@cosmicdrift/kumiko-framework 0.173.0 → 0.174.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.173.0",
+  "version": "0.174.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -182,7 +182,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.173.0",
+    "@cosmicdrift/kumiko-types": "0.174.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.12.27",
@@ -198,7 +198,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.173.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.174.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/schema-cli.integration.test.ts

@@ -200,6 +200,24 @@ CREATE TABLE IF NOT EXISTS "read_widgets_v2" ("id" uuid PRIMARY KEY);
     expect(cap.err.join("\n")).toContain("read_widgets");
   });
 
+  test("migration file missing a column its snapshot entry claims → column-drift hint, not unexpected-table", async () => {
+    writeSchemaFile(appCwd, "read_widgets", "note");
+    await runSchemaCli(["generate", "init"], appCwd, captureOut().out);
+    writeFileSync(
+      join(appCwd, "kumiko/migrations/0001_init.sql"),
+      `-- oops: hand-edited to drop the "note" column the snapshot still claims
+CREATE TABLE IF NOT EXISTS "read_widgets" ("id" uuid PRIMARY KEY);
+`,
+    );
+    const cap = captureOut();
+    const code = await runSchemaCli(["validate"], appCwd, cap.out);
+    expect(code).toBe(1);
+    const err = cap.err.join("\n");
+    expect(err).toContain("missing columns: note");
+    expect(err).toContain("Fix (missing-table/column-drift)");
+    expect(err).not.toContain("Fix (unexpected-table)");
+  });
+
   test("migration creates a table with no snapshot entry → unexpected-table hint points at r.storeTable, not hand-fix", async () => {
     writeSchemaFile(appCwd, "read_widgets");
     await runSchemaCli(["generate", "init"], appCwd, captureOut().out);

package/src/api/__tests__/request-id-middleware.test.ts

@@ -121,3 +121,76 @@ describe("requestIdMiddleware — ip + userAgent capture (603/2)", () => {
     expect(captured).toBeUndefined();
   });
 });
+
+describe("requestIdMiddleware — client-supplied id sanitization (input-validation)", () => {
+  test("oversized X-Request-ID is rejected, a fresh id is generated instead", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const junk = "x".repeat(5000);
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": junk },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBeDefined();
+    expect(captured).not.toBe(junk);
+    expect(captured?.length).toBeLessThan(128);
+  });
+
+  test("disallowed-character X-Correlation-ID falls back to the (sanitized) requestId", async () => {
+    let captured: { requestId: string | undefined; correlationId: string | undefined } = {
+      requestId: undefined,
+      correlationId: undefined,
+    };
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      const ctx = requestContext.get();
+      captured = { requestId: ctx?.requestId, correlationId: ctx?.correlationId };
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "req-1", "X-Correlation-ID": "corr injected; drop table" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured.requestId).toBe("req-1");
+    expect(captured.correlationId).toBe("req-1");
+  });
+
+  test("a well-formed client id is preserved", async () => {
+    let captured: string | undefined;
+
+    const app = new Hono();
+    app.use("/probe", requestIdMiddleware());
+    app.get("/probe", (c) => {
+      captured = requestContext.get()?.requestId;
+      return c.text("ok");
+    });
+
+    const res = await app.request(
+      new Request("http://test.local/probe", {
+        method: "GET",
+        headers: { "X-Request-ID": "trace-abc123.def" },
+      }),
+    );
+
+    expect(res.status).toBe(200);
+    expect(captured).toBe("trace-abc123.def");
+  });
+});

package/src/api/request-id-middleware.ts

@@ -4,6 +4,16 @@ import { requestContext } from "./request-context";
 const REQUEST_ID_HEADER = "X-Request-ID";
 const CORRELATION_ID_HEADER = "X-Correlation-ID";
 
