@cosmicdrift/kumiko-framework 0.220.1 → 0.221.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.220.1",
+  "version": "0.221.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -194,7 +194,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-types": "0.220.1",
+    "@cosmicdrift/kumiko-types": "0.221.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -210,7 +210,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.220.1",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.221.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/__tests__/store-table.integration.test.ts

@@ -4,6 +4,7 @@
 // kumiko-platform/docs/plans/architecture/table-ddl-guard.md (Stufe 3).
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { Temporal } from "temporal-polyfill";
 import { defineUnmanagedTable } from "../db/entity-table-meta";
 import { asRawClient, insertOne, selectMany } from "../db/query";
 import { defineFeature } from "../engine";
@@ -49,7 +50,7 @@ describe("r.storeTable — DB roundtrip via setupTestStack", () => {
 
     expect(rows).toHaveLength(1);
     expect(rows[0]?.payload).toBe(payload);
-    expect(String(rows[0]?.receivedAt)).toMatch(/^\d{4}-\d{2}-\d{2}T/);
+    expect(rows[0]?.receivedAt).toBeInstanceOf(Temporal.Instant);
   });
 
   test("registry exposes the store table with its reason and featureName", () => {

package/src/__tests__/upgrade-cli.test.ts

@@ -243,35 +243,46 @@ const LEGACY_IMPORT_FIXTURE = [
   "",
 ].join("\n");
 
+// A dedicated fixture — not the real repo's scripts/codemod/ — so the
+// non-.ts and doesn't-exist cases below are isolated from whatever files
+// happen to exist in the real tree. README.md is created for real so a
+// non-.ts rejection is provably caused by the extension check, not by the
+// existsSync guard rejecting a file that never existed.
+function makeCodemodScriptsFixture(): string {
+  return tmp({ "scripts/codemod/README.md": "# Codemods\n" });
+}
+
 describe("resolveCodemodScript", () => {
   test("resolves a real script under scripts/codemod/", () => {
-    const resolved = resolveCodemodScript(REAL_FRAMEWORK_SRC, REAL_CODEMOD);
+    const resolved = resolveCodemodScript(REAL_REPO_ROOT, REAL_CODEMOD);
     expect(resolved).toBe(join(REAL_FRAMEWORK_SRC, REAL_CODEMOD));
   });
 
   test("rejects an absolute path", () => {
-    expect(resolveCodemodScript(REAL_FRAMEWORK_SRC, "/etc/passwd.ts")).toBeNull();
+    expect(resolveCodemodScript(REAL_REPO_ROOT, "/etc/passwd.ts")).toBeNull();
   });
 
   test("rejects path traversal that escapes scripts/codemod/", () => {
     expect(
-      resolveCodemodScript(REAL_FRAMEWORK_SRC, "scripts/codemod/../../package.json.ts"),
+      resolveCodemodScript(REAL_REPO_ROOT, "scripts/codemod/../../package.json.ts"),
     ).toBeNull();
-    expect(resolveCodemodScript(REAL_FRAMEWORK_SRC, "../outside/x.ts")).toBeNull();
+    expect(resolveCodemodScript(REAL_REPO_ROOT, "../outside/x.ts")).toBeNull();
   });
 
   test("rejects a non-.ts file", () => {
-    expect(resolveCodemodScript(REAL_FRAMEWORK_SRC, "scripts/codemod/README.md")).toBeNull();
+    const root = makeCodemodScriptsFixture();
+
+    expect(resolveCodemodScript(root, "scripts/codemod/README.md")).toBeNull();
   });
 
   test("rejects a script that doesn't exist", () => {
-    expect(
-      resolveCodemodScript(REAL_FRAMEWORK_SRC, "scripts/codemod/does-not-exist.ts"),
-    ).toBeNull();
+    const root = makeCodemodScriptsFixture();
+
+    expect(resolveCodemodScript(root, "scripts/codemod/does-not-exist.ts")).toBeNull();
   });
 
   test("rejects an undefined codemod field", () => {
-    expect(resolveCodemodScript(REAL_FRAMEWORK_SRC, undefined)).toBeNull();
+    expect(resolveCodemodScript(REAL_REPO_ROOT, undefined)).toBeNull();
   });
 
   test("findCodemodScriptsRoot resolves through a hoisted node_modules symlink", () => {
@@ -283,7 +294,7 @@ describe("resolveCodemodScript", () => {
     const root = findCodemodScriptsRoot(join(cwd, "apps/web"));
     expect(root).toBe(join(nmPkgDir, "src"));
 
