#19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row

[os-litant]

Ruled: 5861442317 · letter A · 2026-09-28T00:57Z

Path: P1 | 那条路第 1 步「写元数据」 | 39 个活键需要设计控件而非表单行

The bucket

39 keys of #19188's 274, bucket B9: object-rooted metadata type, liveness verdict live, and the schema node is object / array / record / union. ⇒ each needs a designed control, ⛔ not a one-line row.

Examples named by the census: object.access · object.external · object.fieldGroups · field.summaryOperations · action.params.

Why it is separate from the scalar bucket

The scalar bucket (47 keys, filed alongside) is one row per key with no design decision. This one is a widget design per key, or a curated subset entry where the full shape is not worth authoring. Merging them would hide 39 design decisions inside a 86-row mechanical change — which is the shape triage refused when it said 「⛔ do not dispatch this as one flight」.

⚠️ A reasonable first act on this card is to decide, per key, between 「design a control」 and 「record a reason not to offer it」 — the second answer moves the key into the recorded-reason bucket rather than into work. ⛔ That is a judgement per key and this seat makes none of them here.

Dedup words

structured control metadata form · object array record union offer · zodOnly bucket structured · fieldGroups summaryOperations params control · curated subset form entry

---

Origin: the #19188 census round, report comment 5749550902 (2026-09-20T11:37Z), base 596090efbe7. Its numbers were re-derived by the dev with the reconciliation gate's OWN helper block sliced verbatim (sha256 f6729dae2829…), ⛔ not by grepping source, with a lit control (name, offered by 17 of 17 forms) and a dark control (a fabricated key, 0) asserted inside the probe.
Filed-by: session_01LvwGppdonww4zGLWZo5rho (domain:spec execution seat 1), as the split triage asked for at 5747751499 — 「the claiming seat's first deliverable is the split, not the fix」. ⛔ Not graded and ⛔ not routed by this seat.

---

Generated by Claude Code

[os-justin]

Reached in 取卡全序 with its path now FREE, and still not dispatched — the first deliverable is 39 judgements, not a PR. 2026-09-22T07:34Z

domain:spec seat 5. ⛔ Not a claim, ⛔ not a re-grade, ⛔ no label written.

The serial hold on this card is gone, so that is no longer the reason

Sibling #19331 landed as PR #19673, merge commit 408ca2e36, single parent. ⇒ packages/spec/src/**/*.form.ts and the four platform-objects metadata-form catalogs are no longer held. A later seat should ⛔ not re-derive a path collision here; there isn't one.

Why it is still not a dev flight

The card says it itself:

⚠️ A reasonable first act on this card is to decide, per key, between 「design a control」 and 「record a reason not to offer it」 — the second answer moves the key into the recorded-reason bucket rather than into work. ⛔ That is a judgement per key and this seat makes none of them here.

⇒ the first deliverable is a 39-row disposition table, and only what survives it is implementable. A dev dispatched against this card as written would have to make 39 design judgements inside one PR, which is the shape triage refused when it split the census (「⛔ do not dispatch this as one flight」) — and the scalar sibling that just landed is the measurement of why: 45 mechanical rows already needed two rounds of rework and produced three filed findings. Thirty-nine designed widgets is not that change with a different number on it.

What the landed sibling hands this card, ⛔ free

Three findings were filed out of #19331 that this card's design pass will hit on its first day, so they are named here rather than re-measured:

• [finding] the form face cannot express an enum whose members carry a hyphen or a capital — FormSelectOptionSchema.value is a system identifier, so system-data, new-tab and perRecord are unspellable as option values #19678 — FormSelectOptionSchema.value is a system identifier (^[a-z][a-z0-9_.]*$), so an enum member carrying a hyphen or a capital cannot be spelled as an option value at all; defineForm throws invalid_format at module load. Any widget design that emits an options list meets this bound.
• [finding] the object designer's quick-add grid offers two formula return types FieldSchema.returnType refuses — picking Datetime or Currency writes a value the parse rejects #19677 — a shipped example of a control offering members the schema refuses (object.form.ts's fields.returnType), which is the failure mode a per-key design pass is supposed to avoid.
• [finding] field.format is one z.string() key carrying THREE value vocabularies — the engine reads it as an autonumber pattern, objectui as a date display style, and its describe names a third that nothing honours #19679 — a key whose value vocabulary is not settled cannot be given help text at all; that is the shape of the 「record a reason」 answer.

And one mechanical fact the disposition pass will need: the i18n catalogs are ratcheted — a new row's en leaf must be authored in zh-CN / ja-JP / es-ES in the same PR or the catalog check reds on the day it lands (measured on #19673: 45 rows ⇒ 90 leaves ⇒ 270 authored translations, plus three moved pins).

What would make it dispatchable

The 39-row disposition (「design a control」 / 「record a reason」 / 「curated subset entry」), with the per-key reasoning, landed on this card or as its sub-cards. Then each surviving group is an ordinary flight. ⛔ This seat does not take that pass today and ⛔ does not pre-empt any of the 39 judgements.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01CiCTczDo7tGhafXjf61dUJ
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: none (analysis round: no branch, no PR)
Worktree: objectstack-issue-19332
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
File surface: none. This round is read-only. Its deliverable is the per-key disposition table that seat 5's note 5772804840 names as this card's first deliverable: for each of the 39 keys, 「design a control」 / 「record a reason」 / 「curated subset entry」, with measured evidence and a four-axis recommendation. It lands as an os-dev-report comment on this card, with status: needs_decision and no PR. ⛔ No file in the repository is written; a throwaway census probe is deleted after its run. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (analysis only)
Clause-②: no
Thread-read: 5772804840
Serial constraints cleared: read at 2026-09-27T19:54Z. The serial hold seat 5 recorded is gone: #19331 landed as PR #19673 (408ca2e36). This round writes no file, so no open PR or in-flight claim can collide with it. This seat's own #19333 flight (claim 5859116056) re-derives the same census for field.format; the two share the gate's helper as an instrument, read-only.

What happens after the table. The seat reads the table, groups the keys into at most five decision items, and routes them to the decision box on this card (needs-user-decision, with options, a recommendation and the four-axis block per item). Whatever an item resolves to becomes an ordinary flight. ⛔ The seat does not pre-empt any of the 39 judgements, and neither does the dev.

[objectstack-fleet]

os-dev-report

#19332 — per-key disposition of the 39 structured zod-only keys (analysis round, no PR)

Measured on framework 4e0f72e8d, objectui f8a9d0fb0 (the .objectui-sha pin) and hotcrm 2f7b2326. Column (c) is examples / hotcrm / platform author counts; (f) is rows × 2 leaves × 4 locales (1r = 8L). D = design a control, R = record a reason, C = curated subset entry. The five groups, their options, the four-axis analysis and the governing text are in open_questions below. These are recommendations; the seat routes the decisions.

