@cosmicdrift/kumiko-framework 0.288.0 → 0.290.0

package/src/engine/screen-helpers.ts

@@ -98,6 +98,23 @@ export function isWriteFormEditSection(section: EditSectionSpec): section is Edi
   return section.kind === "writeForm";
 }
 
+/** Structural shape of every section that can carry `fields` and/or `groups` —
+ *  matches EditWriteFormSection (no `groups`) too, so callers need no narrowing. */
+export type FieldsOrGroupsSection = {
+  readonly fields: readonly EditFieldSpec[];
+  readonly groups?: readonly {
+    readonly title: string;
+    readonly fields: readonly EditFieldSpec[];
+  }[];
+};
+
+// Union of both sources, unlike the boot-validator's either-or flattening: that
+// one runs after the fields-XOR-groups check, collectors run without it and must
+// not drop a source (fw#2986).
+export function sectionFieldSpecs(section: FieldsOrGroupsSection): readonly EditFieldSpec[] {
+  return [...section.fields, ...(section.groups?.flatMap((group) => group.fields) ?? [])];
+}
+
 // Type guard — narrows FieldRenderer to FormatSpec. Useful for renderer
 // authors who branch on the three FieldRenderer variants without manual
 // "format" in renderer checks.

package/src/errors/classes.ts

@@ -138,6 +138,30 @@ export class VersionConflictError extends ConflictError {
   }
 }
 
+// `update()`'s optional `expect:` precondition (kumiko-framework#3024) —
+// a freshly-read row no longer matches the caller's declared field values.
+// Distinct from VersionConflictError: that one guards the stream version,
+// this one guards an arbitrary business field a lifecycle transition
+// declared ("only from status Active"). Same 409 family: the client can
+// resolve it by re-checking the entity's current state.
+export type PreconditionFailedDetails = {
+  readonly entityId: number | string;
+  readonly field: string;
+};
+
+export class PreconditionFailedError extends ConflictError {
+  override readonly code: string = "precondition_failed";
+
+  constructor(details: PreconditionFailedDetails, opts?: Pick<ErrorOpts, "i18nKey" | "cause">) {
+    super({
+      message: `precondition failed for entity ${details.entityId}: field "${details.field}" no longer matches the expected value`,
+      i18nKey: opts?.i18nKey ?? "errors.preconditionFailed",
+      details,
+      ...(opts?.cause && { cause: opts.cause }),
+    });
+  }
+}
+
 // The caller retried a write with an idempotencyKey it had already used —
 // the event-store's partial unique index on metadata.idempotencyKey caught
 // the duplicate. Distinct from unique_violation/version_conflict: this is

package/src/errors/index.ts

@@ -2,6 +2,7 @@ export type {
   FeatureDisabledDetails,
   FieldIssue,
   NotFoundDetails,
+  PreconditionFailedDetails,
   RateLimitDetails,
   UnconfiguredDetails,
   UniqueViolationDetails,
@@ -16,6 +17,7 @@ export {
   IdempotentReplayError,
   InternalError,
   NotFoundError,
+  PreconditionFailedError,
   RateLimitError,
   UnconfiguredError,
   UniqueViolationError,
@@ -25,6 +27,7 @@ export {
 } from "./classes";
 export type { ErrorCtorInput, ErrorOpts } from "./kumiko-error";
 export { isKumikoError, KumikoError } from "./kumiko-error";
+export { memberResolutionReadOnlyDenied } from "./member-resolution";
 export type { AgentReason, FrameworkReason } from "./reasons";
 export { AgentReasons, FrameworkReasons } from "./reasons";
 export type { ErrorLogEntry, ErrorResponseBody } from "./serialize";

package/src/errors/member-resolution.ts

@@ -0,0 +1,12 @@
+import { AccessDeniedError } from "./classes";
+import { FrameworkReasons } from "./reasons";
+
+// Lives in errors/ (not pipeline/) so db/tenant-db.ts can throw it without importing pipeline.
+export function memberResolutionReadOnlyDenied(cause?: unknown): AccessDeniedError {
+  return new AccessDeniedError({
+    message:
+      "a resolved member principal (ctx.queryAsMember) cannot write or reach raw SQL — read-only",
+    details: { reason: FrameworkReasons.memberResolutionReadOnly },
+    ...(cause instanceof Error && { cause }),
+  });
+}