+// requestId/correlationId flow unvalidated into append-only event-store
+// metadata (e.g. sessions:revoke-all-for-user) — cap shape at the trust
+// boundary so a client can't smuggle an oversized/control-char payload into
+// permanent, replayed, DSGVO-exported storage via a client-set header.
+const SAFE_ID_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+
+function sanitizeClientId(value: string | undefined): string | undefined {
+  return value !== undefined && SAFE_ID_RE.test(value) ? value : undefined;
+}
+
 /**
  * Assigns a requestId + correlationId to every request and wraps execution
  * in AsyncLocalStorage. Runs BEFORE auth — both ids are available even for
@@ -15,8 +25,9 @@ const CORRELATION_ID_HEADER = "X-Correlation-ID";
  */
 export function requestIdMiddleware() {
   return async (c: Context, next: Next) => {
-    const requestId = c.req.header(REQUEST_ID_HEADER) ?? requestContext.generateId();
-    const correlationId = c.req.header(CORRELATION_ID_HEADER) ?? requestId;
+    const requestId =
+      sanitizeClientId(c.req.header(REQUEST_ID_HEADER)) ?? requestContext.generateId();
+    const correlationId = sanitizeClientId(c.req.header(CORRELATION_ID_HEADER)) ?? requestId;
     c.header(REQUEST_ID_HEADER, requestId);
     c.header(CORRELATION_ID_HEADER, correlationId);
     c.set("requestId", requestId);

package/src/api/sse-broker.ts

@@ -19,15 +19,18 @@ export type SseBroker = {
   getClientCount(channel: string): number;
   getTotalClientCount(): number;
   // Separate from addClient so it doesn't count towards getClientCount.
-  // Optional: additive for external/test SseBroker impls (call sites use?.).
-  subscribeAccessInvalidation?(userId: string, onInvalidate: () => void): () => void;
-  publishAccessInvalidation?(userId: string): void;
+  // Required (fw#1601): an app-injected SseBroker (e.g. a Redis-backed
+  // multi-replica broker) that skips these silently turns the mid-stream
+  // access-teardown security control (#1561) into a no-op — a revoked
+  // session keeps receiving live SSE data with no error or log. A no-op
+  // stub is one line for a broker that genuinely doesn't need it.
+  subscribeAccessInvalidation(userId: string, onInvalidate: () => void): () => void;
+  publishAccessInvalidation(userId: string): void;
 };
 
 export function createSseBroker(): SseBroker {
-  // ponytail: in-process only — publishAccessInvalidation does not fan out via
-  // Redis. Multi-replica deployments will not revoke SSE streams on other pods
-  // (security control is single-node). Upgrade: Redis pub/sub on userAccessChannel.
+  // Cross-replica fanout lives one level up: the SSE + access-invalidation
+  // consumers (system-hooks.ts) run delivery: "per-instance" (#1718).
   const channels = new Map<string, Map<string, SseClient>>();
   const accessInvalidationListeners = new Map<string, Set<() => void>>();
 

package/src/crypto/__tests__/kms-wiring.test.ts

@@ -83,6 +83,12 @@ describe("buildPgKmsOptions", () => {
       /PLATFORM_KEK_PREVIOUS_VERSION must be set/,
     );
   });
+
+  test("rejects PLATFORM_KEK_PREVIOUS_VERSION without PLATFORM_KEK_PREVIOUS — half-set rotation must not silently drop the version", () => {
+    expect(() => buildPgKmsOptions({ ...rotationEnv, PLATFORM_KEK_PREVIOUS_VERSION: "1" })).toThrow(
+      /PLATFORM_KEK_PREVIOUS must be set/,
+    );
+  });
 });
 
 describe("resolveKmsWiring", () => {

package/src/crypto/kms-wiring.ts

@@ -83,6 +83,11 @@ export function buildPgKmsOptions(env: PgKmsRotationEnv): PgKmsAdapterOptions {
     ? parseKekVersion(env.PLATFORM_KEK_VERSION, "PLATFORM_KEK_VERSION")
     : 1;
   if (!env.PLATFORM_KEK_PREVIOUS) {
+    if (env.PLATFORM_KEK_PREVIOUS_VERSION) {
+      throw new Error(
+        "PLATFORM_KEK_PREVIOUS must be set when PLATFORM_KEK_PREVIOUS_VERSION is set.",
+      );
+    }
     return {
       databaseUrl: env.SUBJECT_KEYS_DATABASE_URL,
       platformKek: env.PLATFORM_KEK,

