@startsimpli/ui 0.4.120 → 0.4.121

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/ui",
-  "version": "0.4.120",
+  "version": "0.4.121",
   "description": "Shared UI components package for StartSimpli applications",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
@@ -47,9 +47,9 @@
     "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
+    "@startsimpli/i18n": "^0.1.3",
     "@startsimpli/api": "^0.5.58",
-    "@startsimpli/auth": "^0.4.35",
-    "@startsimpli/i18n": "^0.1.3"
+    "@startsimpli/auth": "^0.4.35"
   },
   "peerDependenciesMeta": {
     "@startsimpli/api": {
@@ -123,8 +123,8 @@
     "tailwindcss": "^3.4.19",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
-    "@startsimpli/realtime": "0.0.2",
-    "@startsimpli/i18n": "0.1.3"
+    "@startsimpli/i18n": "0.1.3",
+    "@startsimpli/realtime": "0.0.2"
   },
   "keywords": [
     "ui",

package/src/components/collection/DraftReviewWorkspace.tsx

@@ -17,7 +17,7 @@ import { Badge } from '../ui/badge';
 import { notify } from '../toast/use-notify';
 import { MarkdownRenderer } from '../blog/MarkdownRenderer';
 import type { CollectionClient, EntityRecord } from './types';
-import { readData, toCamelKey } from './data';
+import { declaredBlob, readData, writeData } from './data';
 import { scopeKey } from './scoped-client';
 import {
   groupDrafts,
@@ -127,8 +127,13 @@ export function DraftReviewWorkspace({ client }: DraftReviewWorkspaceProps) {
     // The FULL blob, spread from the record: PATCH REPLACES `data`, so an
     // attribute this board never touches — the scope path included — has to be
     // sent back to survive. A write is never a move between scopes.
-    const data: Record<string, unknown> = { ...record.data };
-    for (const [k, v] of Object.entries(changes)) data[toCamelKey(k)] = v;
+    // Re-keyed to the type's DECLARED attribute names before it goes back:
+    // the client cannot rebuild an underscore that sat before a digit, so a
+    // whole-blob write would rename `source_1` to `source1` (bd
+    // startsim-8hgmq.18, collection/data.ts).
+    let data: Record<string, unknown> = { ...record.data };
+    for (const [k, v] of Object.entries(changes)) data = writeData(data, k, v);
+    data = declaredBlob(data, (draftType?.attributes ?? []).map((a) => a.name));
     return client.updateEntity(record.id, { data });
   }
 

package/src/components/collection/InlineReviewActions.tsx

@@ -24,7 +24,7 @@ import { Popover, PopoverContent, PopoverTrigger } from '../ui/popover';
 import { notify } from '../toast/use-notify';
 import { cn } from '../../lib/utils';
 import type { CollectionClient, EntityRecord, EntityTypeDef } from './types';
-import { toCamelKey } from './data';
+import { writeData } from './data';
 import {
   applyDecisionToData,
   fieldStr,
@@ -63,6 +63,8 @@ export interface InlineReviewActionsProps {
 
 export function InlineReviewActions({ client, type, record, config, onSaved }: InlineReviewActionsProps) {
   const cfg = useMemo(() => resolveReviewConfig(type, config), [type, config]);
+  /** The type's declared attribute names — the spellings a write must send back. */
+  const declaredNames = useMemo(() => (type.attributes ?? []).map((a) => a.name), [type]);
   const decisions = useMemo(
     () => [...reviewDecisions(cfg)].sort((a, b) => ORDER.indexOf(a.key) - ORDER.indexOf(b.key)),
     [cfg],
@@ -89,18 +91,10 @@ export function InlineReviewActions({ client, type, record, config, onSaved }: I
     setAppliedKey(d.key); // optimistic
     setBusy(d.key);
     try {
-      const data = applyDecisionToData(record.data, d, cfg);
-      if (noteText !== undefined) {
-        const camel = toCamelKey(cfg.noteAttr);
-        const t = noteText.trim();
-        if (t) {
-          data[camel] = t;
-          if (camel !== cfg.noteAttr) delete data[cfg.noteAttr];
-        } else {
-          delete data[camel];
-          delete data[cfg.noteAttr];
-        }
-      }
+      // Declared names re-key the whole outgoing blob, so a decision here cannot
+      // rename `source_1` to `source1` (bd startsim-8hgmq.18, collection/data.ts).
+      let data = applyDecisionToData(record.data, d, cfg, declaredNames);
+      if (noteText !== undefined) data = writeData(data, cfg.noteAttr, noteText.trim());
       await client.updateEntity(record.id, { data });
       onSaved?.();
       return true;