package/src/event-store/__tests__/backfill-pii.integration.test.ts

@@ -42,7 +42,7 @@ const BIDX_KEY = Buffer.alloc(32, 5).toString("base64");
 const contactEntity = createEntity({
   fields: {
     email: createTextField({ required: true, personal: "self", find: "exact" }),
-    displayName: createTextField(),
+    displayName: createTextField({ personal: false, reason: "test_fixture" }),
   },
 });
 const contactTable = buildEntityTable("contact", contactEntity);
@@ -82,7 +82,7 @@ const signalsFeature = defineFeature("signals", (r) => {
 // absent from an old event's payload, unlike contact.email (self-subject via row id).
 const noteEntity = createEntity({
   fields: {
-    authorId: createTextField(),
+    authorId: createTextField({ personal: false, reason: "test_fixture" }),
     body: createTextField({ personal: { of: "authorId" }, find: "none" }),
   },
 });

package/src/event-store/__tests__/event-attribution.integration.test.ts

@@ -0,0 +1,186 @@
+// #3043 — event attribution. append() stamps metadata.feature +
+// metadata.handler from the ambient execution scope, below every envelope
+// builder, so no writer can forget it.
+//
+// Claims pinned here:
+//   1. Dispatch path: an event a write-handler appends carries the handler's
+//      qualified name and its owning feature.
+//   2. In-process path: the entity-executor's CRUD event carries the SAME
+//      attribution although nothing was passed through its signature.
+//   3. MSP-apply: an event an apply writes is attributed to the consumer, not
+//      to the handler that started the chain.
+//   4. No scope: a bare append() stamps the sentinel, never a guess.
+//   5. appendRaw stays unstamped — historical rows keep their metadata verbatim
+//      and stay readable without the new fields.
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { UNATTRIBUTED_ORIGIN } from "@cosmicdrift/kumiko-types/event-store-types";
+import { z } from "zod";
+import { createEventStoreExecutor } from "../../db/event-store-executor";
+import { selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import { createEntity, createTextField, defineFeature } from "../../engine";
+import {
+  resetEventStore,
+  setupTestStack,
+  type TestStack,
+  TestUsers,
+  unsafeCreateEntityTable,
+} from "../../stack";
+import { generateId as uuid } from "../../utils";
+import { appendRaw } from "../admin-api";
+import { append } from "../event-store";
+import { eventsTable } from "../events-schema";
+
+const orderEntity = createEntity({
+  table: "read_attribution_orders",
+  fields: {
+    item: createTextField({ personal: false, reason: "test_fixture", required: true }),
+  },
+});
+
+const orderTable = buildEntityTable("attr-order", orderEntity);
+
+const PLACED = "attribution:event:placed";
+const CONFIRMED = "attribution:event:confirmed";
+const PLACE_HANDLER = "attribution:write:order:place";
+const CONFIRMER_MSP = "attribution:projection:confirmer";
+
+const attributionFeature = defineFeature("attribution", (r) => {
+  r.entity("attr-order", orderEntity);
+
+  const placed = r.defineEvent("placed", z.object({ orderId: z.uuid() }), { piiFields: "none" });
+  const confirmed = r.defineEvent("confirmed", z.object({ orderId: z.uuid() }), {
+    piiFields: "none",
+  });
+
+  const orderExecutor = createEventStoreExecutor(orderTable, orderEntity, {
+    entityName: "attr-order",
+  });
+
+  r.writeHandler(
+    "order:place",
+    z.object({ item: z.string() }),
+    async (event, ctx) => {
+      const created = await orderExecutor.create({ item: event.payload.item }, event.user, ctx.db);
+      if (!created.isSuccess) return created;
+      await ctx.unsafeAppendEvent({
+        aggregateId: String(created.data.id),
+        aggregateType: "attr-order",
