@cosmicdrift/kumiko-framework 0.270.0 → 0.273.0

package/src/engine/__tests__/entity-write-crosstenant.integration.test.ts

@@ -1,19 +1,23 @@
-// fw#2650 — crossTenant on write handlers. A SystemAdmin operator writes a
-// row that lives in a different tenant than their own session. That needs
-// two things: (1) an unfiltered db instead of the caller's tenant-scoped
-// one (so the row is even visible), and (2) the event-store stream AND the
-// entity's tenant-based write-ownership rule — both keyed off the ACTING
-// user, not the db — so the acting user's tenantId must be rewritten to the
-// target row's tenant before the write, not just handed an unfiltered db.
+// fw#2650/fw#2915 — crossTenant / escapeHatch on entity convention handlers. A
+// SystemAdmin operator reads/writes a row that lives in a different tenant
+// than their own session. That needs two things: (1) an unfiltered db
+// instead of the caller's tenant-scoped one (so the row is even visible),
+// and (2) the event-store stream AND the entity's tenant-based
+// write-ownership rule — both keyed off the ACTING user, not the db — so the
+// acting user's tenantId must be rewritten to the target row's tenant before
+// the write, not just handed an unfiltered db.
 //
-// Two stacks on the SAME Postgres database: one registers the update
-// handler without `crossTenant`, the other with it — a clean A/B on the one
-// flag, no handler-name collisions to work around.
+// Three stacks on the SAME Postgres database: "none" (no cross-tenant
+// option), "legacy" (`crossTenant: true`), "escapeHatch"
+// (`escapeHatch: { reason }`) — a clean A/B/C on the one option, no
+// handler-name collisions to work around.
 
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import type { EscapeHatchUseEvent } from "@cosmicdrift/kumiko-types/handlers";
 import { selectMany } from "../../db/query";
 import { buildEntityTable } from "../../db/table-builder";
 import { eventsTable } from "../../event-store";
+import type { Logger } from "../../logging/types";
 import {
   setupTestStack,
   type TestStack,
@@ -21,10 +25,12 @@ import {
   testTenantId,
   unsafeCreateEntityTable,
 } from "../../stack";
+import { DEPRECATED_CROSS_TENANT_SIGNAL } from "../entity-handlers";
 import {
   createEntity,
   createTextField,
   defineEntityCreateHandler,
+  defineEntityListHandler,
   defineEntityUpdateHandler,
   defineFeature,
   from,
@@ -32,9 +38,9 @@ import {
 
 // "Admin" passes unconditionally (any tenant may create its own rows).
 // "SystemAdmin" is tenant-scoped — this is the entity-level rule the
-// crossTenant acting-user rewrite must satisfy for the operator write to
-// go through; without the rewrite the acting user's own tenant would never
-// match a foreign row's tenantId here.
+// crossTenant/escapeHatch acting-user rewrite must satisfy for the operator
+// write to go through; without the rewrite the acting user's own tenant
+// would never match a foreign row's tenantId here.
 const thingEntity = createEntity({
   table: "ctwrite_things",
   fields: {
@@ -44,7 +50,22 @@ const thingEntity = createEntity({
 });
 const thingTable = buildEntityTable("thing", thingEntity);
 
-function buildFeature(crossTenant: boolean) {
+const ESCAPE_HATCH_REASON = "fw#2915 integration test — operator cross-tenant scan";
+
+type CrossTenantMode = "none" | "legacy" | "escapeHatch";
+
+function crossTenantOptionsFor(mode: CrossTenantMode) {
+  switch (mode) {
+    case "legacy":
+      return { crossTenant: true as const };
+    case "escapeHatch":
+      return { escapeHatch: { reason: ESCAPE_HATCH_REASON } };
+    case "none":
+      return {};
+  }
+}
+
+function buildFeature(mode: CrossTenantMode) {
   return defineFeature("ctwrite", (r) => {
     r.entity("thing", thingEntity);
     r.writeHandler(
@@ -55,7 +76,13 @@ function buildFeature(crossTenant: boolean) {
     r.writeHandler(
       defineEntityUpdateHandler("thing", thingEntity, {
         access: { roles: ["SystemAdmin"] },
-        ...(crossTenant && { crossTenant: true }),
+        ...crossTenantOptionsFor(mode),
+      }),
+    );
+    r.queryHandler(
+      defineEntityListHandler("thing", thingEntity, {
+        access: { roles: ["SystemAdmin"] },
+        ...crossTenantOptionsFor(mode),
       }),
     );
   });
@@ -63,48 +90,81 @@ function buildFeature(crossTenant: boolean) {
 
 const dbName = `kumiko_test_ctwrite_${crypto.randomUUID().replace(/-/g, "").slice(0, 8)}`;
 