package/src/components/collection/ReviewDrawer.tsx

@@ -42,7 +42,7 @@ import {
 import { notify } from '../toast/use-notify';
 import { cn } from '../../lib/utils';
 import type { CollectionClient, EntityRecord, EntityTypeDef } from './types';
-import { readData, toCamelKey } from './data';
+import { declaredBlob, readData, writeData } from './data';
 import { parseSources } from './drafts';
 import {
   resolveReviewConfig,
@@ -111,6 +111,8 @@ function ReviewDrawerInner({
 }: ReviewDrawerProps & { record: EntityRecord }) {
   const cfg = useMemo(() => resolveReviewConfig(type, config), [type, config]);
   const decisions = useMemo(() => reviewDecisions(cfg), [cfg]);
+  /** The type's declared attribute names — the spellings a write must send back. */
+  const declaredNames = useMemo(() => (type.attributes ?? []).map((a) => a.name), [type]);
   const [mode, setMode] = useState<'review' | 'edit'>('review');
   // Local optimistic copy so a click reflects instantly (the parent also refetches).
   const [data, setData] = useState<Record<string, unknown>>(() => ({ ...record.data }));
@@ -140,19 +142,20 @@ function ReviewDrawerInner({
    */
   const decided = useMemo(() => ({ ...record, data }), [record, data]);
 
-  /** Merge changes into the (camelCased) blob and PATCH; the backend REPLACES data. */
+  /**
+   * Merge changes into the blob and PATCH; the backend REPLACES data.
+   *
+   * The whole blob goes back, so it is re-keyed to the type's DECLARED attribute
+   * names first (`declaredBlob`). Without that, every decision renames
+   * `source_1` to `source1` on the way out — the client cannot rebuild an
+   * underscore that sat before a digit. See collection/data.ts and bd
+   * startsim-8hgmq.18. It also REPAIRS: a row that already holds `source1` is
+   * written back as `source_1`.
+   */
   async function patch(changes: Record<string, unknown>, key: string, advance = false) {
-    const nextData: Record<string, unknown> = { ...data };
-    for (const [k, v] of Object.entries(changes)) {
-      const camel = toCamelKey(k);
-      if (v === '' || v == null) {
-        delete nextData[camel];
-        delete nextData[k];
-      } else {
-        nextData[camel] = v;
-        if (camel !== k) delete nextData[k];
-      }
-    }
+    let nextData: Record<string, unknown> = { ...data };
+    for (const [k, v] of Object.entries(changes)) nextData = writeData(nextData, k, v);
+    nextData = declaredBlob(nextData, declaredNames);
     setData(nextData); // optimistic
     setBusy(key);
     try {

package/src/components/collection/TopicReviewWorkspace.tsx

@@ -17,7 +17,7 @@ import { Textarea } from '../ui/textarea';
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '../ui/select';
 import { notify } from '../toast/use-notify';
 import type { CollectionClient, EntityRecord, EntityTypeDef } from './types';
-import { readData, toCamelKey } from './data';
+import { declaredBlob, readData, writeData } from './data';
 import { scopeKey } from './scoped-client';
 
 const STATUSES = ['suggested', 'ready', 'rejected', 'written'] as const;
@@ -104,8 +104,13 @@ export function TopicReviewWorkspace({ client, markets = [], renderDetail }: Top
   }, [records]);
 