+        type: placed.name,
+        payload: { orderId: String(created.data.id) },
+      });
+      return created;
+    },
+    { access: { roles: ["Admin"] } },
+  );
+
+  r.multiStreamProjection({
+    name: "confirmer",
+    apply: {
+      [placed.name]: async (event, _tx, ctx) => {
+        if (!ctx) throw new Error("MSP-apply ctx missing — regression of C.2b wiring");
+        await ctx.unsafeAppendEvent({
+          aggregateId: event.aggregateId,
+          aggregateType: "attr-order",
+          type: confirmed.name,
+          payload: { orderId: event.aggregateId },
+        });
+      },
+    },
+  });
+});
+
+let stack: TestStack;
+const admin = TestUsers.admin;
+
+beforeAll(async () => {
+  stack = await setupTestStack({ features: [attributionFeature], systemHooks: [] });
+  await unsafeCreateEntityTable(stack.db, orderEntity, "attr-order");
+});
+
+afterAll(async () => {
+  await stack.cleanup();
+});
+
+afterEach(async () => {
+  await resetEventStore(stack, ["read_attribution_orders"]);
+});
+
+type Origin = { feature?: string; handler?: string };
+
+async function originOf(type: string): Promise<Origin> {
+  const rows = await selectMany(stack.db, eventsTable);
+  const row = rows.find((r: Record<string, unknown>) => r["type"] === type);
+  expect(row).toBeDefined();
+  return (row?.["metadata"] ?? {}) as Origin;
+}
+
+describe("#3043 — event attribution from the execution scope", () => {
+  test("dispatch path: ctx.appendEvent stamps the handler and its feature", async () => {
+    await stack.http.writeOk(PLACE_HANDLER, { item: "widget" }, admin);
+
+    expect(await originOf(PLACED)).toMatchObject({
+      feature: "attribution",
+      handler: PLACE_HANDLER,
+    });
+  });
+
+  test("in-process path: the entity-executor CRUD event carries the same attribution", async () => {
+    await stack.http.writeOk(PLACE_HANDLER, { item: "sprocket" }, admin);
+
+    // Nothing is threaded through createEntityExecutor → EventStoreExecutor.write —
+    // the write runs inside the handler's scope, so the stamp finds it anyway.
+    expect(await originOf("attr-order.created")).toMatchObject({
+      feature: "attribution",
+      handler: PLACE_HANDLER,
+    });
+  });
+
+  test("MSP-apply: the follow-up event is attributed to the consumer, not the trigger", async () => {
+    await stack.http.writeOk(PLACE_HANDLER, { item: "gasket" }, admin);
+    await stack.eventDispatcher?.runOnce();
+
+    expect(await originOf(CONFIRMED)).toMatchObject({
+      feature: "attribution",
+      handler: CONFIRMER_MSP,
+    });
+  });
+
+  test("no scope: a bare append() stamps the sentinel instead of guessing", async () => {
+    const aggregateId = uuid();
+    await append(stack.db, {
+      aggregateId,
+      aggregateType: "attr-order",
+      tenantId: admin.tenantId,
+      expectedVersion: 0,
+      type: PLACED,
+      payload: { orderId: aggregateId },
+      metadata: { userId: admin.id },
+    });
+
+    expect(await originOf(PLACED)).toMatchObject({
+      feature: UNATTRIBUTED_ORIGIN,
+      handler: UNATTRIBUTED_ORIGIN,
+    });
+  });
+
+  test("appendRaw keeps historical metadata verbatim and stays readable", async () => {
+    const aggregateId = uuid();
+    await appendRaw(stack.db, {
+      aggregateId,
+      aggregateType: "attr-order",
+      tenantId: admin.tenantId,
+      expectedVersion: 0,
+      type: CONFIRMED,
+      payload: { orderId: aggregateId },
+      metadata: { userId: admin.id },
+      createdAt: Temporal.Instant.from("2023-01-15T10:00:00Z"),
+      createdBy: admin.id,
+    });
+
+    const origin = await originOf(CONFIRMED);
+    expect(origin.feature).toBeUndefined();
+    expect(origin.handler).toBeUndefined();
+  });
+});