-    const resolved = resolveCodemodScript(root!, REAL_CODEMOD);
+    const resolved = resolveCodemodScript(join(cwd, "apps/web"), REAL_CODEMOD);
     expect(resolved).toBe(join(nmPkgDir, "src", REAL_CODEMOD));
   });
 });
@@ -365,7 +376,27 @@ describe("upgrade command — --apply", () => {
     expect(existsSync(join(cwd, ".kumiko/upgrade-state.json"))).toBe(false);
   });
 
-  test("breaking changes without a codemod field are reported as manual, no marker written", async () => {
+  test("stops and writes no marker when the codemod script exits non-zero", async () => {
+    const cwd = tmp({
+      "packages/framework/src/changes.json": breakingEntryWithCodemod(
+        "scripts/codemod/always-fail.ts",
+      ),
+    });
+    const failingRepoRoot = tmp({
+      "packages/framework/src/scripts/codemod/always-fail.ts": "process.exit(1);\n",
+    });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(["--from", "0.165.0", "--apply"], cwd, spy.out, {
+      repoRoot: failingRepoRoot,
+    });
+
+    expect(exit).toBe(1);
+    expect(spy.errs.join("\n")).toContain("scripts/codemod/always-fail.ts failed");
+    expect(existsSync(join(cwd, ".kumiko/upgrade-state.json"))).toBe(false);
+  });
+
+  test("breaking changes without a codemod field are reported as manual; marker still written", async () => {
     const cwd = tmp({
       "packages/framework/src/changes.json": breakingEntryWithCodemod(undefined),
     });
@@ -377,7 +408,10 @@ describe("upgrade command — --apply", () => {
 
     expect(exit).toBe(0);
     expect(spy.logs.join("\n")).toContain("no codemod, manual migration required");
-    expect(existsSync(join(cwd, ".kumiko/upgrade-state.json"))).toBe(false);
+    // Marker must be written so guard-upgrade-state is not stuck when only
+    // manuals/improvements remain (fw#2299 / #2308). Manuals stay pending via
+    // markerVersionForPending not advancing onto them when mixed with later work.
+    expect(existsSync(join(cwd, ".kumiko/upgrade-state.json"))).toBe(true);
   });
 
   test("nothing pending: reports up to date, still bootstraps the marker", async () => {
@@ -401,6 +435,41 @@ describe("upgrade command — --apply", () => {
     expect(typeof marker.appliedAt).toBe("string");
   });
 
+  test("nothing pending + --from: marker records installed version, not the filter", async () => {
+    const cwd = tmp({
+      "packages/framework/src/changes.json": breakingEntryWithCodemod(REAL_CODEMOD),
+      "packages/bundled-features/package.json": JSON.stringify({ version: "0.190.0" }),
+    });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(["--from", "0.999.0", "--apply"], cwd, spy.out, {
+      repoRoot: REAL_REPO_ROOT,
+    });
+
+    expect(exit).toBe(0);
+    const marker = JSON.parse(readFileSync(join(cwd, ".kumiko/upgrade-state.json"), "utf-8"));
+    expect(marker.version).toBe("0.190.0");
+  });
+
+  test("--dir that is not a directory exits 1 without writing a marker", async () => {
+    const cwd = tmp({
+      "packages/framework/src/changes.json": breakingEntryWithCodemod(REAL_CODEMOD),
+      "not-a-dir.txt": "x",
+    });
+    const spy = makeSpyOutput();
+
+    const exit = await runUpgradeCli(
+      ["--from", "0.165.0", "--apply", "--dir", join(cwd, "not-a-dir.txt")],
+      cwd,
+      spy.out,
+      { repoRoot: REAL_REPO_ROOT },
+    );
+
+    expect(exit).toBe(1);
+    expect(spy.errs.join("\n")).toContain("not a directory");
+    expect(existsSync(join(cwd, ".kumiko/upgrade-state.json"))).toBe(false);
+  });
+
   test("nothing pending + --dry-run: reports up to date, writes no marker", async () => {
     const cwd = tmp({
       "packages/framework/src/changes.json": breakingEntryWithCodemod(REAL_CODEMOD),