#	key	(a) node (obj! = strict)	(b) verdict · verified reader	(c) authors ex / hotcrm / platform	(d) Studio edits it another way	(e) form-face bound	(f) cost	recommendation
1	object.access	obj! {default: enum public/private}	live · plugin-security permission-evaluator.ts (4 hits)	0 / 0 / 6	yes — ObjectDefaultInspector posture toggle	none (both members spellable)	1r = 8L	D · type: composite (G1)
2	object.actions	arr of ActionSchema obj! (40+ keys)	live · runtime app-plugin.ts collectBundleActions (22)	0 / 0 / 16	yes — studio-design ObjectActionsPanel, and the action type editor	no row renders a 40-key action inline	1 root omit, 0L	R · own editor (G3)
3	object.activityMilestones	arr obj! {field, value, summary, type}	live · plugin-audit audit-writers.ts (3); objectui recordActivityFeed	1 / 2 / 0	no	field pickers bind nothing on an object draft ⇒ text sub-rows	5r = 40L	D · repeater, 4 sub-rows (G2)
4	object.external	obj! {remoteName, remoteSchema, writable, columnMap rec, introspectedAt, ignoreColumns}	live · runtime external-validation-plugin.ts (44)	2 / 0 / 1 (the import generator)	yes — external-datasource import flow drafts it (external-datasource-service.ts)	introspectedAt is platform-written (Set by os datasource introspect)	1 root omit, 0L	R · own editor (G3)
5	object.fieldGroups	arr obj! 9 keys, 3 of them [DEPRECATED → collapse]	live · objectui plugin-form sectionGroups / FormPage; dogfood proof	2 / 18 / 0	yes — ObjectFormDesigner / ObjectGroupInspector	a derived face offers the 3 deprecated aliases (object.zod.ts:1206-1210)	7r = 56L + 3 nested omit	D · curated repeater (G2)
6	object.highlightFields	arr of string (field names)	live · objectui buildDefaultPageSchema (18); dogfood proof	3 / 18 / 76	yes — ObjectSettingsPanel semantic roles	field-multi binds nothing on an object draft (ResourceEditPage.tsx:890) ⇒ string-tags, the nameField type: text precedent	1r = 8L	D · string-tags (G1)
7	object.indexes	arr obj! {name, fields, unique: false / global / organization}	live · driver-sql syncTableIndexes / syncDeclaredIndexes (76)	1 / 15 / 77	no (ObjectFieldInspector: "Object-level indexes[] is the real surface")	derived unique offers the deprecated bare true (object.zod.ts:490) ⇒ inline options global / organization	4r = 32L	D · repeater, 3 sub-rows (G2)
8	object.listViews	rec of ListView obj! (40+ keys)	live · objectui ObjectView (25); framework expandViewContainer	0 / 0 / 40	yes — the view type editor (ViewDefaultInspector); #19330 A: per-arm forms	no row renders a ListView record	1 root omit, 0L	R · own editor (G3)
9	object.publicSharing	obj! {enabled, allowedAudiences enum[], allowedPermissions enum[], maxExpiryDays, redactFields, eligibility CEL}	live · plugin-sharing share-link-service.ts getPolicy (18)	1 / 1 / 0	no	members spellable; eligibility is CEL ⇒ code/expression; redactFields free text	7r = 56L	D · curated composite, 6 sub-rows (G2)
10	object.requiredPermissions	U(arr of string / obj! {read, create, update, delete})	live · plugin-security security-plugin.ts getObjectSecurityMeta (36)	0 / 0 / 2 (sys-scim-connection-credential, sys-sso-provider)	yes — ObjectDefaultInspector (both arms)	string-tags reads a stored map as [] and overwrites it (widgets.tsx:1290) ⇒ json, the only lossless face	1r = 8L	D · json (G1)
11	object.searchableFields	arr of string	live · objectql engine.ts $search / search-filter.ts; objectui ListView	1 / 11 / 0	no	as highlightFields; a non-stored entry is refused at parse	1r = 8L	D · string-tags (G1)
12	object.stageField	U(string / false)	live · objectui record-semantics / buildDefaultPageSchema; dogfood proof	1 / 0 / 0	yes — ObjectSettingsPanel (string / false / unset)	the false arm cannot be an option value; the derived face takes the string branch in create mode	1 root omit, 0L	R · form-face gap (G5)
13	object.systemFields	U(false / obj! {tenant, audit})	live · spec injected-system-columns.ts (9), objectql registry.ts applySystemFields (11)	0 / 0 / 1	no	false arm unspellable	1 root omit, 0L	R · code-declared platform config (G4)
14	object.tenancy	obj! {enabled, tenantField} (drilled row, both children live)	live · spec isTenancyDisabled (23), driver-sql (41), plugin-security (23)	0 / 0 / 4	no	none	1 root omit, 0L	R · code-declared platform config (G4)
15	object.userActions	obj! {create/import/edit/delete: U(boolean / obj! {enabled, visibleWhen, disabledWhen}), exportCsv}	live · objectui ObjectGrid / ListView (30 files)	1 / 0 / 6	no	per-op object arm unreachable in create (boolean branch first) ⇒ curated to switches	6r = 48L	D · composite, 5 sub-rows (G2)
16	field.accept	arr of string (MIME / extension)	live · service-storage file-reference-lifecycle.ts assertFileConstraints (10)	0 / 3 / 0	no	none	1r = 8L	D · string-tags + media-type gate (G1)
17	field.currencyConfig	obj! {precision, currencyMode enum dynamic/fixed, defaultCurrency}	live · objectui i18n currency.ts (4), CurrencyField	3 / 0 / 0	no	none	1r = 8L	D · composite + currency gate (G1)
18	field.dependsOn	arr of U(string / obj! {field, param})	live · objectui LookupField / form renderer (framework 0: client-only)	3 / 4 / 1	yes — ObjectFieldInspector (string arm)	union element: derived face falls to raw JSON; string-tags would mangle an object entry	1r = 8L	D · json (G1)
19	field.inlineColumns	arr obj! 20 keys (drilled row, all live)	live · objectui plugin-form deriveMasterDetail	1 / 0 / 0	no	20 sub-keys; identity-only {name} entries hydrate from the child object	5r = 40L + 1 nested subset	C · curated subset (G2)
20	field.inlineEdit	U(boolean / enum grid, form)	live · objectui MetadataProvider.tsx:514 → plugin-form deriveMasterDetail resolveInlineMode	3 / 0 / 0	no	boolean arm cannot be an option; derived face shows a switch in create ⇒ grid/form unreachable	1 root omit, 0L	R · form-face gap (G5)
21	field.lookupColumns	arr of U(string / obj! {field, label, width, type})	live · objectui RecordPickerDialog / LookupField	1 / 0 / 0 (showcase uses the object arm)	no	string-tags would mangle the only author's object entries	1r = 8L	D · json (G1)
22	field.lookupFilters	arr obj! {field, operator enum incl. notIn, value}	live · objectui RecordPickerDialog (17), LookupField	1 / 0 / 0	yes — ObjectFieldInspector	notIn unspellable (#19678) ⇒ no inline options; mirror object.form.ts:242	1r = 8L	D · json mirror (G1)
23	field.readonlyWhen	U(CEL string / expression envelope)	live · objectql rule-validator.ts stripReadonlyWhenFields (63)	1 / 0 / 1	yes — ObjectFieldInspector CEL editor	none — mirror object.form.ts:337	1r = 8L	D · code/expression (G1)
24	field.relatedList	U(boolean / literal primary)	live · objectui deriveRelatedLists.ts (7)	2 / 0 / 1	no	boolean arm unspellable; derived face shows a switch ⇒ primary unreachable	1 root omit, 0L	R · form-face gap (G5)
25	field.relatedListColumns	arr of string (child field names)	live · objectui deriveRelatedLists.ts (4)	3 / 3 / 0	no	a picker would bind the parent, not the child ⇒ string-tags	1r = 8L	D · string-tags + lookup gate (G1)
26	field.requiredPermissions	arr of string	live · plugin-security security-plugin.ts foldFieldRequiredPermissions (36)	0 / 0 / 0 (both platform hits are object-level)	no	none — mirror app.form.ts:102	1r = 8L	D · string-tags (G1)
27	field.requiredWhen	U(CEL string / expression envelope)	live · objectql rule-validator.ts evaluateValidationRules (33)	1 / 4 / 0	yes — ObjectFieldInspector	none — mirror object.form.ts:338	1r = 8L	D · code/expression (G1)
28	field.storage	obj! {notNull}	live · driver-sql createColumn + schema-drift.ts diffManagedTable (8 + 8)	0 / 18 files, 68 hits / 5 hits	no	none; notNull beside requiredWhen is refused at parse (loud)	1r = 8L	D · composite (G1)
29	field.visibleWhen	U(CEL string / expression envelope)	live · objectui FormPage / ExpressionProvider	2 / 0 / 0	yes — ObjectFieldInspector	none — mirror object.form.ts:336	1r = 8L	D · code/expression (G1)
30	app.contextSelectors	arr obj! {id, label, icon, optionsSource obj, allValue, persist enum} (drilled row, 6 live children)	live · objectui ContextSelectors.tsx	0 / 0 / 1 (studio.app.ts)	no	optionsSource is a nested endpoint mapping	1 root omit, 0L	R · code-declared platform config (G4)
31	action.aria	obj! {ariaLabel, ariaDescribedBy, role}	ledger live with an uncited "PARTIAL" note; MEASURED 0 action-surface readers (objectui + framework; lit control action.variant = 14 files)	0 / 0 / 0	yes — ActionDefaultInspector "More fields" (derived)	a row would advertise a control nothing honours	1 root omit after re-grade, 0L	R · not honoured (G5) + finding
32	action.bodyExtra	rec string → unknown	live · objectui useConsoleActionRuntime.tsx (6), ActionRunner	1 / 0 / 6 decl. files	yes — ActionDefaultInspector "More fields"	raw JSON only; refused beside operation: update	1r = 8L	D · json + type == api gate (G1)
33	action.description	U(string / locale map)	live · objectui ActionParamDialog / useConsoleActionRuntime	NOT MEASURED (pattern cannot separate it from other description: keys)	yes — "More fields"	none — textarea, as the description rows on skill.form.ts:21 / flow.form.ts:25	1r = 8L	D · textarea (G1)
34	action.errorMessage	U(string / locale map)	live · objectui action-group / ActionContext toast	0 / 0 / 0	yes — ActionDefaultInspector (curated)	none — twin of action.form.ts:105 successMessage	1r = 8L	D · plain row (G1)
35	action.patch	rec string → unknown	live · runtime action-execution.ts declarativeUpdateWrite (14)	0 / 0 / 0	yes — ActionDefaultInspector (curated key-value editor)	refused without operation: update ⇒ visibleWhen gate	1r = 8L	D · json + update gate (G1)
36	action.requiredPermissions	arr of string	live · runtime action-execution.ts actionPermissionError (5), domains/actions.ts (4)	1 / 0 / n/s	yes — "More fields"	none — mirror app.form.ts:102	1r = 8L	D · string-tags (G1)
37	action.resultDialog	obj! {title, description, acknowledge, format enum incl. code-list, fields arr obj!}	live · objectui ActionRunner (14), ActionResultDialog	0 / 0 / 4	yes — "More fields"	code-list unspellable (#19678)	1 root omit, 0L	R · code-declared platform config (G4)
38	page.slots	obj! 7 slots, each U(component / component[])	live · objectui plugin-detail buildDefaultPageSchema (8)	1 / 1 / 4	yes — page designer PageBlockInspector writes slots.NAME	no row renders a component tree	1 root omit, 0L	R · own editor (G3)
39	permission.adminScope	obj! {businessUnit, includeSubtree, manageAssignments, manageBindings, authorEnvironmentSets, assignablePermissionSets}	live · plugin-security delegated-admin-gate.ts (21)	0 / 0 / 1	yes — PermissionAdvancedFacets (beside tabPermissions / rowLevelSecurity)	none — mirror permission.form.ts:71-72	1r = 8L	D · json (G1)

