JM: Record which submission changed data on every form

[maebeale]

🤖 suggested review level: 3 Read 📖 turns on change tracking for signed-out bulk payers and ticket-form submitters; moves the submission id into the services

Every form now records which submission made each change, so the change-log links from #2719 work everywhere.

Stacked on #2719. That PR adds the change-log links and the callout capture. This one covers the Current-based recording.

• New paths: bulk payments, ticket callout forms, and linking an organization from a standalone submission's page now record the submission id. Their changes show up on that submission's "What this submission changed" page.
• The submitting services set the id: PublicRegistration, PublicFormSubmission, BulkPayment and CalloutFormSubmission set Current.form_submission_id on success, so a new caller can't forget it. The controller lines are gone.
• Signed-out submitters are now tracked: signed-out bulk payers and callout submitters get Current.source (bulk_payment / ticket_callout). Without a source or a signed-in user, nothing is logged. Public forms and registrations already work this way.

Optional: link older changes (run by hand after deploy)

Paste into a production Rails console. It's a dry run as written: check the counts, then run again with dry_run = false. It never touches an event that already has an id, so re-running is safe.

• How it matches: every change from one request is logged at the same moment under the same visit. A request that created a submission, or changed only its link fields (metadata), passes that id to its other unstamped changes.
• What it skips: requests that touched more than one submission, and other submission updates such as a person merge.
• Can't be recovered: signed-out submitters before this PR, since nothing was logged for them.
• Tested: I ran it against the backfill's 7 specs before removing them from the PR.

# Stamp form_submission_id onto older Ahoy change events so change logs link them
# to their submission. A request's events share a visit and an instant; a request
# that created a submission, or changed only its metadata (org linking, callout
# re-submit), names the rest. Requests touching several submissions are skipped.
# Run as-is for a dry run; set dry_run = false to write.
dry_run = true
window = 1.second
seen = Set.new
stamped = 0
ambiguous = 0

stamp_of = ->(event) { event.properties&.dig("form_submission_id").presence&.to_i }
named_submission = lambda do |event|
  next stamp_of.(event) if stamp_of.(event)
  next unless event.resource_type == "FormSubmission"

  changed = event.properties&.dig("changes")&.keys
  event.resource_id if event.name == "create.form_submission" || (changed.present? && (changed - %w[metadata]).empty?)
end

Ahoy::Event.where(resource_type: "FormSubmission", name: %w[create.form_submission update.form_submission])
  .where.not(visit_id: nil).find_each do |anchor|
  next if seen.include?(anchor.id)

  events = Ahoy::Event.mutations.where(visit_id: anchor.visit_id, time: (anchor.time - window)..(anchor.time + window)).to_a
  seen.merge(events.map(&:id))
  unstamped = events.reject { |event| stamp_of.(event) }
  next if unstamped.empty?

  submission_ids = events.filter_map { |event| named_submission.(event) }.uniq
  if submission_ids.many?
    ambiguous += 1
  elsif submission_ids.one?
    stamped += unstamped.size
    unless dry_run
      unstamped.each { |event| event.update_columns(properties: event.properties.to_h.merge("form_submission_id" => submission_ids.first)) }
    end
  end
end

puts "events #{dry_run ? "to stamp" : "stamped"}: #{stamped}"
puts "requests skipped (ambiguous): #{ambiguous}"

🤖 Generated with Claude Code

[maebeale]

🤖 From Claude: The submission and its answers are now saved before the org capture, so the org-type "Other" can point at its answer. If saving an answer fails, the whole transaction still rolls back. The resubmission diff only compares this submission with the previous one, so it doesn't depend on this order.

[maebeale]

🤖 From Claude: Setting a source makes signed-out callout submitters (and bulk payers) generate lifecycle events for the first time, the same as public forms. Expect more Ahoy rows per submission: the submission, its answers, and any profile write-through.

[maebeale]

🤖 From Claude: Matching only uses a submission that was created or had just its metadata changed in that request. That way a person merge, which reassigns person_id, can't credit its own deletes and edits to a submission. Run it as a dry run first in production and check the counts.

[maebeale]

@jmilljr24 are you comfortable w using Current for this?