-let tenantScopedStack: TestStack;
-let crossTenantStack: TestStack;
+function recordingSink(events: EscapeHatchUseEvent[]) {
+  return async (event: EscapeHatchUseEvent) => {
+    events.push(event);
+  };
+}
+
+function recordingLogger(sink: Array<{ msg: string; data?: Record<string, unknown> }>): Logger {
+  const log: Logger = {
+    info() {},
+    debug() {},
+    warn(msg, data) {
+      sink.push({ msg, data });
+    },
+    error() {},
+    child() {
+      return log;
+    },
+  };
+  return log;
+}
+
+let noneStack: TestStack;
+let legacyStack: TestStack;
+let escapeHatchStack: TestStack;
+
+const legacyWarnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+const escapeHatchWarnCalls: Array<{ msg: string; data?: Record<string, unknown> }> = [];
+const escapeHatchAuditEvents: EscapeHatchUseEvent[] = [];
 
 beforeAll(async () => {
-  tenantScopedStack = await setupTestStack({ features: [buildFeature(false)], dbName });
-  await unsafeCreateEntityTable(tenantScopedStack.db, thingEntity, "thing");
-  // Second connection to the SAME database — persistentDb:true means its
-  // cleanup() only closes the pool; tenantScopedStack (created without that
-  // flag) owns the actual DROP DATABASE and must clean up last.
-  crossTenantStack = await setupTestStack({
-    features: [buildFeature(true)],
+  noneStack = await setupTestStack({ features: [buildFeature("none")], dbName });
+  await unsafeCreateEntityTable(noneStack.db, thingEntity, "thing");
+  // Second and third connections to the SAME database — persistentDb:true
+  // means their cleanup() only closes the pool; noneStack (created without
+  // that flag) owns the actual DROP DATABASE and must clean up last.
+  legacyStack = await setupTestStack({
+    features: [buildFeature("legacy")],
+    dbName,
+    persistentDb: true,
+    extraContext: { log: recordingLogger(legacyWarnCalls) },
+  });
+  escapeHatchStack = await setupTestStack({
+    features: [buildFeature("escapeHatch")],
     dbName,
     persistentDb: true,
+    extraContext: {
+      _escapeHatchAuditSink: recordingSink(escapeHatchAuditEvents),
+      log: recordingLogger(escapeHatchWarnCalls),
+    },
   });
 });
 
 afterAll(async () => {
-  await crossTenantStack.cleanup();
-  await tenantScopedStack.cleanup();
+  await escapeHatchStack.cleanup();
+  await legacyStack.cleanup();
+  await noneStack.cleanup();
 });
 
 async function updatedEventTenantId(aggregateId: string): Promise<string | undefined> {
-  const rows = await selectMany<{ type: string; tenantId: string }>(
-    tenantScopedStack.db,
-    eventsTable,
-    {
-      aggregateId,
-    },
-  );
+  const rows = await selectMany<{ type: string; tenantId: string }>(noneStack.db, eventsTable, {
+    aggregateId,
+  });
   const updatedRow = rows.find((r) => r.type.includes("updated"));
   return updatedRow?.tenantId;
 }
 
-describe("entity write handlers: crossTenant option (fw#2650)", () => {
-  test("crossTenant handler: SystemAdmin updates a row owned by another tenant", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+describe("entity write/list handlers: crossTenant vs. escapeHatch (fw#2650/fw#2915)", () => {
+  test("legacy crossTenant handler: SystemAdmin updates a row owned by another tenant", async () => {
+    const created = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
       { label: "foreign" },
       TestUsers.otherTenant,
     );
 
