@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/components/form/automated/ResourceAutomatedForm.js

@@ -11,11 +11,16 @@ import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-run
  * - Handles success notifications based on operation configuration
  * - Determines wizard mode from frontEndApplication configuration
  */
-import React, { useEffect, useLayoutEffect, useMemo, useState, useCallback, useRef } from 'react';
+import isEqual from 'lodash/isEqual.js';
+import React, { useContext, useEffect, useLayoutEffect, useMemo, useState, useCallback, useRef } from 'react';
+import { NotificationContext } from '../../../core/events/NotificationContext.js';
 import { useFormContext } from 'react-hook-form';
 import { z } from 'zod';
-import { CoreResourceOperation, CoreUserNotificationChannel, CoreUserNotificationTarget, RelationshipNature, ResourceRelationshipBulkAction, ResourcesConfig_OperationPathUtils, ResourceOperationVariantType, ErrorCustomMessageReference, ErrorType, UserNotificationLevel, ResourcesConfigOperationsUrlsBuilderUtils, Resources_SharedUtils, ResourceOperationRiskLevel, MAIN_API_BASE_PATH, BULK_OPERATION_HOST_SUPPLIED_FIELDS, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, CoreUserNotificationChannel, CoreUserNotificationTarget, RelationshipNature, ResourceRelationshipBulkAction, ResourcesConfig_OperationPathUtils, ResourceOperationVariantType, ErrorCustomMessageReference, ErrorType, UserNotificationLevel, ResourcesConfigOperationsUrlsBuilderUtils, Resources_SharedUtils, ResourceOperationRiskLevel, isIrreversibleOperation, MAIN_API_BASE_PATH, BULK_OPERATION_HOST_SUPPLIED_FIELDS, resourceInheritanceVariantSchemas, readOperationApprovalPending, READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME, CoreResourceType, } from '@wildo-ai/saas-models';
 import { OperationsConfirmCritical } from '../../../components/feedback/operations-confirm-critical.js';
+import { isReadThroughOrganizationUnitFieldInert, readThroughCreateOrganizationUnitCandidates } from '../../../core/resources/read-through-organization-unit.frontend.utils.js';
+import { useReferenceRecordLabels } from '../../../components/form/automated/useReferenceRecordLabels.js';
+import { UserOrgsContext } from '../../../core/security/UserOrgsContext.js';
 import { Button, ButtonVariants_Variant } from '../../../components/actions/button.js';
 import { AlertDialog, AlertDialogContent, AlertDialogHeader, AlertDialogFooter, AlertDialogTitle, AlertDialogDescription, AlertDialogCancel, AlertDialogAction, } from '../../../components/overlays/containers/alert-dialog.js';
 import { prepareFormSchema, AutosaveTrigger } from '@wildo-ai/zod-decorators';
@@ -23,7 +28,10 @@ import { FrontendComponentType, } from '@wildo-ai/presets-components-models';
 import { AutomatedForm } from './AutomatedForm.js';
 import { useOptionalFormTemplateContext } from './FormTemplateContext.js';
 import { ResourceFormActionsProvider, HostFormActionsFooter, } from './ResourceFormActionsContext.js';
-import { carryStoredSiblingsIntoPartialWrites, formOffersSectionSave, pickSubmissionDataPaths, sanitizeAutomatedFormSubmissionData, shouldOmitClearedFieldsForOperation } from './automated-form-submit.utils.js';
+import { FORM_LEVEL_ERROR_PATH } from '../form-context.js';
+import { bulkClearsWithin, bulkUpdatePatch, bulkWriteUnits, carryStoredSiblingsIntoPartialWrites, formOffersSectionSave, pickSubmissionDataPaths, resolveBulkFieldClear, sanitizeAutomatedFormSubmissionData, shouldOmitClearedFieldsForOperation, withPathValue, BulkFieldClearKind } from './automated-form-submit.utils.js';
+import { BulkFieldClearContext } from './bulk-field-clear-context.js';
+import { carryStoredDiscriminators, resolveDiscriminatorFieldNames } from '../../../core/resources/resource-discriminators.frontend.utils.js';
 import { resolveCreateFormInitialValues } from './create-form-default-values.utils.js';
 import { AutomatedLayoutFrontendUtils } from '../../../core/automated-layout/automated-layout.frontend.utils.js';
 import { extractSchemaFieldList, generateDefaultFormTemplate } from '../../../core/automated-layout/default-layout-generator.frontend.utils.js';
@@ -36,23 +44,26 @@ import { useOptionalAutosave } from '../../../components/form/automated/Autosave
 import { mutationErrorForReport } from '../../../core/resources/rmm/mutation-error-report.utils.js';
 import { extractServerValidationErrors } from '../../../components/form/validation-errors/form-error-extraction.utils.js';
 import { collectErroredFieldPaths, scrollAndFocusFirstErroredField } from '../../../components/form/validation-errors/scroll-to-first-error.utils.js';
+import { zodIssuesToFieldErrors } from '../../../components/form/validation-errors/zod-issue-resolver.js';
+import { UnplacedRequestFieldsContext } from './unplaced-request-fields.context.js';
 import { extractErrorInfo } from '../../../core/errors/errors.frontend.schemas.js';
 import { useUserFacingErrorMessage } from '../../../core/errors/useUserFacingErrorMessage.js';
 import { useServerErrorInjection } from '../../../components/form/validation-errors/useServerErrorInjection.js';
 import { LoggerFrontendService } from '../../../core/monitoring/logger.frontend.service.js';
 import { useResourceRegistry } from '../../../core/resources/useResourceRegistry.js';
-import { isLiteralCoreResourceOperation, isSingleResourceUpdateLikeOperation, isUpdateLikeCoreOperation, mergeBulkSelectionIntoRequestData, pickPreferredOperationForCoreSemantic, resolveEffectiveCoreOperation, toOperationResultSummary, } from '../../../core/resources/operation-semantics.frontend.utils.js';
+import { isLiteralCoreResourceOperation, isRiskyResourceOperation, isSingleResourceUpdateLikeOperation, isUpdateLikeCoreOperation, mergeBulkSelectionIntoRequestData, pickPreferredOperationForCoreSemantic, readBulkOperationSelectionCount, resolveEffectiveCoreOperation, toOperationResultSummary, } from '../../../core/resources/operation-semantics.frontend.utils.js';
 import { pickPreferredOperationForCoreSemanticAddressability } from '../../../core/resources/resource-addressability.frontend.utils.js';
 import { useOperationEnabled } from '../../../core/resources/hooks/useOperationEnabled.js';
 import { frontendResourceUtils, FrontendResourceUtils } from '../../../core/resources/frontend-resource.utils.js';
 import { resolveRelationshipWriteSurface, } from '../../../core/resources/relationship-surface-runtime.frontend.utils.js';
 import { useEventBus } from '../../../core/events/useEventBus.js';
+import { useResourceOperationOutcomeEmitter } from '../../../core/resources/useResourceOperationOutcomeEmitter.js';
 import { useI18n } from '../../../core/i18n/useI18n.js';
 import { resolveOperationDisplayTitle } from '../../../core/i18n/operation-title-resolution.utils.js';
 import { LoadingGate } from '../../../core/loading/LoadingGate.js';
 import { ErrorBuilderFrontend } from '../../../core/errors/errors-builder.frontend.services.js';
 import { FrontendEvents } from '../../../core/events/events.frontend.schemas.js';
-import { isForeignKey, isUnique, getZodObjectShape } from '@wildo-ai/zod-decorators';
+import { isForeignKey, isUnique, lastActionRecordFieldNames, withOptionalNestedChildren } from '@wildo-ai/zod-decorators';
 import { envLoader } from '../../../core/runtime/env-variable-loader.frontend.service.js';
 import { NavigationUtils } from '../../../core/navigation/navigation.utils.js';
 import { buildValidateFieldUrl } from '../../../components/form/validation-errors/validate-field-url.frontend.js';
@@ -60,7 +71,7 @@ import { MutationPriority, MutationType, MutationSourceType, MutationErrorType,
 import { useResourceRMM } from '../../../core/resources/rmm/useResourceRMM.js';
 import { useExecutionDirtyBridge } from '../../../core/execution/useExecutionDirtyBridge.js';
 import { performCanonicalRMMRead, resolveCanonicalRMMReadOperation, resolveCanonicalRMMReadOperationPathKey, } from '../../../core/resources/rmm/canonical-read.frontend.utils.js';
-import { allowsDirectOperationFallback, MissingRMMRuntimeError, resolveDeclaredUpdateLikeMutationFallbackMode, } from '../../../core/resources/rmm/update-like-mutation-fallback.frontend.js';
+import { allowsDirectOperationFallback, MissingRMMRuntimeError, resolveUpdateLikeMutationFallbackMode, } from '../../../core/resources/rmm/update-like-mutation-fallback.frontend.js';
 import { RemoteChangeNotification } from '../../../components/form/feedback/RemoteChangeNotification.js';
 import { emitQuickCreateCompleted, resolveQuickCreateCreatedResourceId, } from '../../../core/resources/relationship-quick-create.frontend.utils.js';
 import { normalizeContextResourceIdentifiersForOutcome, normalizeContextResourceIdentifiersForTransport, } from '../../../core/resources/context-resource-identifiers.frontend.utils.js';
@@ -83,6 +94,43 @@ function readPathValue(value, path) {
         return currentValue[segment];
     }, value);
 }
+/**
+ * A section's values keyed by FIELD PATH (`address.city`), the shape the RMM queues a partial write in: it builds the
+ * request body from these when the mutation is sent, and reports exactly these paths as saved. A field the payload
+ * boundary removed (hidden, owned by the context) has no value here and is not sent.
+ */
+function sectionFieldsByPath(data, fieldNames) {
+    const normalize = (path) => path.replace(/\[(\d+)\]/g, '.$1');
+    const normalizedNames = fieldNames.map(normalize);
+    const fields = {};
+    for (const name of fieldNames) {
+        // A path under another registered path (an array's item leaf, when the array itself is registered) is already
+        // carried whole by its ancestor; writing it again would be a second, redundant write of the same value.