package/src/db/__tests__/eagerload.integration.test.ts

@@ -9,7 +9,7 @@ import {
   InMemoryKmsAdapter,
   isPiiCiphertext,
 } from "../../crypto";
-import { createEntity, createTextField } from "../../engine";
+import { createEntity, createTextField, from } from "../../engine";
 import type { EntityDefinition } from "../../engine/types";
 import { setupTestStack, type TestStack, testTenantId, unsafeCreateEntityTable } from "../../stack";
 import { createTestEnvelopeCipher, resetPiiSubjectKmsForTests, seedRows } from "../../testing";
@@ -58,13 +58,44 @@ const leadEntity = createEntity({
   fields: {
     title: createTextField({ required: true }),
     contact: { type: "reference", entity: "contact" },
+    ownedContact: { type: "reference", entity: "ownedContact" },
+    unrestrictedContact: { type: "reference", entity: "unrestrictedContact" },
   },
 });
 const contactTable = buildEntityTable("contact", contactEntity);
 
+// fw#1671: ownership-scoped ref entity — eagerload has no SessionUser to
+// evaluate access.read against, so PII/encrypted fields must be stripped
+// entirely rather than decrypted (fail closed, not a same-tenant PII leak).
+const ownedContactEntity = createEntity({
+  table: "el_owned_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+    iban: createTextField({ required: true, encrypted: true }),
+  },
+  access: { read: { admin: from("user:id", "ownerId") } },
+});
+const ownedContactTable = buildEntityTable("ownedContact", ownedContactEntity);
+
+// access.read present but every role is "all" (unrestricted) — must NOT
+// trigger the strip path, or #1667's decrypt would silently regress for
+// every entity that merely declares an access.read map without narrowing it.
+const unrestrictedContactEntity = createEntity({
+  table: "el_unrestricted_contacts",
+  fields: {
+    name: createTextField({ required: true }),
+    email: createTextField({ required: true, tenantOwned: true }),
+  },
+  access: { read: { admin: "all", member: "all" } },
+});
+const unrestrictedContactTable = buildEntityTable("unrestrictedContact", unrestrictedContactEntity);
+
 const resolve = (name: string): EntityDefinition | undefined => {
   if (name === "author") return authorEntity;
   if (name === "contact") return contactEntity;
+  if (name === "ownedContact") return ownedContactEntity;
+  if (name === "unrestrictedContact") return unrestrictedContactEntity;
   return undefined;
 };
 
@@ -83,6 +114,9 @@ const many = (r: EagerloadedRow | undefined, f: string) =>
   r?._refs?.[f] as ReadonlyArray<Record<string, unknown>> | undefined;
 
 const CX = "44444444-4444-4444-8444-444444444444";
+const OWNED = "66666666-6666-4666-8666-666666666666";
+const UNRESTRICTED = "88888888-8888-4888-8888-888888888888";
+const BROKEN = "77777777-7777-4777-8777-777777777777";
 const TEST_KEY = Buffer.from("a]bJm#kP9xQ2@wN!vL$hR5yT8eU0iO3f").toString("base64");
 const cipher = createTestEnvelopeCipher(TEST_KEY);
 const kms = new InMemoryKmsAdapter();
@@ -94,6 +128,8 @@ beforeAll(async () => {
   stack = await setupTestStack({ features: [] });
   await unsafeCreateEntityTable(stack.db, authorEntity);
   await unsafeCreateEntityTable(stack.db, contactEntity);
+  await unsafeCreateEntityTable(stack.db, ownedContactEntity);
+  await unsafeCreateEntityTable(stack.db, unrestrictedContactEntity);
   dbA = createTenantDb(stack.db, tenantA, "tenant");
 