   async function patch(record: EntityRecord, changes: Record<string, unknown>) {
-    const data: Record<string, unknown> = { ...record.data };
-    for (const [k, v] of Object.entries(changes)) data[toCamelKey(k)] = v;
+    // Re-keyed to the type's DECLARED attribute names before it goes back:
+    // the client cannot rebuild an underscore that sat before a digit, so a
+    // whole-blob write would rename `source_1` to `source1` (bd
+    // startsim-8hgmq.18, collection/data.ts).
+    let data: Record<string, unknown> = { ...record.data };
+    for (const [k, v] of Object.entries(changes)) data = writeData(data, k, v);
+    data = declaredBlob(data, (topicType?.attributes ?? []).map((a) => a.name));
     try {
       // The FULL blob, spread from the record — so an attribute this workspace
       // never touches (the scope path among them) survives a PATCH that

package/src/components/collection/__tests__/blob-round-trip.test.tsx

@@ -0,0 +1,248 @@
+/**
+ * THE WIRE ROUND TRIP: a declared attribute whose name has an underscore before
+ * a DIGIT must survive being read into a surface and written back out.
+ *
+ * bd startsim-8hgmq.18. The shared API client transforms keys in BOTH directions
+ * and the pair is not an involution:
+ *
+ *   snakeToCamel: /_([a-z0-9])/ -> uppercase   so  source_1 -> source1
+ *   camelToSnake: /[A-Z]/       -> _lowercase  so  source1  -> source1
+ *
+ * Uppercasing a digit is a no-op, so the underscore is destroyed on the way IN
+ * and cannot be reconstructed on the way OUT. `team_verdict` survives only
+ * because `teamVerdict` has a hump to split on. Any surface that reads the
+ * camelised blob and PATCHes the WHOLE thing back therefore RENAMES the declared
+ * attribute `source_1` to the undeclared `source1` — which the app still renders
+ * (readData tries both spellings) but which `attr.source_1=` server-side filters
+ * and `redenormalize_attributes` cannot see.
+ *
+ * WHY THE ASSERTIONS RUN ON THE WIRE, not on the surface's output object. The
+ * outgoing blob is camelCase by construction; a test that stops there passes
+ * while the wire is still wrong. It also cannot see the OTHER failure: two keys
+ * in the outgoing object that camelToSnake collapses onto one wire key, where
+ * only insertion order decides the survivor. So every case here goes
+ *
+ *     stored (wire) -> snakeToCamel -> surface write path -> camelToSnake -> wire
+ *
+ * using the REAL transforms imported from @startsimpli/api, so the test cannot
+ * drift from the client it is describing.
+ *
+ * THE FIX UNDER TEST is not "camelise harder": it is to write declared
+ * attributes back under their DECLARED (snake) name. camelToSnake is the
+ * identity on a pure-snake key — `source_1` -> `source_1`, `team_verdict` ->
+ * `team_verdict` — so a blob keyed by declared names round-trips exactly, with
+ * no change to the shared client and no change for any other app.
+ */
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { snakeToCamel, camelToSnake } from '@startsimpli/api';
+
+import { declaredBlob, writeData } from '../data';
+import { ReviewDrawer } from '../ReviewDrawer';
+import type { CollectionClient, EntityRecord, EntityTypeDef } from '../types';
+
+/** The blob as the tenant stores it — the n8n writer's spelling. */
+const STORED: Record<string, unknown> = {
+  title: 'Gulf Conflict Risk Checklist',
+  status: 'suggested',
+  team_verdict: '',
+  source_1: 'https://example.com/a',
+  source_2: 'https://example.com/b',
+  source_3: 'https://example.com/c',
+  _origin: 'n8n',
+  source_meta: { verified: true },
+};
+
+/** What the browser client hands a component after transforming the response. */
+function asRead(stored: Record<string, unknown>): Record<string, unknown> {