+        const normalized = normalize(name);
+        if (normalizedNames.some((other) => other !== normalized && normalized.startsWith(`${other}.`)))
+            continue;
+        const value = readPathValue(data, name);
+        if (value !== undefined)
+            fields[name] = value;
+    }
+    return fields;
+}
+/**
+ * Whether a field still holds the value a save sent. An emptied field may have been sent as `null` (the cleared
+ * sentinel) while the form holds `''` or nothing, so the three empties are one value here.
+ */
+function isSameFormValue(current, sent) {
+    const isEmpty = (value) => value === undefined || value === null || value === '';
+    if (isEmpty(current) || isEmpty(sent))
+        return isEmpty(current) && isEmpty(sent);
+    return isEqual(current, sent);
+}
+/** Whether a failed mutation's validation error names fields, so it can be shown at them rather than in a toast. */
+function mutationErrorNamesFields(error) {
+    if (!error.validationErrors)
+        return false;
+    return extractServerValidationErrors({ httpStatus: error.status ?? 400, validationErrors: error.validationErrors }) !== null;
+}
 // =============================================================================
 // VALIDATION HELPERS
 // =============================================================================
@@ -199,6 +247,9 @@ function resolveAuthoredEditTemplateForOperation(template, operationIdentifier,
  * a render-prop function, when it is not mounted as the form opens. Everything a `FormField`,
  * `FormFieldArray` or `ArrayField` names in the template's JSX under its `FormLayout` or a `Section` is
  * seen, mounted or not (`collectPlacedFieldPaths`). Placement is per top-level field.
+ *
+ * A layout inside the template may claim the fields and show them itself (`UnplacedRequestFieldsContext`): a wizard
+ * renders them in its last step, where appending them after it put them below its navigation, outside every step.
  */
 function AuthoredTemplateWithUnplacedRequestFields({ Template, requestFieldNames, }) {
     const registry = useTemplatePlacedFieldsRegistry();
@@ -214,7 +265,19 @@ function AuthoredTemplateWithUnplacedRequestFields({ Template, requestFieldNames
         setUnplacedFieldNames(requestFieldNames.filter((name) => !placed.has(name) && !leftOut.has(name)));
         // Read ONCE, deliberately: see the component's JSDoc.
     }, []);
-    return (_jsxs(_Fragment, { children: [_jsx(TemplatePlacedFieldsContext.Provider, { value: registry, children: _jsx(Template, {}) }), unplacedFieldNames && unplacedFieldNames.length > 0 && (_jsx("div", { 
+    const [claims, setClaims] = useState(0);
+    const claim = useCallback(() => {
+        setClaims((count) => count + 1);
+        return () => setClaims((count) => count - 1);
+    }, []);
+    const hasUnplaced = !!unplacedFieldNames && unplacedFieldNames.length > 0;
+    const unplacedContext = useMemo(() => ({
+        content: hasUnplaced
+            ? (_jsx("div", { className: "flex flex-col gap-field", "data-guidance-unplaced-request-fields": "", children: unplacedFieldNames.map((name) => _jsx(FormField, { name: name }, name)) }))
+            : null,
+        claim,
+    }), [claim, hasUnplaced, unplacedFieldNames]);
+    return (_jsxs(_Fragment, { children: [_jsx(TemplatePlacedFieldsContext.Provider, { value: registry, children: _jsx(UnplacedRequestFieldsContext.Provider, { value: unplacedContext, children: _jsx(Template, {}) }) }), hasUnplaced && claims === 0 && (_jsx("div", { 
                 // A section's seam above it (the template's own layout stacks sections at `space-y-section`, and
                 // this block sits outside it), capped at the reading measure like a template's default FormLayout.
                 className: "mr-auto mt-section w-full space-y-field", style: { maxInlineSize: responsiveMaxWidthToCssValue('measure') }, "data-guidance-unplaced-request-fields": "", children: unplacedFieldNames.map((name) => _jsx(FormField, { name: name }, name)) }))] }));
@@ -251,7 +314,24 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     const errorBuilder = useMemo(() => new ErrorBuilderFrontend(), []);
     // Extract from resource context
     const { resourceType, operation, contextResourceIdentifiers } = resourceContext;
-    const updateLikeMutationFallbackMode = callerUpdateLikeMutationFallbackMode ?? resolveDeclaredUpdateLikeMutationFallbackMode(operation);
+    // A section's own Save announces its write here, since it calls no host `onSuccess` (which would navigate or close).
+    const announceOutcome = useResourceOperationOutcomeEmitter(resourceContext, operation);
+    /*
+     * #2288: a write held for another person's approval changed nothing. Told as WAITING, never as saved: no success
+     * notice, no field marked saved, no outcome announced (the emitter refuses a held answer too). Read from the context so
+     * the form never hard-requires a NotificationProvider. Answers whether the write was held, so each save path stops.
+     */
+    const notification = useContext(NotificationContext);
+    const notificationRef = useRef(notification);
+    notificationRef.current = notification;
+    const tellHeldForApproval = useCallback((result) => {
+        if (!readOperationApprovalPending(result))
+            return false;
+        notificationRef.current?.notifyInfo(tComponent(FrontendComponentType.RESOURCES_LAYOUTS_CREATE, 'operationSentForApproval'));
+        return true;
+    }, [tComponent]);
+    const updateLikeMutationFallbackMode = callerUpdateLikeMutationFallbackMode
+        ?? resolveUpdateLikeMutationFallbackMode(operation, registry.resourceConfigurations[resourceType]?.operations);
     const operationIdentifier = String(operation.operationIdentifier);
     const effectiveCoreOperation = resolveEffectiveCoreOperation(operationIdentifier, operation.resourceOperationLike ? String(operation.resourceOperationLike) : undefined);
     // Derive operationType and operationLike for decorator-based field filtering
@@ -295,8 +375,8 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     const { initAutoClearing, injectServerErrors, clearServerErrors } = useServerErrorInjection(formMethodsRef);
     // State for pending publish data (waiting for confirmation dialog)
     const [pendingPublish, setPendingPublish] = useState(null);
-    // Holds the validated form data of a CRITICAL submit awaiting typed double-validation.
-    const [pendingCriticalSubmit, setPendingCriticalSubmit] = useState(null);
+    // Holds the validated form data of a HIGH/CRITICAL submit awaiting its confirmation (typed, for CRITICAL).
+    const [pendingRiskySubmit, setPendingRiskySubmit] = useState(null);
     // Track current draft status
     const [isDraft, setIsDraft] = useState(draftConfig?.isDraft ?? false);
     // Conflict banner (persists until user acknowledges)
@@ -334,16 +414,60 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             // (Match / Filters / Search) whose empty value was submitted as the selection (#2035 run).
             const hostSuppliedKeys = BULK_OPERATION_HOST_SUPPLIED_FIELDS
                 .filter((field) => field in schema.shape);
-            if (hostSuppliedKeys.length > 0) {
-                return schema.omit(Object.fromEntries(hostSuppliedKeys.map((field) => [field, true])));
-            }
+            const withoutSelectors = hostSuppliedKeys.length > 0
+                ? schema.omit(Object.fromEntries(hostSuppliedKeys.map((field) => [field, true])))
+                : schema;
+            /*
+             * A BULK UPDATE writes a nested object child by child, only the children the person changed (#2581), so a child
+             * its object requires is not required of the form: requiring it made the person fill every required sibling to
+             * change one, and those were then written to every selected row. The server validates each child written, and
+             * builds a whole object only for a row that has none.
+             */
+            return isUpdateLikeCoreOperation(effectiveCoreOperation) ? withOptionalNestedChildren(withoutSelectors) : withoutSelectors;
         }
         return schema;
-    }, [operation, operationIdentifier, resourceType]);
+    }, [effectiveCoreOperation, operation, operationIdentifier, resourceType]);
     // Get resource configuration for frontendConfiguration
     const resourceConfig = useMemo(() => {
         return registry.resourceConfigurations[resourceType];
     }, [registry, resourceType]);
+    // The fields that select a polymorphic record's variant, read from the RESOURCE schema as inline edit does, so a
+    // request DTO that omits them still gets them in a partial write (`carryStoredDiscriminators`).
+    const discriminatorFieldNames = useMemo(() => resolveDiscriminatorFieldNames(resourceConfig?.mainSchema), [resourceConfig]);
+    /*
+     * What an ACTION's form starts from when it acts on an existing record (#2192).
+     *
+     * An update-like form starts from the record it acts on, and that is right: "Set disclosure" opens on the current
+     * disclosure, "Set agents" on the agents admitted now, so a person who submits without reading changes nothing they
+     * did not touch. It is wrong for a row field that holds what the LAST action said about itself
+     * (`.isLastActionRecord()` — the reason given for a decision). A verb whose request names that field opened with the
+     * previous decision's words already typed in: "Suspend" prefilled with the reason an acceptance was given, which a
+     * person who submits without reading records as the reason for the suspension. So those fields are left out of
+     * EVERY seed taken from a record — the mount, the override resets and the version-conflict reset — unless the host
+     * supplied them itself (`defaultValuesOverride` is the host's explicit choice).
+     *
+     * Only custom verbs are filtered. A READ shows the record as it is, and the literal `update` edits the row's own
+     * fields, so a marked field it exposes is edited from its current value. The loaded record (`defaultValues`) still
+     * feeds the availability guard and the stored-state comparison, which ask about the record, not about what the
+     * person is about to type.
+     */
+    const lastActionRecordFields = useMemo(() => {
+        if (effectiveCoreOperation === CoreResourceOperation.READ || operationIdentifier === CoreResourceOperation.UPDATE) {
+            return new Set();
+        }
+        // Every schema a row can have (#2455): a variant's last-action field is not seeded from the record either.
