@cosmicdrift/kumiko-framework 0.323.0 → 0.324.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cosmicdrift/kumiko-framework",
-  "version": "0.323.0",
+  "version": "0.324.0",
   "description": "Framework core — engine, pipeline, API, DB, and every other bit that makes Kumiko go.",
   "license": "BUSL-1.1",
   "author": "Marc Frost <marc@cosmicdriftgamestudio.com>",
@@ -202,8 +202,8 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@cosmicdrift/kumiko-http": "0.323.0",
-    "@cosmicdrift/kumiko-types": "0.323.0",
+    "@cosmicdrift/kumiko-http": "0.324.0",
+    "@cosmicdrift/kumiko-types": "0.324.0",
     "bullmq": "^5.76.7",
     "bun-types": "^1.3.13",
     "hono": "^4.13.1",
@@ -219,7 +219,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@cosmicdrift/kumiko-dispatcher-live": "0.323.0",
+    "@cosmicdrift/kumiko-dispatcher-live": "0.324.0",
     "bun-types": "^1.3.13",
     "pino-pretty": "^13.1.3"
   },

package/src/changes.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.324.0",
+    "type": "breaking",
+    "title": "Writes on readAsInstruction fields now require agent.risk \"high\" on the directly-dispatched handler",
+    "migration": "New field flag `readAsInstruction: true` on `text`, `longText`, and `jsonb`\nfields (`@cosmicdrift/kumiko-types`) marks a field whose value a later run\nreads as an instruction — a prompt, rule, or template. Any create/update\nwhose payload writes such a field must resolve `agent.risk: \"high\"` on the\ndirectly-dispatched entry handler, or the executor gate denies it with\n`access_denied` / `instruction_field_write_requires_high_risk` before any\nDB write. This is opt-in per field, but touches every write path once a\nfield carries the flag — consumer checklist:\n\n1. Mark fields that a later run reads as an instruction (prompts, rules,\n   templates) with `readAsInstruction: true`.\n2. Update your own handlers that write such a field via\n   `executor.create`/`executor.update`, or delegate into one via\n   `ctx.write`/`writeAs`, to `agent: { risk: \"high\" }` — the directly\n   called handler must carry it, delegation does not inherit it.\n3. Standard entity-convention create/update handlers on an entity with such\n   a field now default to \"high\" automatically; declaring a lower\n   `agent.risk` on one is a define-time error, same as the delete floor\n   from #3345.\n4. An update whose payload doesn't include the flagged field stays allowed\n   unchanged — the gate checks payload presence after `preSave`, not\n   whether the value actually changed.\n5. Not gated: `delete`/`restore` (they don't write the field; the existing\n   irreversible-delete floor still applies), and your own domain events\n   applied via `ctx.appendEvent` whose projection writes a flagged field —\n   route such writes through the executor primitives (`create`/`update`)\n   to get the gate.\n6. On `create`, a flagged field with a `default` counts as written even if\n   the payload omits it — `applyDefaults` runs before the gate. A custom\n   mid-risk create handler whose payload leaves the field out is denied\n   just the same, and a standard create with `excludeFields` on such a\n   field still resolves to \"high\"."
+  },
+  {
+    "version": "0.324.0",
+    "type": "improvement",
+    "title": "TestStack.drainJobs() waits deterministically for jobs and their follow-up consumers",
+    "detail": "Migration note: replace `waitFor` polling on a job's side effect with `await\nstack.drainJobs()`; it rejects with the job's name and error on final\nfailure. New `JobRunner.countPendingJobs()` — hand-written `JobRunner`\nstubs (test doubles) must add it."
+  },
   {
     "version": "0.323.0",
     "type": "improvement",

package/src/db/event-store-executor-write.ts

@@ -1,4 +1,5 @@
 import { checkWriteFieldOwnership } from "../engine/field-access";
+import { instructionFieldNames } from "../engine/instruction-fields";
 import { userCanCreateFieldRow, userCanWriteFieldRow } from "../engine/ownership";
 import { SYSTEM_ROLE, SYSTEM_USER_ID } from "../engine/system-user";
 import type { EntityId, SessionUser } from "../engine/types";
@@ -19,6 +20,7 @@ import {
   getStreamVersion,
 } from "../event-store";
 import {
+  assertInstructionFieldWriteAllowed,
   assertIrreversibleOperationAllowed,
   isIrreversibleEntityVerb,
 } from "../pipeline/irreversible-operation-gate";
@@ -122,6 +124,7 @@ export function createWriteVerbs(
     assertStreamWritable,
     loadExpectSnapshot,
   } = ctx;
+  const entityInstructionFieldNames = instructionFieldNames(entity);
 
   return {
     async create(payload, user, db, options) {
@@ -152,6 +155,12 @@ export function createWriteVerbs(
 
       // After preSave so derived fields count, before the event append so nothing persists.
       assertPersonalDataWrite(db, tableNameOf(table), Object.keys(data), entity);
+      assertInstructionFieldWriteAllowed(
+        entityName,
+        "create",
+        Object.keys(data),
+        entityInstructionFieldNames,
+      );
 
       // H.2 — entity-level write-ownership on create. No oldRow exists, so
       // only the new row is checked. No Straddle concern for creates.
@@ -344,6 +353,12 @@ export function createWriteVerbs(
 
       // After preSave so derived fields count, before the event append so nothing persists.
       assertPersonalDataWrite(db, tableNameOf(table), Object.keys(changes), entity);
+      assertInstructionFieldWriteAllowed(
+        entityName,
+        "update",
+        Object.keys(changes),
+        entityInstructionFieldNames,
+      );
 
       // H.2 — entity-level write-ownership on update. Load old row (already
       // done above), build post-change row via shallow merge. Straddle-safe

package/src/engine/__tests__/entity-handlers.test.ts

@@ -13,7 +13,7 @@ import {
   type EntityCrudRegistrar,
   registerEntityCrud,
 } from "../entity-handlers";
-import { createEntity, createTextField } from "../factories";
+import { createEntity, createLongTextField, createTextField } from "../factories";
 // Barrel import, not "../entity-handlers": covers that entityListSchema is
 // actually re-exported through engine/index.ts.
 import { entityListSchema, resolveAgentExposure } from "../index";
@@ -37,6 +37,31 @@ const noteEntitySoftDelete = createEntity({
   softDelete: true,
 });
 