+  return snakeToCamel(stored) as Record<string, unknown>;
+}
+
+/** What the tenant actually stores after the client transforms the request. */
+function asStored(outgoing: Record<string, unknown>): Record<string, unknown> {
+  return camelToSnake(outgoing) as Record<string, unknown>;
+}
+
+const TOPIC_TYPE: EntityTypeDef = {
+  id: 'tt',
+  key: 'topic',
+  label: 'Topic',
+  attributes: [
+    { id: '1', name: 'title', dataType: 'text', required: false, config: {} },
+    {
+      id: '2',
+      name: 'status',
+      dataType: 'enum',
+      required: false,
+      config: { choices: ['suggested', 'ready', 'rejected', 'written'] },
+    },
+    { id: '3', name: 'team_verdict', dataType: 'text', required: false, config: {} },
+    { id: '4', name: 'team_notes', dataType: 'longtext', required: false, config: {} },
+    { id: '5', name: 'source_1', dataType: 'text', required: false, config: {} },
+    { id: '6', name: 'source_2', dataType: 'text', required: false, config: {} },
+    { id: '7', name: 'source_3', dataType: 'text', required: false, config: {} },
+  ],
+} as unknown as EntityTypeDef;
+
+const DECLARED = TOPIC_TYPE.attributes.map((a) => a.name);
+
+// ── the pure helpers ────────────────────────────────────────────────────────
+
+describe('the transform pair is lossy, which is why this bug exists', () => {
+  it('destroys the underscore before a digit and cannot restore it', () => {
+    expect(snakeToCamel({ source_1: 'x' })).toEqual({ source1: 'x' });
+    expect(camelToSnake({ source1: 'x' })).toEqual({ source1: 'x' });
+  });
+
+  it('is the identity on a declared snake key, which is what the fix relies on', () => {
+    for (const name of DECLARED) {
+      expect(camelToSnake({ [name]: 'x' })).toEqual({ [name]: 'x' });
+    }
+  });
+});
+
+describe('declaredBlob', () => {
+  it('renames a camel-collapsed key back to the declared attribute name', () => {
+    const out = declaredBlob(asRead(STORED), DECLARED);
+    expect(asStored(out)).toMatchObject({
+      source_1: 'https://example.com/a',
+      source_2: 'https://example.com/b',
+      source_3: 'https://example.com/c',
+    });
+    expect(asStored(out)).not.toHaveProperty('source1');
+  });
+
+  it('leaves the camel spelling behind — both keys would collide on the wire', () => {
+    const out = declaredBlob(asRead(STORED), DECLARED);
+    expect(out).not.toHaveProperty('source1');
+  });
+
+  it('repairs an ALREADY-corrupted row on the next write', () => {
+    const corrupted = { title: 'x', source1: 'https://example.com/a', status: 'ready' };
+    const out = declaredBlob(asRead(corrupted), DECLARED);
+    expect(asStored(out)).toEqual({
+      title: 'x',
+      source_1: 'https://example.com/a',
+      status: 'ready',
+    });
+  });
+
+  it('prefers the declared spelling when a row carries BOTH (JSONB orders the short key first, so the declared value is the one the client kept)', () => {
+    // The client collapses both onto `source1`; the later (declared) entry wins.
+    const both = { source1: 'stale', source_1: 'fresh' };
+    expect(asRead(both)).toEqual({ source1: 'fresh' });
+    expect(asStored(declaredBlob(asRead(both), DECLARED))).toEqual({ source_1: 'fresh' });
+  });
+
+  it('does not touch undeclared blob keys, which already round-trip exactly', () => {
+    const out = asStored(declaredBlob(asRead(STORED), DECLARED));
+    expect(out).toMatchObject({ _origin: 'n8n', source_meta: { verified: true } });
+  });
+
+  it('is idempotent', () => {
+    const once = declaredBlob(asRead(STORED), DECLARED);
+    expect(declaredBlob(once, DECLARED)).toEqual(once);
+  });
+
+  it('drops a key nothing declared away only when it is a lossy alias of a declared one', () => {