   await seedRows(stack.db, authorTable, [
@@ -120,6 +156,44 @@ beforeAll(async () => {
     cipher,
   );
   await seedRows(stack.db, contactTable, [encrypted]);
+
+  const plainOwned = {
+    id: OWNED,
+    tenantId: tenantA,
+    name: "Owned Grace",
+    email: "owned-grace@acme.test",
+    iban: "DE99999",
+  };
+  const ownedPiiEncrypted = await encryptPiiFieldValues(
+    plainOwned,
+    ownedContactEntity,
+    ["email"],
+    kms,
+    { requestId: "test" },
+  );
+  const ownedEncrypted = await encryptEntityFieldValues(
+    ownedPiiEncrypted,
+    collectEncryptedFieldNames(ownedContactEntity),
+    cipher,
+  );
+  await seedRows(stack.db, ownedContactTable, [ownedEncrypted]);
+
+  // Legacy/backfilled row: iban never went through encryptEntityFieldValues,
+  // so decryptEntityFieldValues throws on it (fw#1671 error-propagation) —
+  // a single row like this must not 500 the whole eagerload lookup.
+  await seedRows(stack.db, contactTable, [
+    {
+      id: BROKEN,
+      tenantId: tenantA,
+      name: "Broken",
+      email: "broken@acme.test",
+      iban: "not-an-envelope",
+    },
+  ]);
+
+  await seedRows(stack.db, unrestrictedContactTable, [
+    { id: UNRESTRICTED, tenantId: tenantA, name: "Unrestricted", email: "unrestricted@acme.test" },
+  ]);
 });
 
 afterAll(async () => {
@@ -237,4 +311,48 @@ describe("enrichWithReferences", () => {
     expect(contact?.["iban"]).toBe("DE12345");
     expect(isPiiCiphertext(contact?.["email"])).toBe(false);
   });
+
+  test('fw#1671: access.read map where every rule is "all" (unrestricted) does NOT trigger the strip path', async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", unrestrictedContact: UNRESTRICTED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const unrestricted = single(row, "unrestrictedContact");
+
+    expect(unrestricted).toBeDefined();
+    expect(unrestricted?.["name"]).toBe("Unrestricted");
+    expect(unrestricted?.["email"]).toBe("unrestricted@acme.test");
+  });
+
+  test("fw#1671: ownership-scoped ref entity — PII/encrypted fields are stripped, not decrypted or leaked as ciphertext", async () => {
+    const [row] = (await enrichWithReferences(
+      [{ id: "l1", ownedContact: OWNED }],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+    const owned = single(row, "ownedContact");
+
+    expect(owned).toBeDefined();
+    expect(owned?.["name"]).toBe("Owned Grace");
+    expect(owned?.["email"]).toBeUndefined();
+    expect(owned?.["iban"]).toBeUndefined();
+  });
+
+  test("fw#1671: a row with a broken envelope is dropped, a sibling row's good ref still resolves in the same batch", async () => {
+    const [goodRow, brokenRow] = (await enrichWithReferences(
+      [
+        { id: "l1", contact: CX },
+        { id: "l2", contact: BROKEN },
+      ],
+      leadEntity,
+      resolve,
+      dbA,
+    )) as EagerloadedRow[];
+
+    expect(single(goodRow, "contact")?.["email"]).toBe("grace@acme.test");
+    expect(single(brokenRow, "contact")).toBeUndefined();
+  });
 });

