@cosmicdrift/kumiko-framework 0.270.0 → 0.273.0

package/src/pipeline/__tests__/escape-hatch-audit.integration.test.ts

@@ -0,0 +1,254 @@
+// fw#2861 — every escape-hatch use reports through AppContext._escapeHatchAuditSink
+// (or warn-logs when no sink is wired). Real HTTP calls + setupTestStack — never
+// createTestDispatcher. Modelled on unsafe-raw-escape-hatch.integration.test.ts and
+// system-identity-switch.integration.test.ts.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { defineUnmanagedTable } from "../../db/entity-table-meta";
+import { executeRawQuery } from "../../db/queries/raw-sql";
+import { createSystemUser, defineFeature } from "../../engine";
+import type { EscapeHatchUseEvent } from "../../engine/types";
+import type { Logger } from "../../logging/types";
+import { createTestUser, setupTestStack, type TestStack } from "../../stack";
+import { ESCAPE_HATCH_USED_SIGNAL } from "../escape-hatch-report";
+
+const globalStoreTable = defineUnmanagedTable({
+  tableName: "store_fw2861_escape_hatch_audit_items",
+  tenancy: "global",
+  columns: [
+    {
+      name: "id",
+      pgType: "uuid",
+      notNull: true,
+      primaryKey: true,
+      defaultSql: "gen_random_uuid()",
+    },
+    { name: "note", pgType: "text", notNull: true },
+  ],
+});
+
+const UNSAFE_RAW_REASON = "fw#2861 integration test — declared unsafeRaw write";
+const GLOBAL_WRITE_REASON = "fw#2861 integration test — declared cross-tenant write";
+const IDENTITY_SWITCH_REASON = "fw#2861 integration test — needs SYSTEM to look itself up";
+const ACKNOWLEDGE_REASON = "fw#2861 integration test — system-wide scan";
+
+const probeFeature = defineFeature("escape-hatch-audit-probe", (r) => {
+  r.storeTable(globalStoreTable, {
+    reason: "fw#2861 integration test — cross-tenant store table for db.global()",
+  });
+
+  r.queryHandler(
+    "whoami",
+    z.object({}),
+    async (query) => ({ id: query.user.id, tenantId: query.user.tenantId }),
+    { access: { roles: ["system", "User"] } },
+  );
+
+  r.writeHandler(
+    "unsafe-raw-write",
+    z.object({}),
+    async (_event, ctx) => {
+      const runner = ctx.db.unsafeRaw(UNSAFE_RAW_REASON);
+      const rows = await executeRawQuery<{ one: number }>(runner, "SELECT 1 AS one");
+      return { isSuccess: true as const, data: { one: rows[0]?.one } };
+    },
+    { access: { roles: ["User"] }, escapeHatch: { reason: UNSAFE_RAW_REASON } },
+  );
+
+  r.writeHandler(
+    "global-write",
+    z.object({}),
+    async (_event, ctx) => {
+      const row = await ctx.db.global(globalStoreTable).insertOne<{ id: string }>({
+        note: "hi",
+      });
+      return { isSuccess: true as const, data: row };
+    },
+    { access: { roles: ["User"] }, escapeHatch: { reason: GLOBAL_WRITE_REASON } },
+  );
+
+  r.writeHandler(
+    "identity-switch-write",
+    z.object({}),
+    async (event, ctx) =>
+      ctx
+        .queryAs(createSystemUser(event.user.tenantId), "escape-hatch-audit-probe:query:whoami", {})
+        .then((data) => ({ isSuccess: true as const, data })),
+    { access: { roles: ["User"] }, escapeHatch: { reason: IDENTITY_SWITCH_REASON } },
+  );
+
+  r.writeHandler(
+    "identity-switch-self-write",
+    z.object({}),
+    async (event, ctx) =>
+      ctx
+        .queryAs(event.user, "escape-hatch-audit-probe:query:whoami", {})
+        .then((data) => ({ isSuccess: true as const, data })),
+    { access: { roles: ["User"] }, escapeHatch: { reason: IDENTITY_SWITCH_REASON } },
+  );
+});
+
+const systemScopeProbeFeature = defineFeature("escape-hatch-audit-probe-system", (r) => {
+  r.systemScope();
+
+  r.queryHandler(
+    "acknowledge-cross-tenant-query",
+    z.object({}),