+    const out = declaredBlob({ ...asRead(STORED), somethingElse: 1 }, DECLARED);
+    expect(out).toHaveProperty('somethingElse', 1);
+  });
+});
+
+describe('writeData', () => {
+  it('writes under the declared name and removes the camel alias', () => {
+    const blob = writeData(asRead(STORED), 'source_1', 'https://example.com/new');
+    expect(blob).not.toHaveProperty('source1');
+    expect(asStored(blob)).toMatchObject({ source_1: 'https://example.com/new' });
+  });
+
+  it('deletes every spelling when the value is blank', () => {
+    const blob = writeData(asRead(STORED), 'source_1', '');
+    expect(blob).not.toHaveProperty('source1');
+    expect(blob).not.toHaveProperty('source_1');
+  });
+
+  it('round-trips a hump-bearing declared name without minting a second key', () => {
+    const blob = writeData(asRead(STORED), 'team_verdict', 'approved');
+    expect(Object.keys(asStored(blob)).filter((k) => k.includes('verdict'))).toEqual([
+      'team_verdict',
+    ]);
+    expect(asStored(blob).team_verdict).toBe('approved');
+  });
+});
+
+// ── the surface: a drawer decision ──────────────────────────────────────────
+
+function stubClient(saved: Record<string, unknown>[]): CollectionClient {
+  return {
+    listTypes: jest.fn(async () => ({ count: 1, next: null, previous: null, results: [TOPIC_TYPE] })),
+    listAllEntities: jest.fn(async () => []),
+    updateEntity: jest.fn(async (_id, input: { data?: Record<string, unknown> }) => {
+      saved.push(input.data ?? {});
+      return {} as EntityRecord;
+    }),
+  } as unknown as CollectionClient;
+}
+
+const RECORD: EntityRecord = {
+  id: 'topic-1',
+  entityType: 'topic',
+  name: 'Gulf Conflict Risk Checklist',
+  data: asRead(STORED),
+} as unknown as EntityRecord;
+
+describe('ReviewDrawer decision — the surface corrupting topics today', () => {
+  it('keeps source_1 on the wire after an Approve', async () => {
+    const saved: Record<string, unknown>[] = [];
+    render(
+      <ReviewDrawer
+        client={stubClient(saved)}
+        type={TOPIC_TYPE}
+        records={[RECORD]}
+        record={RECORD}
+        onClose={() => {}}
+        onNavigate={() => {}}
+      />,
+    );
+
+    await userEvent.click(await screen.findByRole('button', { name: /approve/i }));
+    await waitFor(() => expect(saved).toHaveLength(1));
+
+    const wire = asStored(saved[0]!);
+    expect(wire).toHaveProperty('source_1', 'https://example.com/a');
+    expect(wire).toHaveProperty('source_2', 'https://example.com/b');
+    expect(wire).toHaveProperty('source_3', 'https://example.com/c');
+    expect(wire).not.toHaveProperty('source1');
+    expect(wire).not.toHaveProperty('source2');
+    expect(wire).not.toHaveProperty('source3');
+    // the decision itself still lands, under its declared names
+    expect(wire.status).toBe('ready');
+    expect(wire.team_verdict).toBeTruthy();
+  });
+
+  it('repairs an already-renamed row rather than re-minting the bad key', async () => {
+    const saved: Record<string, unknown>[] = [];
+    const corrupted = {
+      ...RECORD,
+      data: asRead({ title: 't', status: 'written', source1: 'https://example.com/a' }),
+    } as EntityRecord;
+    render(
+      <ReviewDrawer
+        client={stubClient(saved)}
+        type={TOPIC_TYPE}
+        records={[corrupted]}
+        record={corrupted}
+        onClose={() => {}}
+        onNavigate={() => {}}
+      />,
+    );
+
+    await userEvent.click(await screen.findByRole('button', { name: /reject/i }));
+    await waitFor(() => expect(saved).toHaveLength(1));
+
+    const wire = asStored(saved[0]!);
+    expect(wire).toHaveProperty('source_1', 'https://example.com/a');
+    expect(wire).not.toHaveProperty('source1');
+  });
+});

