@cosmicdrift/kumiko-bundled-features 0.243.4 → 0.245.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-bundled-features",
-  "version": "0.243.4",
+  "version": "0.245.0",
   "description": "Built-in features — tenant, user, auth, delivery. The stuff you'd rewrite anyway, already typed.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -130,12 +130,12 @@
     "./workflow-runner": "./src/workflow-runner/index.ts"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.243.4",
-    "@cosmicdrift/kumiko-framework": "0.243.4",
-    "@cosmicdrift/kumiko-headless": "0.243.4",
-    "@cosmicdrift/kumiko-renderer": "0.243.4",
-    "@cosmicdrift/kumiko-renderer-web": "0.243.4",
-    "@cosmicdrift/kumiko-types": "0.243.4",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.245.0",
+    "@cosmicdrift/kumiko-framework": "0.245.0",
+    "@cosmicdrift/kumiko-headless": "0.245.0",
+    "@cosmicdrift/kumiko-renderer": "0.245.0",
+    "@cosmicdrift/kumiko-renderer-web": "0.245.0",
+    "@cosmicdrift/kumiko-types": "0.245.0",
     "@mollie/api-client": "^4.5.0",
     "@node-rs/argon2": "^2.0.2",
     "@types/mailparser": "^3.4.6",
@@ -164,7 +164,7 @@
   "devDependencies": {
     "@testing-library/user-event": "^14.6.1",
     "@types/qrcode": "^1.5.5",
-    "@cosmicdrift/kumiko-locale-de": "0.243.4",
-    "@cosmicdrift/kumiko-locale-es": "0.243.4"
+    "@cosmicdrift/kumiko-locale-de": "0.245.0",
+    "@cosmicdrift/kumiko-locale-es": "0.245.0"
   }
 }

package/src/auth-mfa-user-data/hooks.ts

@@ -15,6 +15,7 @@ import {
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { userMfaEntity, userMfaTable } from "../auth-mfa";
+import { assertErased } from "../shared";
 
 const executor = createEventStoreExecutor(userMfaTable, userMfaEntity, {
   entityName: "user-mfa",
@@ -49,6 +50,6 @@ export const userMfaDeleteHook: UserDataDeleteHook = async (ctx) => {
   const systemUser = createSystemUser(ctx.tenantId);
   const tdb = createTenantDb(ctx.db, ctx.tenantId, "system");
   for (const row of rows) {
-    await executor.forget({ id: row.id }, systemUser, tdb);
+    assertErased(await executor.forget({ id: row.id }, systemUser, tdb), "user-mfa", row.id);
   }
 };

package/src/notes-history/__tests__/add-note-author-name-kms.integration.test.ts

@@ -5,15 +5,25 @@
 // KMS adapter so the round-trip is proven end-to-end, not assumed from a
 // no-op-encrypt test env — a later refactor that silently reintroduces the
 // raw UUID or gets stuck on the placeholder would fail this.
+//
+// fw#2627 made add-note's parent-visibility check unconditional, so a
+// minimal `contact` fixture entity (PASS_CLAUSE) is mounted below and seeded
+// with the one row this file writes a note to — orthogonal to what this file
+// actually tests (authorName stamping).
 
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
-import { selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
+import { asRawClient, selectMany } from "@cosmicdrift/kumiko-framework/bun-db";
 import {
   configurePiiSubjectKms,
   InMemoryKmsAdapter,
   isPiiCiphertext,
 } from "@cosmicdrift/kumiko-framework/crypto";
-import type { SessionUser } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
 import {
   setupTestStack,
   type TestStack,
@@ -30,6 +40,16 @@ import { createNotesHistoryFeature } from "../feature";
 const notesHistoryFeature = createNotesHistoryFeature();
 const tenantId = testTenantId(1);
 
+const CONTACT_TABLE = "notes_kms_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-kms-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+const CONTACT_KMS_AUTHOR = "40000000-0000-4000-8000-000000000001";
+
 let stack: TestStack;
 
 function memberUser(userId: string): SessionUser {
@@ -37,9 +57,14 @@ function memberUser(userId: string): SessionUser {
 }
 
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [notesHistoryFeature] });
+  stack = await setupTestStack({ features: [notesHistoryFeature, contactFixtureFeature] });
   await unsafeCreateEntityTable(stack.db, noteEntryEntity);
   await unsafeCreateEntityTable(stack.db, userEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+    [CONTACT_KMS_AUTHOR, tenantId, CONTACT_KMS_AUTHOR],
+  );
 });
 
 afterAll(async () => {
@@ -70,13 +95,13 @@ describe("add-note — authorName stamped from the writer's own user row", () =>
 
     const { id: noteId } = await stack.http.writeOk<{ id: string }>(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "contact-kms-author", body: "Called back." },
+      { entityType: "contact", entityId: CONTACT_KMS_AUTHOR, body: "Called back." },
       memberUser(userId),
     );
 
     const { rows } = await stack.http.queryOk<{ rows: Array<Record<string, unknown>> }>(
       NotesHistoryQueries.noteList,
-      { filter: { field: "entityId", op: "eq", value: "contact-kms-author" } },
+      { filter: { field: "entityId", op: "eq", value: CONTACT_KMS_AUTHOR } },
       memberUser(userId),
     );
 

package/src/notes-history/__tests__/notes-history-ownership.integration.test.ts

@@ -9,10 +9,24 @@
 // stress shiftParams: the ownership fragment's `$N` placeholder must be
 // renumbered past the tenant-scope filter's already-consumed slots
 // (event-store-executor-read.ts), not just happen to work at `$1`.
+//
+// fw#2627 made add-note's parent-visibility check unconditional: entityType
+// must now name a registered entity, and the row must exist and be visible
+// to the caller. This file tests NOTE-level ownership, not parent-level, so
+// the fixture `project` entity below is deliberately registered with NO
+// `access` (PASS_CLAUSE) — any tenant member can write a note onto it — and
+// every project row used below is inserted before its add-note call, so the
+// parent-visibility check never interferes with what this file is actually
+// proving.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
-import type { EntityDefinition } from "@cosmicdrift/kumiko-framework/engine";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -49,6 +63,23 @@ const teamOwnership: NonNullable<EntityDefinition["access"]> = {
   },
 };
 
