fix(flows): scope nested step_values leaves out of reuse too

step_scoped holds the overlay's TOP-LEVEL keys, but the guard compared the
leaf name — so an overlay key naming a section let every value inside it
through. For {'connection': {'province': 'TX'}} the leaf is 'province',
which is nowhere in {'connection'}, and a later step declaring
connection.province resubmitted TX instead of its stored value.

Matched on the root of the declaration path instead.

Found by CodeRabbit review on #2256.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012d29UJTiH4Uy2Pm37SBPtr

Author: kingpanther13

src/ha_mcp/tools/config_entry_flow_form.py

@@ -123,12 +123,17 @@ def record(
         """
         dotted = _section_path(path_prefix, name)
         self.filled.add(dotted)
-        if name in self.step_scoped:
+        if dotted.split(".", 1)[0] in self.step_scoped:
             # Supplied by ``step_values`` for THIS step only. ``filled`` still
             # takes it so nothing is injected over it here, but it must never
             # reach ``flat``/``scoped``: those survive the whole walk, and a
             # later step that nobody addressed would then reuse a value the
             # caller scoped to one step instead of its own stored one.
+            #
+            # Matched on the ROOT of the declaration path, not the leaf name:
+            # an overlay key naming a SECTION carries leaves whose own names
+            # are nowhere in ``step_scoped``, so comparing the leaf let every
+            # nested value through (CodeRabbit review, issue #2254).
             return
         if scoped_only:
             self.scoped[dotted] = copy.deepcopy(value)

tests/src/unit/test_flow_options_preserve.py

@@ -961,6 +961,67 @@ def test_a_step_scoped_value_never_leaks_to_an_unaddressed_step(self) -> None:
             f"The step-scoped value leaked into an unaddressed step: {seen[2]}"
         )
 
+    def test_a_nested_step_scoped_value_never_leaks_either(self) -> None:
+        """An overlay key naming a SECTION scopes its leaves too.
+
+        ``step_scoped`` holds the overlay's top-level keys, so matching the
+        leaf name let every value inside a section through: for
+        ``{"connection": {"province": "TX"}}`` the leaf is ``province``, which
+        is nowhere in ``{"connection"}``. The guard matches the ROOT of the
+        declaration path instead (CodeRabbit review, #2256).
+        """
+
+        def step(step_id: str) -> dict[str, Any]:
+            return {
+                "type": "form",
+                "step_id": step_id,
+                "data_schema": [
+                    {
+                        "type": "expandable",
+                        "name": "connection",
+                        "required": False,
+                        "schema": [
+                            {
+                                "name": "province",
+                                "required": False,
+                                "optional": True,
+                                "description": {"suggested_value": "BW"},
+                            },
+                        ],
+                    },
+                ],
+            }
+
+        reuse_state = _ReuseState()
+        remaining: dict[str, Any] = {
+            "step_values": {"one": {"connection": {"province": "TX"}}}
+        }
+        first = _handle_form_step(
+            "flow-2254",
+            step("one"),
+            remaining,
+            None,
+            set(),
+            reuse_state,
+            keep_current_values=True,
+        )
+        second = _handle_form_step(
+            "flow-2254",
+            step("two"),
+            remaining,
+            None,
+            set(),
+            reuse_state,
+            keep_current_values=True,
+        )
+
+        assert first == {"connection": {"province": "TX"}}
+        assert second == {"connection": {"province": "BW"}}, (
+            f"The nested step-scoped value leaked: {second}"
+        )
+        assert reuse_state.scoped == {}
+        assert reuse_state.flat == {}
+
     def test_an_undeclared_field_inside_step_values_is_reported(self) -> None:
         """A typo'd FIELD inside an entry must not vanish silently.