package/src/api/api-constants.ts

@@ -125,4 +125,14 @@ export const TENANT_COOKIE_NAME = "kumiko_tenant";
 // request-locale.ts and dispatch-shared.ts's ctx.locale resolution.
 export const LOCALE_HEADER_NAME = "X-Locale";
 
+// Internal-only signal set by buildServer's app.notFound() to mark "no
+// route matched" 404s so tryHonoFirst (server-runtime) can tell them apart
+// from a matched route's own deliberate 404 (e.g. default-deny reads) —
+// see kumiko-framework#2435. Never reaches a client: tryHonoFirst and every
+// direct app.fetch() passthrough strip it before the response leaves the
+// process, since its presence would otherwise let a caller distinguish
+// "unregistered path" from "registered path, access denied" — a leak the
+// denying routes deliberately collapse into one status code.
+export const NO_ROUTE_MATCH_HEADER_NAME = "X-Kumiko-No-Route-Match";
+
 export type Route = (typeof Routes)[keyof typeof Routes];

package/src/api/index.ts

@@ -1,5 +1,6 @@
 export type { SetTenantCookieOptions } from "./anonymous-cookie";
 export { deleteTenantCookie, setTenantCookie } from "./anonymous-cookie";
+export { LOCALE_HEADER_NAME, NO_ROUTE_MATCH_HEADER_NAME } from "./api-constants";
 export type {
   AnonymousAccessConfig,
   AnonymousAccessResolved,

package/src/api/server.ts

@@ -49,7 +49,7 @@ import {
 } from "../rate-limit";
 import type { SearchAdapter } from "../search/types";
 import { assertUnreachable, generateId } from "../utils";
-import { PUBLIC_API_PATHS } from "./api-constants";
+import { NO_ROUTE_MATCH_HEADER_NAME, PUBLIC_API_PATHS } from "./api-constants";
 import { type AnonymousAccessResolved, authMiddleware, getUser } from "./auth-middleware";
 import { type AuthRoutesConfig, createAuthRoutes } from "./auth-routes";
 import { csrfMiddleware } from "./csrf-middleware";
@@ -836,6 +836,22 @@ export function buildServer(options: ServerOptions): KumikoServer {
   // Default-Handler aus BUILD_VERSION/BUILD_TIME-env-vars.
   registerVersionRoute(app);
 
+  // Marks "no route matched this path" so tryHonoFirst (server-runtime)
+  // can tell it apart from a matched route's OWN deliberate 404 (e.g.
+  // default-deny reads like file-derivatives' public-variant route) —
+  // without this, tryHonoFirst's only signal was the status code, and a
+  // matched route answering 404 got silently rewritten to the SPA shell
+  // with status 200 (kumiko-framework#2435). Must be the LAST thing wired
+  // on `app`: this only fires when the router found no handler at all, so
+  // a route's own `c.text(..., 404)` never passes through here. A handler
+  // that calls `c.notFound()` instead of building its own Response DOES
+  // route through this same handler and stays indistinguishable from a
+  // routing miss — pre-existing Hono semantics, not something this fix
+  // changes; deliberate 404s must build their own Response.
+  // The header is an internal signal only — tryHonoFirst and every direct
+  // app.fetch() passthrough strip it before a response reaches a client.
+  app.notFound((c) => c.text("Not Found", 404, { [NO_ROUTE_MATCH_HEADER_NAME]: "1" }));
+
   return {
     app,
     jwt,

package/src/bun-db/__tests__/coerce-row-plain-date.test.ts

@@ -28,6 +28,7 @@ describe("coerceRow — date → Temporal.PlainDate", () => {
     // (2026-03-15T00:00:00.000Z) regardless of process TZ.
     const row = { published_at: new Date(Date.UTC(2026, 2, 15)) };
     const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBeInstanceOf(Temporal.PlainDate);
     expect((result.published_at as unknown as Temporal.PlainDate).toString()).toBe("2026-03-15");
   });
 