+// The `project` parent entity add-note now always checks for. No `access` —
+// PASS_CLAUSE — so it never gates on its own; this file's team split is
+// entirely on the note-entry side (teamOwnership above).
+const PROJECT_TABLE = "notes_ownership_test_projects";
+const projectEntity: EntityDefinition = createEntity({
+  table: PROJECT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const projectFixtureFeature = defineFeature("notes-ownership-test-project-fixture", (r) => {
+  r.entity("project", projectEntity);
+});
+
+const PROJ_1 = "20000000-0000-4000-8000-000000000001";
+const PROJ_9 = "20000000-0000-4000-8000-000000000009";
+const PROJ_2 = "20000000-0000-4000-8000-000000000002";
+const PROJ_B = "20000000-0000-4000-8000-00000000000b";
+
 type TestUser = ReturnType<typeof createTestUser>;
 
 let scopedStack: TestStack;
@@ -67,23 +98,42 @@ const userB: TestUser = createTestUser({
   claims: { team: "team-b" },
 });
 
+async function insertProjects(
+  stack: TestStack,
+  tenantId: string,
+  ids: readonly string[],
+): Promise<void> {
+  for (const id of ids) {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [id, tenantId, id],
+    );
+  }
+}
+
 beforeAll(async () => {
   scopedStack = await setupTestStack({
-    features: [createNotesHistoryFeature({ ownership: teamOwnership })],
+    features: [createNotesHistoryFeature({ ownership: teamOwnership }), projectFixtureFeature],
   });
   await unsafeCreateEntityTable(scopedStack.db, createNoteEntryEntity(teamOwnership));
+  await unsafeCreateEntityTable(scopedStack.db, projectEntity);
   await createEventsTable(scopedStack.db);
   await asRawClient(scopedStack.db).unsafe(
     `CREATE TABLE IF NOT EXISTS ${TEAMS_TABLE} (entity_id text PRIMARY KEY, team_id text NOT NULL)`,
   );
+  await insertProjects(scopedStack, userA.tenantId, [PROJ_1, PROJ_9, PROJ_2]);
 
   // Regression control, dedicated stack (mirrors tags.integration.test.ts's
   // openStack/defaultStack): a plain (unscoped) mount of the SAME feature,
   // used to prove the 0-rows result below is the ownership rule doing real
   // work, not an empty table or a broken query.
-  defaultStack = await setupTestStack({ features: [createNotesHistoryFeature()] });
+  defaultStack = await setupTestStack({
+    features: [createNotesHistoryFeature(), projectFixtureFeature],
+  });
   await unsafeCreateEntityTable(defaultStack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(defaultStack.db, projectEntity);
   await createEventsTable(defaultStack.db);
+  await insertProjects(defaultStack, userA.tenantId, [PROJ_1]);
 });
 
 afterAll(async () => {
@@ -128,16 +178,16 @@ describe("notes-history integration — row ownership (where-rule)", () => {
     // weaker test would miss: a broken shiftParams (team_id compared against
     // the tenant UUID or nothing → everyone sees 0) and a trivially-true
     // subquery (EXISTS matches regardless of team_id → everyone sees both).
-    await addNote(scopedStack, "proj-1", userA); // will be team-a
-    await addNote(scopedStack, "proj-9", userA); // will be team-b — same author, different team
+    await addNote(scopedStack, PROJ_1, userA); // will be team-a
+    await addNote(scopedStack, PROJ_9, userA); // will be team-b — same author, different team
     await asRawClient(scopedStack.db).unsafe(
       `INSERT INTO ${TEAMS_TABLE} (entity_id, team_id) VALUES ($1, $2), ($3, $4)`,
-      ["proj-1", "team-a", "proj-9", "team-b"],
+      [PROJ_1, "team-a", PROJ_9, "team-b"],
     );
 
     // User B (different team) sees nothing, even filtered down to the exact row.
     expect(
-      await listNotes(scopedStack, userB, { field: "entityId", op: "eq", value: "proj-1" }),
+      await listNotes(scopedStack, userB, { field: "entityId", op: "eq", value: PROJ_1 }),
     ).toHaveLength(0);
 
     // User A (own team) sees it. This is the real shiftParams exercise: the
@@ -148,7 +198,7 @@ describe("notes-history integration — row ownership (where-rule)", () => {
     const ownRows = await listNotes(scopedStack, userA, {
       field: "entityId",
       op: "eq",
-      value: "proj-1",
+      value: PROJ_1,
     });
     expect(ownRows).toHaveLength(1);
     expect(ownRows[0]?.["body"]).toBe("note");
@@ -158,17 +208,17 @@ describe("notes-history integration — row ownership (where-rule)", () => {
     // subquery (which would return both).
     const aRows = await listNotes(scopedStack, userA);
     expect(aRows).toHaveLength(1);
-    expect(aRows[0]?.["entityId"]).toBe("proj-1");
+    expect(aRows[0]?.["entityId"]).toBe(PROJ_1);
 
     // B authored NEITHER note, yet must see exactly the team-b one — proves
     // the rule grants access by team membership, not by who wrote the row.
     const bRows = await listNotes(scopedStack, userB);
     expect(bRows).toHaveLength(1);
-    expect(bRows[0]?.["entityId"]).toBe("proj-9");
+    expect(bRows[0]?.["entityId"]).toBe(PROJ_9);
   });
 
   test("the same data on an unscoped mount leaks across teams (regression control)", async () => {
-    await addNote(defaultStack, "proj-1", userA);
+    await addNote(defaultStack, PROJ_1, userA);
     // No ownership option on this stack's feature — the pre-fix behavior.
     // Proves the 0-rows result above comes from the ownership rule, not
     // from an unrelated empty-table/broken-query artifact.
@@ -176,10 +226,10 @@ describe("notes-history integration — row ownership (where-rule)", () => {
   });
 
   test("no explicit filter — ownership fragment still shifts correctly against the bare tenant scope", async () => {
-    await addNote(scopedStack, "proj-2", userA);
+    await addNote(scopedStack, PROJ_2, userA);
     await asRawClient(scopedStack.db).unsafe(
       `INSERT INTO ${TEAMS_TABLE} (entity_id, team_id) VALUES ($1, $2)`,
-      ["proj-2", "team-a"],
+      [PROJ_2, "team-a"],
     );
 
     expect(await listNotes(scopedStack, userB)).toHaveLength(0);
@@ -187,8 +237,88 @@ describe("notes-history integration — row ownership (where-rule)", () => {
   });
 });
 