{
 "issue": 19332,
 "status": "needs_decision",
 "branch": "none (analysis round: no branch, no PR)",
 "pr": null,
 "session": "session_01CiCTczDo7tGhafXjf61dUJ — mode:subagent, the dispatching seat session (Claim 5859298824)",
 "premise_still_valid": true,
 "measured_at": {
  "framework": "4e0f72e8d24c67705ce278de24bc4166ba3f1cd6 (origin/main)",
  "objectui": "f8a9d0fb0596f4521076628e2bbfe27e6ce67d52 (.objectui-sha pin, anonymous shallow clone)",
  "hotcrm": "2f7b2326e8f52adfc9efd00b68beda5348e71a1b (local checkout, read-only)"
 },
 "summary": "Re-derived on origin/main 4e0f72e8d with the gate's own helper block and LIT / DARK controls: 84 top-level keys have neither an offer nor a root ledger row, 44 of them view (outside the direction per #19330 A) and 40 object-rooted; excluding field.format (the #19333 flight) leaves 39, the same 39 the card named: a re-run at the census base 596090efbe7 reproduces the census helper sha and the same set, 0 added, 0 removed, 0 retired. Per key: 21 are one-row D offers mirroring a row already on a registered form (G1), 6 need a designed nested list (G2: 5 D, 1 C), 8 are R under two proposed reason classes (G3 own editor 4, G4 code-declared platform config 4), and 4 cannot be offered honestly today (G5: three boolean/false unions, and action.aria, whose `live` verdict measured 0 readers). No file was written and no PR opened; the throwaway probes were deleted and the worktree removed.",
 "population": {
  "instrument": "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts bytes 0..35929 (lines 1-684, up to the first top-level describe), sha256 9599e809114b4e386670c55bf80756a22f41ec9a2bed3f5361b2225208f59bb0, sliced verbatim into zz-census-19332.tmp.test.ts beside it (prefix proved byte-identical on disk), deleted after the run; query per registered type: offerableKeysAt(getMetadataTypeSchema(type), ROOT_PATH) minus topLevelFields(form) minus omittedAt(LEDGER, type, ROOT_PATH)",
  "controls": "asserted by expect() inside the probe: LIT `name` offered by 17 of 17 forms and declared by 17 of 17 schemas; DARK `zzFabricatedKey19332DarkControl` offered by 0, declared by 0, in 0 census rows",
  "reading_4e0f72e8d": "17 forms; top-level non-overlay zod-only 98 (view 49, object-rooted 49); excused by root ledger rows 14 (view 5; object 3, field 2, app 1, action 1, page 1, agent 1); unexplained 84 = view 44 + object-rooted 40 (object 15, field 15, action 7, app 1, page 1, permission 1); minus field.format = 39",
  "field_format": "excluded: scalar string, live, the #19333 flight is recording its reason (PR #19673 left it out for three value vocabularies)",
  "diff_vs_card": "census base 596090efbe7, same probe with that tree's helper block (sha256 f6729dae28293c94b885958664a6e9696bcb754d4863967a04504427c7418006, byte-identical to the census report's): 142 non-overlay, 94 object-rooted, 43 structured; minus object.titleFormat (census B3) and action.onSuccess / page.requires / agent.structuredOutput (census B4) = 39. Set difference against 4e0f72e8d: added 0, removed 0, retired 0. Inside the set: object.tenancy lost its `organizationField` child (502f179cc, #19054 via PR #19618); field.currencyConfig ledger evidence re-cited (03d6cb04a). #20227's view owner / hidden retirement is outside this population (view is not object-rooted). A first run at 6a6a17b62 read the same 39 with identical node shapes and verdicts.",
  "liveness": "37 carry a direct `live` row; object.tenancy and app.contextSelectors are drilled rows with no own status whose children are all live (the census counted both in B9). No key is dead, planned or experimental."
 },
 "per_key_table": "| # | key | (a) node (`obj!` = strict) | (b) verdict · verified reader | (c) authors ex / hotcrm / platform | (d) Studio edits it another way | (e) form-face bound | (f) cost | recommendation |\n|---|---|---|---|---|---|---|---|---|\n| 1 | `object.access` | obj! {default: enum public/private} | live · plugin-security `permission-evaluator.ts` (4 hits) | 0 / 0 / 6 | yes — ObjectDefaultInspector posture toggle | none (both members spellable) | 1r = 8L | D · `type: composite` (G1) |\n| 2 | `object.actions` | arr of ActionSchema obj! (40+ keys) | live · runtime `app-plugin.ts` collectBundleActions (22) | 0 / 0 / 16 | yes — studio-design ObjectActionsPanel, and the `action` type editor | no row renders a 40-key action inline | 1 root omit, 0L | R · own editor (G3) |\n| 3 | `object.activityMilestones` | arr obj! {field, value, summary, type} | live · plugin-audit `audit-writers.ts` (3); objectui recordActivityFeed | 1 / 2 / 0 | no | field pickers bind nothing on an object draft ⇒ text sub-rows | 5r = 40L | D · repeater, 4 sub-rows (G2) |\n| 4 | `object.external` | obj! {remoteName, remoteSchema, writable, columnMap rec, introspectedAt, ignoreColumns} | live · runtime `external-validation-plugin.ts` (44) | 2 / 0 / 1 (the import generator) | yes — external-datasource import flow drafts it (`external-datasource-service.ts`) | `introspectedAt` is platform-written (`Set by os datasource introspect`) | 1 root omit, 0L | R · own editor (G3) |\n| 5 | `object.fieldGroups` | arr obj! 9 keys, 3 of them `[DEPRECATED → collapse]` | live · objectui plugin-form sectionGroups / FormPage; dogfood proof | 2 / 18 / 0 | yes — ObjectFormDesigner / ObjectGroupInspector | a derived face offers the 3 deprecated aliases (`object.zod.ts:1206-1210`) | 7r = 56L + 3 nested omit | D · curated repeater (G2) |\n| 6 | `object.highlightFields` | arr of string (field names) | live · objectui buildDefaultPageSchema (18); dogfood proof | 3 / 18 / 76 | yes — ObjectSettingsPanel semantic roles | `field-multi` binds nothing on an object draft (`ResourceEditPage.tsx:890`) ⇒ `string-tags`, the `nameField` `type: text` precedent | 1r = 8L | D · `string-tags` (G1) |\n| 7 | `object.indexes` | arr obj! {name, fields, unique: false / global / organization} | live · driver-sql syncTableIndexes / syncDeclaredIndexes (76) | 1 / 15 / 77 | no (ObjectFieldInspector: \"Object-level indexes[] is the real surface\") | derived `unique` offers the deprecated bare `true` (`object.zod.ts:490`) ⇒ inline options global / organization | 4r = 32L | D · repeater, 3 sub-rows (G2) |\n| 8 | `object.listViews` | rec of ListView obj! (40+ keys) | live · objectui ObjectView (25); framework expandViewContainer | 0 / 0 / 40 | yes — the `view` type editor (ViewDefaultInspector); #19330 A: per-arm forms | no row renders a ListView record | 1 root omit, 0L | R · own editor (G3) |\n| 9 | `object.publicSharing` | obj! {enabled, allowedAudiences enum[], allowedPermissions enum[], maxExpiryDays, redactFields, eligibility CEL} | live · plugin-sharing `share-link-service.ts` getPolicy (18) | 1 / 1 / 0 | no | members spellable; `eligibility` is CEL ⇒ code/expression; `redactFields` free text | 7r = 56L | D · curated