+        return new Set([resourceConfig?.mainSchema, ...resourceInheritanceVariantSchemas(resourceConfig?.inheritenceSchemaDefinition)]
+            .flatMap((rowSchema) => [...lastActionRecordFieldNames(rowSchema)]));
+    }, [effectiveCoreOperation, operationIdentifier, resourceConfig]);
+    const seedFromRecord = useCallback((record, applyHostOverride = true) => {
+        const override = (defaultValuesOverride ?? {});
+        const seed = applyHostOverride ? { ...record, ...override } : { ...record };
+        for (const fieldName of lastActionRecordFields) {
+            if (!Object.prototype.hasOwnProperty.call(override, fieldName))
+                delete seed[fieldName];
+        }
+        return seed;
+    }, [defaultValuesOverride, lastActionRecordFields]);
     // Get frontEndApplication config for current app type
     const feAppConfig = useMemo(() => {
         return operation.operationFrontendConfig;
@@ -387,7 +511,11 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     }, [formSchema]);
     // Resolve explicit edit template from layout config — for the operations it can serve
     // (`resolveAuthoredEditTemplateForOperation`).
-    const explicitEditTemplate = useMemo(() => resolveAuthoredEditTemplateForOperation(resourceConfig?.frontendConfiguration?.layout?.edit, operation.operationIdentifier, formFieldShape, resourceConfig?.mainSchema), [resourceConfig, operation.operationIdentifier, formFieldShape]);
+    const explicitEditTemplate = useMemo(() => resolveAuthoredEditTemplateForOperation(resourceConfig?.frontendConfiguration?.layout?.edit, operation.operationIdentifier, formFieldShape, 
+    // Every field some row can hold (#2455), so a custom operation writing a variant field keeps the template.
+    resourceConfig?.inheritenceSchemaDefinition
+        ? z.object(FrontendResourceUtils.resolveFieldShapeOfAnyVariant(resourceConfig) ?? {})
+        : resourceConfig?.mainSchema), [resourceConfig, operation.operationIdentifier, formFieldShape]);
     // Extract draft config from resource-level configuration
     const resourceDraftConfig = resourceConfig?.frontendConfiguration?.draftableConfig;
     // Merge resource-level draft config with prop-provided config (props take precedence)
@@ -472,6 +600,28 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         return writeSurfaces;
     }, [effectiveFormOperationType, formFieldShape, registry, resourceType]);
     const resourceOperations = resourceConfig?.operations ?? [];
+    // The backend's organization-unit narrowing, as the session's access profile serves it (#2939). Read tolerantly: a form
+    // rendered outside a session provider has none, and keeps every field.
+    const accessProfile = useContext(UserOrgsContext)?.permissions?.accessProfile;
+    const organizationUnitNarrowing = accessProfile?.organizationUnitNarrowing;
+    // #2943: on a create, the organization units this caller may name, as the backend's placement answered in advance —
+    // offered as a choice of those units instead of a picker over every unit. `undefined` keeps the picker.
+    const createOrganizationUnitCandidates = useMemo(() => (effectiveCoreOperation === CoreResourceOperation.CREATE
+        ? readThroughCreateOrganizationUnitCandidates({
+            resourceType,
+            resourceConfiguration: resourceConfig,
+            formFieldShape,
+            readThroughCreateOrganizationUnits: accessProfile?.readThroughCreateOrganizationUnits,
+        })
+        : undefined), [accessProfile?.readThroughCreateOrganizationUnits, effectiveCoreOperation, formFieldShape, resourceConfig, resourceType]);
+    const createOrganizationUnitLabels = useReferenceRecordLabels({
+        resourceType: CoreResourceType.ORGANIZATION_UNITS,
+        ids: createOrganizationUnitCandidates,
+        hostContextualParameters: contextualParameters,
+    });
+    const allowedValuesByField = useMemo(() => (createOrganizationUnitCandidates
+        ? { [READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME]: { values: createOrganizationUnitCandidates, labels: createOrganizationUnitLabels } }
+        : undefined), [createOrganizationUnitCandidates, createOrganizationUnitLabels]);
     // Resource-aware hidden-field derivation stays here on purpose.
     // `AutomatedForm` only consumes these names as opaque infrastructure input.
     const hiddenFieldNames = useMemo(() => {
@@ -515,12 +665,18 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             }
             hiddenNames.push(relationshipField);
         }
+        // A read-through resource's organization unit, where this deployment's system of record is not partitioned (#2939).
+        if (isReadThroughOrganizationUnitFieldInert({ resourceType, resourceConfiguration: resourceConfig, formFieldShape, organizationUnitNarrowing })) {
+            hiddenNames.push(READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME);
+        }
         return hiddenNames;
     }, [
         contextFieldValues,
         effectiveFormOperationType,
         formFieldShape,
+        organizationUnitNarrowing,
         relationshipWriteSurfacesByFieldName,
+        resourceConfig,
         resourceOperations,
         resourceType,
     ]);
@@ -535,16 +691,18 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         return isSingleResourceUpdateLikeOperation(operation);
     }, [operation]);
     const resourceId = useMemo(() => {
-        const contextId = contextResourceIdentifiers[resourceType];
+        // Only an operation that addresses ONE record has an id in its context; on a CREATE (or a collection or bulk
+        // operation) the own-type slot holds at most ambient scope and must not become this form's record id.
+        const contextId = frontendResourceUtils.getAddressedRecordId({ resourceType, operation, contextResourceIdentifiers });
         if (contextId) {
-            return typeof contextId === 'string' ? contextId : contextId.resourceId;
+            return contextId;
         }
         const loadedId = defaultValues && typeof defaultValues === 'object'
             ? defaultValues._id
             : undefined;
         return typeof loadedId === 'string' && loadedId.length > 0 ? loadedId : null;
         // eslint-disable-next-line react-hooks/exhaustive-deps -- using stable key instead of object reference
-    }, [contextResourceIdentifiersKey, defaultValues, resourceType]);
+    }, [contextResourceIdentifiersKey, defaultValues, resourceType, operation]);
     const parentResourcesRequirementsKey = useMemo(() => {
         return JSON.stringify(resourceContext.parentResourcesRequirements ?? []);
     }, [resourceContext.parentResourcesRequirements]);
@@ -637,6 +795,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         parentResourcesRequirements: resourceContext.parentResourcesRequirements,
         contextResourceIdentifiers: contextResourceIdentifiersWithResourceId,
         resourceSchema: resourceConfig?.mainSchema,
+        resourceInheritance: resourceConfig?.inheritenceSchemaDefinition,
         enabled: isUpdateLikeOperation && !!resourceId,
         conflictPolicy: { strategy: ConflictStrategy.ACCEPT_REMOTE },
         directFallbackAccepted: allowsDirectOperationFallback(updateLikeMutationFallbackMode),
@@ -773,6 +932,36 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         rmm,
         allowsDirectUpdateLikeMutationFallback,
     ]);
+    /**
+     * Marks saved fields SAVED: each takes the stored value, and stops being dirty.
+     *
+     * The write-back used `setValue(…, { shouldDirty: false })`, which writes the value but leaves a field that was
+     * already dirty dirty, so after a section save or an autosave the form still reported unsaved changes for fields
+     * the server had just stored. `resetField` with the stored value as the field's new default is how React Hook Form
+     * says "this is the saved value". It also clears the field's error, which the save has made obsolete, and keeps it
+     * touched. A field that is not registered (a conditional field hidden right now) has no state to reset, so its value
+     * is written with `setValue` first.
+     *
+     * A field the person changed while the save was on its way is left alone: it holds a newer value than the one saved,
+     * and writing the stored value back erased what they had typed since (an autosave of "abc" landing while the field
+     * read "abcd" turned it back into "abc"). It stays unsaved, so its own save marks it.
+     *
+     * @param storedRecord the record as stored after the save; a field it does not carry keeps the value the form holds.
+     * @param sentValues the values the save sent, by field path, when known.
+     */
+    const markFieldsSaved = useCallback((fieldNames, storedRecord, sentValues) => {
+        const form = formMethodsRef.current;
+        if (!form)
+            return;
+        for (const field of fieldNames) {
+            if (sentValues && Object.prototype.hasOwnProperty.call(sentValues, field) && !isSameFormValue(form.getValues(field), sentValues[field]))
+                continue;
+            const stored = readPathValue(storedRecord, field);
+            const value = stored !== undefined ? stored : form.getValues(field);
+            form.setValue(field, value, { shouldDirty: false, shouldValidate: false });
+            form.resetField(field, { defaultValue: value, keepTouched: true });
+        }
+    }, []);
     // This is the wrapper's single RMM subscription seam. All authoritative
     // mutation/read-back/remote-reset outcomes are translated here into form
     // state updates, server validation injection, transient remote-update UI, and
@@ -785,14 +974,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             case RMMEventType.MUTATION_RESULT: {
                 const { result } = event;
                 if (result.success && result.savedFields) {
-                    if (formMethodsRef.current) {
-                        for (const field of result.savedFields) {
-                            formMethodsRef.current.setValue(field, readPathValue(rmmSnapshot.confirmedData, field), {
-                                shouldDirty: false,
-                                shouldValidate: false,
-                            });
-                        }
-                    }
+                    markFieldsSaved(result.savedFields, rmmSnapshot.confirmedData, result.savedValues);
                 }
                 if (!result.success && result.error?.type === MutationErrorType.VALIDATION) {
                     if (result.error.validationErrors) {
@@ -834,7 +1016,9 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             }
             case RMMEventType.CONFLICT_RESET: {
                 if (formMethodsRef.current) {
-                    formMethodsRef.current.reset(event.currentData);
+                    // The server's record after a conflict: still a record, so the same seed rule applies (#2192). The host's
+                    // prefill is NOT re-applied: after a conflict the server's values are the ones the person must see.