+describe("unqualified where-rule fails closed, not open (fw#2639)", () => {
+  // Same shape as `teamOwnership` above, but the subquery's inner reference
+  // is left unqualified (`entity_id` instead of `t.entity_id`/`${ctx.tableName}.entity_id`).
+  // Postgres binds the unqualified name to the innermost table (`t`) first,
+  // so `t.entity_id = entity_id` silently becomes `t.entity_id = t.entity_id`
+  // — a self-join tautology that matches every row regardless of team.
+  const unqualifiedOwnership: NonNullable<EntityDefinition["access"]> = {
+    read: {
+      TenantMember: {
+        kind: "where",
+        where: (user, ctx) => {
+          const team = user.claims?.["team"];
+          // Boot probe has no claims and bails out here; the runtime lint in
+          // ruleToFragment is what must catch the unqualified reference.
+          if (typeof team !== "string") throw new Error("team claim required");
+          return {
+            sqlText: `EXISTS (SELECT 1 FROM ${TEAMS_TABLE} t WHERE t.entity_id = entity_id AND t.team_id = $${ctx.paramStart})`,
+            params: [team],
+          };
+        },
+      },
+    },
+  };
+
+  let unqualifiedStack: TestStack;
+
+  beforeAll(async () => {
+    // Reaching this point at all proves the boot guard doesn't false-positive
+    // on this rule: PROBE_USER carries no claims, so `where()` throws before
+    // the lint ever sees the bad SQL, and boot-validator/ownership.ts's
+    // probeWhereRule swallows that and moves on.
+    //
+    // add-note's parent-visibility check is unconditional since fw#2627, so
+    // this stack also needs the PASS_CLAUSE project fixture mounted — this
+    // block otherwise stays focused on the note-entry ownership rule.
+    unqualifiedStack = await setupTestStack({
+      features: [
+        createNotesHistoryFeature({ ownership: unqualifiedOwnership }),
+        projectFixtureFeature,
+      ],
+    });
+    await unsafeCreateEntityTable(unqualifiedStack.db, createNoteEntryEntity(unqualifiedOwnership));
+    await unsafeCreateEntityTable(unqualifiedStack.db, projectEntity);
+    await createEventsTable(unqualifiedStack.db);
+    await asRawClient(unqualifiedStack.db).unsafe(
+      `CREATE TABLE IF NOT EXISTS ${TEAMS_TABLE} (entity_id text PRIMARY KEY, team_id text NOT NULL)`,
+    );
+    await insertProjects(unqualifiedStack, userB.tenantId, [PROJ_B]);
+  });
+
+  afterAll(async () => {
+    await unqualifiedStack.cleanup();
+  });
+
+  test("list() fails closed instead of leaking userB's row to userA", async () => {
+    await addNote(unqualifiedStack, PROJ_B, userB);
+    await asRawClient(unqualifiedStack.db).unsafe(
+      `INSERT INTO ${TEAMS_TABLE} (entity_id, team_id) VALUES ($1, $2)`,
+      [PROJ_B, "team-b"],
+    );
+
+    // Pre-fix: this query returned HTTP 200 with userB's row (the tautology
+    // matches every row) — queryErr would throw "Expected query to fail but
+    // it succeeded". Post-fix: the runtime lint in ruleToFragment throws
+    // before the query ever runs, so the request fails loud instead of
+    // leaking. Asserting the concrete status (not just "isSuccess: false")
+    // documents exactly how it fails: an uncaught Error auto-wraps into
+    // InternalError (500), not a handled 4xx.
+    const error = await unqualifiedStack.http.queryErr(NotesHistoryQueries.noteList, {}, userA);
+    expect(error.httpStatus).toBe(500);
+    expect(error.code).toBe("internal_error");
+  });
+
+  // Green-path twin: `scopedStack` above (built with the correctly-qualified
+  // `teamOwnership` rule) already proves the lint doesn't reject every
+  // subquery rule — its first test asserts userA sees exactly its own
+  // team's row via HTTP 200 and never userB's. Relying on that coverage
+  // instead of duplicating a second correctly-qualified stack here.
+});
+
 describe("notes-history — boot guard rejects a where-rule in ownership.write", () => {
-  test("createNotesHistoryFeature throws instead of shipping a create()-time landmine", () => {
+  test("createNotesHistoryFeature throws instead of shipping a deny-only ownership map", () => {
     expect(() =>
       createNotesHistoryFeature({
         ownership: {

package/src/notes-history/__tests__/notes-history-parent-visibility.integration.test.ts