@@ -50,6 +51,7 @@ describe("coerceRow — date → Temporal.PlainDate", () => {
   test("coerces a plain 'yyyy-mm-dd' driver string", () => {
     const row = { published_at: "2026-12-01" };
     const result = coerceRow(row, dateTableInfo());
+    expect(result.published_at).toBeInstanceOf(Temporal.PlainDate);
     expect((result.published_at as unknown as Temporal.PlainDate).toString()).toBe("2026-12-01");
   });
 

package/src/bun-db/__tests__/coerce-row-temporal.test.ts

@@ -8,7 +8,7 @@
 // coerceRow — proving the coercion no longer depends on the global at all.
 
 import { describe, expect, test } from "bun:test";
-import type { Temporal } from "temporal-polyfill";
+import { Temporal } from "temporal-polyfill";
 import { coerceRow, type TableInfo } from "../query";
 
 function timestamptzTableInfo(): TableInfo {
@@ -29,6 +29,7 @@ describe("coerceRow — timestamptz → Temporal.Instant", () => {
     try {
       const row = { updated_at: new Date("2026-04-18T10:00:00Z") };
       const result = coerceRow(row, timestamptzTableInfo());
+      expect(result.updated_at).toBeInstanceOf(Temporal.Instant);
       expect((result.updated_at as unknown as Temporal.Instant).toString()).toBe(
         "2026-04-18T10:00:00Z",
       );

package/src/bun-db/index.ts

@@ -25,6 +25,7 @@ export {
   insertMany,
   insertOne,
   runInSavepoint,
+  runInSavepointIfSupported,
   selectMany,
   transaction,
   type UpsertOnConflictOptions,

package/src/bun-db/query.ts

@@ -25,8 +25,8 @@ import type {
   WhereObject,
   WhereOperator,
 } from "@cosmicdrift/kumiko-types/where-clause-types";
-// Static import, not the ambient global: Bun doesn't expose Temporal on
-// globalThis, so instantFromDriver crashed on timestamptz reads (#1480).
+// Static polyfill import (not getTemporal()): coercion results stay on one
+// Temporal implementation repo-wide, even when Bun exposes a global (#1480).
 import { Temporal } from "temporal-polyfill";
 import { computeBlindIndex, configuredBlindIndexKey } from "../crypto/blind-index";
 import { SQL_EXPR_BRAND } from "../db/dialect";
@@ -46,6 +46,7 @@ function snakeToCamel(key: string): string {
   return envCamelCase(key);
 }
 
+import type { DbRunner } from "@cosmicdrift/kumiko-types/db-connection";
 import type { BunDbRunner } from "./connection";
 
 // Drizzle-pgTable-Inspection via raw Symbol-access (kein drizzle-orm import).
@@ -155,16 +156,18 @@ export async function runInSavepoint<T>(tx: unknown, fn: (sp: unknown) => Promis
 // executed yet.
 export async function runInSavepointIfSupported<T>(
   db: unknown,
-  fn: (sp: unknown) => Promise<T>,
+  fn: (sp: DbRunner) => Promise<T>,
 ): Promise<T> {
   const raw = asRawClient(db) as unknown as {
     savepoint?: <TR>(cb: (sp: unknown) => Promise<TR>) => Promise<TR>;
   };
-  if (typeof raw.savepoint !== "function") return fn(db);
+  // @cast-boundary driver savepoint handle → DbRunner at the single seam
+  const asRunner = (sp: unknown): DbRunner => sp as DbRunner;
+  if (typeof raw.savepoint !== "function") return fn(asRunner(db));
   try {
-    return await raw.savepoint(fn);
+    return await raw.savepoint((sp) => fn(asRunner(sp)));
   } catch (e) {
-    if (extractPgError(e)?.code === "25P01") return fn(db);
+    if (extractPgError(e)?.code === "25P01") return fn(asRunner(db));
     throw e;
   }
 }
@@ -328,11 +331,11 @@ function quoteIdent(name: string): string {
 // Symmetric on write: Temporal.Instant doesn't bind directly into postgres-js
 // params — convert to ISO string when the column pgType is timestamptz.
 