+                    formMethodsRef.current.reset(seedFromRecord(event.currentData, false));
                 }
                 clearServerErrors();
                 setConflictBanner({
@@ -899,20 +1083,19 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             return null;
         }
         try {
-            const primaryResourceId = isUpdateOperation
-                ? resourceId ?? frontendResourceUtils.getPrimaryResourceIdentifier(resourceContext)
-                : frontendResourceUtils.getPrimaryResourceIdentifier(resourceContext);
+            // An UPDATE's own route segment is the record it edits — the addressed record (`resourceId`), never a
+            // second read of the own-type slot. A CREATE has none: its slot holds at most ambient scope (#2143 review).
+            const updatedRecordId = isUpdateOperation ? resourceId : null;
             const apiBaseUrl = envLoader.getApiUrl();
             if (!resourceConfig?.resourceFieldIdentifier) {
                 throw FrontendResourceUtils.buildConfigurationError(ErrorCustomMessageReference.FRONTEND_RESOURCE_FIELD_IDENTIFIER_NOT_FOUND, { resourceType: resourceContext.resourceType, component: 'ResourceAutomatedForm' });
             }
             const resourceFieldIdentifier = resourceConfig.resourceFieldIdentifier;
             const contextualParameters = { ...contextualParametersWithResourceId };
-            if (isUpdateOperation && primaryResourceId) {
-                contextualParameters[resourceFieldIdentifier] = primaryResourceId;
+            if (updatedRecordId) {
+                contextualParameters[resourceFieldIdentifier] = updatedRecordId;
             }
-            const routeBearingMutationOperation = (operation.variantType === ResourceOperationVariantType.API_CALL
-                || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK)
+            const routeBearingMutationOperation = (operation.variantType === ResourceOperationVariantType.API_CALL)
                 ? operation
                 : resourceConfig && isUpdateOperation
                     ? pickPreferredOperationForCoreSemanticAddressability({
@@ -955,7 +1138,6 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                 apiBaseUrl,
                 basePath,
                 contextualParameters,
-                primaryResourceId,
                 resourceFieldIdentifier,
             };
         }
@@ -984,8 +1166,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         const isUpdateOperation = isSingleResourceUpdateLikeOperation(operation);
         const { apiBaseUrl, contextualParameters } = resourceApiBase;
         try {
-            const uploadOperation = (operation.variantType === ResourceOperationVariantType.API_CALL
-                || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK)
+            const uploadOperation = (operation.variantType === ResourceOperationVariantType.API_CALL)
                 ? operation
                 : isUpdateOperation
                     ? pickPreferredOperationForCoreSemanticAddressability({
@@ -1079,10 +1260,11 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         // Currently checks: isUnique()
         // When new server-validated decorators are added (e.g., isExternallyValidated),
         // add them to this check to enable the validate-field URL for those resources.
-        const mainSchema = resourceConfig.mainSchema;
-        if (!mainSchema)
+        // Every field some row can hold (#2455): a unique field only a variant declares warns early too (its backend route
+        // exists since #2434).
+        const shape = FrontendResourceUtils.resolveFieldShapeOfAnyVariant(resourceConfig);
+        if (!shape)
             return undefined;
-        const shape = getZodObjectShape(mainSchema);
         const hasServerValidatedFields = Object.values(shape).some(fieldSchema => isUnique(fieldSchema)
         // Future: || isExternallyValidated(fieldSchema)
         // Future: || isServerValidated(fieldSchema)
@@ -1136,14 +1318,16 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         return composed;
     }, [resourceApiBase, resourceConfig, resourceContext.parentResourcesRequirements, resourceType]);
     /**
-     * Resource ID for UPDATE operations.
-     * Passed as excludeId to the validate-field endpoint so server-side validation
-     * strategies can exclude the current resource from checks (e.g., uniqueness
-     * validation shouldn't conflict with the resource's own values during UPDATE).
+     * The form's record id, as the form PUBLISHES it to its fields (the form context's `resourceId`): the
+     * uniqueness check's `excludeId`, a reference field's host record, quick-create's source record.
+     *
+     * It is the addressed record (`resourceId` above, through `getAddressedRecordId`) and nothing else. It used to
+     * fall back to `getPrimaryResourceIdentifier`, which reads the own-type slot whatever the operation: on a
+     * CREATE that slot holds at most ambient scope — the quick-switcher's selection, or the host record a
+     * same-type quick-create was opened from — and every field saw it as the record being created (#2143 review).
+     * For a record operation the fallback read the same slot `resourceId` already read, so it added nothing.
      */
-    const primaryResourceId = useMemo(() => {
-        return resourceId ?? frontendResourceUtils.getPrimaryResourceIdentifier(resourceContext) ?? undefined;
-    }, [resourceContext, resourceId]);
+    const primaryResourceId = useMemo(() => resourceId ?? undefined, [resourceId]);
     const canonicalReadOperation = useMemo(() => {
         if (rmm) {
             return undefined;
@@ -1187,6 +1371,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         resourceType,
         enabled: needsFetch && hasLoadedOnce && !fetchError,
     });
+    const recordSeededDefaultValues = useMemo(() => (defaultValues ? seedFromRecord(defaultValues) : defaultValues), [defaultValues, seedFromRecord]);
     // CREATE-only synchronous default-value seed.
     //
     // Two jobs (see `resolveCreateFormInitialValues` for the full rationale):
@@ -1204,15 +1389,128 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     // first mount and never reach RHF.
     // Computed only for CREATE; UPDATE-like operations take their defaults from the
     // fetched record. Default-free non-discriminated resources resolve to `undefined`.
+    /*
+     * A BULK update form writes what the person SETS, each nested child by its dotted path (`bulkUpdatePatch`, #2581). It
+     * starts EMPTY, as bulk editors do (Jira's bulk edit, Salesforce's mass update): no selected row's value can be shown
+     * (each has its own), and a schema default shown in its place could then never be written, since a field still
+     * holding what the form showed is not a change. A host's own prefill (`defaultValuesOverride`) is its explicit
+     * choice, so it is shown AND counts as set.
+     */
+    const writesBulkPatch = operation.isBulkOperation === true && isUpdateLikeCoreOperation(effectiveCoreOperation);
     const createSeededDefaultValues = useMemo(() => {
         if (needsFetch)
             return undefined;
+        if (writesBulkPatch)
+            return defaultValuesOverride;
         return resolveCreateFormInitialValues({
             formFieldShape,
             inheritanceConfig,
             defaultValuesOverride: defaultValuesOverride,
         });
-    }, [needsFetch, formFieldShape, inheritanceConfig, defaultValuesOverride]);
+    }, [needsFetch, formFieldShape, inheritanceConfig, defaultValuesOverride, writesBulkPatch]);
+    // Compared against NOTHING: the form starts empty, so every value it holds was set (by the person, or by the host's
+    // prefill), and a field holding only what an untouched control holds is not written (`bulkUpdatePatch`).
+    const toBulkPatch = useCallback((values, writtenAsHeld, clears = {}) => bulkUpdatePatch({
+        values,
+        seed: undefined,
+        schema: formSchema,
+        writtenAsHeld,
+        variantFields: discriminatorFieldNames,
+        clears,
+    }), [discriminatorFieldNames, formSchema]);
+    /*
+     * The person's explicit "clear on every selected record" choices (#2620), by field path, each the value
+     * `resolveBulkFieldClear` chose. A ref beside the state: each write reads the clears it carries when it builds its body,
+     * and the autosave a choosing click triggers runs before React re-renders. A clear leaves once a write carried it
+     * (`consumeBulkClears`), so a value the person sets afterwards is never cleared again by a later write.
+     */
+    const [bulkClears, setBulkClears] = useState({});
+    const bulkClearsRef = useRef(bulkClears);
+    const bulkSelectionCount = readBulkOperationSelectionCount(resourceContext.additionalContext);
+    const bulkClearFor = useMemo(() => {
+        const decided = new Map();
+        return (fieldName) => {
+            if (!writesBulkPatch)
+                return undefined;
+            if (!decided.has(fieldName)) {
+                decided.set(fieldName, resolveBulkFieldClear(fieldName, operation.requestDto, formSchema, discriminatorFieldNames));
+            }
+            return decided.get(fieldName);
+        };
+    }, [discriminatorFieldNames, formSchema, operation.requestDto, writesBulkPatch]);
+    const setBulkFieldCleared = useCallback((fieldName, cleared) => {
+        const clear = cleared ? bulkClearFor(fieldName) : undefined;
+        if (cleared && !clear)
+            return;
+        const next = { ...bulkClearsRef.current };
+        if (clear)
+            next[fieldName] = clear.value;
+        else
+            delete next[fieldName];
+        bulkClearsRef.current = next;
+        setBulkClears(next);
+        if (!clear)
+            return;
+        /*
+         * The control then holds what the clear writes, never what the person typed and chose to drop (an autosave validates
+         * it). A list holds `[]`: a field array resyncs only from an array, so `undefined` left its rows on screen after an
+         * undo while the form held none. A switch holds `false`. A value holds nothing, which every scalar control renders
+         * empty and the bulk form's schema accepts on a relaxed child, where `null` would not parse.
+         */
+        const held = clear.kind === BulkFieldClearKind.EMPTY ? [] : clear.kind === BulkFieldClearKind.TURN_OFF ? false : undefined;
+        formMethodsRef.current?.setValue(fieldName, held, { shouldDirty: true });
+        // An error raised by the dropped value no longer describes the field.
+        formMethodsRef.current?.clearErrors(fieldName);
+    }, [bulkClearFor]);
+    /*
+     * The fields whose clear affordance is on screen, counted (a remount of the same field mounts before it unmounts). A
+     * write carries only their clears (`liveBulkClears`): a field hidden after its clear was chosen leaves the form's values,
+     * as the form does not submit an unmounted field, so its clear leaves the write too.
+     */
+    const mountedBulkClearFieldsRef = useRef(new Map());
+    const registerBulkClearField = useCallback((fieldName) => {
+        const mounted = mountedBulkClearFieldsRef.current;
+        mounted.set(fieldName, (mounted.get(fieldName) ?? 0) + 1);
+        return () => {
+            const remaining = (mounted.get(fieldName) ?? 1) - 1;
+            if (remaining > 0)
+                mounted.set(fieldName, remaining);
+            else
+                mounted.delete(fieldName);
+        };
+    }, []);
+    // The choices belong to ONE operation's form: a host that hands this instance another operation (hosts do not key it)
+    // must not carry a clear chosen for the first into the second's write.