-    const updated = await crossTenantStack.http.writeOk<{ id: string; data: { label: string } }>(
+    const updated = await legacyStack.http.writeOk<{ id: string; data: { label: string } }>(
       "ctwrite:write:thing:update",
       { id: created.id, version: 1, changes: { label: "touched by operator" } },
       TestUsers.systemAdmin,
@@ -113,7 +173,7 @@ describe("entity write handlers: crossTenant option (fw#2650)", () => {
 
     // Row stays on its original tenant — crossTenant reaches across the
     // tenant boundary, it does not migrate the row.
-    const rows = await selectMany(tenantScopedStack.db, thingTable, { id: created.id });
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
     expect(rows[0]?.["tenantId"]).toBe(testTenantId(2));
 
     // The append must land on the row's own tenant stream, not the acting
@@ -123,36 +183,135 @@ describe("entity write handlers: crossTenant option (fw#2650)", () => {
     expect(await updatedEventTenantId(created.id)).toBe(testTenantId(2));
   });
 
+  test("escapeHatch handler: SystemAdmin updates a row owned by another tenant, reported as acknowledge-cross-tenant", async () => {
+    escapeHatchAuditEvents.length = 0;
+    const created = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "foreign-escape-hatch" },
+      TestUsers.otherTenant,
+    );
+
+    const updated = await escapeHatchStack.http.writeOk<{ id: string; data: { label: string } }>(
+      "ctwrite:write:thing:update",
+      { id: created.id, version: 1, changes: { label: "touched by operator via escapeHatch" } },
+      TestUsers.systemAdmin,
+    );
+    expect(updated.data.label).toBe("touched by operator via escapeHatch");
+
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
+    expect(rows[0]?.["tenantId"]).toBe(testTenantId(2));
+    expect(await updatedEventTenantId(created.id)).toBe(testTenantId(2));
+
+    const matches = escapeHatchAuditEvents.filter((e) => e.kind === "acknowledge-cross-tenant");
+    expect(matches).toEqual([
+      {
+        handler: "ctwrite:write:thing:update",
+        kind: "acknowledge-cross-tenant",
+        reason: ESCAPE_HATCH_REASON,
+        tenantId: TestUsers.systemAdmin.tenantId,
+        actor: TestUsers.systemAdmin.id,
+      },
+    ]);
+  });
+
+  test("escapeHatch list: SystemAdmin sees rows from every tenant, reported as acknowledge-cross-tenant", async () => {
+    escapeHatchAuditEvents.length = 0;
+    await noneStack.http.writeOk(
+      "ctwrite:write:thing:create",
+      { label: "own-tenant-row" },
+      TestUsers.admin,
+    );
+    await noneStack.http.writeOk(
+      "ctwrite:write:thing:create",
+      { label: "other-tenant-row" },
+      TestUsers.otherTenant,
+    );
+
+    const list = await escapeHatchStack.http.queryOk<{
+      rows: ReadonlyArray<{ tenantId: string }>;
+    }>("ctwrite:query:thing:list", {}, TestUsers.systemAdmin);
+    const tenantIds = new Set(list.rows.map((r) => r.tenantId));
+    expect(tenantIds.has(testTenantId(1))).toBe(true);
+    expect(tenantIds.has(testTenantId(2))).toBe(true);
+
+    const matches = escapeHatchAuditEvents.filter((e) => e.kind === "acknowledge-cross-tenant");
+    expect(matches).toEqual([
+      {
+        handler: "ctwrite:query:thing:list",
+        kind: "acknowledge-cross-tenant",
+        reason: ESCAPE_HATCH_REASON,
+        tenantId: TestUsers.systemAdmin.tenantId,
+        actor: TestUsers.systemAdmin.id,
+      },
+    ]);
+  });
+
+  test("none: list returns only the caller's own tenant rows", async () => {
+    const created = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "none-mode-own-tenant" },
+      TestUsers.admin,
+    );
+
+    const list = await noneStack.http.queryOk<{
+      rows: ReadonlyArray<{ id: string; tenantId: string }>;
+    }>("ctwrite:query:thing:list", {}, TestUsers.systemAdmin);
+    expect(list.rows.some((r) => r.id === created.id)).toBe(true);
+    expect(list.rows.every((r) => r.tenantId === testTenantId(1))).toBe(true);
+  });
+
   test("normal (non-crossTenant) handler cannot reach a row in another tenant", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+    const created = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
       { label: "foreign-untouched" },
       TestUsers.otherTenant,
     );
 