package/src/components/collection/data.ts

@@ -1,17 +1,145 @@
 /**
- * camelCase-aware read/write helpers for an Entity.data blob. The tenant API
- * client camelCases response keys (incl. the data blob), so a snake_case attr
- * `team_verdict` lands as `teamVerdict`; try the camel form first, then the raw
- * key. Pure + framework-free.
+ * camelCase-aware read/write helpers for an Entity.data blob.
+ *
+ * ── WHY THIS MODULE EXISTS AT ALL ───────────────────────────────────────────
+ *
+ * The tenant API client transforms keys in BOTH directions, recursively, and
+ * that includes the `data` blob — which is not an API contract but whatever
+ * attribute names the tenant declared. So the declared attribute `team_verdict`
+ * reaches a component as `teamVerdict`. {@link readData} tries the camel form
+ * first and the raw name second, so a component reads either shape.
+ *
+ * ── THE TRAP THIS MODULE ALSO EXISTS TO CLOSE (bd startsim-8hgmq.18) ────────
+ *
+ * The transform pair is NOT an involution:
+ *
+ *   snake -> camel:  /_([a-z0-9])/ -> uppercase   so  source_1 -> source1
+ *   camel -> snake:  /[A-Z]/       -> _lowercase  so  source1  -> source1
+ *
+ * Uppercasing a DIGIT is a no-op, so the underscore is destroyed on the way in
+ * and there is no hump to split on on the way back out. `team_verdict` survives
+ * only because `teamVerdict` has one. Any surface that reads the camelised blob
+ * and PATCHes the WHOLE thing back therefore RENAMES the declared attribute
+ * `source_1` to the undeclared `source1`. Nothing looks broken — `readData`
+ * finds either spelling — but the rename is invisible to `attr.source_1=`
+ * server-side filters (which this tenant answers by matching NOTHING, silently),
+ * to `redenormalize_attributes`, and to anything reading the row outside the app.
+ *
+ * THE FIX IS NOT TO CAMELISE HARDER. camelToSnake is the IDENTITY on a pure
+ * snake_case key — `source_1` -> `source_1`, `team_verdict` -> `team_verdict` —
+ * so a blob written back under its DECLARED names round-trips exactly, with no
+ * change to the shared client and no change for any other app. That is what
+ * {@link declaredBlob} and {@link writeData} do; every surface that writes a
+ * whole blob back must run it through one of them.
+ *
+ * WHAT THIS CANNOT FIX, stated so it is not mistaken for coverage: a declared
+ * name that is not itself snake_case (`sourceMeta`, `URL`) is mangled by
+ * camelToSnake no matter what a surface writes, because the surface never sees a
+ * wire key it could restore. Only the client can protect those, by not
+ * transforming the blob at all. Measured 2026-09-09 on marketing-agents: zero
+ * such declared names exist, and the whole lossy set is {source_1, source_2,
+ * source_3} on the topic type.
+ *
+ * Pure + framework-free.
  */
 import type { EntityRecord } from './types';
 
+/** The spelling the shared client produces from a wire key. */
 export function toCamelKey(name: string): string {
   return name.replace(/_+([a-z0-9])/g, (_m, c: string) => c.toUpperCase());
 }
 