-function isTemporalInstant(v: unknown): boolean {
+function isTemporalInstant(v: unknown): v is Temporal.Instant {
   return (
     typeof v === "object" &&
     v !== null &&
-    typeof (v as { epochNanoseconds?: unknown }).epochNanoseconds === "bigint"
+    (v as { [Symbol.toStringTag]?: unknown })[Symbol.toStringTag] === "Temporal.Instant"
   );
 }
 
@@ -377,12 +380,21 @@ function instantFromDriver(value: unknown): Temporal.Instant | null {
   return null;
 }
 
-function isTemporalPlainDate(v: unknown): boolean {
+function isTemporalPlainDate(v: unknown): v is Temporal.PlainDate {
   return (
     typeof v === "object" &&
     v !== null &&
-    typeof (v as { day?: unknown }).day === "number" &&
-    typeof (v as { calendarId?: unknown }).calendarId === "string"
+    (v as { [Symbol.toStringTag]?: unknown })[Symbol.toStringTag] === "Temporal.PlainDate"
+  );
+}
+
+function isTemporalPlainDateTimeLike(v: unknown): v is { toPlainDate(): Temporal.PlainDate } {
+  return (
+    typeof v === "object" &&
+    v !== null &&
+    ((v as { [Symbol.toStringTag]?: unknown })[Symbol.toStringTag] === "Temporal.PlainDateTime" ||
+      (v as { [Symbol.toStringTag]?: unknown })[Symbol.toStringTag] === "Temporal.ZonedDateTime") &&
+    typeof (v as { toPlainDate?: unknown }).toPlainDate === "function"
   );
 }
 
@@ -397,7 +409,7 @@ function isTemporalPlainDate(v: unknown): boolean {
 // `.getTime()`), just anchored to a fixed zone instead of process-local.
 function plainDateFromDriver(value: unknown): Temporal.PlainDate | null {
   if (value === null || value === undefined) return null;
-  if (isTemporalPlainDate(value)) return value as Temporal.PlainDate;
+  if (isTemporalPlainDate(value)) return value;
   if (typeof value === "string") {
     const isoDay = /^\d{4}-\d{2}-\d{2}/.exec(value)?.[0];
     if (isoDay === undefined) return null;
@@ -520,10 +532,13 @@ function isSqlExpression(v: unknown): v is { kind: "sql-expr"; text: string } {
 // driver can't serialize.
 function prepareDateValue(value: unknown): PreparedValue | undefined {
   if (isTemporalPlainDate(value)) {
-    return { kind: "param", sql: "", bound: (value as Temporal.PlainDate).toString() };
+    return { kind: "param", sql: "", bound: value.toString() };
+  }
+  if (isTemporalPlainDateTimeLike(value)) {
+    return { kind: "param", sql: "", bound: value.toPlainDate().toString() };
   }
   if (isTemporalInstant(value)) {
-    const day = (value as Temporal.Instant).toZonedDateTimeISO("UTC").toPlainDate();
+    const day = value.toZonedDateTimeISO("UTC").toPlainDate();
     return { kind: "param", sql: "", bound: day.toString() };
   }
   return undefined;
@@ -688,6 +703,7 @@ function isClosedConnectionError(err: unknown): boolean {
 // Exported so raw-SQL query modules outside bun-db (e.g. bundled-features'
 // db/queries/*.ts) can opt into the same #1163 retry instead of calling
 // asRawClient(db).unsafe(...) directly and losing it.
+// READS ONLY — retry re-executes the statement; never pass INSERT/UPDATE/DELETE.
 export async function unsafeReadRetrying<TRow>(
   db: AnyDb,
   sqlText: string,