+    const bulkClearsOperationKeyRef = useRef(currentOperationPathKey);
+    useEffect(() => {
+        if (bulkClearsOperationKeyRef.current === currentOperationPathKey)
+            return;
+        bulkClearsOperationKeyRef.current = currentOperationPathKey;
+        if (Object.keys(bulkClearsRef.current).length === 0)
+            return;
+        bulkClearsRef.current = {};
+        setBulkClears({});
+    }, [currentOperationPathKey]);
+    const liveBulkClears = useCallback(() => Object.fromEntries(Object.entries(bulkClearsRef.current).filter(([fieldName]) => mountedBulkClearFieldsRef.current.has(fieldName))), []);
+    const consumeBulkClears = useCallback((written) => {
+        const paths = Object.keys(written);
+        if (paths.length === 0)
+            return;
+        const next = { ...bulkClearsRef.current };
+        for (const path of paths)
+            delete next[path];
+        bulkClearsRef.current = next;
+        setBulkClears(next);
+    }, []);
+    const bulkFieldClearing = useMemo(() => (writesBulkPatch
+        ? {
+            selectionCount: bulkSelectionCount,
+            clearFor: bulkClearFor,
+            isCleared: (fieldName) => Object.hasOwn(bulkClears, fieldName),
+            setCleared: setBulkFieldCleared,
+            registerField: registerBulkClearField,
+        }
+        : null), [bulkClearFor, bulkClears, bulkSelectionCount, registerBulkClearField, setBulkFieldCleared, writesBulkPatch]);
     // Fetch existing data for UPDATE-like operations
     // Use refs to avoid infinite loops from unstable function references
     useEffect(() => {
@@ -1339,13 +1637,28 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                     }
                     throw mutationErrorForReport(mutationResult.error, 'Submit failed');
                 }
-                result = mutationResult.responseData;
+                result = mutationResult.heldForApproval ?? mutationResult.responseData;
             }
             else {
                 assertRMMAvailableForDefaultUpdateLikeMutation('ResourceAutomatedForm submit');
+                const contextFieldNames = Object.keys(contextFieldValues);
+                // Every explicit clear: the main submit writes the whole form (#2620).
+                const sentBulkClears = writesBulkPatch ? liveBulkClears() : {};
+                const requestBody = writesBulkPatch ? toBulkPatch(data, contextFieldNames, sentBulkClears) : data;
+                /*
+                 * A literal bulk UPDATE that sets nothing would write nothing but a new version and `updatedAt` on every selected
+                 * row (and a stale-version refusal for anyone editing one) while reporting success. Its meaning IS its patch, so
+                 * an empty one is said, not sent. A VERB (an update-like custom operation) still runs on an empty patch: the verb
+                 * itself is what the person asked for, and its own logic may be all it writes.
+                 */
+                const isLiteralUpdate = operationIdentifier === CoreResourceOperation.UPDATE || operationIdentifier === CoreResourceOperation.UPDATE_MANY;
+                if (writesBulkPatch && isLiteralUpdate && Object.keys(requestBody).every((key) => contextFieldNames.includes(key))) {
+                    injectServerErrors({ [FORM_LEVEL_ERROR_PATH]: tComponent(FrontendComponentType.RESOURCES_LAYOUTS_CREATE, 'bulkNothingToChange') });
+                    return;
+                }
                 result = await doOperationRef.current(currentOperationTransportOverride.operationPathKey, {
                     contextualParameters: currentOperationTransportOverride.contextualParameters,
-                    requestData: mergeRequestDataWithBulkSelection(data),
+                    requestData: mergeRequestDataWithBulkSelection(requestBody),
                     parentResourcesRequirements: currentOperationTransportOverride.parentResourcesRequirements,
                 }, 
                 // `silent`: this form owns the user-facing failure UX (the catch below
@@ -1355,8 +1668,14 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                 // Side-effects (auth-logout on 401, redirect, dedup) still run — `silent`
                 // now suppresses only the global display, not the ERROR_OCCURED event.
                 { silent: true });
+                consumeBulkClears(sentBulkClears);
             }
             logDebug('handleSubmit: success', { operationPathKey });
+            if (tellHeldForApproval(result)) {
+                // The request was made: the host moves on (a create goes back, as it does for an answer naming no record).
+                onSuccessRef.current?.(result);
+                return;
+            }
             // Emit success notification event if configured
             const frontendNotification = getFrontendNotification(operation);
             if (frontendNotification) {
@@ -1444,13 +1763,21 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         }
     }, [
         assertRMMAvailableForDefaultUpdateLikeMutation,
+        contextFieldValues,
         currentOperationTransportOverride,
+        injectServerErrors,
         mergeRequestDataWithBulkSelection,
+        operationIdentifier,
         operationPathKey,
         contextualParameters,
         operation,
         resourceContext,
         rmm,
+        tComponent,
+        toBulkPatch,
+        consumeBulkClears,
+        liveBulkClears,
+        writesBulkPatch,
     ]);
     // Handle validation errors (client-side, from RHF)
     const handleError = (errors) => {
@@ -1470,7 +1797,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         if (!defaultValuesOverride || !formMethodsRef.current)
             return;
         const merged = defaultValues
-            ? { ...defaultValues, ...defaultValuesOverride }
+            ? seedFromRecord(defaultValues)
             : defaultValuesOverride;
         formMethodsRef.current.reset(merged);
         // eslint-disable-next-line react-hooks/exhaustive-deps -- only run when override changes
@@ -1482,7 +1809,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         // When defaultValuesOverride is set (e.g. from DISCOVER), reset form with merged values
         if (defaultValuesOverride) {
             const merged = defaultValues
-                ? { ...defaultValues, ...defaultValuesOverride }
+                ? seedFromRecord(defaultValues)
                 : defaultValuesOverride;
             formMethods.reset(merged);
         }
@@ -1506,24 +1833,40 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         };
         // Check if already aborted before starting
         checkAborted();
-        // A composite child autosaves under its dotted path (`address.city`). This handler supplies the
-        // RMM's `transportOverride.requestData`, which the RMM sends as given, so the body must already be
-        // in the resource's own shape: the WHOLE top-level field with the edit written into it. A flat
-        // dotted key is dropped by the strict UPDATE parse with a 200, and a bare nested fragment would
-        // erase the siblings, because an UPDATE replaces a nested object (#1395). The stored parent comes
-        // from the RMM's confirmed state, the last thing the server said; without an RMM, from the form.
-        const storedRecord = (rmm?.getSnapshot().confirmedData ?? formMethodsRef.current?.getValues() ?? null);
-        const requestData = mergeRequestDataWithBulkSelection(buildInlineUpdateRequestData(storedRecord, fieldName, value));
-        // Check abort again after shaping the request payload.
-        checkAborted();
+        /*
+         * A composite child autosaves under its dotted path (`address.city`), and the body must be in the resource's own
+         * shape: the WHOLE top-level field with the edit written into it. A flat dotted key is dropped by the strict
+         * UPDATE parse with a 200, and a bare nested fragment would erase the siblings, because an UPDATE replaces a
+         * nested object (#1395).
+         *
+         * On the RMM lane the RMM builds that body itself when it SENDS the mutation (`buildWireRequestData`), onto the
+         * record as confirmed at that moment. This handler used to build it here, at QUEUE time, and hand it over as
+         * `transportOverride.requestData`, which the RMM sends as given: an autosave queued behind an in-flight save of a
+         * sibling (`address.street`) then re-sent the sibling's old value, and passed the version check. Only the direct
+         * lane, which sends at once, builds the body here, from the record the form loaded.
+         *
+         * Both send the record's stored discriminator, which a polymorphic resource's partial UPDATE needs: the RMM adds the
+         * one it has confirmed when it sends, and the direct lane adds the one the form loaded.
+         *
+         * A BULK update has no record to build onto (each selected row has its own): it writes the field by its path, a
+         * nested child as `contact.city` (#2581), and nothing when the field holds what the form was seeded with.
+         */
+        // The explicit clears this field's write covers (#2620): a clear chosen on the field autosaves as its other changes do.
+        const sentBulkClears = !rmm && writesBulkPatch ? bulkClearsWithin(liveBulkClears(), bulkWriteUnits([fieldName], formSchema)) : {};
+        const bulkAutosavePatch = !rmm && writesBulkPatch
+            ? toBulkPatch(pickSubmissionDataPaths(
+            // The value this autosave validated, over the form's full values (a path into an array writes the array).
+            withPathValue((formMethodsRef.current?.getValues() ?? {}), fieldName, value), bulkWriteUnits([fieldName], formSchema)), [], sentBulkClears)
+            : undefined;
+        if (bulkAutosavePatch && Object.keys(bulkAutosavePatch).length === 0)
+            return;
         const operationPromise = rmm
-            ? rmm.queueMutation({ [fieldName]: value }, {
+            ? rmm.queueMutation(
+            // The RMM adds the stored discriminator when it sends (`resource-discriminators.frontend.utils.ts`).