composite, 6 sub-rows (G2) |\n| 10 | `object.requiredPermissions` | U(arr of string / obj! {read, create, update, delete}) | live · plugin-security `security-plugin.ts` getObjectSecurityMeta (36) | 0 / 0 / 2 (sys-scim-connection-credential, sys-sso-provider) | yes — ObjectDefaultInspector (both arms) | `string-tags` reads a stored map as `[]` and overwrites it (`widgets.tsx:1290`) ⇒ `json`, the only lossless face | 1r = 8L | D · `json` (G1) |\n| 11 | `object.searchableFields` | arr of string | live · objectql `engine.ts` $search / `search-filter.ts`; objectui ListView | 1 / 11 / 0 | no | as highlightFields; a non-stored entry is refused at parse | 1r = 8L | D · `string-tags` (G1) |\n| 12 | `object.stageField` | U(string / false) | live · objectui record-semantics / buildDefaultPageSchema; dogfood proof | 1 / 0 / 0 | yes — ObjectSettingsPanel (string / false / unset) | the `false` arm cannot be an option value; the derived face takes the string branch in create mode | 1 root omit, 0L | R · form-face gap (G5) |\n| 13 | `object.systemFields` | U(false / obj! {tenant, audit}) | live · spec `injected-system-columns.ts` (9), objectql `registry.ts` applySystemFields (11) | 0 / 0 / 1 | no | `false` arm unspellable | 1 root omit, 0L | R · code-declared platform config (G4) |\n| 14 | `object.tenancy` | obj! {enabled, tenantField} (drilled row, both children live) | live · spec isTenancyDisabled (23), driver-sql (41), plugin-security (23) | 0 / 0 / 4 | no | none | 1 root omit, 0L | R · code-declared platform config (G4) |\n| 15 | `object.userActions` | obj! {create/import/edit/delete: U(boolean / obj! {enabled, visibleWhen, disabledWhen}), exportCsv} | live · objectui ObjectGrid / ListView (30 files) | 1 / 0 / 6 | no | per-op object arm unreachable in create (boolean branch first) ⇒ curated to switches | 6r = 48L | D · composite, 5 sub-rows (G2) |\n| 16 | `field.accept` | arr of string (MIME / extension) | live · service-storage `file-reference-lifecycle.ts` assertFileConstraints (10) | 0 / 3 / 0 | no | none | 1r = 8L | D · `string-tags` + media-type gate (G1) |\n| 17 | `field.currencyConfig` | obj! {precision, currencyMode enum dynamic/fixed, defaultCurrency} | live · objectui i18n `currency.ts` (4), CurrencyField | 3 / 0 / 0 | no | none | 1r = 8L | D · composite + `currency` gate (G1) |\n| 18 | `field.dependsOn` | arr of U(string / obj! {field, param}) | live · objectui LookupField / form renderer (framework 0: client-only) | 3 / 4 / 1 | yes — ObjectFieldInspector (string arm) | union element: derived face falls to raw JSON; `string-tags` would mangle an object entry | 1r = 8L | D · `json` (G1) |\n| 19 | `field.inlineColumns` | arr obj! 20 keys (drilled row, all live) | live · objectui plugin-form deriveMasterDetail | 1 / 0 / 0 | no | 20 sub-keys; identity-only `{name}` entries hydrate from the child object | 5r = 40L + 1 nested subset | C · curated subset (G2) |\n| 20 | `field.inlineEdit` | U(boolean / enum grid, form) | live · objectui `MetadataProvider.tsx:514` → plugin-form deriveMasterDetail resolveInlineMode | 3 / 0 / 0 | no | boolean arm cannot be an option; derived face shows a switch in create ⇒ grid/form unreachable | 1 root omit, 0L | R · form-face gap (G5) |\n| 21 | `field.lookupColumns` | arr of U(string / obj! {field, label, width, type}) | live · objectui RecordPickerDialog / LookupField | 1 / 0 / 0 (showcase uses the object arm) | no | `string-tags` would mangle the only author's object entries | 1r = 8L | D · `json` (G1) |\n| 22 | `field.lookupFilters` | arr obj! {field, operator enum incl. notIn, value} | live · objectui RecordPickerDialog (17), LookupField | 1 / 0 / 0 | yes — ObjectFieldInspector | `notIn` unspellable (#19678) ⇒ no inline options; mirror `object.form.ts:242` | 1r = 8L | D · `json` mirror (G1) |\n| 23 | `field.readonlyWhen` | U(CEL string / expression envelope) | live · objectql `rule-validator.ts` stripReadonlyWhenFields (63) | 1 / 0 / 1 | yes — ObjectFieldInspector CEL editor | none — mirror `object.form.ts:337` | 1r = 8L | D · code/expression (G1) |\n| 24 | `field.relatedList` | U(boolean / literal primary) | live · objectui `deriveRelatedLists.ts` (7) | 2 / 0 / 1 | no | boolean arm unspellable; derived face shows a switch ⇒ `primary` unreachable | 1 root omit, 0L | R · form-face gap (G5) |\n| 25 | `field.relatedListColumns` | arr of string (child field names) | live · objectui `deriveRelatedLists.ts` (4) | 3 / 3 / 0 | no | a picker would bind the parent, not the child ⇒ `string-tags` | 1r = 8L | D · `string-tags` + lookup gate (G1) |\n| 26 | `field.requiredPermissions` | arr of string | live · plugin-security `security-plugin.ts` foldFieldRequiredPermissions (36) | 0 / 0 / 0 (both platform hits are object-level) | no | none — mirror `app.form.ts:102` | 1r = 8L | D · `string-tags` (G1) |\n| 27 | `field.requiredWhen` | U(CEL string / expression envelope) | live · objectql `rule-validator.ts` evaluateValidationRules (33) | 1 / 4 / 0 | yes — ObjectFieldInspector | none — mirror `object.form.ts:338` | 1r = 8L | D · code/expression (G1) |\n| 28 | `field.storage` | obj! {notNull} | live · driver-sql createColumn + `schema-drift.ts` diffManagedTable (8 + 8) | 0 / 18 files, 68 hits / 5 hits | no | none; `notNull` beside `requiredWhen` is refused at parse (loud) | 1r = 8L | D · composite (G1) |\n| 29 | `field.visibleWhen` | U(CEL string / expression envelope) | live · objectui FormPage / ExpressionProvider | 2 / 0 / 0 | yes — ObjectFieldInspector | none — mirror `object.form.ts:336` | 1r = 8L | D · code/expression (G1) |\n| 30 | `app.contextSelectors` | arr obj! {id, label, icon, optionsSource obj, allValue, persist enum} (drilled row, 6 live children) | live · objectui `ContextSelectors.tsx` | 0 / 0 / 1 (`studio.app.ts`) | no | `optionsSource` is a nested endpoint mapping | 1 root omit, 0L | R · code-declared platform config (G4) |\n| 31 | `action.aria` | obj! {ariaLabel, ariaDescribedBy, role} | ledger `live` with an uncited \"PARTIAL\" note; MEASURED 0 action-surface readers (objectui + framework; lit control `action.variant` = 14 files) | 0 / 0 / 0 | yes — ActionDefaultInspector \"More fields\" (derived) | a row would advertise a control nothing honours | 1 root omit after re-grade, 0L | R · not honoured (G5) + finding |\n| 32 | `action.bodyExtra` | rec string → unknown | live · objectui `useConsoleActionRuntime.tsx` (6), ActionRunner | 1 / 0 / 6 decl. files | yes — ActionDefaultInspector \"More fields\" | raw JSON only; refused beside `operation: update` | 1r = 8L | D · `json` + `type == api` gate (G1) |\n| 33 | `action.description` | U(string / locale map) | live · objectui ActionParamDialog / useConsoleActionRuntime | NOT MEASURED (pattern cannot separate it from other `description:` keys) | yes — \"More fields\" | none — textarea, as the description rows on `skill.form.ts:21` / `flow.form.ts:25` | 1r = 8L | D · `textarea` (G1) |\n| 34 | `action.errorMessage` | U(string / locale map) | live · objectui action-group / ActionContext toast | 0 / 0 / 0 | yes — ActionDefaultInspector (curated) | none — twin of `action.form.ts:105` successMessage | 1r = 8L | D · plain row (G1) |\n| 35 | `action.patch` | rec string → unknown | live · runtime `action-execution.ts` declarativeUpdateWrite (14) | 0 / 0 / 0 | yes — ActionDefaultInspector (curated key-value editor) | refused without `operation: update` ⇒ visibleWhen gate | 1r = 8L | D · `json` + `update` gate (G1) |\n| 36 | `action.requiredPermissions` | arr of string | live · runtime `action-execution.ts` actionPermissionError (5), `domains/actions.ts` (4) | 1 / 0 / n/s | yes — \"More fields\" | none — mirror `app.form.ts:102` | 1r = 8L | D · `string-tags` (G1) |\n| 37 | `action.resultDialog` | obj! {title, description, acknowledge, format enum incl. code-list, fields arr obj!