package/src/event-store/__tests__/provenance-append.integration.test.ts

@@ -2,7 +2,7 @@ import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:tes
 import { type BunTestDb, createTestDb } from "../../bun-db/__tests__/bun-test-db";
 import { asRawClient, transaction } from "../../db/query";
 import { createTenantDb, type TenantDb } from "../../db/tenant-db";
-import { InternalError } from "../../errors";
+import { AccessDeniedError, InternalError } from "../../errors";
 import { ensureTemporalPolyfill } from "../../time/polyfill";
 import { generateId as uuid } from "../../utils";
 import { createEventsTable, loadAggregate, VersionConflictError } from "../index";
@@ -12,6 +12,14 @@ let testDb: BunTestDb;
 let tdb: TenantDb;
 
 const tenantA = uuid();
+const tenantB = uuid();
+
+async function countAllEvents(): Promise<number> {
+  const rows = await asRawClient(testDb.db).unsafe<{ n: string }>(
+    "SELECT count(*)::text AS n FROM kumiko_events",
+  );
+  return Number(rows[0]?.n);
+}
 
 function provenanceEvent(overrides: Partial<ProvenanceEventInput>): ProvenanceEventInput {
   return {
@@ -106,4 +114,28 @@ describe("appendProvenanceEvent", () => {
     const events = await loadAggregate(testDb.db, event.aggregateId, tenantA);
     expect(events).toHaveLength(0);
   });
+
+  test("a foreign event.tenantId is rejected and writes no row at all", async () => {
+    const event = provenanceEvent({ tenantId: tenantB });
+    const before = await countAllEvents();
+
+    await expect(appendProvenanceEvent(tdb, event)).rejects.toThrow(AccessDeniedError);
+    await expect(appendProvenanceEvent(tdb, event)).rejects.toThrow(
+      new RegExp(`"${tenantB}".+"${tenantA}"`),
+    );
+
+    expect(await countAllEvents()).toBe(before);
+    expect(await loadAggregate(testDb.db, event.aggregateId, tenantB)).toHaveLength(0);
+  });
+
+  test('a mode: "system" TenantDb is rejected for a foreign event.tenantId too', async () => {
+    const systemTdb = createTenantDb(testDb.db, tenantA, "system");
+    const event = provenanceEvent({ tenantId: tenantB });
+    const before = await countAllEvents();
+
+    await expect(appendProvenanceEvent(systemTdb, event)).rejects.toThrow(AccessDeniedError);
+
+    expect(await countAllEvents()).toBe(before);
+    expect(await loadAggregate(testDb.db, event.aggregateId, tenantB)).toHaveLength(0);
+  });
 });

package/src/event-store/event-store.ts

@@ -1,4 +1,8 @@
-import type { EventMetadata, StoredEvent } from "@cosmicdrift/kumiko-types/event-store-types";
+import {
+  type EventMetadata,
+  type StoredEvent,
+  UNATTRIBUTED_ORIGIN,
+} from "@cosmicdrift/kumiko-types/event-store-types";
 // Value-only import, aliased to avoid shadowing the ambient global
 // `Temporal` TYPE this file's other Temporal.Instant annotations resolve
 // against (StoredEvent.createdAt et al. — importing the bare name here
@@ -6,6 +10,7 @@ import type { EventMetadata, StoredEvent } from "@cosmicdrift/kumiko-types/event
 // as a runtime value on globalThis, so the un-aliased call below crashed
 // with "Temporal is not defined" outside boot paths that install it (#1480).
 import { Temporal as TemporalPolyfill } from "temporal-polyfill";
+import { requestContext } from "../api/request-context";
 import { encryptEventPayloadPii } from "../crypto/event-pii";
 import type { DbRunner } from "../db";
 import { constraintOf, isUniqueViolation } from "../db/pg-error";
@@ -83,7 +88,7 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
     aggregateType: event.aggregateType,
     aggregateId: event.aggregateId,
   });
-  const toStore = payload === event.payload ? event : { ...event, payload };
+  const toStore = stampOrigin(payload === event.payload ? event : { ...event, payload });
   const newVersion = toStore.expectedVersion + 1;
   const eventVersion = toStore.eventVersion ?? 1;
 