+            { [fieldName]: value }, {
                 type: MutationType.AUTOSAVE,
                 priority: MutationPriority.LOW,
-                transportOverride: {
-                    ...currentOperationTransportOverride,
-                    requestData,
-                },
+                transportOverride: currentOperationTransportOverride,
             }).then((mutationResult) => {
                 if (!mutationResult.success) {
                     throw mutationResult.error ?? new Error('Autosave failed');
@@ -1531,7 +1874,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             })
             : doOperationRef.current(currentOperationTransportOverride.operationPathKey, {
                 contextualParameters: currentOperationTransportOverride.contextualParameters,
-                requestData,
+                requestData: mergeRequestDataWithBulkSelection(bulkAutosavePatch ?? carryStoredDiscriminators(buildInlineUpdateRequestData((formMethodsRef.current?.getValues() ?? null), fieldName, value), discriminatorFieldNames, defaultValues)),
                 parentResourcesRequirements: currentOperationTransportOverride.parentResourcesRequirements,
             }, {
                 signal: abortSignal,
@@ -1559,13 +1902,47 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         await Promise.race([operationPromise, abortPromise]);
         // Final abort check after operation completes
         checkAborted();
+        consumeBulkClears(sentBulkClears);
     }, [
         assertRMMAvailableForDefaultUpdateLikeMutation,
         currentOperationTransportOverride,
+        defaultValues,
+        discriminatorFieldNames,
+        formSchema,
         mergeRequestDataWithBulkSelection,
         rmm,
+        toBulkPatch,
+        consumeBulkClears,
+        liveBulkClears,
+        writesBulkPatch,
     ]);
-    // Section save handler - saves a subset of fields via PATCH
+    /**
+     * Saves the fields ONE section registered, and owns the whole outcome of that save.
+     *
+     * ## It is not the operation completing
+     *
+     * A host's `onSuccess` / `onError` mean "the record is saved (or refused): announce it and move on", and
+     * `ResourceLayout_Update` navigates to the record. A section save called them too, so saving one section of a
+     * multi-section form took the person off the page with the other sections unsaved, and announced the save twice.
+     * Neither is called here: the form announces the section's outcome itself, once, and stays.
+     *
+     * ## Queued by field path, built when sent
+     *
+     * The RMM queues a partial write by FIELD PATH (`address.city`), as autosave does, and builds the request body when
+     * it SENDS the mutation (`buildWireRequestData`), onto the record as it is confirmed at that moment. The section
+     * used to queue a nested object with a body frozen at queue time, which went wrong twice: the body carried the
+     * stored siblings of every nested parent as they were when the save was QUEUED, so a mutation confirmed in between
+     * (an autosave of `address.street`) was overwritten by the older value and still passed the version check; and the
+     * RMM reported the top-level key (`address`) as saved, so the write-back replaced the whole object from the server
+     * and erased unsaved edits to its other children in another section.
+     *
+     * ## Failures
+     *
+     * A field-level refusal is shown at its fields (`injectServerErrors`, through the RMM event seam or directly on the
+     * direct lane), with no toast. A refusal that names no field, and any other failure, raise ONE resource error
+     * toast. A save cancelled on purpose (the main submit superseded it) says nothing. A caller-supplied handler that
+     * throws is reported the same way instead of escaping as an unhandled rejection.
+     */
     const handleSectionSave = useCallback(async (sectionRef, fieldNames, data) => {
         if (fieldNames.length === 0) {
             if (envLoader.isDevelopment()) {
@@ -1576,61 +1953,96 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             }
             return;
         }
-        const sectionScopedData = fieldNames.length > 0
-            ? pickSubmissionDataPaths(data, fieldNames)
-            : data;
-        const sanitizedData = sanitizeAutomatedFormSubmissionData(sectionScopedData, {
+        const sanitizedData = sanitizeAutomatedFormSubmissionData(pickSubmissionDataPaths(data, fieldNames), {
             hiddenFieldNames,
             contextFieldValues,
             omitClearedFields: omitClearedFieldsForSubmission,
             schema: formSchema,
         });
-        // If a custom callback is provided, use it
-        if (onSectionSaveRef.current) {
-            await onSectionSaveRef.current(sectionRef, fieldNames, sanitizedData);
-            return;
-        }
         try {
+            // A caller-supplied handler owns the save (P9), but not an escaping rejection.
+            if (onSectionSaveRef.current) {
+                await onSectionSaveRef.current(sectionRef, fieldNames, sanitizedData);
+                return;
+            }
             let result;
-            // A section may hold only SOME of a composite's children, and an UPDATE replaces the nested
-            // object whole — so the body carries the stored siblings of every partially-written parent
-            // (#1410). Stored = the RMM's confirmed state, or on the direct lane the record the form loaded.
-            const storedRecord = (rmm ? rmm.getSnapshot().confirmedData : defaultValues);
-            const requestData = mergeRequestDataWithBulkSelection(carryStoredSiblingsIntoPartialWrites(sanitizedData, fieldNames, storedRecord));
             if (rmm) {
-                const mutationResult = await rmm.queueMutation(sanitizedData, {
+                // The RMM lane is single-record (`useResourceRMM` is enabled only with a `resourceId`), so there is no bulk
+                // selection to merge into the body here; a bulk update takes the direct lane below.
+                // The RMM adds the stored discriminator when it sends (`resource-discriminators.frontend.utils.ts`).
+                const mutationResult = await rmm.queueMutation(sectionFieldsByPath(sanitizedData, fieldNames), {
                     type: MutationType.SECTION,
                     priority: MutationPriority.NORMAL,
                     source: { type: MutationSourceType.FORM, subscriberId: `section:${sectionRef}` },
-                    transportOverride: {
-                        ...currentOperationTransportOverride,
-                        requestData,
-                    },
+                    transportOverride: currentOperationTransportOverride,
                 });
                 if (!mutationResult.success) {
                     if (isConflictMutationFailure(mutationResult)) {
                         return;
                     }
-                    if (mutationResult.error?.type === MutationErrorType.VALIDATION) {
-                        onErrorRef.current?.(mutationErrorForReport(mutationResult.error, 'Section save validation failed'));
+                    if (mutationResult.error?.type === MutationErrorType.VALIDATION && mutationErrorNamesFields(mutationResult.error)) {
+                        // Shown at the fields by the RMM event seam below.
                         return;
                     }
                     throw mutationErrorForReport(mutationResult.error, 'Section save failed');
                 }
-                result = mutationResult.responseData;
+                result = mutationResult.heldForApproval ?? mutationResult.responseData;
             }
             else {
                 assertRMMAvailableForDefaultUpdateLikeMutation('ResourceAutomatedForm section save');
+                let requestData;
+                let sentBulkClears = {};
+                if (writesBulkPatch) {
+                    // A BULK update has no stored siblings to carry (each selected row has its own): it writes each nested child
+                    // by its path, and only what the person changed (#2581). A path into an array or a value type is written as
+                    // that whole value, read from the form's full values (`bulkWriteUnits`).
+                    const contextFieldNames = Object.keys(contextFieldValues);
+                    // The explicit clears this section's fields carry (#2620); a clear on another section waits for its own save.
+                    sentBulkClears = bulkClearsWithin(liveBulkClears(), bulkWriteUnits(fieldNames, formSchema));
+                    // The full values carry each path whole, except a request field the operation offers (#2744 review N3): that one
+                    // takes what the form's offer filter let through (`data`), so a value the operation does not offer is not sent.
+                    const fullValues = { ...(formMethodsRef.current?.getValues() ?? data) };
+                    for (const offeredField of Object.keys(operation.requestFieldOffers ?? {})) {
+                        if (offeredField in data)
+                            fullValues[offeredField] = data[offeredField];
+                        else
+                            delete fullValues[offeredField];
+                    }
+                    const patch = toBulkPatch(sanitizeAutomatedFormSubmissionData(pickSubmissionDataPaths(fullValues, bulkWriteUnits(fieldNames, formSchema)), { hiddenFieldNames, contextFieldValues, omitClearedFields: omitClearedFieldsForSubmission, schema: formSchema }), contextFieldNames, sentBulkClears);
+                    // Nothing set in the section: as for the main submit, a literal update says so instead of sending a write that
+                    // would only bump every row, while a VERB still runs (the verb is what was asked).
+                    const isLiteralUpdate = operationIdentifier === CoreResourceOperation.UPDATE || operationIdentifier === CoreResourceOperation.UPDATE_MANY;
+                    if (isLiteralUpdate && Object.keys(patch).every((key) => contextFieldNames.includes(key))) {
+                        injectServerErrors({ [FORM_LEVEL_ERROR_PATH]: tComponent(FrontendComponentType.RESOURCES_LAYOUTS_CREATE, 'bulkNothingToChange') });
+                        return;
+                    }
+                    requestData = mergeRequestDataWithBulkSelection(patch);
+                }
+                else {
+                    // A section may hold only SOME of a composite's children, and an UPDATE replaces the nested object whole, so
+                    // the body carries the stored siblings of every partially-written parent (#1410): here, the record the form
+                    // loaded. Sent at once, so it cannot go stale in a queue.
+                    const storedRecord = defaultValues;
+                    requestData = mergeRequestDataWithBulkSelection(carryStoredDiscriminators(carryStoredSiblingsIntoPartialWrites(sanitizedData, fieldNames, storedRecord), discriminatorFieldNames, storedRecord));
+                }
                 result = await doOperationRef.current(currentOperationTransportOverride.operationPathKey, {
                     contextualParameters: currentOperationTransportOverride.contextualParameters,
                     requestData,
                     parentResourcesRequirements: currentOperationTransportOverride.parentResourcesRequirements,
                 }, 
-                // silent: form owns the failure UX (catch emits NOTIFY_RESOURCE_ERROR);
-                // suppress the duplicate global toast. See handleSubmit for rationale.
+                // silent: the form owns the failure UX (the catch below), so the global toast is suppressed.
                 { silent: true });
+                // No RMM event will write the saved values back, so the form marks them saved itself — unless nothing was saved.
+                if (!readOperationApprovalPending(result))
+                    markFieldsSaved(fieldNames, result, Object.fromEntries(fieldNames.map((field) => [field, readPathValue(sanitizedData, field)])));
+                consumeBulkClears(sentBulkClears);
             }
-            // Emit success event for the section save
+            if (tellHeldForApproval(result))
+                return;
+            // The rest of the screen hears about the write (a display of the row re-reads it, a listing refreshes, a
+            // background run is recorded), as after the main submit. Announced as PARTIAL: the form stays open over the same
+            // records, so nothing reads it as the operation being done.