package/src/crypto/index.ts

@@ -14,6 +14,7 @@ export {
   encryptEventPayloadPii,
 } from "./event-pii";
 export { InMemoryKmsAdapter } from "./in-memory-kms-adapter";
+export { isSelfPiiField } from "./is-self-pii-field";
 export {
   isLocalKeyKmsAdapter,
   KeyAlreadyExistsError,

package/src/crypto/is-self-pii-field.ts

@@ -0,0 +1,8 @@
+import type { EntityDefinition } from "../engine/types/fields";
+
+type AnyField = EntityDefinition["fields"][string];
+
+/** True when the field's own row id is the PII subject (`pii: true`). */
+export function isSelfPiiField(field: AnyField): boolean {
+  return "pii" in field && field.pii === true;
+}

package/src/crypto/subject-resolver.ts

@@ -1,5 +1,6 @@
 import type { EntityDefinition } from "../engine/types/fields";
 import type { TenantId } from "../engine/types/identifiers";
+import { isSelfPiiField } from "./is-self-pii-field";
 import type { SubjectId } from "./kms-adapter";
 
 // Thrown when a field IS pii-annotated but the row can't name its subject —
@@ -63,7 +64,7 @@ export function resolveSubjectForField(
     return { kind: "tenant", tenantId };
   }
 
-  if ("pii" in field && field.pii === true) {
+  if (isSelfPiiField(field)) {
     // pii: true = the entity itself is the subject (user.email belongs to
     // that user row). Serial ids are stringified — subject keys are text.
     const id = row["id"];
@@ -85,7 +86,7 @@ export function collectPiiSubjectFields(entity: EntityDefinition): readonly stri
       ([, field]) =>
         ("userOwned" in field && field.userOwned !== undefined) ||
         ("tenantOwned" in field && field.tenantOwned === true) ||
-        ("pii" in field && field.pii === true),
+        isSelfPiiField(field),
     )
     .map(([name]) => name);
 }
@@ -97,7 +98,7 @@ export function collectSearchableSubjectFields(entity: EntityDefinition): readon
       const subject =
         ("userOwned" in field && field.userOwned !== undefined) ||
         ("tenantOwned" in field && field.tenantOwned === true) ||
-        ("pii" in field && field.pii === true);
+        isSelfPiiField(field);
       if (!subject) return false;
       if ("sensitive" in field && field.sensitive === true) return false;
       return "searchable" in field && field.searchable === true;

package/src/db/__tests__/event-store-executor-list.integration.test.ts

@@ -506,7 +506,9 @@ describe("event-store-executor.list — runtime SearchAdapter (Tier 2.7e Audit-F
     expect(res.rows).toHaveLength(0);
   });
 
-  test("system-mode list: search uses SYSTEM_TENANT_ID (not session tenant)", async () => {
+  test("system-mode list: search still uses session tenantId (streamTenantFor)", async () => {
+    // Non-systemStream entities are indexed under event.tenantId (= session),
+    // even when listed via r.systemScope() — db.mode must not redirect search.
     const systemTdb = createTenantDb(testDb.db, admin.tenantId, "system");
     let searchedTenant: string | undefined;
     const mockAdapter = {
@@ -523,7 +525,7 @@ describe("event-store-executor.list — runtime SearchAdapter (Tier 2.7e Audit-F
     await exec.list({ limit: 50, search: "x" }, admin, systemTdb, {
       searchAdapter: mockAdapter,
     });
-    expect(searchedTenant).toBe(SYSTEM_TENANT_ID);
+    expect(searchedTenant).toBe(admin.tenantId);
   });
 