@@ -116,6 +121,22 @@ export async function append(db: DbRunner, event: EventToAppend): Promise<Stored
   }
 }
 
+// #3043 — attribution is derived from the execution scope, never taken from
+// the caller: a passed-in value can lie about who wrote the row, a derived
+// one cannot. Hence overwrite rather than merge. appendRaw/appendRawBatch
+// bypass this deliberately — they replay historical rows verbatim.
+function stampOrigin(event: EventToAppend): EventToAppend {
+  const origin = requestContext.get();
+  return {
+    ...event,
+    metadata: {
+      ...event.metadata,
+      feature: origin?.feature ?? UNATTRIBUTED_ORIGIN,
+      handler: origin?.handler ?? UNATTRIBUTED_ORIGIN,
+    },
+  };
+}
+
 type InsertReturn = { id: bigint; createdAt: Temporal.Instant };
 
 async function insertFirstEvent(

package/src/event-store/provenance-append.ts

@@ -1,7 +1,7 @@
 import { runInSavepointIfSupported } from "../db/query";
 import { type TenantDb, unsafeRawForDeclaredStep, withUnsafeRawGrant } from "../db/tenant-db";
 import type { TenantId } from "../engine/types";
-import { InternalError } from "../errors";
+import { AccessDeniedError, InternalError } from "../errors";
 import { SYSTEM_EVENT_PREFIX } from "../pipeline/append-event-core";
 import { append, type EventMetadata, getStreamVersion } from "./event-store";
 
@@ -38,6 +38,14 @@ export async function appendProvenanceEvent(
   }
   const granted = withUnsafeRawGrant(db, { reason: PROVENANCE_APPEND_REASON });
   const runner = unsafeRawForDeclaredStep(granted, PROVENANCE_APPEND_REASON);
+  // Unconditional, including mode "system": crossTenantRebinders keeps the
+  // original tenantId and only flips the mode, so a system-scoped db must not
+  // append for a foreign tenant either.
+  if (event.tenantId !== db.tenantId) {
+    throw new AccessDeniedError({
+      message: `appendProvenanceEvent: event tenant "${event.tenantId}" does not match the TenantDb's tenant "${db.tenantId}".`,
+    });
+  }
   // Bun.SQL/postgres.js abort the whole surrounding begin() on a statement
   // error (25P02) even when the caller's catch swallows it — the savepoint
   // confines that to this scope. Pool connections have no ambient tx to poison.

package/src/files/__tests__/file-handle.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { createFileContext, createFileHandle, deriveKey } from "../file-handle";
+import {
+  createFileContext,
+  createFileHandle,
+  deriveKey,
+  storageKeyStemPrefix,
+} from "../file-handle";
 import { createInMemoryFileProvider } from "../in-memory-provider";
 
 describe("deriveKey", () => {
@@ -24,6 +29,28 @@ describe("deriveKey", () => {
   });
 });
 
+describe("storageKeyStemPrefix", () => {
+  test("matches the original key and every derived variant", () => {
+    const prefix = storageKeyStemPrefix("tenant/vehicle/1/photo/abc.jpg");
+    expect("tenant/vehicle/1/photo/abc.jpg".startsWith(prefix)).toBe(true);
+    expect(deriveKey("tenant/vehicle/1/photo/abc.jpg", "medium").startsWith(prefix)).toBe(true);
+    expect(deriveKey("tenant/vehicle/1/photo/abc.jpg", "thumb").startsWith(prefix)).toBe(true);
+  });
+
+  test("does not match an unrelated key with the same directory", () => {
+    const prefix = storageKeyStemPrefix("tenant/vehicle/1/photo/abc.jpg");
+    expect("tenant/vehicle/1/photo/abcdef.jpg".startsWith(prefix)).toBe(false);
+  });
+
+  test("appends a dot for a key without an extension", () => {
+    expect(storageKeyStemPrefix("tenant/bar")).toBe("tenant/bar.");
+  });
+
+  test("only splits on the last segment — earlier dots stay", () => {
+    expect(storageKeyStemPrefix("archive.v2/foo.jpg")).toBe("archive.v2/foo.");
+  });
+});
+
 describe("FileHandle", () => {
   test("read/write round-trip through the provider", async () => {
     const provider = createInMemoryFileProvider();

package/src/files/file-handle.ts

@@ -49,16 +49,35 @@ export function createFileContext(resolve: () => Promise<FileStorageProvider>):
   };
 }
 