@@ -0,0 +1,225 @@
+// fw#2627 — add-note previously trusted entityType/entityId straight from the
+// client, so any dispatch-eligible tenant user could attach a note to a
+// parent object they had no read access to. The parent-visibility check is
+// unconditional (default-on, no opt-in): entityType must name a registered
+// entity, and the row must be visible through that entity's own read path
+// (tenant scope plus its `access.read` ownership) before add-note accepts
+// the write — on every mount, `parents` or not. `parents`, when set, only
+// narrows FURTHER to an allowlist of permitted parent entity names; it is
+// not what turns the check on (see `openStack` tests below, which mount
+// notes-history with no `parents` at all and still enforce the check).
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import {
+  createEntity,
+  createTextField,
+  defineFeature,
+  type EntityDefinition,
+} from "@cosmicdrift/kumiko-framework/engine";
+import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
+import {
+  createTestUser,
+  setupTestStack,
+  type TestStack,
+  unsafeCreateEntityTable,
+} from "@cosmicdrift/kumiko-framework/stack";
+import { NotesHistoryHandlers } from "../constants";
+import { createNoteEntryEntity } from "../entity";
+import { createNotesHistoryFeature } from "../feature";
+
+const PROJECT_TABLE = "notes_pv_test_projects";
+
+// Team-scoped read ownership on the parent entity itself — the caller sees a
+// project row only if their `team` claim matches the row's team_id.
+const projectOwnership: NonNullable<EntityDefinition["access"]> = {
+  read: {
+    TenantMember: {
+      kind: "where",
+      where: (user, ctx) => ({
+        sqlText: `${ctx.tableName}.team_id = $${ctx.paramStart}`,
+        params: [user.claims?.["team"] ?? null],
+      }),
+    },
+  },
+};
+
+function createProjectEntity(access?: EntityDefinition["access"]): EntityDefinition {
+  return createEntity({
+    table: PROJECT_TABLE,
+    fields: {
+      teamId: createTextField({ required: true, maxLength: 64 }),
+      name: createTextField({ required: true, maxLength: 64 }),
+    },
+    access,
+  });
+}
+
+const guardedProjectEntity = createProjectEntity(projectOwnership);
+
+// A second registered entity, deliberately left OUT of the `parents`
+// allowlist below — proves the allowlist rejects a real, registered entity
+// too, not just made-up names.
+const contactEntity = createEntity({
+  table: "notes_pv_test_contacts",
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+
+const fixturesFeature = defineFeature("notes-pv-test-fixtures", (r) => {
+  r.entity("project", guardedProjectEntity);
+  r.entity("contact", contactEntity);
+});
+
+type TestUser = ReturnType<typeof createTestUser>;
+
+// Same tenant, different team claim — mirrors the ownership integration test.
+const userA: TestUser = createTestUser({
+  id: 40,
+  roles: ["TenantMember"],
+  claims: { team: "team-a" },
+});
+const userB: TestUser = createTestUser({
+  id: 41,
+  roles: ["TenantMember"],
+  claims: { team: "team-b" },
+});
+
+const PROJECT_A = "a0000000-0000-4000-8000-000000000001";
+// A second team-a project, dedicated to the cross-team-denial case so its
+// note-count stays independent of PROJECT_A's.
+const PROJECT_A2 = "a0000000-0000-4000-8000-000000000002";
+// openStack-only team-a project row — never reused as PROJECT_A2 so the two
+// stacks' tests stay order-independent.
+const PROJECT_OPEN = "a0000000-0000-4000-8000-000000000009";
+
+let guardedStack: TestStack;
+let openStack: TestStack;
+
+beforeAll(async () => {
+  guardedStack = await setupTestStack({
+    features: [createNotesHistoryFeature({ parents: ["project"] }), fixturesFeature],
+  });
+  await unsafeCreateEntityTable(guardedStack.db, guardedProjectEntity);
+  await unsafeCreateEntityTable(guardedStack.db, createNoteEntryEntity());
+  await createEventsTable(guardedStack.db);
+  await asRawClient(guardedStack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES
+       ($1, $2, 'team-a', 'Project A'),
+       ($3, $2, 'team-a', 'Project A2')`,
+    [PROJECT_A, userA.tenantId, PROJECT_A2],
+  );
+
+  // Unguarded mount: the SAME feature with no `parents` at all — proves the
+  // parent-visibility check itself is default-on, not something `parents`
+  // switches on.
+  openStack = await setupTestStack({
+    features: [createNotesHistoryFeature(), fixturesFeature],
+  });
+  await unsafeCreateEntityTable(openStack.db, guardedProjectEntity);
+  await unsafeCreateEntityTable(openStack.db, createNoteEntryEntity());
+  await createEventsTable(openStack.db);
+  await asRawClient(openStack.db).unsafe(
+    `INSERT INTO ${PROJECT_TABLE} (id, tenant_id, team_id, name) VALUES ($1, $2, 'team-a', 'Project Open')`,
+    [PROJECT_OPEN, userA.tenantId],
+  );
+});
+
+afterAll(async () => {
+  await guardedStack.cleanup();
+  await openStack.cleanup();
+});
+
+async function addNote(
+  stack: TestStack,
+  entityType: string,
+  entityId: string,
+  user: TestUser,
+): Promise<{ id: string }> {
+  return stack.http.writeOk<{ id: string }>(
+    NotesHistoryHandlers.addNote,
+    { entityType, entityId, body: "note" },
+    user,
+  );
+}
+
+async function addNoteErr(stack: TestStack, entityType: string, entityId: string, user: TestUser) {
+  return stack.http.writeErr(
+    NotesHistoryHandlers.addNote,
+    { entityType, entityId, body: "note" },
+    user,
+  );
+}
+
+async function noteCountFor(stack: TestStack, entityId: string): Promise<number> {
+  const rows = await asRawClient(stack.db).unsafe<{ count: string }>(
+    `SELECT count(*)::text AS count FROM read_note_entries WHERE entity_id = $1`,
+    [entityId],
+  );
+  return Number(rows[0]?.count ?? "0");
+}
+
+describe("notes-history integration — add-note parent-visibility (parents option)", () => {
+  test("caller may note a parent row visible through the parent entity's own read path", async () => {
+    const result = await addNote(guardedStack, "project", PROJECT_A, userA);
+    expect(result.id).toBeTruthy();
+    expect(await noteCountFor(guardedStack, PROJECT_A)).toBe(1);
+  });
+
+  test("caller is denied noting a parent row from a foreign team while the same row is writable by its own team", async () => {
+    const err = await addNoteErr(guardedStack, "project", PROJECT_A2, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+    expect(await noteCountFor(guardedStack, PROJECT_A2)).toBe(0);
+
+    // Positive control: PROJECT_A2 itself is writable — by its own team — so
+    // the deny above is the team-claim check, not some other rejection (e.g.
+    // a row that doesn't exist at all).
+    const result = await addNote(guardedStack, "project", PROJECT_A2, userA);
+    expect(result.id).toBeTruthy();
+    expect(await noteCountFor(guardedStack, PROJECT_A2)).toBe(1);
+  });
+
+  test("entityType outside the allowlist is denied even when it is a registered entity", async () => {
+    const err = await addNoteErr(
+      guardedStack,
+      "contact",
+      "c0000000-0000-4000-8000-000000000003",
+      userA,
+    );
+    expect(err.code).toBe("not_found");
+  });
+
+  test("entityType that is not registered anywhere is denied", async () => {
+    const err = await addNoteErr(guardedStack, "totally-unknown-entity", "x", userA);
+    expect(err.code).toBe("not_found");
+  });
+
+  test("a malformed entityId is denied cleanly, without poisoning the connection for later writes", async () => {
+    const err = await addNoteErr(guardedStack, "project", "not-a-uuid", userA);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+
+    // The stack must still be usable afterwards — proves the malformed id was
+    // rejected before it ever reached a query, not caught after a failed
+    // (and tx-poisoning) cast.
+    const result = await addNote(guardedStack, "project", PROJECT_A, userA);
+    expect(result.id).toBeTruthy();
+  });
+
+  test("on an unguarded mount (no `parents`), an unregistered entityType is still denied — the check is default-on", async () => {
+    const err = await addNoteErr(openStack, "totally-unknown-entity", "y", userA);
+    expect(err.code).toBe("not_found");
+  });
+
+  test("on an unguarded mount, a registered and visible parent still succeeds", async () => {
+    const result = await addNote(openStack, "project", PROJECT_OPEN, userA);
+    expect(result.id).toBeTruthy();
+    expect(await noteCountFor(openStack, PROJECT_OPEN)).toBe(1);
+  });
+
+  test("on an unguarded mount, a registered parent from a foreign team is still denied", async () => {
+    const err = await addNoteErr(openStack, "project", PROJECT_OPEN, userB);
+    expect(err.code).toBe("not_found");
+    expect(err.httpStatus).toBe(404);
+  });
+});

package/src/notes-history/__tests__/notes-history.integration.test.ts

@@ -9,9 +9,17 @@
 //   - read-layer composition: list filtered on entityId
 //   - multi-tenant isolation
 //   - append-only: only add-note and list are registered handlers
+//
+// fw#2627 made add-note's parent-visibility check unconditional: entityType
+// must name a registered entity, and the row must be visible to the caller.
+// A minimal `contact` fixture entity (PASS_CLAUSE, no `access`) is mounted
+// below and seeded with one row per id this file writes a note to — this
+// file's own assertions are about note-entry behavior, not about parent
+// ownership, so the fixture stays unrestricted on purpose.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -25,12 +33,57 @@ import { createNotesHistoryFeature } from "../feature";
 
 const notesHistoryFeature = createNotesHistoryFeature();
 