package/src/db/__tests__/event-store-executor-write-verbs.integration.test.ts

@@ -245,6 +245,33 @@ describe("event-store-executor write-verbs — field-level ownership_denied", ()
     if (result.isSuccess) return;
     expect((result.error.details as { reason?: string }).reason).toBe("ownership_denied");
   });
+
+  // fw#1685: a preSave hook that derives a field the user never submitted
+  // must not have that field field-ownership-checked against the user —
+  // only what the user actually wrote in `payload.changes` is checked.
+  test("create: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const result = await crud.create({ authorId: TestUsers.driver.id }, nonAdmin, tdb, {
+      preSave: async (changes) => ({ ...changes, note: "hook-derived" }),
+    });
+    expect(result.isSuccess).toBe(true);
+  });
+
+  test("update: preSave-derived `note` (not submitted by the user) does not trigger ownership_denied", async () => {
+    const created = await crud.create(
+      { authorId: TestUsers.driver.id, note: "original" },
+      admin,
+      tdb,
+    );
+    if (!created.isSuccess) throw new Error("setup failed");
+
+    const result = await crud.update(
+      { id: created.data.id, version: 1, changes: {} },
+      nonAdmin,
+      tdb,
+      { preSave: async (changes) => ({ ...changes, note: "hook-derived" }) },
+    );
+    expect(result.isSuccess).toBe(true);
+  });
 });
 
 // =============================================================================

package/src/db/__tests__/migrate-runner.test.ts

@@ -38,6 +38,10 @@ describe("splitSqlStatements", () => {
     expect(splitSqlStatements("SELECT a/*x*/AS b;")).toEqual(["SELECT a AS b;"]);
   });
 
+  test("nested block comment also leaves a space at outer depth (#1599)", () => {
+    expect(splitSqlStatements("SELECT a/*x/*y*/z*/AS b;")).toEqual(["SELECT a AS b;"]);
+  });
+
   test("nested block comments close only at matching depth (Postgres)", () => {
     expect(splitSqlStatements("/* a /* b */ c */ SELECT 1;")).toEqual(["SELECT 1;"]);
   });

package/src/db/eagerload.ts

@@ -95,25 +95,80 @@ export function collectReferenceFields(entity: EntityDefinition): readonly Refer
 // event-store-executor-context's decryptForRead ordering: PII is the outer
 // layer, peel it before the envelope-encrypted fields, or the envelope
 // cipher chokes on a still-PII-wrapped string.
+//
+// Ownership guard (fw#1671): the ref lookup below is tenant-scoped only, not
+// ownership-scoped — this function has no SessionUser to evaluate
+// refEntity.access.read against. If the ref entity declares row-level
+// ownership at all, decrypting here would hand a same-tenant User A the
+// plaintext PII of a User B row they merely reference (e.g. a freely-settable
+// reference UUID), even though refEntity.access.read says "own" — the caller
+// never gets to run that ownership check. Fail closed: strip PII/encrypted
+// fields entirely instead of decrypting (or leaking ciphertext) when that
+// guarantee can't be evaluated here.
+function hasOwnershipScopedRead(refEntity: EntityDefinition): boolean {
+  const readMap = refEntity.access?.read;
+  if (readMap === undefined) return false;
+  // "all" means that role sees every row unrestricted — a map where every
+  // rule is "all" carries no ownership restriction at all, so stripping
+  // here would just silently drop PII/encrypted fields #1667 wants
+  // decrypted, for no security benefit.
+  return Object.values(readMap).some((rule) => rule !== "all");
+}
+
 async function decryptReferencedRow(
   row: Record<string, unknown>,
   refEntity: EntityDefinition,
 ): Promise<Record<string, unknown>> {
-  let out = row;
   const piiFields = collectPiiSubjectFields(refEntity);
+  const encryptedFields = collectEncryptedFieldNames(refEntity);
+  if (hasOwnershipScopedRead(refEntity)) {
+    if (piiFields.length === 0 && encryptedFields.size === 0) return row;
+    const out = { ...row };
+    for (const field of piiFields) delete out[field];
+    for (const field of encryptedFields) delete out[field];
+    return out;
+  }
+
+  let out = row;
   const kms = configuredPiiSubjectKms();
   if (piiFields.length > 0 && kms) {
     out = await decryptPiiFieldValues(out, piiFields, kms, {
       requestId: requestContext.get()?.requestId ?? "eagerload",
     });
   }
-  const encryptedFields = collectEncryptedFieldNames(refEntity);
   if (encryptedFields.size > 0) {
     out = await decryptEntityFieldValues(out, encryptedFields, resolveEntityFieldEncryption());
   }
   return out;
 }
 
