@@ -189,6 +189,35 @@ edit (two registered `description` strings) and was ruled a hold, as 1.0.4's was
 
 ### Fixed
 
+- **Java: no POST could create anything for an entity whose primary key is `@required`.** The
+  generated Spring controller's vanilla create handler validated the WHOLE request DTO:
+  `if (!validator.validate(dto).isEmpty()) return 400 {"error":"validation"}`. But
+  `SpringDtoGenerator` emits ONE record used as both request and response body, so a `@required`
+  primary key earns `@NotNull` — a true statement about the RESPONSE and a false one about the
+  request, since `identity.primary @generation: uuid|increment` means the database supplies the
+  key and the caller must not invent one. Every create therefore answered 400, and the only
+  workaround was a client-supplied primary key, which defeats the declared generation strategy.
+
+  The generator already knew the rule and one door never called it:
+  `SpringDtoGenerator.settableFields(...)` returns "effective scalars MINUS the primary key MINUS
+  the discriminator", and its javadoc states it outright — *"the PK is auto-generated and the
+  discriminator is injected from the URL, so neither is validated from the body."* It was applied
+  on the TPH create path and to `<Entity>Patch`. So a TPH entity POSTed fine while a plain one
+  did not: same model, same generator, two write paths, one of which had learned the rule.
+
+  The vanilla create now emits a `SERVER_OWNED_ON_CREATE` set (primary-key components plus
+  `@autoSet` columns) and filters violations by top-level property name. `validator.validate(dto)`
+  is KEPT rather than narrowed to per-property `validateValue`, because it is what cascades
+  `@Valid` into nested value objects — the violations are filtered, not the validation weakened,
+  and a nested path like `labels[0].code` can never match a top-level name, so cascaded
+  constraints still reject. An entity with no server-owned component keeps its previous handler
+  byte-for-byte.
+
+  **No corpus could have caught it**, which is worth recording: the api-contract corpus's only
+  entity declares `Author.id` with no `@required`, so no port's DTO ever annotated the key and
+  both lanes stayed green everywhere. Found by building a Java adopter app, where a shared
+  `BaseEntity` declares `id` required — the shape real models actually have.
+
 - **Java/Kotlin: a `<loader><libraries>` entry naming a LAYER (`iam/db`) failed the build,
   so the JVM could opt into a library's design but never its tables.** Libraries are
   layered and the selection is layer-granular — `"iam"` is the inert core, `"iam/db"` the
 
@@ -227,6 +227,7 @@ protected void emit(MetaObject entity, Path outRoot) {
         }
         src.append(");\n\n");
         appendSortDefaultOrders(src, entity, sortFields);
+        appendServerOwnedOnCreate(src, entity);
 
         // Repository wiring — constructor injection (Spring's recommended idiom; avoids
         // field-injection magic, plays well with final fields + final test seams). The
@@ -296,7 +297,31 @@ protected void emit(MetaObject entity, Path outRoot) {
         // any field-constraint violation BEFORE persisting.
         src.append("    @PostMapping\n");
         src.append("    public ResponseEntity<?> create(@RequestBody ").append(dtoName).append(" dto) {\n");
-        src.append("        if (!validator.validate(dto).isEmpty()) {\n");
+        // A caller does not supply server-owned columns, so a @NotNull on one must not reject
+        // the request. The DTO is BOTH the request and the response body, so `id` carries
+        // @NotNull because it is @required in the RESPONSE — while being identity.primary
+        // @generation:uuid, i.e. a column the database defaults and the caller must not invent.
+        // Validating the whole DTO therefore made every POST a 400 for any entity whose PK is
+        // @required, and the only "workaround" was a client-invented primary key.
+        //
+        // The TPH create path has always applied this rule, through
+        // SpringDtoGenerator.settableFields ("the PK is auto-generated and the discriminator is
+        // injected from the URL, so neither is validated from the body") — which is why a TPH
+        // entity POSTed fine while a vanilla one did not. This is the vanilla path adopting the
+        // same rule, so the two write surfaces finally agree.
+        //
+        // validator.validate(dto) is KEPT rather than narrowed to per-property validateValue:
+        // it is what cascades @Valid into nested value objects. The violations are FILTERED,
+        // and only by TOP-LEVEL property name — a nested path like "labels[0].code" can never
+        // match, so cascaded constraints still reject.
+        if (serverOwnedOnCreate(entity).isEmpty()) {
+            // Byte-identical to the pre-fix handler for an entity with no server-owned column,
+            // so this change moves only the output it has to.
+            src.append("        if (!validator.validate(dto).isEmpty()) {\n");
+        } else {
+            src.append("        if (validator.validate(dto).stream()\n");
+            src.append("                .anyMatch(v -> !SERVER_OWNED_ON_CREATE.contains(v.getPropertyPath().toString()))) {\n");
+        }
         src.append("            return ResponseEntity.badRequest().body(Map.of(\"error\", \"validation\"));\n");
         src.append("        }\n");
         // Issue #203: honor @autoSet — stamp EVERY onCreate AND onUpdate column with now() before
@@ -941,4 +966,47 @@ private static void appendSortDefaultOrders(StringBuilder src, MetaObject owner,
            .append(entries).append(");\n\n");
     }
 