+const CONTACT_TABLE = "notes_history_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-history-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+
 let stack: TestStack;
 
+// Distinct ids (default createTestUser() shares TestUsers.admin.id) —
+// authorId-attribution tests need two genuinely different users.
+const admin = createTestUser({ id: 1, roles: ["TenantAdmin"] });
+const member = createTestUser({ id: 2, roles: ["TenantMember"] });
+const otherTenant = createTestUser({
+  id: 10,
+  roles: ["TenantAdmin"],
+  tenantId: "00000000-0000-4000-8000-0000000000aa",
+});
+
+const CONTACT_1 = "30000000-0000-4000-8000-000000000001";
+const CONTACT_2 = "30000000-0000-4000-8000-000000000002";
+const CONTACT_2B = "30000000-0000-4000-8000-00000000002b";
+const CONTACT_3 = "30000000-0000-4000-8000-000000000003";
+const CONTACT_4 = "30000000-0000-4000-8000-000000000004";
+const CONTACT_5 = "30000000-0000-4000-8000-000000000005";
+const CONTACT_6 = "30000000-0000-4000-8000-000000000006";
+const CONTACT_SHARED = "30000000-0000-4000-8000-000000000007";
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [notesHistoryFeature] });
+  stack = await setupTestStack({ features: [notesHistoryFeature, contactFixtureFeature] });
   await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity);
   await createEventsTable(stack.db);
+
+  for (const id of [
+    CONTACT_1,
+    CONTACT_2,
+    CONTACT_2B,
+    CONTACT_3,
+    CONTACT_4,
+    CONTACT_5,
+    CONTACT_6,
+    CONTACT_SHARED,
+  ]) {
+    await asRawClient(stack.db).unsafe(
+      `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+      [id, admin.tenantId, id],
+    );
+  }
 });
 
 afterAll(async () => {
@@ -42,16 +95,6 @@ beforeEach(async () => {
   await asRawClient(stack.db).unsafe("DELETE FROM read_note_entries");
 });
 
-// Distinct ids (default createTestUser() shares TestUsers.admin.id) —
-// authorId-attribution tests need two genuinely different users.
-const admin = createTestUser({ id: 1, roles: ["TenantAdmin"] });
-const member = createTestUser({ id: 2, roles: ["TenantMember"] });
-const otherTenant = createTestUser({
-  id: 10,
-  roles: ["TenantAdmin"],
-  tenantId: "00000000-0000-4000-8000-0000000000aa",
-});
-
 async function addNote(
   entityType: string,
   entityId: string,
@@ -80,8 +123,8 @@ async function listNotes(
 
 describe("notes-history integration — add + list", () => {
   test("add-note lands in read_note_entries with author + timestamp stamped", async () => {
-    const { id } = await addNote("contact", "contact-1", "Called about renewal", member);
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-1" });
+    const { id } = await addNote("contact", CONTACT_1, "Called about renewal", member);
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_1 });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["id"]).toBe(id);
     expect(rows[0]?.["body"]).toBe("Called about renewal");
@@ -95,8 +138,8 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("a client-supplied authorId in the payload is ignored", async () => {
-    await addNote("contact", "contact-2", "note", member, { authorId: admin.id });
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2" });
+    await addNote("contact", CONTACT_2, "note", member, { authorId: admin.id });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_2 });
     // The write always attributes to the authenticated caller (member), never
     // to a value smuggled in through the payload — schema doesn't even accept
     // an authorId field, so this proves it's silently dropped, not honoured.
@@ -104,8 +147,8 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("a client-supplied authorName in the payload is ignored", async () => {
-    await addNote("contact", "contact-2b", "note", member, { authorName: "Fake Display Name" });
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-2b" });
+    await addNote("contact", CONTACT_2B, "note", member, { authorName: "Fake Display Name" });
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_2B });
     // Same guard as authorId above: addNotePayloadSchema doesn't accept an
     // authorName field, so a smuggled value never survives to the write —
     // the name (once stamped) can only come from the caller's own session.
@@ -114,17 +157,17 @@ describe("notes-history integration — add + list", () => {
   });
 
   test("multiple notes on the same entity accumulate — nothing overwrites", async () => {
-    await addNote("contact", "contact-3", "first");
-    await addNote("contact", "contact-3", "second");
-    await addNote("contact", "contact-3", "third");
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-3" });
+    await addNote("contact", CONTACT_3, "first");
+    await addNote("contact", CONTACT_3, "second");
+    await addNote("contact", CONTACT_3, "third");
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_3 });
     expect(rows.map((r) => r["body"]).sort()).toEqual(["first", "second", "third"]);
   });
 
   test("read-layer composition: filtering by entityId scopes to that entity only", async () => {
-    await addNote("contact", "contact-4", "for four");
-    await addNote("contact", "contact-5", "for five");
-    const rows = await listNotes({ field: "entityId", op: "eq", value: "contact-4" });
+    await addNote("contact", CONTACT_4, "for four");
+    await addNote("contact", CONTACT_5, "for five");
+    const rows = await listNotes({ field: "entityId", op: "eq", value: CONTACT_4 });
     expect(rows).toHaveLength(1);
     expect(rows[0]?.["body"]).toBe("for four");
   });
@@ -132,7 +175,7 @@ describe("notes-history integration — add + list", () => {
   test("empty body is rejected", async () => {
     const err = await stack.http.writeErr(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "contact-6", body: "  " },
+      { entityType: "contact", entityId: CONTACT_6, body: "  " },
       admin,
     );
     expect(err.httpStatus).toBe(400);
@@ -141,13 +184,13 @@ describe("notes-history integration — add + list", () => {
 
 describe("notes-history integration — multi-tenant isolation", () => {
   test("tenant B sees none of tenant A's notes", async () => {
-    await addNote("contact", "contact-shared-id", "A's note", admin);
+    await addNote("contact", CONTACT_SHARED, "A's note", admin);
 
     expect(
-      await listNotes({ field: "entityId", op: "eq", value: "contact-shared-id" }, otherTenant),
+      await listNotes({ field: "entityId", op: "eq", value: CONTACT_SHARED }, otherTenant),
     ).toHaveLength(0);
     expect(
-      await listNotes({ field: "entityId", op: "eq", value: "contact-shared-id" }, admin),
+      await listNotes({ field: "entityId", op: "eq", value: CONTACT_SHARED }, admin),
     ).toHaveLength(1);
   });
 });