} | live · objectui ActionRunner (14), ActionResultDialog | 0 / 0 / 4 | yes — \"More fields\" | `code-list` unspellable (#19678) | 1 root omit, 0L | R · code-declared platform config (G4) |\n| 38 | `page.slots` | obj! 7 slots, each U(component / component[]) | live · objectui plugin-detail buildDefaultPageSchema (8) | 1 / 1 / 4 | yes — page designer PageBlockInspector writes `slots.NAME` | no row renders a component tree | 1 root omit, 0L | R · own editor (G3) |\n| 39 | `permission.adminScope` | obj! {businessUnit, includeSubtree, manageAssignments, manageBindings, authorEnvironmentSets, assignablePermissionSets} | live · plugin-security `delegated-admin-gate.ts` (21) | 0 / 0 / 1 | yes — PermissionAdvancedFacets (beside tabPermissions / rowLevelSecurity) | none — mirror `permission.form.ts:71-72` | 1r = 8L | D · `json` (G1) |",
 "cost_model": "a form row is 2 en leaves (label, helpText) in the metadata-forms catalog, so 8 leaves across en / zh-CN / ja-JP / es-ES, 6 of them hand-authored because the three translated catalogs are ratcheted (PR #19673: 45 rows ⇒ 90 leaves ⇒ 270 translations). A nested sub-row costs the same. R costs one LEDGER row and 0 leaves. Totals if every recommendation lands: G1 21 rows = 168 leaves (126 translations); G2 34 rows = 272 leaves (204 translations) + 4 nested ledger rows; G3 + G4 + G5 = 11 root ledger rows, 0 leaves. Rows with a visibleWhen gate also move the measured pins #19673 moved (object collapsed-section populations, the translated-label control, the lint shipped-form predicate census).",
 "form_face_today": "objectui SchemaForm at f8a9d0fb: registered widgets ref:object, ref:component, filter-mode, object-selector, field-selector, field-ref, field-multi, action-multi, filter-builder, view-ref, icon, color-picker, color-input, condition, master-detail, string-tags, multiselect, code, secret, dynamic-config (widgets.tsx WIDGETS); passthrough hints text, textarea, number, switch, select, json; structural faces composite, repeater, record, nested-form, object-rows, raw-json, scalar. Bounds that bite: an option value is a lowercase system identifier (#19678), so hyphen / capital members and boolean arms cannot be options; a union node renders the first branch in create mode; field-ref / field-multi bind to object / objectName / data.object / interfaceConfig.source, none of which an object draft carries (ResourceEditPage.tsx:890); string-tags reads a non-array as [] (widgets.tsx:1290). Where the registry form shows: object, action and page have curated default inspectors on the main edit page, so their registry form appears in the embedded drawer and create flows; field, app (no selection) and permission render it as the editor.",
 "tests": "Probe runs, all through bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/system/zz-census-19332.tmp.test.ts' with OS_VERIFY_LOCK_SLOT=issue-19332: at 6a6a17b62 1 file / 1 test passed, VERDICT command-exit 0 (waited 0s); at 596090efbe7 (base-helper probe zz-census-19332-base.tmp.test.ts) 1/1 passed, VERDICT command-exit 0 (waited 528s); at 4e0f72e8d 1/1 passed, VERDICT command-exit 0 (held 27s, waited 0s). The controls are expect()-asserted inside the probe, so each pass is the control reading. Per-key greps: scratchpad measure.py, git grep -E over framework packages (non-test, non-schema), objectui packages (non-test), examples/**, hotcrm src/**, and 86 platform object-definition files; LIT control `nameField` = framework 79 files, objectui 19, examples 1, hotcrm 16, platform 64; DARK `zzFabricated19332` = 0 in all five. Every ledger-cited reader file was checked with git grep -c -w KEY (counts in the table); action.aria reader search used lit control `action.variant` (14 objectui files) against 0 action-surface hits. Studio doors read at the pin: ObjectDefaultInspector (access, requiredPermissions), ObjectFieldInspector (visibleWhen / readonlyWhen / requiredWhen / lookupFilters / dependsOn), ObjectSettingsPanel (stageField, highlightFields), ObjectFormDesigner (fieldGroups), ObjectActionsPanel (actions), ActionDefaultInspector (CURATED_FIELDS at :266 plus a derived \"More fields\" form), PageBlockInspector (slots), PermissionAdvancedFacets (adminScope). No browser run. No ablation: no code was written.",
 "mcp_calls": "0",
 "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/19332/comments (this report, through scripts/pm/post-stamped.mjs). Reads were GET only: issues 19332, 19188, 19330 and their comments, comment 5749550902, pulls 19673 and its files, /rate_limit.",
 "open_questions": [
  {
   "question": "Offer each of these 21 live keys as one form row, mirroring a row that already exists on a registered form?",
   "group": "G1 — D, one row each: a widget the form face renders today, and a registered form already spells the same shape (21 keys)",
   "keys": [
    "object.access",
    "object.highlightFields",
    "object.requiredPermissions",
    "object.searchableFields",
    "field.accept",
    "field.currencyConfig",
    "field.dependsOn",
    "field.lookupColumns",
    "field.lookupFilters",
    "field.readonlyWhen",
    "field.relatedListColumns",
    "field.requiredPermissions",
    "field.requiredWhen",
    "field.storage",
    "field.visibleWhen",
    "action.bodyExtra",
    "action.description",
    "action.errorMessage",
    "action.patch",
    "action.requiredPermissions",
    "permission.adminScope"
   ],
   "options": [
    "A. D: one row each, mirroring the precedent row (code/expression, json, string-tags, composite, textarea, plain); 21 rows ⇒ 42 en leaves ⇒ 168 catalog leaves, 126 of them hand-authored zh-CN / ja-JP / es-ES",
    "B. R for the 12 keys the Studio already edits in a dedicated panel (\"the registry form is the fallback door\"), D for the other 9",
    "C. Defer: no rows until #19188 wires the top-level direction and each key reds"
   ],