+const promptEntity = createEntity({
+  table: "prompts",
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "test_fixture" }),
+    body: createLongTextField({
+      personal: false,
+      reason: "test_fixture",
+      readAsInstruction: true,
+    }),
+  },
+});
+
+const promptEntityDefaultedBody = createEntity({
+  table: "prompts_defaulted",
+  fields: {
+    label: createTextField({ required: true, personal: false, reason: "test_fixture" }),
+    body: createLongTextField({
+      personal: false,
+      reason: "test_fixture",
+      readAsInstruction: true,
+      default: "system default prompt",
+    }),
+  },
+});
+
 const adminAccess = { access: { roles: ["Admin"] } } as const;
 
 describe("defineEntityWriteHandler", () => {
@@ -138,6 +163,42 @@ describe("defineEntityWriteHandler", () => {
     expect(def.agent).toBeUndefined();
     expect(resolveAgentExposure(def, "write").risk).toBe("mid");
   });
+
+  test("standard create on an entity with a readAsInstruction field defaults agent.risk to high", () => {
+    const def = defineEntityCreateHandler("prompt", promptEntity, adminAccess);
+    expect(resolveAgentExposure(def, "write").risk).toBe("high");
+  });
+
+  test("standard update on an entity with a readAsInstruction field defaults agent.risk to high", () => {
+    const def = defineEntityUpdateHandler("prompt", promptEntity, adminAccess);
+    expect(resolveAgentExposure(def, "write").risk).toBe("high");
+  });
+
+  test("declaring mid on a readAsInstruction-writing standard handler throws", () => {
+    expect(() =>
+      defineEntityUpdateHandler("prompt", promptEntity, {
+        access: { roles: ["Admin"] },
+        agent: { risk: "mid" },
+      }),
+    ).toThrow(/agent\.risk must be "high"/);
+  });
+
+  test("update with excludeFields excluding all readAsInstruction fields is not forced to high", () => {
+    const def = defineEntityUpdateHandler("prompt", promptEntity, {
+      access: { roles: ["Admin"] },
+      excludeFields: ["body"],
+    });
+    expect(def.agent).toBeUndefined();
+    expect(resolveAgentExposure(def, "write").risk).toBe("mid");
+  });
+
+  test("create excluding a readAsInstruction field that has a default is still forced to high", () => {
+    const def = defineEntityCreateHandler("prompt", promptEntityDefaultedBody, {
+      access: { roles: ["Admin"] },
+      excludeFields: ["body"],
+    });
+    expect(resolveAgentExposure(def, "write").risk).toBe("high");
+  });
 });
 
 describe("defineEntityQueryHandler", () => {

package/src/engine/entity-handlers.ts

@@ -13,6 +13,7 @@ import { acknowledgeConventionCrossTenant, type TenantDb } from "../db/tenant-db
 import { isSystemIdentity } from "../pipeline/system-identity-switch";
 import { assertUnreachable } from "../utils";
 import { PAGED_QUERY_HANDLER_BRAND } from "./define-handler";
+import { instructionFieldNames } from "./instruction-fields";
 import { buildInsertSchema, buildUpdateSchema } from "./schema-builder";
 import type {
   AccessRule,
@@ -214,19 +215,45 @@ function isInTotalsMatchPair(entity: EntityDefinition, fieldName: string): boole
   );
 }
 
-// delete on an entity without softDelete hard-purges the row — the agent
-// risk gate only protects it if this handler resolves to "high".
+// A create/update handler can write a field flagged readAsInstruction: true if:
+// update — the field isn't in excludeFields; create — the field isn't excluded,
+// or is excluded but has a default (applyDefaults writes it regardless, so the
+// define-time floor must match what the executor gate will see at runtime).
+function writableInstructionFields(
+  verb: "create" | "update",
+  entity: EntityDefinition,
+  excludedFields: readonly string[],
+): readonly string[] {
+  return instructionFieldNames(entity).filter((fieldName) => {
+    if (!excludedFields.includes(fieldName)) return true;
+    if (verb !== "create") return false;
+    const field = entity.fields[fieldName];
+    return field !== undefined && "default" in field && field.default !== undefined;
+  });
+}
+
+// delete on an entity without softDelete hard-purges the row, and create/update
+// handlers writing a readAsInstruction field are irreversible in effect (a
+// revert doesn't undo a run that already read the value) — the agent risk gate
+// only protects either case if this handler resolves to "high".
 function resolveEntityWriteAgentHints(
   name: string,
   verb: (typeof WRITE_VERBS)[number],
   entity: EntityDefinition,
   agent: AgentHandlerHints | undefined,
+  excludedFields: readonly string[],
 ): AgentHandlerHints | undefined {
-  if (verb !== "delete" || entity.softDelete) return agent;
+  const isIrreversibleDelete = verb === "delete" && !entity.softDelete;
+  const instructionFields =
+    verb === "create" || verb === "update"
+      ? writableInstructionFields(verb, entity, excludedFields)
+      : [];
+  if (!isIrreversibleDelete && instructionFields.length === 0) return agent;
   if (agent?.risk !== undefined && agent.risk !== "high") {
-    throw new Error(
-      `"${name}": delete on an entity without softDelete is irreversible — agent.risk must be "high" (got "${agent.risk}").`,
-    );
+    const reason = isIrreversibleDelete
+      ? "delete on an entity without softDelete is irreversible"
+      : `it writes field(s) ${instructionFields.join(", ")} flagged readAsInstruction: true`;
+    throw new Error(`"${name}": ${reason} — agent.risk must be "high" (got "${agent.risk}").`);
   }
   return { ...agent, risk: "high" };
 }
@@ -271,9 +298,15 @@ export function defineEntityWriteHandler(
       `"${name}": restore is only valid for entities declared with softDelete: true.`,
     );
   }
-  const agentHints = resolveEntityWriteAgentHints(name, verb, entity, options.agent);
   const excludedFields = options.excludeFields ?? [];
   assertExcludableFields(name, verb, entity, excludedFields);
+  const agentHints = resolveEntityWriteAgentHints(
+    name,
+    verb,
+    entity,
+    options.agent,
+    excludedFields,
+  );
 