package/src/notes-history/changes.json

@@ -1,4 +1,11 @@
 [
+  {
+    "version": "0.244.0",
+    "type": "improvement",
+    "title": "add-note now always verifies entityType/entityId against the parent entity's own read path",
+    "detail": "Before this change, add-note took entityType/entityId straight from the client with no check — any dispatch-eligible tenant user could attach a note to any parent object, including one they couldn't otherwise see. add-note now unconditionally verifies that entityType names a registered entity and that the row is visible to the caller through that entity's own read path (tenant scope plus its `access.read` ownership) before accepting the write; entries that fail either check are rejected with a not_found response. createNotesHistoryFeature also accepts a `parents` option — an allowlist further narrowing which registered entities may be a note's parent — but this option is additive-only; the parent-visibility check itself is not gated behind it.",
+    "migration": "entityType must now name an entity registered in the same app (via r.entity(...) or a bundled feature), and the caller must be able to see the target row through that entity's own read path. Any consumer that called add-note with an entityType that is NOT a registered entity name, or with an entityId the caller could not otherwise read, will now get a not_found error instead of a successful write — register the parent entity (and, if it needs row-level ownership, its `access.read` rule) before upgrading."
+  },
   {
     "version": "0.215.3",
     "type": "improvement",

package/src/notes-history/feature.ts

@@ -30,6 +30,7 @@ function registerNotesHistory(
   r: FeatureRegistrar<typeof NOTES_HISTORY_FEATURE_NAME>,
   access: AccessRule,
   ownership: EntityDefinition["access"] | undefined,
+  parents: ReadonlySet<string> | undefined,
 ): void {
   r.describe(
     "Generic, host-agnostic, append-only note history for any entity. Owns one event-sourced entity, `note-entry` (`read_note_entries`), keyed by (entityType, entityId) — so attaching notes adds NO column to the host entity and needs no relational pivot or JOIN. Provides a `create` write-handler (author stamped server-side from the caller, never client-supplied) and a `list` query filterable on entityId. Deliberately append-only: no update or delete handler is registered — a correction is a new entry, not an edit, so who-said-what-when stays reconstructable. Every path uses one access rule — adopt the host's model with createNotesHistoryFeature({ access: { openToAll: true } }) or pin roles with createNotesHistoryFeature({ roles }).",
@@ -43,7 +44,7 @@ function registerNotesHistory(
   const entity = createNoteEntryEntity(ownership);
   r.entity("note-entry", entity);
 
-  r.writeHandler(createAddNoteHandler(access));
+  r.writeHandler(createAddNoteHandler(access, parents));
   r.queryHandler(
     defineEntityListHandler("note-entry", entity, {
       access,
@@ -56,7 +57,7 @@ function registerNotesHistory(
 }
 
 export const notesHistoryFeature = defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
-  registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined),
+  registerNotesHistory(r, DEFAULT_NOTES_HISTORY_ACCESS, undefined, undefined),
 );
 
 export type NotesHistoryFeatureOptions = {
@@ -83,6 +84,16 @@ export type NotesHistoryFeatureOptions = {
    *  crypto-shredding — a silent Art.17 failure, not a thrown error. Make
    *  sure any `ownership.write` you set covers that role, or leave it unset. */
   readonly ownership?: EntityDefinition["access"];
+  /** Allowlist further narrowing which registered entities may be used as a
+   *  note's parent (entityType). This is NOT what turns parent-checking on —
+   *  add-note always verifies that entityType names a registered entity and
+   *  that the row is visible to the caller through that entity's own read
+   *  path (tenant scope plus its `access.read` ownership); an entityType
+   *  that names no registered entity is rejected regardless of this option.
+   *  Setting `parents` narrows further, to a specific set of entity names —
+   *  useful when a host entity is registered but should never be a valid
+   *  note parent. */
+  readonly parents?: readonly string[];
 };
 
 function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
@@ -96,7 +107,12 @@ function resolveAccess(opts: NotesHistoryFeatureOptions): AccessRule {
 export function createNotesHistoryFeature(
   opts: NotesHistoryFeatureOptions = {},
 ): typeof notesHistoryFeature {
-  if (opts.access === undefined && opts.roles === undefined && opts.ownership === undefined) {
+  if (
+    opts.access === undefined &&
+    opts.roles === undefined &&
+    opts.ownership === undefined &&
+    opts.parents === undefined
+  ) {
     return notesHistoryFeature;
   }
   if (hasWhereRule(opts.ownership?.write)) {
@@ -105,11 +121,23 @@ export function createNotesHistoryFeature(
         '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
         "layer (the read path, via buildOwnershipClause). Write paths that " +
         "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them: create throws at runtime, update/delete/forget/restore " +
-        "silently deny. Use a `from()` rule for ownership.write, or leave it unset.",
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.",
     );
   }
+  // A mount that accepts no parents at all can never take a note write —
+  // that's a config mistake, not a valid allowlist. Omit `parents` instead
+  // of passing an empty array.
+  if (opts.parents !== undefined && opts.parents.length === 0) {
+    throw new Error(
+      "createNotesHistoryFeature({ parents }): parents must not be an empty array — " +
+        "an empty allowlist rejects every add-note call. Omit `parents` to keep " +
+        "today's unrestricted behavior instead.",
+    );
+  }
+  const parents = opts.parents === undefined ? undefined : new Set(opts.parents);
   return defineFeature(NOTES_HISTORY_FEATURE_NAME, (r) =>
-    registerNotesHistory(r, resolveAccess(opts), opts.ownership),
+    registerNotesHistory(r, resolveAccess(opts), opts.ownership, parents),
   );
 }

package/src/notes-history/handlers/add-note.write.ts

@@ -1,9 +1,11 @@
 import { fetchOne, runInSavepointIfSupported } from "@cosmicdrift/kumiko-framework/bun-db";
 import type { AccessRule, WriteHandlerDef } from "@cosmicdrift/kumiko-framework/engine";
+import { NotFoundError, writeFailure } from "@cosmicdrift/kumiko-framework/errors";
 import { decryptStoredPii } from "../../shared";
 import { userTable } from "../../user";
 import { DEFAULT_NOTES_HISTORY_ACCESS } from "../constants";
 import { noteEntryExecutor } from "../executor";
+import { parentRowIsVisible } from "../parent-visibility";
 import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 
 // add-note — appends a note-entry to (entityType, entityId). authorId is
@@ -11,8 +13,16 @@ import { type AddNotePayload, addNotePayloadSchema } from "../schemas";
 // (event.user.id), so a note can't be authored as someone else. No update or
 // delete counterpart is registered — see entity.ts for why append-only is
 // deliberate.
+//
+// entityType/entityId are never trusted client input: entityType must name a
+// registered entity, and the row must be visible to the caller through that
+// entity's own read path (tenant scope plus its `access.read` ownership) —
+// see parent-visibility.ts. `parents`, when set, is an ADDITIONAL allowlist
+// narrowing which registered entities may be a note's parent at all; it is
+// not what turns the check on.
 export function createAddNoteHandler(
   access: AccessRule = DEFAULT_NOTES_HISTORY_ACCESS,
+  parents?: ReadonlySet<string>,
 ): WriteHandlerDef {
   return {
     name: "add-note",
@@ -23,6 +33,23 @@ export function createAddNoteHandler(
     handler: async (event, ctx) => {
       const payload = event.payload as AddNotePayload; // @cast-boundary engine-payload
 