-    const err = await tenantScopedStack.http.writeErr(
+    const err = await noneStack.http.writeErr(
       "ctwrite:write:thing:update",
       { id: created.id, version: 1, changes: { label: "nope" } },
       TestUsers.systemAdmin,
     );
     expect(err.code).toBe("not_found");
 
-    const rows = await selectMany(tenantScopedStack.db, thingTable, { id: created.id });
+    const rows = await selectMany(noneStack.db, thingTable, { id: created.id });
     expect(rows[0]?.["label"]).toBe("foreign-untouched");
   });
 
-  test("crossTenant still gates on access — a role without SystemAdmin is denied", async () => {
-    const created = await tenantScopedStack.http.writeOk<{ id: string }>(
+  test("crossTenant/escapeHatch still gate on access — a role without SystemAdmin is denied", async () => {
+    const createdLegacy = await noneStack.http.writeOk<{ id: string }>(
       "ctwrite:write:thing:create",
-      { label: "foreign-denied" },
+      { label: "foreign-denied-legacy" },
       TestUsers.otherTenant,
     );
+    const errLegacy = await legacyStack.http.writeErr(
+      "ctwrite:write:thing:update",
+      { id: createdLegacy.id, version: 1, changes: { label: "nope" } },
+      TestUsers.admin,
+    );
+    expect(errLegacy.code).toBe("access_denied");
 
-    const err = await crossTenantStack.http.writeErr(
+    const createdEscapeHatch = await noneStack.http.writeOk<{ id: string }>(
+      "ctwrite:write:thing:create",
+      { label: "foreign-denied-escape-hatch" },
+      TestUsers.otherTenant,
+    );
+    const errEscapeHatch = await escapeHatchStack.http.writeErr(
       "ctwrite:write:thing:update",
-      { id: created.id, version: 1, changes: { label: "nope" } },
+      { id: createdEscapeHatch.id, version: 1, changes: { label: "nope" } },
       TestUsers.admin,
     );
-    expect(err.code).toBe("access_denied");
+    expect(errEscapeHatch.code).toBe("access_denied");
+  });
+
+  test("legacy stack warns once per deprecated crossTenant handler at boot; the escapeHatch stack does not", () => {
+    const legacyMatches = legacyWarnCalls.filter((c) => c.msg === DEPRECATED_CROSS_TENANT_SIGNAL);
+    const legacyHandlers = legacyMatches.map((c) => c.data?.["handler"]).sort();
+    expect(legacyHandlers).toEqual(["ctwrite:query:thing:list", "ctwrite:write:thing:update"]);
+
+    const escapeHatchMatches = escapeHatchWarnCalls.filter(
+      (c) => c.msg === DEPRECATED_CROSS_TENANT_SIGNAL,
+    );
+    expect(escapeHatchMatches).toEqual([]);
   });
 });