   test("tenant-mode list: search still uses session tenantId", async () => {
@@ -544,6 +546,33 @@ describe("event-store-executor.list — runtime SearchAdapter (Tier 2.7e Audit-F
     });
     expect(searchedTenant).toBe(admin.tenantId);
   });
+
+  test("tenant-mode list: systemStream entity searches SYSTEM_TENANT_ID", async () => {
+    const sysEntity = createEntity({
+      table: "read_pager_sys",
+      systemStream: true,
+      fields: { title: createTextField({ required: true }) },
+    });
+    const sysTable = buildEntityTable("pagerSys", sysEntity);
+    await unsafeCreateEntityTable(testDb.db, sysEntity, "pagerSys");
+    const sysExec = createEventStoreExecutor(sysTable, sysEntity, { entityName: "pagerSys" });
+    let searchedTenant: string | undefined;
+    const mockAdapter = {
+      configure: async () => {},
+      index: async () => {},
+      indexBatch: async () => {},
+      remove: async () => {},
+      search: async (tenantId: string) => {
+        searchedTenant = tenantId;
+        return [];
+      },
+      reset: async () => {},
+    } as never;
+    await sysExec.list({ limit: 50, search: "x" }, admin, tdb, {
+      searchAdapter: mockAdapter,
+    });
+    expect(searchedTenant).toBe(SYSTEM_TENANT_ID);
+  });
 });
 
 describe("event-store-executor.list — keyset cursor mit custom sort (#2265)", () => {

package/src/db/__tests__/migrate-generator.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import type { EntityTableMeta } from "../entity-table-meta";
 import {
+  assertValidMigrationName,
   diffSnapshots,
   generateMigration,
   renderMigrationSql,
@@ -197,3 +198,14 @@ describe("renderMigrationSql — managed recreate vs unmanaged in-place", () =>
     expect(sql).toContain("new NOT NULL column(s) without default: envelope");
   });
 });
+
+describe("assertValidMigrationName", () => {
+  test("accepts alphanumeric hyphenated names", () => {
+    expect(() => assertValidMigrationName("add-user-table")).not.toThrow();
+  });
+
+  test("rejects leading hyphen and oversized names", () => {
+    expect(() => assertValidMigrationName("-foo")).toThrow(/Invalid migration name/);
+    expect(() => assertValidMigrationName(`a${"x".repeat(64)}`)).toThrow(/Invalid migration name/);
+  });
+});

package/src/db/__tests__/multi-row-insert.integration.test.ts

@@ -9,6 +9,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { createEntity, createTextField } from "../../engine";
@@ -61,6 +62,7 @@ describe("instant() customType is forgiving with ISO strings", () => {
     expect(rows).toHaveLength(1);
     const insertedAt = rows[0]?.["insertedAt"];
     expect(insertedAt).toBeDefined();
+    expect(insertedAt).toBeInstanceOf(Temporal.Instant);
     expect((insertedAt as Temporal.Instant).toString()).toBe(isoString);
   });
 });

package/src/db/__tests__/schema-migration.integration.test.ts

@@ -314,6 +314,7 @@ describe("date field — real DATE column, no TZ dependence (kumiko-framework#19
     const rows = await selectMany(testDb.db, table);
     expect(rows).toHaveLength(1);
     const periodFrom = (rows[0] as { periodFrom: unknown }).periodFrom;
+    expect(periodFrom).toBeInstanceOf(Temporal.PlainDate);
     expect((periodFrom as Temporal.PlainDate).toString()).toBe("2026-03-15");
   });
 

package/src/db/__tests__/source-shadow-create.integration.test.ts

@@ -13,6 +13,7 @@
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
 import { seedRow } from "@cosmicdrift/kumiko-framework/testing";
+import { Temporal } from "temporal-polyfill";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { createEntity, createTextField } from "../../engine";
@@ -52,6 +53,7 @@ describe("entity with a `source` field — create-path is shadow-proof", () => {
     expect(rows[0]?.["source"]).toBe("import");
     const insertedAt = rows[0]?.["insertedAt"];
     expect(insertedAt).toBeDefined();
+    expect(insertedAt).toBeInstanceOf(Temporal.Instant);
     expect((insertedAt as Temporal.Instant).toString()).toBe("2026-01-15T12:00:00Z");
   });
 });