+// Splits a key into the part before the last dot of its last path segment
+// (the "stem") and the extension including the dot. No dot in the last
+// segment: the whole key is the stem, extension is empty.
+function splitKeyExtension(key: string): { readonly stem: string; readonly ext: string } {
+  const lastSlash = key.lastIndexOf("/");
+  const lastSegment = lastSlash === -1 ? key : key.slice(lastSlash + 1);
+  const lastDot = lastSegment.lastIndexOf(".");
+  if (lastDot === -1) return { stem: key, ext: "" };
+  const stem = key.slice(0, key.length - lastSegment.length + lastDot);
+  const ext = lastSegment.slice(lastDot);
+  return { stem, ext };
+}
+
 // Inserts a suffix before the file extension. Keys without an extension get
 // the suffix appended with a dot: `foo/bar` + `"small"` → `foo/bar.small`.
 // Keys with a dot earlier in the path (e.g. `archive.v2/foo.jpg`) correctly
 // split on the LAST segment only.
 export function deriveKey(key: string, suffix: string): string {
-  const lastSlash = key.lastIndexOf("/");
-  const lastSegment = lastSlash === -1 ? key : key.slice(lastSlash + 1);
-  const lastDot = lastSegment.lastIndexOf(".");
-  if (lastDot === -1) return `${key}.${suffix}`;
-  const prefix = key.slice(0, key.length - lastSegment.length + lastDot);
-  const ext = lastSegment.slice(lastDot);
-  return `${prefix}.${suffix}${ext}`;
+  const { stem, ext } = splitKeyExtension(key);
+  return ext === "" ? `${key}.${suffix}` : `${stem}.${suffix}${ext}`;
+}
+
+// The prefix that covers a key AND every `derive()`d variant of it —
+// `foo/bar.jpg` → `foo/bar.`, matching `foo/bar.jpg` and `foo/bar.medium.jpg`
+// alike, since derive() only ever inserts a suffix between the stem and the
+// extension. Used by the tenant-handover destroy sweep (kumiko-framework#3035)
+// to reach a moved fileRef's original plus every already-rendered derivative,
+// none of which have their own `file_refs` row.
+export function storageKeyStemPrefix(key: string): string {
+  const { stem, ext } = splitKeyExtension(key);
+  return ext === "" ? `${key}.` : `${stem}.`;
 }

package/src/files/index.ts

@@ -2,7 +2,7 @@ export { createFilesFeature } from "./feature";
 export type { FileContext, FileHandle } from "./file-handle";
 // `createFileHandle` is an implementation detail — construct handles via
 // `createFileContext(provider).ref(key)`, which is the AppContext surface.
-export { createFileContext, deriveKey } from "./file-handle";
+export { createFileContext, deriveKey, storageKeyStemPrefix } from "./file-handle";
 export { fileRefEntity } from "./file-ref-entity";
 export { fileRefsTable } from "./file-ref-table";
 export type {

package/src/i18n/required-surface-keys.ts

@@ -1,8 +1,10 @@
 import { isExplicitDotFormKey } from "../engine/i18n-key";
+import type { FieldsOrGroupsSection } from "../engine/screen-helpers";
 import {
   isExtensionEditSection,
   isWriteFormEditSection,
   normalizeListColumn,
+  sectionFieldSpecs,
 } from "../engine/screen-helpers";
 import type {
   ActionFormScreenDefinition,
@@ -82,6 +84,16 @@ function editFieldName(f: string | { readonly field: string }): string {
   return typeof f === "string" ? f : f.field;
 }
 