+    async (_query, ctx) => {
+      if (!ctx.systemDb) throw new Error("expected ctx.systemDb on a systemScope() handler");
+      const db = ctx.systemDb.acknowledgeCrossTenant(ACKNOWLEDGE_REASON);
+      return { tenantId: db.tenantId };
+    },
+    { access: { roles: ["User"] } },
+  );
+});
+
+const user = createTestUser({
+  id: 93,
+  tenantId: "11111111-0000-4000-8000-000000000093",
+  roles: ["User"],
+});
+
+function recordingSink(events: EscapeHatchUseEvent[]) {
+  return async (event: EscapeHatchUseEvent) => {
+    events.push(event);
+  };
+}
+
+describe("escape-hatch uses report through AppContext._escapeHatchAuditSink", () => {
+  let stack: TestStack;
+  const events: EscapeHatchUseEvent[] = [];
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [probeFeature, systemScopeProbeFeature],
+      extraContext: { _escapeHatchAuditSink: recordingSink(events) },
+    });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("unsafeRaw reports exactly one unsafe-raw event with handler/kind/reason/tenantId/actor, deduped on a repeat call within the window", async () => {
+    events.length = 0;
+    await stack.http.writeOk("escape-hatch-audit-probe:write:unsafe-raw-write", {}, user);
+    // Identical (handler, kind, reason, tenantId, actor) — the 60s dedup window
+    // must suppress this second report.
+    await stack.http.writeOk("escape-hatch-audit-probe:write:unsafe-raw-write", {}, user);
+
+    const matches = events.filter((e) => e.kind === "unsafe-raw");
+    expect(matches).toEqual([
+      {
+        handler: "escape-hatch-audit-probe:write:unsafe-raw-write",
+        kind: "unsafe-raw",
+        reason: UNSAFE_RAW_REASON,
+        tenantId: user.tenantId,
+        actor: user.id,
+      },
+    ]);
+  });
+
+  test("db.global() write reports exactly one global-write event with the escapeHatch's reason", async () => {
+    events.length = 0;
+    await stack.http.writeOk("escape-hatch-audit-probe:write:global-write", {}, user);
+
+    const matches = events.filter((e) => e.kind === "global-write");
+    expect(matches).toEqual([
+      {
+        handler: "escape-hatch-audit-probe:write:global-write",
+        kind: "global-write",
+        reason: GLOBAL_WRITE_REASON,
+        tenantId: user.tenantId,
+        actor: user.id,
+      },
+    ]);
+  });
+
+  test("ctx.systemDb.acknowledgeCrossTenant reports exactly one acknowledge-cross-tenant event", async () => {
+    events.length = 0;
+    await stack.http.queryOk(
+      "escape-hatch-audit-probe-system:query:acknowledge-cross-tenant-query",
+      {},
+      user,
+    );
+
+    const matches = events.filter((e) => e.kind === "acknowledge-cross-tenant");
+    expect(matches).toEqual([
+      {
+        handler: "escape-hatch-audit-probe-system:query:acknowledge-cross-tenant-query",
+        kind: "acknowledge-cross-tenant",
+        reason: ACKNOWLEDGE_REASON,
+        tenantId: user.tenantId,
+        actor: user.id,
+      },
+    ]);
+  });
+
+  test("a granted SYSTEM identity switch reports exactly one identity-switch event with the target", async () => {
+    events.length = 0;
+    await stack.http.writeOk("escape-hatch-audit-probe:write:identity-switch-write", {}, user);
+
+    const matches = events.filter((e) => e.kind === "identity-switch");
+    expect(matches).toEqual([
+      {
+        handler: "escape-hatch-audit-probe:write:identity-switch-write",
+        kind: "identity-switch",
+        reason: IDENTITY_SWITCH_REASON,
+        tenantId: user.tenantId,
+        actor: user.id,
+        target: { id: createSystemUser(user.tenantId).id, tenantId: user.tenantId },
+      },
+    ]);
+  });
+
+  test("self-delegation with a grant reports no identity-switch event", async () => {