+            announceOutcome(result, { partialWrite: true });
             emitRef.current(FrontendEvents.NOTIFY_RESOURCE_SUCCESS, {
                 ...resourceContext,
                 contextResourceIdentifiers: normalizeContextResourceIdentifiersForOutcome({
@@ -1649,17 +2061,17 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                     notificationLevel: UserNotificationLevel.SUCCESS,
                 },
             });
-            onSuccessRef.current?.(result);
         }
         catch (error) {
+            if (error instanceof MutationCancelledError) {
+                return;
+            }
+            const serverValidation = extractServerValidationErrors(error);
+            if (serverValidation) {
+                injectServerErrors(serverValidation.validationErrors);
+                return;
+            }
             const err = error instanceof Error ? error : new Error(String(error));
-            onErrorRef.current?.(err);
-            // Resource layer owns the failure UX: emit ONE resource error toast (the
-            // doOperation above is `silent`, so the global toast is suppressed). We do
-            // NOT re-throw: the sole consumer (`Section.tsx` save button) has no catch and
-            // no success/failure branching, so a throw would surface ONLY as an unhandled
-            // promise rejection → a generic global toast. This keeps section-save aligned
-            // with handleSubmit/draft/publish (single, resource-aware toast).
             emitRef.current(FrontendEvents.NOTIFY_RESOURCE_ERROR, {
                 ...resourceContext,
                 contextResourceIdentifiers: normalizeContextResourceIdentifiersForTransport(resourceContext.contextResourceIdentifiers),
@@ -1673,16 +2085,27 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
             });
         }
     }, [
+        announceOutcome,
         assertRMMAvailableForDefaultUpdateLikeMutation,
         currentOperationTransportOverride,
         contextFieldValues,
-        contextualParameters,
         defaultValues,
+        discriminatorFieldNames,
+        formSchema,
         hiddenFieldNames,
+        injectServerErrors,
+        markFieldsSaved,
         mergeRequestDataWithBulkSelection,
+        omitClearedFieldsForSubmission,
+        operationIdentifier,
         resourceContext,
         resourceType,
         rmm,
+        tComponent,
+        toBulkPatch,
+        consumeBulkClears,
+        liveBulkClears,
+        writesBulkPatch,
     ]);
     // Autosave config for the provider
     /**
@@ -1711,19 +2134,34 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
      * per-field save before the record exists is a different feature (drafts) with its own surface.
      *
      * An explicit caller-supplied `autosaveConfig` still wins, unchanged — including its own
-     * `defaultTrigger`, so a caller that genuinely wants form-wide autosave can still ask for it.
+     * `defaultTrigger`, so a caller that genuinely wants form-wide autosave can still ask for it — but only where the
+     * form writes fields of records that EXIST (the same rule as a section's Save). Elsewhere it is dropped: with no
+     * record, autosave's direct lane sent the form's own operation, so on a create form every autosaved field CREATED a
+     * record, and on a verb that is not update-like it ran the action once per field.
      */
     const derivedAutosaveEnabled = useMemo(
     // `effectiveFormOperationType`, not `operationType`: a CUSTOM operation declaring
     // `resourceOperationLike: UPDATE` (a `rotate`, say) edits an existing row and autosaves on the
     // same terms. That variable is the one the rest of the form filters fields by.
     () => autosaveConfig === undefined && deriveAutosaveEnabledFromFields(formFieldShape, effectiveFormOperationType), [autosaveConfig, effectiveFormOperationType, formFieldShape]);
+    // #2288: an operation held for approval never autosaves: each debounced field would file its own request for an
+    // approver to answer. The person saves deliberately, and the whole change is one request.
+    const autosaveWritesRecordFields = isUpdateLikeCoreOperation(effectiveCoreOperation) && operation.requiresApproval === undefined;
+    const autosaveRequestedHere = autosaveConfig?.enabled === true;
+    useEffect(() => {
+        if (!autosaveRequestedHere || autosaveWritesRecordFields || !envLoader.isDevelopment())
+            return;
+        logger.warn('[ResourceAutomatedForm] autosaveConfig is ignored: autosave saves fields of records that exist, and this form creates one or runs an action.', {
+            resourceType,
+            operationIdentifier,
+        });
+    }, [autosaveWritesRecordFields, autosaveRequestedHere, operationIdentifier, resourceType]);
     const autosaveProviderConfig = useMemo(() => ({
-        enabled: autosaveConfig?.enabled ?? derivedAutosaveEnabled,
+        enabled: autosaveWritesRecordFields && (autosaveConfig?.enabled ?? derivedAutosaveEnabled),
         defaultTrigger: autosaveConfig?.defaultTrigger ?? (derivedAutosaveEnabled ? AutosaveTrigger.NONE : AutosaveTrigger.DEBOUNCE),
         debounceMs: autosaveConfig?.debounceMs ?? 500,
         savedStateDurationMs: 2000,
-    }), [autosaveConfig, derivedAutosaveEnabled]);
+    }), [autosaveConfig, autosaveWritesRecordFields, derivedAutosaveEnabled]);
     // Draft-relaxed schema for draft saves (makes isDraftRelaxed fields optional)
     const draftSchema = useMemo(() => {
         if (!formSchema || !effectiveDraftConfig?.enabled)
@@ -1780,7 +2218,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                         }
                         throw mutationErrorForReport(mutationResult.error, 'Draft save failed');
                     }
-                    result = mutationResult.responseData;
+                    result = mutationResult.heldForApproval ?? mutationResult.responseData;
                 }
                 else {
                     assertRMMAvailableForDefaultUpdateLikeMutation('ResourceAutomatedForm draft save');
@@ -1793,6 +2231,10 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                     { silent: true });
                 }
             }
+            if (tellHeldForApproval(result)) {
+                onSuccessRef.current?.(result);
+                return;
+            }
             setIsDraft(true);
             if (shouldEmitFrameworkSuccess) {
                 emitRef.current(FrontendEvents.NOTIFY_RESOURCE_SUCCESS, {
@@ -1884,7 +2326,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                         }
                         throw mutationErrorForReport(mutationResult.error, 'Publish failed');
                     }
-                    result = mutationResult.responseData;
+                    result = mutationResult.heldForApproval ?? mutationResult.responseData;
                 }
                 else {
                     assertRMMAvailableForDefaultUpdateLikeMutation('ResourceAutomatedForm publish');
@@ -1897,6 +2339,10 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
                     { silent: true });
                 }
             }
+            if (tellHeldForApproval(result)) {
+                onSuccessRef.current?.(result);
+                return;
+            }
             setIsDraft(false);
             if (shouldEmitFrameworkSuccess) {
                 const frontendNotification = getFrontendNotification(operation);
@@ -1983,31 +2429,51 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     const handleCancelPublish = useCallback(() => {
         setPendingPublish(null);
     }, []);
-    // ── CRITICAL "double validation" on form submit ──────────────────────────
-    // A CRITICAL operation reached through a form (e.g. a reset-with-flags) must
-    // require the same typed double-validation the action bar applies to
-    // direct-execute CRITICAL ops: the submit is held until the user types the
-    // action label in the confirm dialog. This is the form-submit twin of the
-    // confirm-dialog gate in `useResourceOperationActions`.
-    const isCriticalOperation = operation.riskLevel === ResourceOperationRiskLevel.CRITICAL;
+    // ── Risk confirmation on form submit (#2261) ─────────────────────────────
+    // An operation whose risk level asks for a confirmation (`isRiskyResourceOperation`: HIGH and
+    // CRITICAL) asks for it whether it executes from the action ladder or from this form. The action
+    // ladder confirms only the operations it executes DIRECTLY; one that collects input is handed to
+    // this form instead, so this is where its confirmation must live. It used to gate CRITICAL alone, so
+    // every HIGH verb with a request form — revoking an invitation, with its optional reason — was sent
+    // the moment Submit was pressed. HIGH gets the plain confirm the ladder gives it, CRITICAL the typed
+    // double-validation. Both submit lanes go through it: the ordinary submit and a draft's publish.
+    const requiresSubmitConfirmation = isRiskyResourceOperation(operation.riskLevel);
+    const requiresTypedSubmitConfirmation = operation.riskLevel === ResourceOperationRiskLevel.CRITICAL;
+    // The consequence line, as the action ladder states it: "cannot be undone" only when that is true
+    // (the confirm's generic line says exactly that), and no line at all for an action that can be undone.
+    const riskySubmitConsequence = isIrreversibleOperation(operation) ? undefined : null;
+    // The operation's own words, when it authors them (`resources.<r>.operations.<op>.description`, declared by
+    // `hasDescription`): the same words the danger zone shows beside the action, stated BEFORE the consequence
+    // line rather than instead of it. Deactivating your own account is reversible, but not by you, and only that
+    // sentence says so. `tResourceOperation` answers '' for a description nobody authored.
+    const operationOwnDescription = tResourceOperation(resourceType, String(operation.operationIdentifier), 'description') || undefined;
     // The operation's own name, resolved exactly as the action bar names it — so the phrase to type, and a
     // named action's submit button, are the label the person clicked.
     const operationDisplayTitle = useMemo(() => resolveOperationDisplayTitle(tResourceOperation, resourceType, String(operation.operationIdentifier)), [tResourceOperation, resourceType, operation.operationIdentifier]);
-    const handleSubmitWithCriticalGuard = useCallback((data) => {
-        if (isCriticalOperation) {
-            setPendingCriticalSubmit(data);
+    // The submit this form performs once any confirmation is given: a draft-enabled form publishes, every
+    // other form submits.