+    /**
+     * The DTO record components a CALLER never supplies on create, because the server owns them:
+     * the primary-key field(s) and every {@code @autoSet} column.
+     *
+     * <p>This is the same concept {@link SpringDtoGenerator#settableFields(MetaObject, String)}
+     * already excludes for the TPH create path and the {@code <Entity>Patch} — stated here as the
+     * COMPLEMENT (what to ignore) rather than the settable set, because the vanilla create
+     * validates the whole DTO for its {@code @Valid} cascade and filters the result.</p>
+     *
+     * <p>Returned as record-component names, which is what a {@code ConstraintViolation}'s
+     * property path spells for a record.</p>
+     */
+    private static List<String> serverOwnedOnCreate(MetaObject entity) {
+        List<String> pkFields = entity.getIdentities(true).stream()
+            .filter(com.metaobjects.identity.MetaIdentity::isPrimary)
+            .findFirst()
+            .map(com.metaobjects.identity.MetaIdentity::getFields)
+            .orElse(List.of());
+
+        List<String> out = new ArrayList<>();
+        for (MetaField f : SpringDtoGenerator.scalarFields(entity)) {
+            if (pkFields.contains(f.getName()) || AutoSetSupport.isAutoSet(f)) {
+                String component = SpringNaming.recordComponentName(f.getName());
+                if (!out.contains(component)) out.add(component);
+            }
+        }
+        return out;
+    }
+
+    private static void appendServerOwnedOnCreate(StringBuilder src, MetaObject entity) {
+        List<String> serverOwned = serverOwnedOnCreate(entity);
+        if (serverOwned.isEmpty()) return;   // no constant, and the handler keeps its old shape
+        src.append("    /** Components the server owns on create (primary key, @autoSet): a\n");
+        src.append("     *  @NotNull on one of these describes the RESPONSE shape and must not\n");
+        src.append("     *  reject a create body that legitimately omits it. */\n");
+        src.append("    private static final Set<String> SERVER_OWNED_ON_CREATE = Set.of(");
+        for (int i = 0; i < serverOwned.size(); i++) {
+            if (i > 0) src.append(", ");
+            src.append('"').append(serverOwned.get(i)).append('"');
+        }
+        src.append(");\n\n");
+    }
+
 }
@@ -246,4 +246,94 @@ public void viewKindEntitiesAreSkipped() throws Exception {
         assertFalse("view-kind entities must NOT produce a controller; saw " + controller + " present",
             Files.exists(controller));
     }
+
+    /**
+     * The shape every real adopter has and no other fixture in this file had: a primary key
+     * that is {@code @required} AND server-generated. {@code AUTHOR_FIXTURE}'s {@code id}
+     * carries no {@code @required}, so the DTO never put {@code @NotNull} on it and the create
+     * handler's over-broad validation could not be observed — which is exactly why FINDINGS F25
+     * shipped and why this fixture exists rather than a tweak to that one.
+     */
+    private static final String REQUIRED_PK_FIXTURE = """
+        {
+          "metadata.root": { "package": "acme::ship", "children": [
+            { "object.entity": { "name": "Parcel", "children": [
+                { "field.uuid":      { "name": "id", "@required": true } },
+                { "field.string":    { "name": "code", "@maxLength": 24, "@required": true } },
+                { "field.timestamp": { "name": "createdAt", "@required": true } },
+                { "source.rdb":      { "@table": "parcel" } },
+                { "identity.primary": { "name": "pk", "@fields": ["id"], "@generation": "uuid" } }
+            ] } }
+          ] }
+        }
+        """;
+
+    /**
+     * A POST must not be rejected for omitting a column the SERVER owns.
+     *