+    events.length = 0;
+    await stack.http.writeOk("escape-hatch-audit-probe:write:identity-switch-self-write", {}, user);
+
+    expect(events.filter((e) => e.kind === "identity-switch")).toEqual([]);
+  });
+});
+
+describe("escape-hatch uses without a sink fall back to a structured warn log", () => {
+  let stack: TestStack;
+  const warnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+
+  beforeAll(async () => {
+    const log: Logger = {
+      info() {},
+      debug() {},
+      warn(msg, data) {
+        warnCalls.push({ msg, data });
+      },
+      error() {},
+      child() {
+        return log;
+      },
+    };
+    stack = await setupTestStack({
+      features: [probeFeature, systemScopeProbeFeature],
+      extraContext: { log },
+    });
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("unsafeRaw without a sink warn-logs security:escape-hatch-used", async () => {
+    warnCalls.length = 0;
+    await stack.http.writeOk("escape-hatch-audit-probe:write:unsafe-raw-write", {}, user);
+
+    const matches = warnCalls.filter((c) => c.msg === ESCAPE_HATCH_USED_SIGNAL);
+    expect(matches).toHaveLength(1);
+    expect(matches[0]?.data).toEqual({
+      handler: "escape-hatch-audit-probe:write:unsafe-raw-write",
+      kind: "unsafe-raw",
+      reason: UNSAFE_RAW_REASON,
+      tenantId: user.tenantId,
+      actor: user.id,
+    });
+  });
+});

package/src/pipeline/__tests__/escape-hatch-report.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test } from "bun:test";
+import type { EscapeHatchUseEvent } from "../../engine/types";
+import type { Logger } from "../../logging/types";
+import { testTenantId } from "../../stack";
+import {
+  createEscapeHatchReportWindow,
+  ESCAPE_HATCH_USED_SIGNAL,
+  reportEscapeHatchUse,
+} from "../escape-hatch-report";
+
+const tenantId = testTenantId(1);
+
+function recordingLogger(): Logger & {
+  readonly warnCalls: Array<{ msg: string; data?: Record<string, unknown> }>;
+  readonly errorCalls: Array<{ msg: string; data?: Record<string, unknown> }>;
+} {
+  const warnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+  const errorCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+  const logger: Logger & {
+    warnCalls: typeof warnCalls;
+    errorCalls: typeof errorCalls;
+  } = {
+    warnCalls,
+    errorCalls,
+    info() {},
+    debug() {},
+    warn(msg, data) {
+      warnCalls.push({ msg, data });
+    },
+    error(msg, data) {
+      errorCalls.push({ msg, data });
+    },
+    child() {
+      return logger;
+    },
+  };
+  return logger;
+}
+
+const baseEvent: EscapeHatchUseEvent = {
+  handler: 'write "widgets:write:create"',
+  kind: "unsafe-raw",
+  reason: "legacy migration read",
+  tenantId,
+  actor: "user-1",
+};
+
+describe("createEscapeHatchReportWindow", () => {
+  test("dedups an identical key within the window", () => {
+    const window = createEscapeHatchReportWindow({ windowMs: 1000 });
+    expect(window.shouldReport("k1", 0)).toBe(true);
+    expect(window.shouldReport("k1", 500)).toBe(false);
+    expect(window.shouldReport("k1", 999)).toBe(false);
+  });
+
+  test("reports again after the window expires", () => {
+    const window = createEscapeHatchReportWindow({ windowMs: 1000 });
+    expect(window.shouldReport("k1", 0)).toBe(true);
+    expect(window.shouldReport("k1", 1000)).toBe(true);
+  });
+
+  test("evicts the oldest entry beyond maxEntries", () => {
+    const window = createEscapeHatchReportWindow({ windowMs: 1000, maxEntries: 2 });
+    expect(window.shouldReport("k1", 0)).toBe(true);
+    expect(window.shouldReport("k2", 0)).toBe(true);
+    // k3 pushes the cache past its cap — k1 (oldest) is evicted to make room.