   const table = buildEntityTable(entityName, entity);
   const executor = createEventStoreExecutor(table, entity, { entityName });

package/src/engine/instruction-fields.ts

@@ -0,0 +1,11 @@
+import type { EntityDefinition } from "./types";
+
+// Shared between the executor gate (payload-presence check on create/update)
+// and the define-time floor (resolveEntityWriteAgentHints) so both read the
+// exact same field set — a divergence here would let one enforce a flag the
+// other doesn't know about.
+export function instructionFieldNames(entity: EntityDefinition): readonly string[] {
+  return Object.entries(entity.fields)
+    .filter(([, field]) => "readAsInstruction" in field && field.readAsInstruction === true)
+    .map(([name]) => name);
+}

package/src/errors/i18n/de.yaml

@@ -173,6 +173,20 @@ irreversible_operation_requires_high_risk:
 
     `agent: { risk: "high" }` am genannten Handler deklarieren.
 
+instruction_field_write_requires_high_risk:
+  endUser: |
+    Diese Aktion ist nicht erlaubt.
+    Wende dich an einen Administrator wenn du glaubst, dass das ein Fehler ist.
+  developer: |
+    `AccessDeniedError`: der direkt aufgerufene Einstiegs-Handler schreibt ein
+    Feld mit `readAsInstruction: true` (`details.fields`), aber sein
+    aufgelöstes Agent-Risiko (`details.resolvedRisk`) liegt unter `"high"`.
+    `details.handler` nennt den Einstiegs-Handler — eine Delegation über
+    `ctx.write`/`writeAs` aus einem Handler mit niedrigerem Risiko erbt das
+    deklarierte Risiko des inneren Handlers nicht.
+
+    `agent: { risk: "high" }` am genannten Handler deklarieren.
+
 agent.tool_not_allowed:
   endUser: |
     Dieses Tool ist im aktuellen Modus nicht verfügbar.

package/src/errors/i18n/en.yaml

@@ -166,6 +166,20 @@ irreversible_operation_requires_high_risk:
 
     Declare `agent: { risk: "high" }` on the named handler.
 
+instruction_field_write_requires_high_risk:
+  endUser: |
+    This action isn't allowed.
+    Please contact an administrator if you believe this is a mistake.
+  developer: |
+    `AccessDeniedError`: the directly-dispatched entry handler writes a field
+    flagged `readAsInstruction: true` (`details.fields`) but its resolved
+    agent risk (`details.resolvedRisk`) is below `"high"`. `details.handler`
+    names the entry handler — delegating the call via `ctx.write`/`writeAs`
+    from a lower-risk handler does not inherit an inner handler's declared
+    risk.
+
+    Declare `agent: { risk: "high" }` on the named handler.
+
 agent.tool_not_allowed:
   endUser: |
     This tool is not available in the current mode.

package/src/errors/reasons.ts

@@ -68,6 +68,12 @@ export const FrameworkReasons = {
   // delete/forget but its agent.risk resolves below "high" — delegation via
   // ctx.write/writeAs from a lower-risk handler does not inherit the gate.
   irreversibleOperationRequiresHighRisk: "irreversible_operation_requires_high_risk",
+
+  // AccessDeniedError: the directly-dispatched entry handler writes a field
+  // flagged readAsInstruction: true but its agent.risk resolves below "high" —
+  // delegation via ctx.write/writeAs from a lower-risk handler does not
+  // inherit the gate.
+  instructionFieldWriteRequiresHighRisk: "instruction_field_write_requires_high_risk",
 } as const;
 
 export type FrameworkReason = (typeof FrameworkReasons)[keyof typeof FrameworkReasons];

package/src/jobs/__tests__/job-backoff.integration.test.ts

@@ -7,13 +7,12 @@
 //
 // Only lower bounds are asserted (never upper) — BullMQ schedules the next
 // attempt at failureTime + delay using the same wall clock this test reads,
-// so a >= assertion is flake-free without inflating waitFor's budget.
+// so a >= assertion is flake-free without inflating the wait budget.
 
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
 import * as z from "zod";
 import { defineFeature } from "../../engine";
 import { setupTestStack, type TestStack, TestUsers } from "../../stack";
-import { waitFor } from "../../testing";
 
 const exponentialDefaultStarts: number[] = [];
 const exponentialCustomStarts: number[] = [];
@@ -113,9 +112,8 @@ describe("job backoff waits between retries (fw#3167)", () => {
       TestUsers.admin,
     );
 
-    await waitFor(() => {
-      expect(exponentialDefaultStarts).toHaveLength(2);
-    });
+    await stack.drainJobs();
+    expect(exponentialDefaultStarts).toHaveLength(2);
 
     const [gap = 0] = gapsBetween(exponentialDefaultStarts);
     expect(gap).toBeGreaterThanOrEqual(1000);
@@ -128,9 +126,8 @@ describe("job backoff waits between retries (fw#3167)", () => {
       TestUsers.admin,
     );
 
-    await waitFor(() => {
-      expect(exponentialCustomStarts).toHaveLength(4);
-    });
+    await stack.drainJobs();
+    expect(exponentialCustomStarts).toHaveLength(4);
 
     const [gap1 = 0, gap2 = 0, gap3 = 0] = gapsBetween(exponentialCustomStarts);
     expect(gap1).toBeGreaterThanOrEqual(50);
@@ -141,9 +138,8 @@ describe("job backoff waits between retries (fw#3167)", () => {
   test('backoff: { type: "fixed", delayMs } waits the configured constant delay', async () => {
     await stack.http.writeOk("backofffixture:write:trigger-fixed-custom", {}, TestUsers.admin);
 