+    const isDraftPublishLane = Boolean(effectiveDraftConfig?.enabled && draftSchema);
+    const performConfirmedSubmit = useCallback((data) => {
+        if (isDraftPublishLane)
+            void handlePublish(data);
+        else
+            void handleSubmit(data);
+    }, [isDraftPublishLane, handlePublish, handleSubmit]);
+    const handleSubmitWithRiskConfirmation = useCallback((data) => {
+        if (requiresSubmitConfirmation) {
+            setPendingRiskySubmit(data);
             return;
         }
-        void handleSubmit(data);
-    }, [isCriticalOperation, handleSubmit]);
-    const handleConfirmCriticalSubmit = useCallback(() => {
-        const data = pendingCriticalSubmit;
-        setPendingCriticalSubmit(null);
+        performConfirmedSubmit(data);
+    }, [requiresSubmitConfirmation, performConfirmedSubmit]);
+    const handleConfirmRiskySubmit = useCallback(() => {
+        const data = pendingRiskySubmit;
+        setPendingRiskySubmit(null);
         if (data !== null)
-            void handleSubmit(data);
-    }, [pendingCriticalSubmit, handleSubmit]);
-    const handleCancelCriticalSubmit = useCallback(() => {
-        setPendingCriticalSubmit(null);
+            performConfirmedSubmit(data);
+    }, [pendingRiskySubmit, performConfirmedSubmit]);
+    const handleCancelRiskySubmit = useCallback(() => {
+        setPendingRiskySubmit(null);
     }, []);
     // Build default submit button if not provided
     // When draft mode is enabled, show "Save as Draft" and "Publish" buttons
@@ -2173,7 +2639,7 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
     // synchronous discriminator seed so RHF initializes with it on the very
     // first render (see createSeededDefaultValues).
     const effectiveDefaultValues = needsFetch
-        ? (defaultValues ?? defaultValuesOverride)
+        ? (recordSeededDefaultValues ?? defaultValuesOverride)
         : (createSeededDefaultValues ?? defaultValuesOverride);
     // Guard against missing schema
     if (!formSchema) {
@@ -2195,15 +2661,20 @@ export function ResourceAutomatedForm({ resourceContext, onSuccess, onError, onC
         dismissAriaLabel: tComponent(FrontendComponentType.RESOURCES_LAYOUTS_CREATE, 'dismiss'),
     } : undefined;
     // Form content that may or may not be wrapped with AutosaveProvider
-    const formContent = (_jsx(LoadingGate, { i18nKeys: i18nKeys, loadingScopes: loadingScopes, readiness: readiness, children: _jsxs("div", { className: className, children: [_jsx(AlertDialog, { open: !!pendingPublish, onOpenChange: (open) => !open && handleCancelPublish(), children: _jsxs(AlertDialogContent, { children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: confirmPublishTitle }), _jsx(AlertDialogDescription, { children: confirmPublishMessage })] }), _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { onClick: handleCancelPublish, children: confirmPublishCancel }), _jsx(AlertDialogAction, { onClick: handleConfirmPublish, children: confirmPublishConfirm })] })] }) }), pendingCriticalSubmit !== null && (_jsx(OperationsConfirmCritical, { open: true, onOpenChange: (open) => { if (!open)
-                        handleCancelCriticalSubmit(); }, cancelCallback: handleCancelCriticalSubmit, validationCallback: handleConfirmCriticalSubmit, requireTypedConfirmation: true, confirmationPhrase: operationDisplayTitle })), remoteUpdateIndicator && remoteUpdateLabels && (_jsx(RemoteChangeNotification, { type: "remote-update", changedFields: remoteUpdateIndicator.changedFields, labels: remoteUpdateLabels, onDismiss: () => setRemoteUpdateIndicator(null) })), _jsx(ResourceFormActionsProvider, { value: formActionsValue, children: _jsx(AutomatedForm, { schema: formSchema, defaultValues: effectiveDefaultValues, onSubmit: effectiveDraftConfig?.enabled && draftSchema ? handlePublish : handleSubmitWithCriticalGuard, onError: handleError, validationMode: validationMode, disabled: disabled || isSubmitting, labels: labels, layoutRefs: layoutRefs, operationRef: operationIdentifier, operationType: operationType, operationLike: operationLike, coreOperation: effectiveCoreOperation, fileUploadContext: fileUploadContext, contextFieldValues: contextFieldValues, hiddenFieldNames: hiddenFieldNames, generatedFieldOverrides: generatedFieldOverrides, inheritanceConfig: inheritanceConfig, 
-                        // No section Save on a form whose record does not exist yet (see `formOffersSectionSave`).
-                        onSectionSave: formOffersSectionSave({
-                            createsRecord: effectiveCoreOperation === CoreResourceOperation.CREATE,
-                            hasCallerSectionHandler: onSectionSaveProp !== undefined,
-                        })
-                            ? handleSectionSave
-                            : undefined, onFormReady: handleFormReady, validateFieldUrl: validateFieldUrl, resourceId: primaryResourceId, contextResourceIdentifiers: contextResourceIdentifiersWithResourceId, parentResourcesRequirements: resourceContext.parentResourcesRequirements, navigationZone: navigationZone, chromeMode: defaultEditChromeMode, layoutTemplate: layoutTemplate }, defaultValuesSource) })] }) }));
+    const formContent = (_jsx(LoadingGate, { i18nKeys: i18nKeys, loadingScopes: loadingScopes, readiness: readiness, children: _jsxs("div", { className: className, children: [_jsx(AlertDialog, { open: !!pendingPublish, onOpenChange: (open) => !open && handleCancelPublish(), children: _jsxs(AlertDialogContent, { children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: confirmPublishTitle }), _jsx(AlertDialogDescription, { children: confirmPublishMessage })] }), _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { onClick: handleCancelPublish, children: confirmPublishCancel }), _jsx(AlertDialogAction, { onClick: handleConfirmPublish, children: confirmPublishConfirm })] })] }) }), pendingRiskySubmit !== null && (_jsx(OperationsConfirmCritical, { open: true, onOpenChange: (open) => { if (!open)
+                        handleCancelRiskySubmit(); }, cancelCallback: handleCancelRiskySubmit, validationCallback: handleConfirmRiskySubmit, label: operationDisplayTitle, confirmLabel: operationDisplayTitle, description: riskySubmitConsequence, detail: operationOwnDescription, requireTypedConfirmation: requiresTypedSubmitConfirmation, confirmationPhrase: requiresTypedSubmitConfirmation ? operationDisplayTitle : '' })), remoteUpdateIndicator && remoteUpdateLabels && (_jsx(RemoteChangeNotification, { type: "remote-update", changedFields: remoteUpdateIndicator.changedFields, labels: remoteUpdateLabels, onDismiss: () => setRemoteUpdateIndicator(null) })), _jsx(BulkFieldClearContext.Provider, { value: bulkFieldClearing, children: _jsx(ResourceFormActionsProvider, { value: formActionsValue, children: _jsx(AutomatedForm, { schema: formSchema, defaultValues: effectiveDefaultValues, onSubmit: handleSubmitWithRiskConfirmation, onError: handleError, validationMode: validationMode, disabled: disabled || isSubmitting, labels: labels, layoutRefs: layoutRefs, operationRef: operationIdentifier, operationType: operationType, operationLike: operationLike, coreOperation: effectiveCoreOperation, fileUploadContext: fileUploadContext, contextFieldValues: contextFieldValues, hiddenFieldNames: hiddenFieldNames, generatedFieldOverrides: generatedFieldOverrides, allowedValuesByField: allowedValuesByField, 
+                            // #2744: what each request field offers, judged against the row an operation on a record acts on.
+                            requestFieldOffers: operation.requestFieldOffers, requestFieldOfferRecord: needsFetch ? defaultValues : undefined, inheritanceConfig: inheritanceConfig, 
+                            // A section Save only where the form writes fields of records that exist (see `formOffersSectionSave`).
+                            onSectionSave: formOffersSectionSave({
+                                writesRecordFields: isUpdateLikeCoreOperation(effectiveCoreOperation),
+                                hasCallerSectionHandler: onSectionSaveProp !== undefined,
+                            })
+                                ? handleSectionSave
+                                : undefined, onFormReady: handleFormReady, 
+                            // Closing the tab or reloading with unsaved edits asks first: a form that edits or creates a record holds
+                            // work only the page has. Saved fields stop being dirty (`markFieldsSaved`), so a saved form does not ask.
+                            warnOnUnsavedChanges: true, validateFieldUrl: validateFieldUrl, resourceId: primaryResourceId, contextResourceIdentifiers: contextResourceIdentifiersWithResourceId, parentResourcesRequirements: resourceContext.parentResourcesRequirements, navigationZone: navigationZone, chromeMode: defaultEditChromeMode, layoutTemplate: layoutTemplate }, defaultValuesSource) }) })] }) }));
     // Wrap with AutosaveProvider if autosave is enabled
     if (autosaveProviderConfig.enabled) {
         return (_jsxs(AutosaveProvider, { labels: autosaveLabels, validateField: validateAutosaveField, onSave: handleAutosave, rmm: rmm ?? undefined, config: autosaveProviderConfig, children: [_jsx(AutosaveCancelBridge, { cancelRef: cancelPendingAutosavesRef }), formContent] }));
@@ -2249,18 +2720,14 @@ function DraftSaveButton({ draftSchema, onSaveDraft, disabled, isSavingDraft, la
             await onSaveDraft(sanitizedValues);
         }
         else {
-            const zodError = result.error;
-            const erroredPaths = [];
-            zodError.issues.forEach((issue) => {
-                const fieldPath = issue.path.join('.');
-                if (fieldPath) {
-                    formContext.setError(fieldPath, {
-                        type: issue.code,
-                        message: issue.message,
-                    });
-                    erroredPaths.push(fieldPath);
-                }
-            });
+            // Reported exactly as the submit's resolver reports them: with the issue's parameters (so the message translates
+            // with its numbers), and with a rule on the whole object under the form-level key instead of being dropped, which
+            // left a draft that failed only on such a rule with no error anywhere and no save.
+            const fieldErrors = zodIssuesToFieldErrors(result.error.issues);
+            const erroredPaths = Object.keys(fieldErrors);
+            for (const [fieldPath, fieldError] of Object.entries(fieldErrors)) {
+                formContext.setError(fieldPath, fieldError);
+            }
             // Audit D4 — same treatment as every other submit-like failure: this
             // draft-validation path sets field errors DIRECTLY (not through
             // `injectServerErrors`), so it carries its own scroll-to-first-error.