   "recommendation": "A, because every one is live with a named reader, a same-shape row already exists on a registered form, and the cost is the ratcheted translations only; B would make a reason class that #19673 did not apply to its scalar siblings (nameField is edited in ObjectSettingsPanel and still got a row); C re-creates the refused red-lines-without-offers shape.",
   "four_axis": {
    "实际业务需求": "21 个键全部 live,且每个都有已核实的运行时读者。作者实测:hotcrm 在 18 个文件里写了 68 处 storage.notNull、18 个文件写 highlightFields、11 个写 searchableFields、4 个写 requiredWhen;showcase 写了 lookupColumns / lookupFilters / relatedListColumns / currencyConfig 等。action.patch、action.errorMessage、action.aria 之外的少数键零应用作者,但 Studio 的动作编辑器已有专门控件,说明产品上确实在用。",
    "项目长远合理性": "每一行都照抄已登记表单上已有的同形行(object.form.ts:242/336-338、app.form.ts:102、permission.form.ts:71-72、action.form.ts:105、page.form.ts:196),不引入新控件、不改 schema。与刚落地的标量兄弟 #19673 同口径。长期代价是 i18n 棘轮:21 行 = 42 个 en 叶子 + 126 条手写译文。",
    "防 AI 犯错": "联合型(object.requiredPermissions、dependsOn、lookupColumns)一律用 json,不用 string-tags:后者会把已存的 map 读成空数组再覆盖(widgets.tsx:1290),静默丢数据。字段选择器在对象草稿上今天绑不到字段(ResourceEditPage.tsx:890),所以字段名列表用自由文本,拼错由解析/校验响亮拒绝;helpText 写运行时真实行为和缺省值,而不是复述键名。",
    "创业阶段不扩散": "不新增门禁,不新增控件种类,不扩 schema;只是给已声明且已兑现的键开一扇门。零作者的 action.patch / errorMessage 行代价各 8 条,且 Studio 已在编辑它们,不算新能力。"
   },
   "governing_text": [
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:26-35 (zod-only is ledgerable only when deliberate)",
    "AGENTS.md Prime Directive #10 (declared = enforced; keep the claim as narrow as the enforcement)",
    "packages/spec/src/ui/view.zod.ts:3123 options describe (#19678 ruling 乙: an unspellable enum derives, meanings in helpText)",
    "precedent rows: object.form.ts:242, :336-338; app.form.ts:102; permission.form.ts:71-72; action.form.ts:105; page.form.ts:196",
    "PR #19673 cost measurement: the metadata-forms catalogs are ratcheted, so every new en leaf is authored in zh-CN / ja-JP / es-ES in the same PR"
   ]
  },
  {
   "question": "Design a curated nested list for each of these six, or offer a derived one-row face, or record a reason?",
   "group": "G2 — D / C, a designed nested list: hand-written sub-rows plus nested ledger rows, because a derived face would offer a deprecated alias, an unreachable union arm or a 20-key grid (6 keys)",
   "keys": [
    "object.fieldGroups",
    "object.indexes",
    "object.activityMilestones",
    "object.publicSharing",
    "object.userActions",
    "field.inlineColumns"
   ],
   "options": [
    "A. D / C: hand-written sub-rows (fieldGroups 6, indexes 3, activityMilestones 4, publicSharing 6, userActions 5, inlineColumns 4 as a curated subset); 34 rows ⇒ 68 en leaves ⇒ 272 catalog leaves; ledger: 3 nested omit rows under fieldGroups and 1 nested subset row for inlineColumns",
    "B. D with a derived one-row face (type composite / no widget): 6 rows, but it shows authors the 3 deprecated fieldGroups aliases and the deprecated bare `unique: true`",
    "C. R: record a reason and wait for demand"
   ],
   "recommendation": "A, dispatched in two flights: fieldGroups and indexes first (hotcrm authors them in 18 and 15 files), then activityMilestones, publicSharing, userActions and the inlineColumns subset; B puts deprecated spellings in front of authors, C withholds keys a real deployment writes.",
   "four_axis": {
    "实际业务需求": "fieldGroups(hotcrm 18 个文件)和 indexes(hotcrm 15、平台 77)有强拉动;activityMilestones(showcase 1 + hotcrm 2)、publicSharing(showcase 1 + hotcrm 1,知识库文章公开分享)、userActions(showcase 1 + 平台 6)是轻拉动;inlineColumns 只有 showcase 一处。Studio 只为 fieldGroups 提供了设计器,其余五个今天只能写源码。",
    "项目长远合理性": "手写子行是 #14327 之后对账门已覆盖的嵌套坐标,omit/subset 词汇现成(object.fields 的 subset 即先例);派生一行虽便宜,但把 [DEPRECATED] 键和已废弃的 unique:true 摆给作者,违背 contract-first。分两批派发可以让高拉动的两键先落地。",
    "防 AI 犯错": "精选子行 + 嵌套 omit 让已废弃别名在结构上不可达;indexes.unique 只给 global / organization 两个可拼写选项,已废弃的裸 true 不出现;publicSharing.eligibility 给 CEL 表达式控件,失败即拒(fail-closed)。",
    "创业阶段不扩散": "不新增门禁、不改 schema;代价集中在 34 行的四语文案(204 条手写译文)。inlineColumns 用 subset 而不是 20 列全量,是按拉动收紧。"
   },
   "governing_text": [
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:172-176 (omit / subset vocabulary) and :196-201 (the object.fields subset precedent)",
    "packages/spec/src/data/object.zod.ts:1206-1210 (`[DEPRECATED → collapse]`) and :490 (bare `unique: true` deprecated, rejected at protocol 18)",
    "packages/spec/src/ui/page.form.ts:164 (the interfaceConfig.userActions composite precedent)",
    "AGENTS.md Prime Directive #12 (contract-first: never teach an off-spec spelling)"
   ]
  },
  {
   "question": "Record a new root-ledger reason class for keys whose authoring door is another metadata type or a dedicated designer?",
   "group": "G3 — R, new reason class: authored through its own metadata type or a dedicated Studio designer, in a shape no form row renders (4 keys)",
   "keys": [
    "object.actions",
    "object.listViews",
    "page.slots",
    "object.external"
   ],
   "options": [
    "A. R: 4 root omit rows under a new reason class (\"authored through its own editor\"), 0 i18n leaves",
    "B. C: a curated inline subset (actions: name / label / type; listViews: name / label / type / columns; external: remoteName / remoteSchema / writable)",
    "C. D: the full shape inline"
   ],
   "recommendation": "A, because each shape already has a richer door (the action type and ObjectActionsPanel, the view type under #19330 A, the page designer block inspector, the external-datasource import flow), and a second, poorer copy inside the object or page form would drift from it; external is the weakest case (showcase hand-writes `remoteName` twice), so B is the fallback for it alone.",
   "four_axis": {
    "实际业务需求": "object.actions(平台 16 个系统对象)、listViews(平台 40)由平台代码写,应用作者走 action / view 类型;page.slots 在 hotcrm 与 showcase 各 1 处,Studio 用页面设计器的区块检视器写它;external 由外部数据源导入流程生成(showcase 手写了 2 处 remoteName)。需求真实,但门已经在别处开着。",
    "项目长远合理性": "#19330 已裁 view 按臂建表单;在对象表单里再塞一个 ListView / Action 编辑器就是第二套编辑器,违背「一条路由一个所有者」。理由类需要裁决,因为 #19333 的根行理由都是从键自身的 describe 或 liveness 读出来的,这一类不是。",
    "防 AI 犯错": "不在表单里给一个残缺的内联副本,AI 就只会走完整的专属门;omit 行点名去哪里编写,比一个只能写一半的控件更不容易写错。",
    "创业阶段不扩散": "零 i18n 成本,零新控件;只多 4 条账本行和一个理由类。"
   },
   "governing_text": [
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:196-201 (subset why: \"the full per-field editor is field.form.ts\")",
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:230-248 (root rows read their reason off describe() or the liveness verdict; a new class is a ruling)",
    "#19330 ruling A (view reconciled per arm, a list view and a page layout are two editors)",
    "AGENTS.md Route & surface ownership rule 1 (one owner per surface)"
   ]
  },
  {
   "question": "Record these four as code-declared platform configuration, the lifecycle onlyWhen precedent at the root?",