-    await waitFor(() => {
-      expect(fixedCustomStarts).toHaveLength(2);
-    });
+    await stack.drainJobs();
+    expect(fixedCustomStarts).toHaveLength(2);
 
     const [gap = 0] = gapsBetween(fixedCustomStarts);
     expect(gap).toBeGreaterThanOrEqual(300);

package/src/jobs/job-runner.ts

@@ -239,6 +239,11 @@ export type JobRunner = {
   // once at boot, after the dispatcher exists (job-runner construction happens
   // before it). Before this runs, JobContext.write/writeAs/queryAs throw.
   attachDispatcher(ref: DispatchWriteRef): void;
+  // Read-only snapshot across both lane queues for test-stack draining
+  // (stack.drainJobs()). Excludes delayed jobs whose BullMQ id starts with
+  // "repeat:" — those are future cron ticks, not work in flight, and would
+  // make drainJobs wait forever on a stack with a scheduled job.
+  countPendingJobs(): Promise<number>;
 };
 
 export type JobRunnerOptions = {
@@ -1335,6 +1340,28 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
     attachDispatcher(ref: DispatchWriteRef): void {
       dispatchWriteRef = ref;
     },
+    async countPendingJobs(): Promise<number> {
+      let total = 0;
+      for (const queue of Object.values(queues)) {
+        const counts = await queue.getJobCounts(
+          "waiting",
+          "active",
+          "prioritized",
+          "waiting-children",
+        );
+        total +=
+          (counts["waiting"] ?? 0) +
+          (counts["active"] ?? 0) +
+          (counts["prioritized"] ?? 0) +
+          (counts["waiting-children"] ?? 0);
+        // getJobCounts has no id-prefix filter for "delayed" — getJobs(["delayed"])
+        // loads the full Job objects (payload included) just to read .id; fine for
+        // test-draining's low volume, not a pattern for a prod-path hot loop.
+        const delayed = await queue.getJobs(["delayed"]);
+        total += delayed.filter((job) => !(job.id ?? "").startsWith("repeat:")).length;
+      }
+      return total;
+    },
   };
 
   selfRunner = runnerApi;

package/src/migrations/__tests__/pending-rebuilds.integration.test.ts

@@ -351,6 +351,7 @@ describe("enqueueProjectionRebuild — inline fallback (jobRunner without the jo
         return "should-not-happen";
       },
       attachDispatcher: () => {},
+      countPendingJobs: async () => 0,
     };
 
     const outcome = await enqueueProjectionRebuild("pendingtest:projection:pending-counts", {