package/src/engine/__tests__/read-steps-tenant-filter.integration.test.ts

@@ -0,0 +1,215 @@
+// fw#2914 — r.step.read.findOne/findMany now apply the caller's tenant
+// filter by default (own tenant + SYSTEM_TENANT_ID reference rows), like
+// ctx.db method-form reads. Cross-tenant reads need `unsafeAllTenants:
+// { reason }` on the step AND `escapeHatch: { reason }` on the handler,
+// reported as an "unsafe-raw" escape-hatch audit event. Real HTTP calls +
+// setupTestStack — never createTestDispatcher. Modelled on the M.1.5
+// section of pipeline-handler.integration.test.ts and
+// escape-hatch-audit.integration.test.ts.
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { z } from "zod";
+import { table, text, uuid } from "../../db/dialect";
+import { insertOne } from "../../db/query";
+import { defineFeature, defineWriteHandler } from "../../engine";
+import { setupTestStack, type TestStack, TestUsers, unsafePushTables } from "../../stack";
+import { stepsPipeline } from "../pipeline";
+import type { EscapeHatchUseEvent } from "../types";
+
+const readFilterTable = table("fw2914_read_filter_items", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  tenantId: uuid("tenant_id").notNull(),
+  label: text("label").notNull(),
+});
+
+const UNDECLARED_REASON =
+  "fw#2914 integration test — cross-tenant read step without a handler grant";
+const ESCAPED_REASON = "fw#2914 integration test — cross-tenant widget count for read step";
+
+const listSchema = z.object({});
+const listHandler = defineWriteHandler({
+  name: "list",
+  schema: listSchema,
+  access: { roles: ["Admin"] },
+  perform: stepsPipeline<z.infer<typeof listSchema>, { count: number; ids: string[] }>(({ r }) => [
+    r.step.read.findMany("items", { table: readFilterTable }),
+    r.step.return(({ steps }) => {
+      const rows = steps["items"] as readonly { id: string }[];
+      return {
+        isSuccess: true as const,
+        data: { count: rows.length, ids: rows.map((row) => row.id) },
+      };
+    }),
+  ]),
+});
+
+const getSchema = z.object({ id: z.uuid() });
+const getHandler = defineWriteHandler({
+  name: "get",
+  schema: getSchema,
+  access: { roles: ["Admin"] },
+  perform: stepsPipeline<z.infer<typeof getSchema>, { found: boolean; label: string | null }>(
+    ({ event, r }) => [
+      r.step.read.findOne("item", {
+        table: readFilterTable,
+        where: () => ({ id: event.payload.id }),
+      }),
+      r.step.return(({ steps }) => {
+        const row = steps["item"] as { label?: string } | null;
+        return {
+          isSuccess: true as const,
+          data: { found: row !== null, label: row?.label ?? null },
+        };
+      }),
+    ],
+  ),
+});
+
+const listUnsafeUndeclaredSchema = z.object({});
+const listUnsafeUndeclaredHandler = defineWriteHandler({
+  name: "list-unsafe-undeclared",
+  schema: listUnsafeUndeclaredSchema,
+  access: { roles: ["Admin"] },
+  perform: stepsPipeline<z.infer<typeof listUnsafeUndeclaredSchema>, { count: number }>(({ r }) => [
+    r.step.read.findMany("items", {
+      table: readFilterTable,
+      unsafeAllTenants: { reason: UNDECLARED_REASON },
+    }),
+    r.step.return(({ steps }) => ({
+      isSuccess: true as const,
+      data: { count: (steps["items"] as readonly unknown[]).length },
+    })),
+  ]),
+});
+
+const listEscapedSchema = z.object({});
+const listEscapedHandler = defineWriteHandler({
+  name: "list-escaped",
+  schema: listEscapedSchema,
+  access: { roles: ["Admin"] },
+  escapeHatch: { reason: ESCAPED_REASON },
+  perform: stepsPipeline<z.infer<typeof listEscapedSchema>, { count: number }>(({ r }) => [
+    r.step.read.findMany("items", {
+      table: readFilterTable,
+      unsafeAllTenants: { reason: ESCAPED_REASON },
+    }),
+    r.step.return(({ steps }) => ({
+      isSuccess: true as const,
+      data: { count: (steps["items"] as readonly unknown[]).length },
+    })),
+  ]),
+});
+
+const readStepsTenantFilterFeature = defineFeature("read-steps-tenant-filter", (r) => {
+  r.requires.projection("fw2914_read_filter_items");
+  r.writeHandler(listHandler);
+  r.writeHandler(getHandler);
+  r.writeHandler(listUnsafeUndeclaredHandler);
+  r.writeHandler(listEscapedHandler);
+});
+
+const admin = TestUsers.admin;
+const otherTenant = TestUsers.otherTenant;
+
+describe("r.step.read.findOne/findMany tenant-filtering (fw#2914)", () => {
+  let stack: TestStack;
+  const events: EscapeHatchUseEvent[] = [];
+  let adminRowId: string;
+  let otherTenantRowId: string;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [readStepsTenantFilterFeature],
+      extraContext: {
+        _escapeHatchAuditSink: async (event: EscapeHatchUseEvent) => {
+          events.push(event);
+        },
+      },
+    });
+    await unsafePushTables(stack.db, { fw2914_read_filter_items: readFilterTable });
+
+    const adminRow = await insertOne<{ id: string }>(stack.db, readFilterTable, {
+      tenantId: admin.tenantId,
+      label: "admin-row",
+    });
+    const otherRow = await insertOne<{ id: string }>(stack.db, readFilterTable, {
+      tenantId: otherTenant.tenantId,
+      label: "other-tenant-row",
+    });
+    adminRowId = adminRow!.id;
+    otherTenantRowId = otherRow!.id;
+  });
+
+  afterAll(async () => {
+    await stack.cleanup();
+  });
+
+  test("read.findMany returns only the caller's own tenant rows", async () => {
+    const data = await stack.http.writeOk<{ count: number; ids: string[] }>(
+      "read-steps-tenant-filter:write:list",
+      {},
+      admin,
+    );
+
+    expect(data.count).toBe(1);
+    expect(data.ids).toEqual([adminRowId]);
+    expect(data.ids).not.toContain(otherTenantRowId);
+  });
+
+  test("read.findOne returns the row when it belongs to the caller's tenant", async () => {
+    const data = await stack.http.writeOk<{ found: boolean; label: string | null }>(
+      "read-steps-tenant-filter:write:get",
+      { id: adminRowId },
+      admin,
+    );
+
+    expect(data).toEqual({ found: true, label: "admin-row" });
+  });
+
+  test("read.findOne returns null for a row belonging to a different tenant", async () => {
+    const data = await stack.http.writeOk<{ found: boolean; label: string | null }>(
+      "read-steps-tenant-filter:write:get",
+      { id: otherTenantRowId },
+      admin,
+    );
+
+    expect(data).toEqual({ found: false, label: null });
+  });
+
+  test("unsafeAllTenants without escapeHatch on the handler is denied and reports nothing", async () => {
+    events.length = 0;
+
+    const err = await stack.http.writeErr(
+      "read-steps-tenant-filter:write:list-unsafe-undeclared",
+      {},
+      admin,
+    );
+
+    expect(err.httpStatus).toBe(403);
+    expect(err.code).toBe("access_denied");
+    expect(events.filter((e) => e.kind === "unsafe-raw")).toEqual([]);
+  });
+
+  test("unsafeAllTenants with escapeHatch on the handler sees rows across tenants and reports unsafe-raw", async () => {
+    events.length = 0;
+
+    const data = await stack.http.writeOk<{ count: number }>(
+      "read-steps-tenant-filter:write:list-escaped",
+      {},
+      admin,
+    );
+
+    expect(data.count).toBeGreaterThanOrEqual(2);
+
+    const matches = events.filter((e) => e.kind === "unsafe-raw");
+    expect(matches).toEqual([
+      {
+        handler: "read-steps-tenant-filter:write:list-escaped",
+        kind: "unsafe-raw",
+        reason: ESCAPED_REASON,
+        tenantId: admin.tenantId,
+        actor: admin.id,
+      },
+    ]);
+  });
+});