+      // NotFoundError, not an access-denied error, so the response doesn't
+      // double as an existence oracle — same policy as executor.detail,
+      // which never distinguishes "no access" from "doesn't exist".
+      if (parents !== undefined && !parents.has(payload.entityType)) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+      const visible = await parentRowIsVisible(
+        ctx.registry,
+        payload.entityType,
+        payload.entityId,
+        event.user,
+        ctx.db,
+      );
+      if (!visible) {
+        return writeFailure(new NotFoundError(payload.entityType, payload.entityId));
+      }
+
       let authorName: string | null = null;
       try {
         // read_users is tenant-agnostic → ctx.db.raw, not the tenant-scoped ctx.db.

package/src/notes-history/parent-visibility.ts

@@ -0,0 +1,46 @@
+import type { EventStoreExecutor, TenantDb } from "@cosmicdrift/kumiko-framework/db";
+import {
+  createEntityExecutor,
+  type EntityDefinition,
+  isUuid,
+  type Registry,
+  type SessionUser,
+} from "@cosmicdrift/kumiko-framework/engine";
+
+// Keyed by definition identity, not by entity name — two test stacks can
+// register different EntityDefinitions under the same entity name.
+const executorsByEntity = new WeakMap<EntityDefinition, EventStoreExecutor>();
+
+function idShapeMatchesEntity(entity: EntityDefinition, entityId: string): boolean {
+  return entity.idType === "serial" ? /^\d+$/.test(entityId) : isUuid(entityId);
+}
+
+// Checks whether a note's proposed (entityType, entityId) parent is one the
+// caller can see via the parent entity's own read path — tenant scope plus
+// its `access.read` ownership. Used to gate add-note when a `parents`
+// allowlist is configured (see feature.ts).
+export async function parentRowIsVisible(
+  registry: Registry,
+  entityType: string,
+  entityId: string,
+  user: SessionUser,
+  db: TenantDb,
+): Promise<boolean> {
+  // Default-deny: an entityType that names no registered entity has no read
+  // path to check visibility against, so it can never be a valid parent.
+  const entity = registry.getEntity(entityType);
+  if (!entity) return false;
+
+  // A malformed id would abort the write transaction on a Postgres cast
+  // error (22P02) instead of cleanly denying — reject it before it reaches
+  // the executor.
+  if (!idShapeMatchesEntity(entity, entityId)) return false;
+
+  let executor = executorsByEntity.get(entity);
+  if (!executor) {
+    executor = createEntityExecutor(entityType, entity).executor;
+    executorsByEntity.set(entity, executor);
+  }
+
+  return (await executor.detail({ id: entityId }, user, db)) !== null;
+}

package/src/notes-history-user-data/__tests__/hooks.integration.test.ts

@@ -4,6 +4,8 @@
 // confirm it doesn't touch the row.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { asRawClient } from "@cosmicdrift/kumiko-framework/bun-db";
+import { createEntity, createTextField, defineFeature } from "@cosmicdrift/kumiko-framework/engine";
 import { createEventsTable } from "@cosmicdrift/kumiko-framework/event-store";
 import {
   createTestUser,
@@ -21,10 +23,34 @@ let stack: TestStack;
 const author = createTestUser({ id: 1, roles: ["TenantMember"] });
 const other = createTestUser({ id: 2, roles: ["TenantMember"] });
 
+// fw#2627 made add-note's parent-visibility check unconditional — entityType
+// must name a registered entity whose row is visible to the caller. This
+// fixture stands in for that parent; it deliberately has no `access` (PASS_CLAUSE)
+// so it never gates on its own, keeping this file focused on author filtering.
+const CONTACT_TABLE = "notes_user_data_test_contacts";
+const contactEntity = createEntity({
+  table: CONTACT_TABLE,
+  fields: { name: createTextField({ required: true, maxLength: 64 }) },
+});
+const contactFixtureFeature = defineFeature("notes-user-data-test-contact-fixture", (r) => {
+  r.entity("contact", contactEntity);
+});
+
+// author and other share the same tenantId (both from TestUsers.admin), so
+// one contact row is visible to both.
+const CONTACT_1 = "30000000-0000-4000-8000-000000000001";
+
 beforeAll(async () => {
-  stack = await setupTestStack({ features: [createNotesHistoryFeature()] });
+  stack = await setupTestStack({
+    features: [createNotesHistoryFeature(), contactFixtureFeature],
+  });
   await unsafeCreateEntityTable(stack.db, noteEntryEntity);
+  await unsafeCreateEntityTable(stack.db, contactEntity);
   await createEventsTable(stack.db);
+  await asRawClient(stack.db).unsafe(
+    `INSERT INTO ${CONTACT_TABLE} (id, tenant_id, name) VALUES ($1, $2, $3)`,
+    [CONTACT_1, author.tenantId, "Contact 1"],
+  );
 });
 
 afterAll(async () => {
@@ -35,12 +61,12 @@ describe("noteEntryExportHook", () => {
   test("includes only the requesting user's own authored notes", async () => {
     await stack.http.writeOk(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "c-1", body: "by author" },
+      { entityType: "contact", entityId: CONTACT_1, body: "by author" },
       author,
     );
     await stack.http.writeOk(
       NotesHistoryHandlers.addNote,
-      { entityType: "contact", entityId: "c-1", body: "by other" },
+      { entityType: "contact", entityId: CONTACT_1, body: "by other" },
       other,
     );
 

package/src/shared/assert-erased.ts

@@ -0,0 +1,15 @@
+import type { WriteResult } from "@cosmicdrift/kumiko-framework/engine";
+
+// GDPR-forget hooks used to `await crud.forget(...)` and drop the result —
+// a silent ownership_denied (or any other failure) meant the row was never
+// actually erased, with nothing surfacing the miss. Callers must assert.
+export function assertErased(result: WriteResult<unknown>, entityName: string, id: string): void {
+  // skip: the happy path — the assertion below only concerns failures.
+  if (result.isSuccess) return;
+  // skip: erasure is idempotent — a row that is already gone (e.g. a parallel
+  // forget sweep) satisfies the erase request just as well as one this call removed.
+  if (result.error.code === "not_found") return;
+  throw new Error(
+    `[user-data-rights] failed to erase ${entityName}/${id}: ${result.error.code} — ${result.error.message}`,
+  );
+}

package/src/shared/has-where-rule.ts

@@ -1,13 +1,10 @@
 import type { OwnershipMap } from "@cosmicdrift/kumiko-framework/engine";
 