+    expect(window.shouldReport("k3", 0)).toBe(true);
+    // k1 was evicted, so it is treated as new and reports again.
+    expect(window.shouldReport("k1", 1)).toBe(true);
+    // k3 is still within its window and was not evicted.
+    expect(window.shouldReport("k3", 1)).toBe(false);
+  });
+});
+
+describe("reportEscapeHatchUse", () => {
+  test("sink present — calls the sink with the exact event and does not log.warn", () => {
+    const calls: EscapeHatchUseEvent[] = [];
+    const sink = async (event: EscapeHatchUseEvent) => {
+      calls.push(event);
+    };
+    const log = recordingLogger();
+
+    reportEscapeHatchUse(baseEvent, { sink, log });
+
+    expect(calls).toEqual([baseEvent]);
+    expect(log.warnCalls).toEqual([]);
+  });
+
+  test("no sink — log.warn called once with ESCAPE_HATCH_USED_SIGNAL and exact fields", () => {
+    const log = recordingLogger();
+
+    reportEscapeHatchUse(baseEvent, { log });
+
+    expect(log.warnCalls.length).toBe(1);
+    expect(log.warnCalls[0]?.msg).toBe(ESCAPE_HATCH_USED_SIGNAL);
+    expect(log.warnCalls[0]?.data).toEqual({
+      handler: baseEvent.handler,
+      kind: baseEvent.kind,
+      reason: baseEvent.reason,
+      tenantId: baseEvent.tenantId,
+      actor: baseEvent.actor,
+    });
+  });
+
+  test("no sink, event has a target — target fields are included", () => {
+    const log = recordingLogger();
+    const eventWithTarget: EscapeHatchUseEvent = {
+      ...baseEvent,
+      kind: "identity-switch",
+      target: { id: "user-2", tenantId },
+    };
+
+    reportEscapeHatchUse(eventWithTarget, { log });
+
+    expect(log.warnCalls[0]?.data).toEqual({
+      handler: eventWithTarget.handler,
+      kind: eventWithTarget.kind,
+      reason: eventWithTarget.reason,
+      tenantId: eventWithTarget.tenantId,
+      actor: eventWithTarget.actor,
+      targetId: "user-2",
+      targetTenantId: tenantId,
+    });
+  });
+
+  test("sink rejection — logs via log.error", async () => {
+    const log = recordingLogger();
+    const sink = async () => {
+      throw new Error("sink boom");
+    };
+
+    reportEscapeHatchUse(baseEvent, { sink, log });
+    // The sink runs async — let its rejection settle before asserting.
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(log.errorCalls.length).toBe(1);
+    expect(log.errorCalls[0]?.msg).toBe(`${ESCAPE_HATCH_USED_SIGNAL}: audit sink failed`);
+    expect(log.errorCalls[0]?.data).toEqual({
+      handler: baseEvent.handler,
+      kind: baseEvent.kind,
+      reason: baseEvent.reason,
+      tenantId: baseEvent.tenantId,
+      actor: baseEvent.actor,
+      error: "sink boom",
+    });
+    expect(log.warnCalls).toEqual([]);
+  });
+});

package/src/pipeline/__tests__/msp-rebuild.integration.test.ts

@@ -364,4 +364,32 @@ describe("rebuildMultiStreamProjection — guard rails", () => {
     expect(state?.status).toBe("dead");
     expect(state?.lastError).toMatch(/appendEvent/);
   });
+
+  test("aborts when the live table has RLS enabled — data survives (fw#2907)", async () => {
+    const erin = "00000000-0000-4000-8000-000000000e05";
+    await updateMany(
+      stack.db,
+      eventConsumerStateTable,
+      { status: "disabled", updatedAt: sql`now()` },
+      { name: SAGA_MSP },
+    );
+    await stack.http.writeOk("mspreb:write:invoice:bill", { customer: erin, cents: 20_00 }, admin);
+    await runFullDispatcher();
+
+    await asRawClient(stack.db).unsafe(
+      `ALTER TABLE "read_mspreb_balance" ENABLE ROW LEVEL SECURITY`,
+    );
+    try {
+      await expect(
+        rebuildMultiStreamProjection(BALANCE_MSP, { db: stack.db, registry: stack.registry }),
+      ).rejects.toThrow(/row level security/);
+
+      const [row] = await selectMany(stack.db, balanceTable, { customer: erin });
+      expect(row).toMatchObject({ invoicesCents: 20_00 });