package/src/pipeline/__tests__/instruction-field-gate.integration.test.ts

@@ -0,0 +1,213 @@
+// Agent-risk floor for writes on fields flagged readAsInstruction: true — a
+// later run reads such a field's value as an instruction (prompt, rule,
+// template), so the directly-dispatched entry handler must resolve agent.risk
+// "high", or the executor gate refuses before any DB write. Real HTTP calls +
+// setupTestStack — never createTestDispatcher. See kumiko-framework#3358.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import * as z from "zod";
+import { createEventStoreExecutor } from "../../db/event-store-executor";
+import { buildEntityTable } from "../../db/table-builder";
+import { createEntity, createLongTextField, createTextField, defineFeature } from "../../engine";
+import type { Registry } from "../../engine/types";
+import { resolveAgentExposure } from "../../engine/types";
+import { resetEventStore, setupTestStack, type TestStack, TestUsers } from "../../stack";
+
+const admin = TestUsers.admin;
+
+const promptEntity = createEntity({
+  table: "gate_instruction_prompts",
+  fields: {
+    label: createTextField({ personal: false, reason: "test_fixture", required: true }),
+    body: createLongTextField({
+      personal: false,
+      reason: "test_fixture",
+      readAsInstruction: true,
+    }),
+  },
+});
+const promptTable = buildEntityTable("prompt", promptEntity);
+const promptExecutor = createEventStoreExecutor(promptTable, promptEntity, {
+  entityName: "prompt",
+});
+
+const gateFeature = defineFeature("instructiongate", (r) => {
+  r.entity("prompt", promptEntity);
+
+  r.crud("prompt", promptEntity, {
+    write: { access: { roles: ["Admin"] } },
+    read: { access: { roles: ["Admin"] } },
+  });
+
+  r.writeHandler(
+    "create-prompt-mid",
+    z.object({ label: z.string(), body: z.string().optional() }),
+    async (event, ctx) => promptExecutor.create(event.payload, event.user, ctx.db),
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.writeHandler(
+    "create-prompt-high",
+    z.object({ label: z.string(), body: z.string().optional() }),
+    async (event, ctx) => promptExecutor.create(event.payload, event.user, ctx.db),
+    { access: { roles: ["Admin"] }, agent: { risk: "high" } },
+  );
+
+  r.writeHandler(
+    "update-prompt-mid",
+    z.object({ id: z.uuid(), label: z.string().optional(), body: z.string().optional() }),
+    async (event, ctx) => {
+      const { id, ...changes } = event.payload;
+      return promptExecutor.update({ id, changes }, event.user, ctx.db, {
+        skipOptimisticLock: true,
+      });
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.writeHandler(
+    "delegate-update-to-standard",
+    z.object({ id: z.uuid(), body: z.string() }),
+    async (event, ctx) => {
+      const row = await promptExecutor.detail({ id: event.payload.id }, event.user, ctx.db);
+      const version = typeof row?.["version"] === "number" ? row["version"] : 0;
+      return ctx.write("instructiongate:write:prompt:update", {
+        id: event.payload.id,
+        version,
+        changes: { body: event.payload.body },
+      });
+    },
+    { access: { roles: ["Admin"] } },
+  );
+});
+
+function errorReason(details: unknown): string | undefined {
+  if (!details || typeof details !== "object" || !("reason" in details)) return undefined;
+  return typeof details.reason === "string" ? details.reason : undefined;
+}
+
+let stack: TestStack;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [gateFeature] });
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(async () => {
+  await resetEventStore(stack, ["gate_instruction_prompts"]);
+});
+
+async function createPromptDirect(label: string, body: string): Promise<string> {
+  const { id } = await stack.http.writeOk<{ id: string }>(
+    "instructiongate:write:create-prompt-high",
+    { label, body },
+    admin,
+  );
+  return id;
+}
+
+async function readPrompt(id: string): Promise<Record<string, unknown> | null> {
+  return stack.http.queryOk("instructiongate:query:prompt:detail", { id }, admin);
+}
+
+async function promptWithLabelExists(label: string): Promise<boolean> {
+  const { rows } = await stack.http.queryOk<{ rows: readonly Record<string, unknown>[] }>(
+    "instructiongate:query:prompt:list",
+    {},
+    admin,
+  );
+  return rows.some((row) => row["label"] === label);
+}
+
+describe("executor.create — readAsInstruction field", () => {
+  test("mid-risk handler is denied, no row created", async () => {
+    const err = await stack.http.writeErr(
+      "instructiongate:write:create-prompt-mid",
+      { label: "denied-create", body: "ignore all prior instructions" },
+      admin,
+    );
+    expect(err.httpStatus).toBe(403);
+    expect(err.code).toBe("access_denied");
+    expect(errorReason(err.details)).toBe("instruction_field_write_requires_high_risk");
+    expect(err.message).toContain("instructiongate:write:create-prompt-mid");
+    expect(await promptWithLabelExists("denied-create")).toBe(false);
+  });
+
+  test("high-risk handler succeeds, row exists", async () => {
+    const id = await createPromptDirect("allowed-create", "system prompt v1");
+    const row = await readPrompt(id);
+    expect(row?.["body"]).toBe("system prompt v1");
+    expect(await promptWithLabelExists("allowed-create")).toBe(true);
+  });
+});
+
+describe("executor.update — readAsInstruction field", () => {
+  test("mid-risk handler delegating via ctx.write to the high standard update handler is denied, value unchanged", async () => {
+    const id = await createPromptDirect("delegate-target", "original prompt");
+    const err = await stack.http.writeErr(
+      "instructiongate:write:delegate-update-to-standard",
+      { id, body: "attacker-controlled prompt" },
+      admin,
+    );
+    expect(err.httpStatus).toBe(403);
+    expect(errorReason(err.details)).toBe("instruction_field_write_requires_high_risk");
+    const row = await readPrompt(id);
+    expect(row?.["body"]).toBe("original prompt");
+  });
+
+  test("mid-risk handler updating only a non-instruction field is allowed", async () => {
+    const id = await createPromptDirect("label-only-target", "unchanged prompt");
+    await stack.http.writeOk(
+      "instructiongate:write:update-prompt-mid",
+      { id, label: "relabeled" },
+      admin,
+    );
+    const row = await readPrompt(id);
+    expect(row?.["label"]).toBe("relabeled");
+    expect(row?.["body"]).toBe("unchanged prompt");
+  });
+
+  test("mid-risk handler with the instruction field in the payload is denied, value unchanged", async () => {
+    const id = await createPromptDirect("body-payload-target", "kept prompt");
+    const err = await stack.http.writeErr(
+      "instructiongate:write:update-prompt-mid",
+      { id, body: "smuggled prompt" },
+      admin,
+    );
+    expect(err.httpStatus).toBe(403);
+    expect(errorReason(err.details)).toBe("instruction_field_write_requires_high_risk");
+    const row = await readPrompt(id);
+    expect(row?.["body"]).toBe("kept prompt");
+  });
+});
+
+describe("standard entity-convention create/update handlers", () => {
+  test("resolve agent.risk to high because the entity has a readAsInstruction field", () => {
+    const registry = stack.registry as Registry;
+    const createHandler = registry.getWriteHandler("instructiongate:write:prompt:create");
+    const updateHandler = registry.getWriteHandler("instructiongate:write:prompt:update");
+    if (!createHandler || !updateHandler) throw new Error("standard handlers missing");
+    expect(resolveAgentExposure(createHandler, "write").risk).toBe("high");
+    expect(resolveAgentExposure(updateHandler, "write").risk).toBe("high");
+  });
+
+  test("standard create and update succeed over HTTP", async () => {
+    const { id } = await stack.http.writeOk<{ id: string }>(
+      "instructiongate:write:prompt:create",
+      { label: "standard-create", body: "initial prompt" },
+      admin,
+    );
+    const created = await readPrompt(id);
+    const version = typeof created?.["version"] === "number" ? created["version"] : 0;
+    await stack.http.writeOk(
+      "instructiongate:write:prompt:update",
+      { id, version, changes: { body: "revised prompt" } },
+      admin,
+    );
+    const row = await readPrompt(id);
+    expect(row?.["body"]).toBe("revised prompt");
+  });
+});

package/src/pipeline/index.ts

@@ -51,6 +51,7 @@ export { ConsumerLagError, pruneEvents } from "./event-retention";
 export type { IdempotencyGuard } from "./idempotency";
 export { createIdempotencyGuard } from "./idempotency";
 export {
+  assertInstructionFieldWriteAllowed,
   assertIrreversibleOperationAllowed,
   isIrreversibleEntityVerb,
 } from "./irreversible-operation-gate";

package/src/pipeline/irreversible-operation-gate.ts

@@ -1,6 +1,8 @@
-import { requestContext } from "../api/request-context";
+import { type RequestContextData, requestContext } from "../api/request-context";
 import type { EntityDefinition } from "../engine/types";
-import { AccessDeniedError, FrameworkReasons } from "../errors";
+import { AccessDeniedError, type FrameworkReason, FrameworkReasons } from "../errors";
+
+type EntryHandler = NonNullable<RequestContextData["entryHandler"]>;
 