-// `where`-rules are read-path only (buildOwnershipClause). On the write path
-// userCanWriteFieldRow silently skips them (fail-closed deny), but
-// userCanCreateFieldRow does NOT skip them — it runs matchesRule(), which
-// throws for `kind: "where"` (no in-memory evaluator for raw SQL). An
-// ownership.write map with a where-rule boots fine (the boot-validator has no
-// where-specific handling either) and only blows up the first time a create
-// hits it. Feature factories that accept an `ownership` option must reject
-// this shape at build time instead of shipping the landmine.
+// `where`-rules are read-path only (buildOwnershipClause). The write path
+// decides in memory against the concrete row, so a where-rule there can only
+// ever deny — boot validation rejects the shape (fw#2626). Feature factories
+// that accept an `ownership` option reject it earlier, at build time, so the
+// author gets the option name in the message instead of an entity scope.
 export function hasWhereRule(map: OwnershipMap | undefined): boolean {
   if (!map) return false;
   return Object.values(map).some((rule) => rule !== "all" && rule.kind === "where");

package/src/shared/index.ts

@@ -1,3 +1,4 @@
+export { assertErased } from "./assert-erased";
 export {
   type ChunkedMigrationOptions,
   type ChunkedMigrationResult,

package/src/tags/__tests__/tags-ownership.test.ts

@@ -1,15 +1,14 @@
-// H.2 boot guard — mirrors notes-history-ownership.integration.test.ts's
-// guard test. A where-rule in ownership.write boots fine (the boot-validator
-// has no where-specific handling) and only blows up the first time
-// assign-tag's create() hits it (userCanCreateFieldRow throws on
-// `kind: "where"`, unlike update/delete/forget which silently deny). No DB
-// needed — the guard fires at feature-construction time.
+// H.2 build-time guard — mirrors notes-history-ownership.integration.test.ts's
+// guard test. A where-rule in ownership.write can only ever deny (the write
+// path has no SQL layer); framework boot validation rejects it too, this guard
+// just fires earlier with the option name in the message. No DB needed — it
+// runs at feature-construction time.
 
 import { describe, expect, test } from "bun:test";
 import { createTagsFeature } from "../feature";
 
 describe("tags — boot guard rejects a where-rule in ownership.write", () => {
-  test("createTagsFeature throws instead of shipping a create()-time landmine", () => {
+  test("createTagsFeature throws instead of shipping a deny-only ownership map", () => {
     expect(() =>
       createTagsFeature({
         ownership: {

package/src/tags/feature.ts

@@ -187,8 +187,9 @@ export function createTagsFeature(opts: TagsFeatureOptions = {}): typeof tagsFea
         '`{ kind: "where" }` rule — where-rules are evaluated only at the SQL ' +
         "layer (the read path, via buildOwnershipClause). Write paths that " +
         "consult access.write (userCanCreateFieldRow/userCanWriteFieldRow) can't " +
-        "evaluate them: create throws at runtime, update/delete/forget/restore " +
-        "silently deny. Use a `from()` rule for ownership.write, or leave it unset.",
+        "evaluate them, so such a rule can only ever deny — boot validation " +
+        "rejects it too (fw#2626). Use a `from()` rule for ownership.write, or " +
+        "leave it unset.",
     );
   }
   const access = resolveAccess(opts);

package/src/user-data-rights-defaults/hooks/config-value.userdata-hook.ts

@@ -6,6 +6,7 @@ import {
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { configValueEntity, configValuesTable } from "../../config";
+import { assertErased } from "../../shared";
 import { featureMounted } from "./feature-mounted";
 
 // userData-Hooks for config's USER-scoped rows (userId set). Tenant-/system-
@@ -46,6 +47,6 @@ export const configValueDeleteHook: UserDataDeleteHook = async (ctx) => {
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    await crud.forget({ id }, systemUser, tdb);
+    assertErased(await crud.forget({ id }, systemUser, tdb), "config-value", id);
   }
 };

package/src/user-data-rights-defaults/hooks/file-ref.userdata-hook.ts

@@ -18,6 +18,7 @@ import {
   fileRefEntity,
   fileRefsTable,
 } from "@cosmicdrift/kumiko-framework/files";
+import { assertErased } from "../../shared";
 
 // Forget writes go through the executor (events), not deleteMany/updateMany:
 // a projection rebuild replays the events, so the erasure survives. Eventless
@@ -258,6 +259,6 @@ export const fileRefDeleteHook: UserDataDeleteHook = async (ctx, strategy) => {
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    await crud.forget({ id }, systemUser, tdb);
+    assertErased(await crud.forget({ id }, systemUser, tdb), "fileRef", id);
   }
 };

package/src/user-data-rights-defaults/hooks/notification-preference.userdata-hook.ts

@@ -6,6 +6,7 @@ import {
   type UserDataExportHook,
 } from "@cosmicdrift/kumiko-framework/engine";
 import { notificationPreferenceEntity, notificationPreferencesTable } from "../../delivery";
+import { assertErased } from "../../shared";
 import { featureMounted } from "./feature-mounted";
 
 // userData-Hooks for delivery's notification-preference rows. Event-sourced
@@ -49,6 +50,6 @@ export const notificationPreferenceDeleteHook: UserDataDeleteHook = async (ctx)
   for (const row of rows) {
     const id = row["id"]; // @cast-boundary db-row
     if (typeof id !== "string") continue;
-    await crud.forget({ id }, systemUser, tdb);
+    assertErased(await crud.forget({ id }, systemUser, tdb), "notification-preference", id);
   }
 };

package/src/user-data-rights-defaults/hooks/tenant-invitation.userdata-hook.ts

@@ -6,7 +6,7 @@ import {
   type UserDataExportHook,
   type UserDataHookCtx,
 } from "@cosmicdrift/kumiko-framework/engine";
-import { decryptStoredPii, mapWithConcurrency } from "../../shared";
+import { assertErased, decryptStoredPii, mapWithConcurrency } from "../../shared";
 import { tenantInvitationEntity, tenantInvitationsTable } from "../../tenant";
 import { userTable } from "../../user";
 import { featureMounted } from "./feature-mounted";
@@ -100,7 +100,7 @@ export const tenantInvitationDeleteHook: UserDataDeleteHook = async (ctx, strate
       const id = row["id"]; // @cast-boundary db-row
       if (typeof id !== "string") continue;
       if (strategy === "delete") {
-        await crud.forget({ id }, systemUser, tdb);
+        assertErased(await crud.forget({ id }, systemUser, tdb), "tenant-invitation", id);
       } else {
         // Row-id in the pseudonym keeps the (tenantId, email) unique index
         // collision-free when a user has invitations in several states.