+    } finally {
+      await asRawClient(stack.db).unsafe(
+        `ALTER TABLE "read_mspreb_balance" DISABLE ROW LEVEL SECURITY`,
+      );
+    }
+  });
 });

package/src/pipeline/__tests__/projection-rebuild.integration.test.ts

@@ -938,3 +938,97 @@ describe("rebuildProjection — stale-registry column fence (#835)", () => {
     expect(await getCount(group)).toBe(1);
   });
 });
+
+describe("rebuildProjection — row level security guard (#2907)", () => {
+  test("aborts when the live table has RLS enabled — data and RLS survive", async () => {
+    const group = "00000000-0000-4000-8000-000000000051";
+    await appendCreatedEvent(group, "item1");
+    await rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry });
+    expect(await getCount(group)).toBe(1);
+
+    const raw = asRawClient(testDb.db);
+    await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" ENABLE ROW LEVEL SECURITY`);
+    try {
+      await expect(
+        rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry }),
+      ).rejects.toThrow(/read_rebuild_items_per_group.*has row level security/);
+
+      // Live table untouched: row count AND the RLS flag itself survive.
+      expect(await getCount(group)).toBe(1);
+      const [pgClass] = await raw.unsafe<{ relrowsecurity: boolean }>(
+        `SELECT relrowsecurity FROM pg_class WHERE relname = 'read_rebuild_items_per_group'`,
+      );
+      expect(pgClass?.relrowsecurity).toBe(true);
+
+      const state = await getProjectionState(testDb.db, qualifiedProjectionName);
+      expect(state?.status).toBe("failed");
+    } finally {
+      await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" DISABLE ROW LEVEL SECURITY`);
+    }
+
+    // RLS cleared again → rebuild works.
+    const result = await rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry });
+    expect(result.eventsProcessed).toBe(1);
+    expect(await getCount(group)).toBe(1);
+  });
+
+  test("aborts on a policy alone, without RLS enabled — policy count reported and survives", async () => {
+    const group = "00000000-0000-4000-8000-000000000052";
+    await appendCreatedEvent(group, "item1");
+    await rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry });
+
+    const raw = asRawClient(testDb.db);
+    await raw.unsafe(
+      `CREATE POLICY rls_guard_probe ON "read_rebuild_items_per_group" USING (true)`,
+    );
+    try {
+      await expect(
+        rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry }),
+      ).rejects.toThrow(/policies: 1/);
+
+      const [policyCount] = await raw.unsafe<{ n: number }>(
+        `SELECT count(*)::int AS n FROM pg_policy p
+         JOIN pg_class c ON c.oid = p.polrelid
+         WHERE c.relname = 'read_rebuild_items_per_group'`,
+      );
+      expect(policyCount?.n).toBe(1);
+    } finally {
+      await raw.unsafe(`DROP POLICY IF EXISTS rls_guard_probe ON "read_rebuild_items_per_group"`);
+    }
+  });
+
+  test("aborts on FORCE ROW LEVEL SECURITY alone, without ENABLE", async () => {
+    const raw = asRawClient(testDb.db);
+    await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" FORCE ROW LEVEL SECURITY`);
+    try {
+      await expect(
+        rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry }),
+      ).rejects.toThrow(/row level security/);
+    } finally {
+      await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" NO FORCE ROW LEVEL SECURITY`);
+      await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" DISABLE ROW LEVEL SECURITY`);
+    }
+  });
+
+  test("swapShadowIntoLive rejects directly when RLS is enabled — live table survives", async () => {
+    const group = "00000000-0000-4000-8000-000000000053";
+    await appendCreatedEvent(group, "item1");
+    await rebuildProjection(qualifiedProjectionName, { db: testDb.db, registry });