 // forget hard-purges regardless of softDelete; delete is only irreversible
 // when the entity has no soft-delete recovery path.
@@ -16,22 +18,58 @@ export function isIrreversibleEntityVerb(
 // executor/KMS calls without one stay ungated in exactly two cases: deleting derived data
 // rebuildable from a reversible source (document-ingest-foundation's forget-extract-with-file-ref
 // consumer, re-created on fileRef.restored), and pipelines started by a risk "high" handler or a
-// cron scan (forget cleanup, retention, tenant destroy). A deferred context can't return
-// irreversibleOperationRequiresHighRisk to the agent synchronously, so the gate sits at the primitives.
-export function assertIrreversibleOperationAllowed(operation: string): void {
+// cron scan (forget cleanup, retention, tenant destroy). A deferred context can't return the
+// reason to the agent synchronously, so the gate sits at the primitives.
+function assertEntryHandlerHighRisk(args: {
+  reason: FrameworkReason;
+  buildMessage: (entryHandler: EntryHandler) => string;
+  details: Record<string, unknown>;
+}): void {
   const entryHandler = requestContext.get()?.entryHandler;
   // skip: no entry handler (see above) or the entry handler already resolves "high".
   if (!entryHandler || entryHandler.risk === "high") return;
   throw new AccessDeniedError({
-    message:
-      `Handler "${entryHandler.qn}" performs an irreversible ${operation} but resolves agent risk ` +
-      `"${entryHandler.risk}" — declare agent: { risk: "high" } on "${entryHandler.qn}". The ` +
-      "directly called handler must carry it; delegating via ctx.write/writeAs does not.",
+    message: args.buildMessage(entryHandler),
     details: {
-      reason: FrameworkReasons.irreversibleOperationRequiresHighRisk,
+      reason: args.reason,
       handler: entryHandler.qn,
-      operation,
       resolvedRisk: entryHandler.risk,
+      ...args.details,
     },
   });
 }
+
+export function assertIrreversibleOperationAllowed(operation: string): void {
+  assertEntryHandlerHighRisk({
+    reason: FrameworkReasons.irreversibleOperationRequiresHighRisk,
+    buildMessage: (entryHandler) =>
+      `Handler "${entryHandler.qn}" performs an irreversible ${operation} but resolves agent risk ` +
+      `"${entryHandler.risk}" — declare agent: { risk: "high" } on "${entryHandler.qn}". The ` +
+      "directly called handler must carry it; delegating via ctx.write/writeAs does not.",
+    details: { operation },
+  });
+}
+
+// Fields flagged readAsInstruction: true have their write payload presence checked here — the
+// same reasoning as assertIrreversibleOperationAllowed, but the irreversible property belongs to
+// the target field, not the verb. Presence in the payload (not a value comparison against the
+// loaded row) is the deliberate fail-closed choice — see kumiko-framework#3358.
+export function assertInstructionFieldWriteAllowed(
+  entityName: string,
+  verb: "create" | "update",
+  writtenFieldNames: readonly string[],
+  instructionFieldNames: readonly string[],
+): void {
+  const fields = writtenFieldNames.filter((name) => instructionFieldNames.includes(name));
+  // skip: the write touches no readAsInstruction field.
+  if (fields.length === 0) return;
+  assertEntryHandlerHighRisk({
+    reason: FrameworkReasons.instructionFieldWriteRequiresHighRisk,
+    buildMessage: (entryHandler) =>
+      `Handler "${entryHandler.qn}" ${verb}s "${entityName}" field(s) ${fields.join(", ")} ` +
+      `flagged readAsInstruction: true but resolves agent risk "${entryHandler.risk}" — declare ` +
+      `agent: { risk: "high" } on "${entryHandler.qn}". The directly called handler must carry ` +
+      "it; delegating via ctx.write/writeAs does not.",
+    details: { entityName, verb, fields },
+  });
+}