+/**
+ * The spelling the shared client sends to the wire for a key.
+ *
+ * A local mirror of `@startsimpli/api` utils/case-transform so `collection/`
+ * stays free of a runtime dependency on the API package. It cannot drift
+ * unnoticed: __tests__/blob-round-trip.test.ts imports the REAL pair and pins
+ * these against it.
+ */
+function toWireKey(key: string): string {
+  return key.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+}
+
+/**
+ * True when a declared attribute name does NOT survive the client's
+ * snake -> camel -> snake round trip, i.e. its camel spelling is a LOSSY ALIAS
+ * that no longer names the attribute. Today that is exactly the names with an
+ * underscore before a digit (`source_1`).
+ */
+export function isLossyName(name: string): boolean {
+  return toWireKey(toCamelKey(name)) !== name;
+}
+
 export function readData(data: EntityRecord['data'] | undefined, name: string): unknown {
   if (!data) return undefined;
   const bag = data as Record<string, unknown>;
   return bag[toCamelKey(name)] ?? bag[name];
 }
+
+/**
+ * Set one declared attribute in a blob, under the spelling that survives the
+ * wire, and remove every other spelling of it.
+ *
+ * A blank value (`''`, null, undefined) DELETES the attribute — the behaviour
+ * every caller here already had.
+ *
+ * WHICH SPELLING IT WRITES. A lossy name goes in under its DECLARED (snake)
+ * name, which camelToSnake then passes through untouched. Any other name keeps
+ * the camel spelling the blob already uses, because that is what round-trips for
+ * it and because writing a second spelling alongside the spread blob leaves two
+ * keys that COLLIDE on the wire, with only key order deciding the survivor. That
+ * is why `_edit_history` is written as `EditHistory` and must stay that way.
+ */
+export function writeData(
+  data: Record<string, unknown> | undefined,
+  name: string,
+  value: unknown,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...(data ?? {}) };
+  const camel = toCamelKey(name);
+  delete out[camel];
+  delete out[name];
+  if (value === '' || value == null) return out;
+  out[isLossyName(name) ? name : camel] = value;
+  return out;
+}
+
+/**
+ * Re-key a whole outgoing blob so every DECLARED attribute goes back to the
+ * tenant under its declared name. Run it on any blob that is about to be PATCHed
+ * in full — the backend REPLACES `data`, so the spread carries every key the
+ * client mangled on the way in, not just the ones the surface touched.
+ *
+ * IT ALSO REPAIRS. A row already holding `source1` is written back as `source_1`,
+ * so the corruption drains as records are worked rather than needing a migration
+ * for rows anyone still touches.
+ *
+ * Only LOSSY names are re-keyed. Everything else already survives the round trip
+ * unchanged, so rewriting it would churn the blob for no gain — and undeclared
+ * keys (`_origin`, `review`, `notes`, `sourceMeta`) are left exactly as they
+ * arrived, because the surface has no way to know their wire spelling.
+ *
+ * @param names the declared attribute names, i.e. `type.attributes.map(a => a.name)`
+ */
+export function declaredBlob(
+  data: Record<string, unknown> | undefined,
+  names: Iterable<string>,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...(data ?? {}) };
+  for (const name of names) {
+    if (!isLossyName(name)) continue;
+    const camel = toCamelKey(name);
+    const hasDeclared = Object.prototype.hasOwnProperty.call(out, name);
+    const hasCamel = Object.prototype.hasOwnProperty.call(out, camel);
+    if (!hasDeclared && !hasCamel) continue;
+    // The declared spelling wins a tie. It is also the one the client already
+    // kept: a row carrying both collapses onto the camel key on the way in and
+    // JSONB orders the SHORTER key first, so the declared value is the later
+    // entry and last-write-wins hands it to the app.
+    const value = hasDeclared ? out[name] : out[camel];
+    delete out[camel];
+    out[name] = value;
+  }
+  return out;
+}

package/src/components/collection/index.ts

@@ -50,7 +50,7 @@ export {
   SCOPE_FILTER,
   type ScopedCollectionClient,
 } from './scoped-client';
-export { readData, toCamelKey } from './data';
+export { readData, toCamelKey, writeData, declaredBlob, isLossyName } from './data';
 export {
   parseSources,
   normUrl,

package/src/components/collection/review.ts

@@ -15,7 +15,7 @@
  * Nothing here is tenant-specific — the defaults are conventions, not requirements.
  */
 import type { AttributeDef, EntityTypeDef } from './types';
-import { readData, toCamelKey } from './data';
+import { declaredBlob, readData, writeData } from './data';
 
 // ---- keyboard guard (lifted so the drawer + any review surface share it) ----
 
@@ -368,17 +368,23 @@ export function applyDecisionToData(
   data: Record<string, unknown> | undefined,
   decision: ReviewDecision,
   cfg: ResolvedReview,
+  /**
+   * The type's declared attribute names. Passing them re-keys the WHOLE outgoing
+   * blob to the declared spellings, which is what stops a decision renaming
+   * `source_1` to `source1` on the way back to the tenant (bd startsim-8hgmq.18,
+   * collection/data.ts). Optional only so an existing caller cannot break; every
+   * caller that has a type SHOULD pass them.
+   */
+  declaredNames: Iterable<string> = [],
 ): Record<string, unknown> {
-  const next: Record<string, unknown> = { ...(data ?? {}) };
+  let next: Record<string, unknown> = { ...(data ?? {}) };
   const set = (attr: string, value: string | null) => {
     if (value == null || value === '') return;
-    const camel = toCamelKey(attr);
-    next[camel] = value;
-    if (camel !== attr) delete next[attr];
+    next = writeData(next, attr, value);
   };
   set(cfg.statusName, decision.status);
   set(cfg.verdictAttr, decision.verdict);
-  return next;
+  return declaredBlob(next, declaredNames);
 }
 
 // ---- small read helpers used by the component (kept here so they're tested) ----