+     * <p>The DTO is both the request and the response body, so a {@code @required} primary key
+     * earns {@code @NotNull} — a true statement about the response, and a false one about the
+     * request, because {@code @generation: uuid} means the caller must NOT invent the key.
+     * Validating the whole DTO therefore turned every create into a 400, and the only workaround
+     * was a client-supplied primary key, which defeats the declared strategy (FINDINGS F25).</p>
+     *
+     * <p>The TPH create path already applied this rule via
+     * {@code SpringDtoGenerator.settableFields}; this pins the vanilla path to the same answer.</p>
+     */
+    @Test
+    public void createDoesNotValidateServerOwnedColumnsOutOfTheBody() throws Exception {
+        Path outDir = tempFolder.newFolder("ctrl-pk").toPath();
+        Path workspace = tempFolder.newFolder("ctrl-pk-fx").toPath();
+        MetaDataLoader loader = SpringTestFixtures.loadFixture(workspace, "parcel-pk", REQUIRED_PK_FIXTURE);
+
+        SpringControllerGenerator gen = new SpringControllerGenerator();
+        Map<String, String> args = new HashMap<>();
+        args.put("outputDir", outDir.toString());
+        gen.setArgs(args);
+        gen.execute(loader);
+
+        String src = Files.readString(outDir.resolve("acme/ship/ParcelController.java"));
+
+        assertTrue("the server-owned set must name the generated primary key; saw:\n" + src,
+            src.contains("SERVER_OWNED_ON_CREATE = Set.of(\"id\")"));
+
+        // The create handler must FILTER violations, not simply reject any.
+        assertTrue("create must ignore violations on server-owned components; saw:\n" + src,
+            src.contains(".anyMatch(v -> !SERVER_OWNED_ON_CREATE.contains(v.getPropertyPath().toString()))"));
+        assertFalse("create must no longer reject on ANY violation; saw:\n" + src,
+            src.contains("if (!validator.validate(dto).isEmpty())"));
+
+        // And it must still VALIDATE — the cascade into nested beans is why validate(dto) is
+        // kept rather than narrowed to per-property validateValue.
+        assertTrue("create must still run the validator; saw:\n" + src,
+            src.contains("validator.validate(dto)"));
+    }
+
+    /**
+     * The rule keys on being the PRIMARY KEY, not on being {@code @required}.
+     *
+     * <p>{@code AUTHOR_FIXTURE}'s {@code id} carries no {@code @required}, so the DTO puts no
+     * {@code @NotNull} on it and the filter has nothing to ignore — but the component is still
+     * server-owned ({@code @generation: increment}), so the set names it anyway. Pinning this
+     * keeps the two cases from drifting into two rules: a key the database generates is not
+     * caller-supplied whether or not the model also calls it required.</p>
+     */
+    @Test
+    public void serverOwnedKeysOnThePrimaryKeyNotOnRequired() throws Exception {
+        Path outDir = tempFolder.newFolder("ctrl-nopk").toPath();
+        Path workspace = tempFolder.newFolder("ctrl-nopk-fx").toPath();
+        MetaDataLoader loader = SpringTestFixtures.loadFixture(workspace, "author-nopk", AUTHOR_FIXTURE);
+
+        SpringControllerGenerator gen = new SpringControllerGenerator();
+        Map<String, String> args = new HashMap<>();
+        args.put("outputDir", outDir.toString());
+        gen.setArgs(args);
+        gen.execute(loader);
+
+        String src = Files.readString(outDir.resolve("acme/blog/AuthorController.java"));
+        assertTrue("a generated PK is server-owned even without @required; saw:\n" + src,
+            src.contains("SERVER_OWNED_ON_CREATE = Set.of(\"id\")"));
+        assertFalse("and the over-broad guard is gone here too; saw:\n" + src,
+            src.contains("if (!validator.validate(dto).isEmpty())"));
+    }
 }