package/src/engine/__tests__/required-surface-keys.test.ts

@@ -44,6 +44,22 @@ describe("requiredKeysFromScreen", () => {
     expect(keys).toContain(fieldLabelKey("publicstatus", ACTION_FORM_ENTITY, "title"));
   });
 
+  test("actionForm honors a fieldLabels override, falls back to ACTION_FORM_ENTITY otherwise", () => {
+    const keys = requiredKeysFromScreen("publicstatus", {
+      id: "reschedule-form",
+      type: "actionForm",
+      handler: "publicstatus:write:incident:reschedule",
+      fields: { dueAt: { type: "date" }, note: { type: "text" } },
+      fieldLabels: { dueAt: "publicstatus:override.dueAt" },
+      layout: {
+        sections: [{ fields: ["dueAt", "note"] }],
+      },
+    });
+    expect(keys).toContain("publicstatus:override.dueAt");
+    expect(keys).not.toContain(fieldLabelKey("publicstatus", ACTION_FORM_ENTITY, "dueAt"));
+    expect(keys).toContain(fieldLabelKey("publicstatus", ACTION_FORM_ENTITY, "note"));
+  });
+
   test("entityEdit emits submitLabel + section titles + field labels (override honored)", () => {
     const screen: EntityEditScreenDefinition = {
       id: "component-edit",