package/src/stack/__tests__/drain-jobs.integration.test.ts

@@ -0,0 +1,159 @@
+// fw#3360: stack.drainJobs() waits deterministically for every in-flight
+// job AND its follow-up event-consumer / job-trigger cascade — replaces
+// `waitFor` polling on a specific job's side effect.
+
+import { afterEach, describe, expect, test } from "bun:test";
+import * as z from "zod";
+import { defineFeature } from "../../engine";
+import { SYSTEM_ROLE } from "../../engine/system-user";
+import { setupTestStack, type TestStack } from "../test-stack";
+import { TestUsers } from "../test-users";
+
+const chainResults: Array<{ value: string }> = [];
+
+// Job A → write handler that appends an r.defineEvent event → the async
+// job-trigger event-consumer → Job B. Exercises exactly the gap drainJobs
+// exists for: a job-completion that only cascades into a follow-up job via
+// the event-dispatcher, not the synchronous write-handler dispatch path.
+const chainFeature = defineFeature("draintestchain", (r) => {
+  const relayed = r.defineEvent("relayed", z.object({ value: z.string() }), {
+    piiFields: "none",
+  });
+
+  r.writeHandler(
+    "start",
+    z.object({ value: z.string() }),
+    async () => ({ isSuccess: true as const, data: {} }),
+    { access: { openToAll: { reason: "test handler callable by any signed-in test user" } } },
+  );
+
+  r.writeHandler(
+    "emit-relayed",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: crypto.randomUUID(),
+        aggregateType: "draintestchain",
+        type: relayed.name,
+        payload: { value: event.payload.value },
+      });
+      return { isSuccess: true as const, data: {} };
+    },
+    { access: { roles: [SYSTEM_ROLE] } },
+  );
+
+  r.job(
+    "job-a",
+    { trigger: { on: "draintestchain:write:start" }, retries: 0 },
+    async (payload, ctx) => {
+      await ctx.write("draintestchain:write:emit-relayed", { value: payload["value"] });
+    },
+  );
+
+  r.job("job-b", { trigger: { on: relayed.name }, retries: 0 }, async (payload) => {
+    chainResults.push({ value: payload["value"] as string }); // @cast-boundary test-fixture
+  });
+});
+
+const alwaysFailsRuns: string[] = [];
+const retrySucceedsAttempts: number[] = [];
+
+const failureFeature = defineFeature("draintestfailure", (r) => {
+  r.job("always-fails", { trigger: { manual: true }, retries: 0 }, async () => {
+    alwaysFailsRuns.push("ran");
+    throw new Error("job-c always fails");
+  });
+
+  r.job(
+    "retry-succeeds",
+    { trigger: { manual: true }, retries: 1, backoff: { type: "fixed", delayMs: 10 } },
+    async () => {
+      retrySucceedsAttempts.push(Date.now());
+      if (retrySucceedsAttempts.length === 1) throw new Error("first attempt fails on purpose");
+    },
+  );
+});
+
+let stack: TestStack | undefined;
+
+afterEach(async () => {
+  if (stack) await stack.cleanup();
+  stack = undefined;
+});
+
+describe("stack.drainJobs() waits for a job's async event-trigger cascade", () => {
+  test("job A → event → job B settles before drainJobs() resolves", async () => {
+    chainResults.length = 0;
+    stack = await setupTestStack({
+      features: [chainFeature],
+      jobs: { consumerLane: "worker" },
+    });
+
+    await stack.http.writeOk("draintestchain:write:start", { value: "hi" }, TestUsers.admin);
+    await stack.drainJobs();
+
+    expect(chainResults).toEqual([{ value: "hi" }]);
+  });
+
+  test("a huge event-dispatcher poll interval doesn't stop drainJobs() from driving the cascade itself", async () => {
+    chainResults.length = 0;
+    stack = await setupTestStack({
+      features: [chainFeature],
+      jobs: { consumerLane: "worker" },
+    });
+    // stop() tears down both the poll timer AND the LISTEN/NOTIFY
+    // subscription (idempotent — cleanup()'s own stop() later is a no-op).
+    // runOnce() still works afterward (event-dispatcher.ts's own contract),
+    // so this leaves drainJobs() as the ONLY thing that can advance the
+    // job-trigger consumer past job A's emitted event — without this, the
+    // always-on pgClient wake-up races the assertion regardless of
+    // eventDispatcherPollIntervalMs.
+    await stack.eventDispatcher?.stop();
+
+    await stack.http.writeOk("draintestchain:write:start", { value: "race" }, TestUsers.admin);
+    await stack.drainJobs();
+
+    expect(chainResults).toEqual([{ value: "race" }]);
+  });
+});
+
+describe("stack.drainJobs() surfaces final job failures", () => {
+  test("a job that always throws rejects drainJobs() with its name and error", async () => {
+    alwaysFailsRuns.length = 0;
+    stack = await setupTestStack({
+      features: [failureFeature],
+      jobs: { consumerLane: "worker" },
+    });
+
+    await stack.jobRunner?.dispatch("draintestfailure:job:always-fails");
+
+    await expect(stack.drainJobs()).rejects.toThrow(
+      /draintestfailure:job:always-fails.*job-c always fails/s,
+    );
+
+    // The tracker is cleared after a rejection — a later drainJobs() call
+    // (e.g. the next test's setup) must not still see this failure.
+    await expect(stack.drainJobs()).resolves.toBeUndefined();
+  });
+
+  test("a job with retries:1 that fails once then succeeds resolves drainJobs()", async () => {
+    retrySucceedsAttempts.length = 0;
+    stack = await setupTestStack({
+      features: [failureFeature],
+      jobs: { consumerLane: "worker" },
+    });
+
+    await stack.jobRunner?.dispatch("draintestfailure:job:retry-succeeds");
+
+    await expect(stack.drainJobs()).resolves.toBeUndefined();
+    expect(retrySucceedsAttempts).toHaveLength(2);
+  });
+});
+
+describe("stack.drainJobs() without a jobRunner", () => {
+  test("rejects with a clear message when the stack has no `jobs` opt-in", async () => {
+    stack = await setupTestStack({ features: [chainFeature] });
+
+    await expect(stack.drainJobs()).rejects.toThrow(/jobRunner is undefined/);
+  });
+});