+    expect(await getCount(group)).toBe(1);
+
+    const raw = asRawClient(testDb.db);
+    await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" ENABLE ROW LEVEL SECURITY`);
+    try {
+      const db = testDb.db as DbConnection; // @cast-boundary test-harness (TestDb.db is intentionally unknown)
+      await expect(
+        db.begin(async (tx: DbTx) => {
+          await swapShadowIntoLive(tx, "read_rebuild_items_per_group");
+        }),
+      ).rejects.toThrow(/shadow swap:.*row level security/);
+
+      expect(await getCount(group)).toBe(1);
+    } finally {
+      await raw.unsafe(`ALTER TABLE "read_rebuild_items_per_group" DISABLE ROW LEVEL SECURITY`);
+    }
+  });
+});

package/src/pipeline/__tests__/projections-runner-systemscope.integration.test.ts

@@ -0,0 +1,101 @@
+// Pins the in-transaction inline-projection path over real HTTP for an
+// r.systemScope() feature — the tenant-mode path is covered by domain-events-projections.integration.test.ts.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import {
+  integer as pgInteger,
+  table as pgTable,
+  text as pgText,
+  uuid as pgUuid,
+} from "../../db/dialect";
+import { insertOne, selectMany } from "../../db/query";
+import {
+  createEntity,
+  createTextField,
+  defineEntityCreateHandler,
+  defineFeature,
+} from "../../engine";
+import {
+  resetEventStore,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "../../stack";
+
+const sysItemEntity = createEntity({
+  table: "read_sysproj_items",
+  fields: { label: createTextField({ personal: false, reason: "test_fixture", required: true }) },
+});
+
+// No tenant_id column — mirrors the "system-scoped projection" table in
+// query-projection.integration.test.ts, but fed by dispatch-write's
+// in-transaction runProjections (r.projection) rather than a query handler.
+const auditTable = pgTable("read_sysproj_item_audit", {
+  itemId: pgUuid("item_id").primaryKey(),
+  tenantId: pgUuid("tenant_id").notNull(),
+  label: pgText("label").notNull(),
+  hits: pgInteger("hits").notNull().default(1),
+});
+
+const sysProjFeature = defineFeature("sysproj", (r) => {
+  r.systemScope();
+  r.entity("sysproj-item", sysItemEntity);
+
+  r.projection({
+    name: "item-audit",
+    source: "sysproj-item",
+    table: auditTable,
+    apply: {
+      "sysproj-item.created": async (event, tx) => {
+        const p = event.payload as { label?: string };
+        await insertOne(tx, auditTable, {
+          itemId: event.aggregateId,
+          tenantId: event.tenantId,
+          label: p.label ?? "?",
+        });
+      },
+    },
+  });
+
+  r.writeHandler(
+    defineEntityCreateHandler("sysproj-item", sysItemEntity, {
+      access: { roles: ["SystemAdmin"] },
+    }),
+  );
+});
+
+let stack: TestStack;
+const systemAdmin = TestUsers.systemAdmin;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [sysProjFeature], systemHooks: [] });
+  await unsafeCreateEntityTable(stack.db, sysItemEntity, "sysproj-item");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(async () => {
+  await resetEventStore(stack, ["read_sysproj_items", "read_sysproj_item_audit"]);
+});
+
+describe("inline r.projection fires in-transaction for an r.systemScope() feature", () => {
+  test("HTTP write lands both the entity row and the projection row", async () => {
+    const created = await stack.http.writeOk<{ id: string }>(
+      "sysproj:write:sysproj-item:create",
+      { label: "widget-a" },
+      systemAdmin,
+    );
+
+    const auditRows = await selectMany<{ itemId: string; label: string; tenantId: string }>(
+      stack.db,
+      auditTable,
+      { itemId: created.id },
+    );
+    expect(auditRows).toHaveLength(1);
+    expect(auditRows[0]?.label).toBe("widget-a");
+    expect(auditRows[0]?.tenantId).toBe(systemAdmin.tenantId);
+  });
+});