+// Per-row, not Promise.all: a single legacy/backfilled row without a valid
+// envelope (decryptEntityFieldValues throws hard on malformed ciphertext)
+// must not 500 the whole list request — the main rows the caller asked for
+// are unrelated to this one broken reference. Drop just that row from the
+// map; the renderer falls back to the raw UUID.
+async function buildRefLookupMap(
+  rawRefRows: ReadonlyArray<Record<string, unknown>>,
+  refEntity: EntityDefinition,
+  refEntityName: string,
+): Promise<Map<string, Record<string, unknown>>> {
+  const map = new Map<string, Record<string, unknown>>();
+  for (const r of rawRefRows) {
+    let decrypted: Record<string, unknown>;
+    try {
+      decrypted = await decryptReferencedRow(r, refEntity);
+    } catch (e) {
+      console.warn(
+        `[eagerload] failed to decrypt referenced row entity=${refEntityName} id=${String(r["id"])}: ${e instanceof Error ? e.message : String(e)}`,
+      );
+      continue;
+    }
+    const id = decrypted["id"];
+    if (typeof id === "string") map.set(id, decrypted);
+  }
+  return map;
+}
+
 /** Eagerload für eine Liste von Rows. Mutiert nicht — gibt eine
  *  flache Kopie der Rows mit hinzugefügtem `_refs`-Property zurück. */
 export async function enrichWithReferences(
@@ -159,12 +214,7 @@ export async function enrichWithReferences(
       const rawRefRows = (await selectMany(db, refTable, { id: idArray })) as Array<
         Record<string, unknown>
       >;
-      const refRows = await Promise.all(rawRefRows.map((r) => decryptReferencedRow(r, refEntity)));
-      const map = new Map<string, Record<string, unknown>>();
-      for (const r of refRows) {
-        const id = r["id"];
-        if (typeof id === "string") map.set(id, r);
-      }
+      const map = await buildRefLookupMap(rawRefRows, refEntity, rf.refEntityName);
       return { fieldName: rf.fieldName, multiple: rf.multiple, map };
     }),
   );

package/src/db/event-store-executor-write.ts

@@ -48,6 +48,40 @@ function isUnchangedValue(a: unknown, b: unknown): boolean {
   return JSON.stringify(a) === JSON.stringify(b);
 }
 
+type PreSaveFn = (
+  changes: Record<string, unknown>,
+  previous: Record<string, unknown>,
+  isNew: boolean,
+) => Promise<Record<string, unknown>>;
+
+// preSave runs before ownership checks: authorization must evaluate the row
+// as it will actually be persisted, including hook-derived fields
+// (kumiko-framework#1672). A throwing hook is an app-author bug (bad
+// business rule, not a framework fault) — map it to a clean writeFailure
+// instead of letting it propagate as an internal_error 500.
+async function runPreSave(
+  preSave: PreSaveFn | undefined,
+  changes: Record<string, unknown>,
+  previous: Record<string, unknown>,
+  isNew: boolean,
+  entityName: string,
+  action: "create" | "update",
+): Promise<{ readonly data: DbRow } | { readonly failure: ReturnType<typeof writeFailure> }> {
+  if (!preSave) return { data: changes as DbRow };
+  try {
+    return { data: (await preSave(changes, previous, isNew)) as DbRow };
+  } catch (e) {
+    return {
+      failure: writeFailure(
+        new UnprocessableError("presave_hook_failed", {
+          i18nKey: "errors.presaveHookFailed",
+          details: { entityName, action, message: e instanceof Error ? e.message : String(e) },
+        }),
+      ),
+    };
+  }
+}
+
 export function createWriteVerbs(
   ctx: ExecutorContext,
 ): Pick<EventStoreExecutor, "create" | "update" | "delete" | "forget" | "restore"> {
@@ -74,12 +108,16 @@ export function createWriteVerbs(
       const explicitId = typeof payload["id"] === "string" ? (payload["id"] as string) : undefined; // @cast-boundary engine-payload
       const aggregateId = explicitId ?? generateId();
       const { id: _id, ...payloadWithoutId } = payload;
-      // preSave runs before ownership checks: authorization must evaluate the
-      // row as it will actually be persisted, including hook-derived fields
-      // (kumiko-framework#1672).
-      const data = options?.preSave
-        ? await options.preSave(applyDefaults(payloadWithoutId), {}, true)
-        : applyDefaults(payloadWithoutId);
+      const preSaveResult = await runPreSave(
+        options?.preSave,
+        applyDefaults(payloadWithoutId),
+        {},
+        true,
+        entityName,
+        "create",
+      );
+      if ("failure" in preSaveResult) return preSaveResult.failure;
+      const data = preSaveResult.data;
 
