undefined;
 			if (!result.authenticated || token === undefined) {
-				const html = renderLoginPage({
+				const vm = buildLoginViewModel({
 					action: this.#authConfig.loginPath,
 					email,
 					error: result.error ?? "Invalid email or password.",
-					hiddenInputs: csrfHiddenInputs(ctx),
+					csrfEnabled: ctx.store?.get("csrfToken") != null,
 				});
+				const html = await this.#renderView(ctx, "station::login", vm);
 				ctx.response.status(401);
 				ctx.response.type("text/html; charset=utf-8");
 				ctx.response.send(html);
@@ -1262,6 +2004,12 @@ export default class StationProvider {
 	 */
 	#buildLogoutHandler(): (ctx: StationHttpContext) => Promise<void> {
 		return async (ctx: StationHttpContext): Promise<void> => {
+			// Fail-close on CSRF: a forged cross-site POST must not be able to log
+			// an admin out (session-fixation nuisance) (see #buildCreateHandler).
+			if (ctx.request.csrfProtected !== true) {
+				denyCsrf(ctx);
+				return;
+			}
 			ctx.response.clearCookie?.(this.#authConfig.cookieName, {
 				path: "/",
 			});
@@ -1284,6 +2032,7 @@ function buildResourceContext(
 	resource: Resource,
 	db: unknown,
 	atlas: AtlasModule,
+	rune: RuneModule | null,
 ): ResourceContext {
 	const entityCtor = loadBearingCast<
 		ConstructorParameters<typeof AtlasBaseRepository>[0]
@@ -1309,7 +2058,32 @@ function buildResourceContext(
 			.filter(([, cfg]) => cfg.autoCreate === true || cfg.autoUpdate === true)
 			.map(([prop]) => prop),
 	);
-	return { repo, columns, pkColumn, autoManaged };
+	// 57.7 — derive the writable validation schema from the SAME column metadata
+	// the old `filterWritableBody` read. `rune === null` here means no write
+	// action is mounted for this resource (start() already fail-closed the
+	// atlas-present-but-rune-absent write case), so the schema stays undefined.
+	const excludedProps = new Set<string>(
+		atlas.getRelationMetadata(resource.entity).map((r) => r.propertyKey),
+	);
+	if (atlas.hasSoftDeletes(resource.entity)) excludedProps.add("deletedAt");
+	const derived =
+		rune === null
+			? undefined
+			: deriveWritableSchema(
+					columns,
+					pkColumn,
+					autoManaged,
+					excludedProps,
+					rune,
+				);
+	return {
+		repo,
+		columns,
+		pkColumn,
+		autoManaged,
+		writableSchema: derived?.schema,
+		booleanKeys: derived?.booleanKeys ?? new Set<string>(),
+	};
 }
 
 /**
@@ -1448,6 +2222,37 @@ function deny(ctx: StationHttpContext): void {
 	);
 }
 
+/**
+ * Fail-closed CSRF denial (403), mirroring {@link deny}'s content negotiation.
+ * Fires when a write reaches an admin handler without a CSRF-verified request
+ * (`ctx.request.csrfProtected !== true`). The FIRST block per process also emits
+ * one `console.error` — unlike the removed boot-time warning it can never
+ * false-alarm (it accompanies a real unprotected write attempt), pointing the
+ * operator at the actual misconfiguration (blackhole unwired / `csrf: false` /
+ * `/admin/*` excepted).
+ */
+function denyCsrf(ctx: StationHttpContext): void {
+	if (!csrfBlockedWarned) {
+		csrfBlockedWarned = true;
+		console.error(
+			"[station] Blocked a write to /admin/* — CSRF was not enforced for this request. Check that @c9up/blackhole is wired (csrf: true) in start/kernel.ts, /admin/* is NOT in csrf.exceptRoutes, and the blackhole native addon has been rebuilt (a stale .node predates the csrfProtected signal and always reads undefined). Returning 403.",
+		);
+	}
+	ctx.response.status(403);
+	if (wantsJsonResponse(ctx)) {
+		ctx.response.json({
+			error: "Forbidden",
+			code: "CSRF_REQUIRED",
+			message: "This admin action requires an active, verified CSRF token.",
+		});
+		return;
+	}
+	ctx.response.type("text/html; charset=utf-8");
+	ctx.response.send(
+		"<h1>403 Forbidden</h1><p>This admin action requires an active, verified CSRF token.</p>",
+	);
+}
+
 /**
  * Memoise the parsed body per request (Adonis BodyParser semantics — the
  * body is parsed once and stays re-readable). `#buildMethodOverrideHandler`
@@ -1483,28 +2288,6 @@ async function parseBody(
 	return isPlainRecord(raw) ? raw : {};
 }
 
-/**
- * Read the CSRF token (when present) from `ctx.store` and shape it as
- * a `hiddenInputs[]` entry for `renderFormPage`. The key `csrfToken`
- * matches the @c9up/blackhole `csrfToken` convention so a fully-
- * wired host stamps the token automatically; a host that doesn't wire
- * CSRF returns no hidden input, and the form is unprotected (the
- * boot-time warn-once already flagged this).
- *
- * The form field is named `_csrf` to match Adonis / Blackhole's
- * default. Hosts using a different field name can override by writing
- * their own hiddenInputs into ctx.store under a richer key, but for
- * the common case this is the zero-config path.
- */
-function csrfHiddenInputs(
-	ctx: StationHttpContext,
-): ReadonlyArray<{ name: string; value: string }> | undefined {
-	if (ctx.store === undefined) return undefined;
-	const token = ctx.store.get("csrfToken");
-	if (typeof token !== "string" || token.length === 0) return undefined;
-	return [{ name: "_csrf", value: token }];
-}
-
 function redirectToShow(
 	ctx: StationHttpContext,
 	resource: Resource,
@@ -1565,15 +2348,18 @@ async function emitAudit(resource: Resource, event: AuditEvent): Promise<void> {
 }
 
 /**
- * Tiny HTML-escape for the 405 error body — duplicated here rather
- * than imported from views/escape.ts to keep the dependency surface
- * of StationProvider minimal (views are otherwise only reached via
- * the renderer modules).
+ * Tiny HTML-escape for the 404 / 405 error bodies — a self-contained
+ * local helper. Station keeps no shared TS escaper (inker's `{{ }}`
+ * owns view escaping); this covers the error bodies that are sent as
+ * `text/html` without going through the inker renderer. Escapes the
+ * same five characters as inker so the two escaping paths stay in
+ * parity (`&` first to avoid double-encoding).
  */
 function escapeMin(value: string): string {
 	return value
 		.replace(/&/g, "&amp;")
 		.replace(/</g, "&lt;")
 		.replace(/>/g, "&gt;")
-		.replace(/"/g, "&quot;");
+		.replace(/"/g, "&quot;")
+		.replace(/'/g, "&#39;");
 }