package/src/stack/drain-jobs.ts

@@ -0,0 +1,129 @@
+import type { DbConnection } from "../db";
+import { getEventsHighWaterMark } from "../event-store";
+import type { JobRunner } from "../jobs";
+import { type EventDispatcher, getConsumerState } from "../pipeline";
+
+// Gap between idle-checks while waiting for a job hook to fire. Short enough
+// that a test never feels it, long enough that consecutive idle passes don't
+// hammer Postgres/Redis with pointless polling between hook-driven wakeups.
+const DRAIN_IDLE_POLL_MS = 25;
+// Two consecutive idle passes (not one) before declaring the stack drained —
+// a single "pending===0 and consumers caught up" pass can be a race: a job
+// hook fires and enqueues a follow-up between the countPendingJobs() read
+// and the consumer check of the SAME pass. A DRAIN_IDLE_POLL_MS wait sits
+// between every pass, including the first and second idle one, so an
+// enqueue that lands just after the first idle read still gets picked up
+// by the second pass instead of racing straight past it.
+const REQUIRED_IDLE_PASSES = 2;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+export type JobFailureTracker = {
+  readonly onJobComplete: (jobName: string, jobId: string) => void;
+  readonly onJobFailed: (jobName: string, jobId: string, error: string) => void;
+  waitForActivity(): Promise<void>;
+  readonly failures: ReadonlyMap<string, { readonly jobName: string; readonly error: string }>;
+  clear(): void;
+};
+
+export function createJobFailureTracker(): JobFailureTracker {
+  const failures = new Map<string, { jobName: string; error: string }>();
+  let wake: (() => void) | undefined;
+  let armed: Promise<void> | undefined;
+
+  function fire(): void {
+    wake?.();
+    armed = undefined;
+    wake = undefined;
+  }
+
+  return {
+    onJobComplete(_jobName, jobId) {
+      // A retry that eventually succeeds must not leave a stale failure
+      // behind from its earlier attempt(s).
+      failures.delete(jobId);
+      fire();
+    },
+    onJobFailed(jobName, jobId, error) {
+      failures.set(jobId, { jobName, error });
+      fire();
+    },
+    waitForActivity() {
+      armed ??= new Promise<void>((resolve) => {
+        wake = resolve;
+      });
+      return armed;
+    },
+    failures,
+    clear() {
+      failures.clear();
+    },
+  };
+}
+
+export type DrainJobsStack = {
+  readonly db: DbConnection;
+  readonly eventDispatcher?: EventDispatcher;
+  readonly jobRunner?: JobRunner;
+};
+
+async function sharedConsumersCaughtUp(
+  db: DbConnection,
+  consumerNames: readonly string[],
+): Promise<boolean> {
+  // skip: no shared consumers wired — nothing to catch up on.
+  if (consumerNames.length === 0) return true;
+  const target = await getEventsHighWaterMark(db);
+  let allCaughtUp = true;
+  for (const name of consumerNames) {
+    const state = await getConsumerState(db, name);
+    if (!state) {
+      throw new Error(`drainJobs: consumer "${name}" not registered or per-instance`);
+    }
+    if (state.status === "dead") {
+      throw new Error(
+        `drainJobs: consumer "${state.name}" is dead — lastError: ${state.lastError ?? "unknown"}`,
+      );
+    }
+    if (state.lastProcessedEventId < target) allCaughtUp = false;
+  }
+  return allCaughtUp;
+}
+
+export async function drainJobs(stack: DrainJobsStack, tracker: JobFailureTracker): Promise<void> {
+  const { db, eventDispatcher, jobRunner } = stack;
+  if (!jobRunner) {
+    throw new Error(
+      "drainJobs: stack.jobRunner is undefined — pass `jobs: {...}` to setupTestStack and " +
+        "register at least one r.job(...) so a runner is built.",
+    );
+  }
+
+  const sharedConsumerNames = (eventDispatcher?.consumers ?? [])
+    .filter((consumer) => (consumer.delivery ?? "shared") === "shared")
+    .map((consumer) => consumer.name);
+
+  try {
+    let consecutiveIdlePasses = 0;
+    while (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
+      await eventDispatcher?.runOnce();
+      const pending = await jobRunner.countPendingJobs();
+      const caughtUp = await sharedConsumersCaughtUp(db, sharedConsumerNames);
+      consecutiveIdlePasses = pending === 0 && caughtUp ? consecutiveIdlePasses + 1 : 0;
+      if (consecutiveIdlePasses < REQUIRED_IDLE_PASSES) {
+        await Promise.race([tracker.waitForActivity(), sleep(DRAIN_IDLE_POLL_MS)]);
+      }
+    }
+
+    if (tracker.failures.size > 0) {
+      const details = [...tracker.failures.values()]
+        .map((failure) => `${failure.jobName}: ${failure.error}`)
+        .join("; ");
+      throw new Error(`drainJobs: job(s) failed: ${details}`);
+    }
+  } finally {
+    tracker.clear();
+  }
+}

package/src/stack/test-stack.ts

@@ -22,6 +22,7 @@ import { createRateLimitResolver } from "../rate-limit";
 import { createInMemorySearchAdapter } from "../search";
 import type { SearchAdapter } from "../search/types";
 import { createTestDb } from "./db";
+import { createJobFailureTracker, drainJobs } from "./drain-jobs";
 import { createEventCollector, type EventCollector } from "./event-collector";
 import { createTestRedis, type TestRedis } from "./redis";
 import { createRequestHelper, type RequestHelper } from "./request-helper";
@@ -64,6 +65,16 @@ export type TestStack = {
   // registered in the mounted features. Lets integration tests call
   // `stack.jobRunner.dispatch(...)` directly, mirroring `ctx.jobRunner`.
   jobRunner?: JobRunner;
+  // Waits for every in-flight job and its follow-up event-consumer /
+  // job-trigger cascade to settle — instead of `waitFor` polling on a
+  // specific job's side effect. Rejects with the failing job's name and
+  // error once a job exhausts its retries, or with a clear error when this
+  // stack has no jobRunner at all. Tracked failures accumulate since the
+  // PREVIOUS drainJobs() call (or setup, if none yet) — on a shared stack
+  // (e.g. beforeAll), a test that deliberately fails a job and never calls
+  // drainJobs() itself leaves that failure for the next test's drainJobs()
+  // call to reject on.
+  drainJobs: () => Promise<void>;
   cleanup: () => Promise<void>;
 };
 
@@ -361,6 +372,11 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
   // context = appContext + tracer/meter, mirroring the prod entrypoint's
   // `contextWithObservability(options.context, observability)`.
   let jobRunner: JobRunner | undefined;
+  // Fed to createJobRunner's onJobComplete/onJobFailed below so drainJobs()
+  // can tell a job's final outcome apart from an attempt that will retry —
+  // built before createJobRunner regardless of whether a runner ends up
+  // existing, so the returned drainJobs() closure always has one to read.
+  const jobFailureTracker = createJobFailureTracker();
   if (options.jobs && registry.getAllJobs().size > 0) {
     jobRunner = createJobRunner({
       registry,
@@ -374,6 +390,8 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
       ...(options.jobs.getActiveTenantIds !== undefined && {
         getActiveTenantIds: options.jobs.getActiveTenantIds,
       }),
+      onJobComplete: (jobName, jobId) => jobFailureTracker.onJobComplete(jobName, jobId),
+      onJobFailed: (jobName, jobId, error) => jobFailureTracker.onJobFailed(jobName, jobId, error),
     });
   }
 
@@ -540,6 +558,7 @@ export async function setupTestStack(options: TestStackOptions): Promise<TestSta
       ...(eventDispatcher ? { eventDispatcher } : {}),
       ...(server.lifecycle ? { lifecycle: server.lifecycle } : {}),
       ...(jobRunner ? { jobRunner } : {}),
+      drainJobs: () => drainJobs({ db: testDb.db, eventDispatcher, jobRunner }, jobFailureTracker),
       cleanup: async () => {
         if (jobRunner) await jobRunner.stop();
         if (eventDispatcher) await eventDispatcher.stop();