+// Group titles are translated exactly like the section title (computeEditViewModel).
+function pushSectionTitles(
+  out: Set<string>,
+  section: { readonly title?: string } & FieldsOrGroupsSection,
+  treatAsKey = false,
+): void {
+  pushKey(out, section.title, treatAsKey);
+  for (const group of section.groups ?? []) pushKey(out, group.title, treatAsKey);
+}
+
 function pushRowActionKeys(out: Set<string>, action: RowAction): void {
   pushKey(out, action.label);
   if (action.kind === "writeHandler" || action.kind === undefined) {
@@ -182,8 +194,8 @@ export function requiredKeysFromScreen(
           continue;
         }
         if (section.kind === "relatedList") continue; // rejected at boot, unreachable here
-        pushKey(out, section.title);
-        for (const f of section.fields) {
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
           const fieldName = editFieldName(f);
           const override = edit.fieldLabels?.[fieldName];
           if (override !== undefined) pushKey(out, override);
@@ -206,8 +218,8 @@ export function requiredKeysFromScreen(
           continue;
         }
         if (section.kind === "relatedList") continue; // rejected at boot, unreachable here
-        pushKey(out, section.title);
-        for (const f of section.fields) {
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
           const fieldName = editFieldName(f);
           const override = form.fieldLabels?.[fieldName];
           if (override !== undefined) pushKey(out, override);
@@ -230,8 +242,8 @@ export function requiredKeysFromScreen(
           continue;
         }
         if (section.kind === "relatedList") continue; // rejected at boot, unreachable here
-        pushKey(out, section.title);
-        for (const f of section.fields) {
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
           const fieldName = editFieldName(f);
           out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
         }
@@ -254,8 +266,8 @@ export function requiredKeysFromScreen(
             continue;
           }
           if (section.kind === "relatedList") continue; // rejected at boot, unreachable here
-          pushKey(out, section.title);
-          for (const f of section.fields) {
+          pushSectionTitles(out, section);
+          for (const f of sectionFieldSpecs(section)) {
             const fieldName = editFieldName(f);
             out.add(fieldLabelKey(featureName, ACTION_FORM_ENTITY, fieldName));
           }
@@ -277,8 +289,8 @@ export function requiredKeysFromScreen(
           continue;
         }
         if (section.kind === "relatedList") continue; // rejected at boot, unreachable here
-        pushKey(out, section.title, treatDotFormAsKey);
-        for (const f of section.fields) {
+        pushSectionTitles(out, section, treatDotFormAsKey);
+        for (const f of sectionFieldSpecs(section)) {
           const fieldName = editFieldName(f);
           const override = config.fieldLabels?.[fieldName];
           if (override !== undefined) pushKey(out, override, treatDotFormAsKey);
@@ -322,8 +334,8 @@ export function requiredKeysFromScreen(
           }
           continue;
         }
-        pushKey(out, section.title);
-        for (const f of section.fields) {
+        pushSectionTitles(out, section);
+        for (const f of sectionFieldSpecs(section)) {
           const fieldName = editFieldName(f);
           const override = detail.fieldLabels?.[fieldName];
           if (override !== undefined) pushKey(out, override);

package/src/jobs/job-runner.ts

@@ -4,6 +4,7 @@ import { requestContext } from "../api/request-context";
 import type { DbConnection, DbRow } from "../db/connection";
 import { createTenantDb, createUncheckedSystemDb, type TenantDb } from "../db/tenant-db";
 import { createDerivativesContext } from "../derivatives/derivatives-context";
+import { qnScope } from "../engine/qualified-name";
 import { createSystemUser } from "../engine/system-user";
 import {
   type AppContext,
@@ -665,8 +666,15 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
 
     const runInSpan = async (): Promise<void> => {
       try {
-        await requestContext.run({ requestId: jobRequestId, correlationId: jobCorrelationId }, () =>
-          jobDef.handler(payload, jobContext),
+        await requestContext.run(
+          {
+            requestId: jobRequestId,
+            correlationId: jobCorrelationId,
+            // #3043 — events a job writes carry the job as their origin.
+            handler: jobName,
+            feature: qnScope(jobName),
+          },
+          () => jobDef.handler(payload, jobContext),
         );
         const duration = Date.now() - startTime;
         await options.onJobComplete?.(jobName, jobId, duration, logs);