   "group": "G4 — R, new reason class: code-declared platform configuration, every author is a platform object declared in code (4 keys)",
   "keys": [
    "object.tenancy",
    "object.systemFields",
    "app.contextSelectors",
    "action.resultDialog"
   ],
   "options": [
    "A. R: 4 root omit rows naming the platform writers, 0 i18n leaves",
    "B. D: design controls (tenancy composite, systemFields false-or-map, contextSelectors repeater, resultDialog composite)"
   ],
   "recommendation": "A, because examples and hotcrm author none of the four, and two of them are isolation switches (tenancy.enabled false turns org scoping off; systemFields false stops injecting organization_id and the audit columns) that a Studio control would make one click away.",
   "four_axis": {
    "实际业务需求": "examples 与 hotcrm 对这四个键的作者数都是 0;写者只有平台代码(tenancy 4 个系统对象、systemFields 1、contextSelectors 只在 studio.app.ts、resultDialog 在 sys-oauth-application / sys-sso-provider 等 4 个)。",
    "项目长远合理性": "与 lifecycle.retention / ttl.onlyWhen 的 omit 行同一理由(写者全是代码声明的系统对象,给控件是表单面新增而非对账);有产品卡拉动时删行再设计。",
    "防 AI 犯错": "tenancy.enabled:false 关掉组织隔离,systemFields:false 停止注入 organization_id 与审计列 —— 放进表单就是一键关隔离;记理由让这两个开关只能出现在经评审的代码里。",
    "创业阶段不扩散": "零拉动的声明面按 implementation-first 处置:不设计控件,只记 4 条账本行。"
   },
   "governing_text": [
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:216-229 (lifecycle.retention / ttl onlyWhen: every writer is a code-declared platform object; offering it is a form-face addition, not a reconciliation)",
    "four-axis framework: 无拉动的声明面按 implementation-first 处置"
   ]
  },
  {
   "question": "For unions with a boolean / false arm, and for action.aria, record a reason now, build a union-aware control in objectui, or offer the first arm only?",
   "group": "G5 — the form face cannot honestly offer it today: a boolean or false arm no option can spell, or a control nothing honours (4 keys)",
   "keys": [
    "object.stageField",
    "field.inlineEdit",
    "field.relatedList",
    "action.aria"
   ],
   "options": [
    "A. R now: 3 root omit rows under a new class (\"no registered widget spells this union\"); action.aria waits for its liveness re-grade (finding 1), then takes #19333's not-enforced bucket or the retirement playbook",
    "B. Design a union-aware select in objectui (a cross-repo form-face addition), then offer all three as D",
    "C. Offer the first arm only: stageField as text, inlineEdit and relatedList as a switch; the other arm silently unreachable"
   ],
   "recommendation": "A, because an option value is a lowercase system identifier so `false` / `true` cannot be options, the derived face shows only the first branch in create mode, and C would ship a control that silently cannot reach `primary`, `grid`/`form` or `false`; B belongs to the first product card that needs one of these keys, and stageField already has its Studio control in ObjectSettingsPanel.",
   "four_axis": {
    "实际业务需求": "relatedList(showcase 2 个文件,用了 primary)、inlineEdit(showcase 3)、stageField(showcase 1)有轻拉动,hotcrm 为 0;action.aria 作者 0,且实测动作渲染面 0 个读者(对照 action.variant 命中 14 个文件)。",
    "项目长远合理性": "联合感知的选择控件是 objectui 的表单面新增,应随第一张需要它的产品卡落地,而不是为对账门提前造;aria 先修正 liveness 判定,再按结果走 #19333 或退役剧本。",
    "防 AI 犯错": "只给第一臂的控件会让作者和 AI 以为另一臂不存在,是静默的部分能力;声明即强制 —— 不能给一个运行时不读的 aria 控件。",
    "创业阶段不扩散": "不为 3 个轻拉动的键新建控件种类;不新增门禁。"
   },
   "governing_text": [
    "packages/spec/src/ui/view.zod.ts:3123 and FormSelectOptionSchema (an option value is a system identifier; #19678 ruling 乙)",
    "packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:189-195 (enable.apiMethods: needs its own control) and :216-229 (a form-face addition rather than a reconciliation)",
    "AGENTS.md Prime Directive #10 (never advertise a capability the runtime does not deliver)",
    "packages/spec/liveness/README.md status vocabulary (`live` cites its consumer)"
   ]
  }
 ],
 "out_of_scope_findings": [
  "class: c · reach: named producer — the Studio action editor's \"More fields\" form, derived from the live server schema, renders an `aria` control (not in CURATED_FIELDS or RETIRED_FIELDS, ActionDefaultInspector.tsx:21, :266; read at f8a9d0fb, not browser-run) · evidence: packages/spec/liveness/action.json grades action.aria `live` with the uncited note \"PARTIAL — honored by a few objectui renderers, not the core action buttons/menus\"; git grep for an action's aria (action / actionDef / def / spec / btn .aria) finds 0 readers in objectui action surfaces and 0 in framework, lit control action.variant = 14 objectui files; the only `schema.aria` readers are record:* page components · dedupe words: `action aria no reader` · `ActionSchema aria liveness partial` · `action aria declared unenforced`",
  "carrier: none (承接者:无) · noted, not filed — objectui ObjectFieldInspector readDependsOn (ObjectFieldInspector.tsx:1475-1481) maps a `{field, param}` dependsOn entry to its bare `field`, and add / remove write the string list back (:1536-1541), so any edit drops every `param`; no measured author uses the object arm (0 in examples and hotcrm by one-line grep), so no victim is measured",
  "carrier: the G1 / G2 flights · noted, not filed — field-ref / field-multi resolve their catalog from object / objectName / data.object / interfaceConfig.source (ResourceEditPage.tsx:890); an object draft carries none, so a field picker on object.form.ts would render an empty catalog. No shipped row uses one there today (#19673 used type text for nameField), so it is a design bound for this card, not a defect"
 ],
 "deviations": [
  "The dispatch said to slice \"the bytes before its first describe(\". The literal first occurrence is at line 232, inside a ledger comment (`describe()`), and slicing there cuts the file mid-array; I sliced at the first top-level describe( (line 685, byte 35929), the convention the census used — its base-commit slice reproduces the census sha exactly.",
  "To name the difference from the card's 39 (the census never enumerated them), I checked out the census base 596090efbe7 in the same detached worktree, ran a second throwaway probe with that tree's helper block, deleted it and returned the worktree to main before anything else.",
  "The worktree was moved from 6a6a17b62 to 4e0f72e8d on the coordinator's resume order; the population was re-derived there and is identical. node_modules removed first, then git worktree remove without --force (exit 0).",
  "(c) author counts are git grep pattern counts; action.description authors are NOT MEASURED (the pattern cannot separate it), and the platform column for action keys counts files, not verified declarations.",
  "The agent contract says the final message is the JSON alone; the dispatch says to return the comment. The final message is this JSON, which carries the per-key table in per_key_table; the comment renders the same table above the same JSON."
 ]
}