       // H.2 — entity-level write-ownership on create. No oldRow exists, so
       // only the new row is checked. No Straddle concern for creates.
@@ -95,7 +133,20 @@ export function createWriteVerbs(
       // Field-level write-ownership on create — mirror of entity-level but
       // per declared field. Role-level was already checked by the
       // dispatcher; here we enforce ownership-rules against the new row.
-      const fieldDeniedCreate = checkWriteFieldOwnership(entity, data, user);
+      //
+      // Which fields get checked is scoped to the pre-hook payload (fw#1685)
+      // — a hook-derived field the user never submitted must not be
+      // field-ownership-checked against the user. The rule for a checked
+      // field is still evaluated against the full post-hook row (`data`) —
+      // an ownership rule can reference a column only a hook populates
+      // (kumiko-framework#1672).
+      const fieldDeniedCreate = checkWriteFieldOwnership(
+        entity,
+        applyDefaults(payloadWithoutId),
+        user,
+        undefined,
+        data,
+      );
       if (fieldDeniedCreate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {
@@ -226,12 +277,16 @@ export function createWriteVerbs(
       const previous = await loadById(payload.id, db);
       if (!previous) return writeFailure(new NotFoundError(entityName, payload.id));
 
-      // preSave runs before ownership checks: authorization must evaluate the
-      // row as it will actually be persisted, including hook-derived fields
-      // (kumiko-framework#1672).
-      const changes = updateOptions?.preSave
-        ? await updateOptions.preSave(payload.changes, previous, false)
-        : payload.changes;
+      const preSaveResult = await runPreSave(
+        updateOptions?.preSave,
+        payload.changes,
+        previous,
+        false,
+        entityName,
+        "update",
+      );
+      if ("failure" in preSaveResult) return preSaveResult.failure;
+      const changes = preSaveResult.data;
 
       // H.2 — entity-level write-ownership on update. Load old row (already
       // done above), build post-change row via shallow merge. Straddle-safe
@@ -259,7 +314,24 @@ export function createWriteVerbs(
       // `previous`, we can run the ownership rules per field against both
       // sides and reject individual fields the user isn't entitled to
       // touch on this specific row.
-      const fieldDeniedUpdate = checkWriteFieldOwnership(entity, changes, user, previous);
+      //
+      // Which fields get checked is scoped to `payload.changes` (the user's
+      // actual submission), NOT `changes` (post-preSave-hook data, fw#1685)
+      // — a hook-derived field the user never submitted (e.g. a system hook
+      // setting `assignedTo`) has no business being field-ownership-checked
+      // against the *user*, and doing so rejects writes the user is fully
+      // entitled to make. The dispatcher's role-gate (checkWriteFieldAccess)
+      // already runs on this same pre-hook payload for consistency. The rule
+      // for a checked field is still evaluated against the full post-hook
+      // row (`changes` merged onto `previous`) — an ownership rule can
+      // reference a column only a hook populates (kumiko-framework#1672).
+      const fieldDeniedUpdate = checkWriteFieldOwnership(
+        entity,
+        payload.changes,
+        user,
+        previous,
+        changes,
+      );
       if (fieldDeniedUpdate) {
         return writeFailure(
           new UnprocessableError("ownership_denied", {