---

Generated by Claude Code

[objectstack-fleet]

Decision box: five disposition groups for the 39 structured zod-only keys (2026-09-27T21:34Z)

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ). This comment routes the analysis round of claim 5859298824 to the decision box. The per-key table (39 rows: node shape, verdict and reader, authors, the Studio's other door, form-face bound, cost) is the dev report 5859943900 above, and it is the evidence for everything below.

Background.

• #19188 reports that the metadata-form ↔ zod reconciliation gate never wired its top-level zodOnly direction.
• This card holds the 39 live, structured keys that have neither a form row nor a recorded reason.
• Until each has one or the other, the direction cannot be wired, and #19333 item 2 waits on it.
• The population was re-derived at origin/main 4e0f72e8d, with the gate's own helper block and lit/dark controls. It is exactly the card's 39: 0 added, 0 removed, 0 retired.
• #19333's dev derived the same 39 independently, as the residue after field.format, and that PR (test(spec): record why field.format is never offered by a metadata form #20322) records field.format.

Governing text.

• packages/spec/src/system/metadata-form-zod-reconciliation.test.ts: :26–35 (zod-only is ledgerable only when deliberate), :172–201 (the omit / subset vocabulary and the object.fields subset precedent), :216–229 (the lifecycle.*.onlyWhen "code-declared platform writer" precedent), :230–248 (root rows read their reason off describe() or the liveness verdict).
• AGENTS.md Prime Directive chore: version packages #10 (declared = enforced) and Add comprehensive test suite for Zod schema validation #12 (contract-first).
• #19330 ruling A (view is reconciled per arm).
• #19678 ruling 乙 (an option value is a system identifier).

Protocol statement. No option changes the protocol; every option is form-face or ledger text. The seat spot-checked the spec-side citations at 4e0f72e8d:

• the three [DEPRECATED → collapse] aliases on fieldGroups (object.zod.ts:1206–1210);
• the lifecycle.*.onlyWhen precedent rows (:216–229);
• action.aria's ledger row, live with a note of 「PARTIAL」 (liveness/action.json:215–217).

The objectui citations (widgets.tsx:1290, ResourceEditPage.tsx:890, the inspectors) are the dev's reading at the .objectui-sha pin; the seat did not re-measure them.

Premises, with re-check commands.

• The population: run the gate's helper block as a throwaway probe (see the report's population.instrument). ⇒ 84 unexplained = view 44 + object-rooted 40 (39 + field.format).
• The form face's bounds: git -C OBJECTUI_CLONE grep -n "string-tags" -- packages/*/src/**/widgets.tsx ⇒ it reads a non-array as [] at the pin.

Prior rulings read: metadata form,zodonly,reconciliation,form row → 6 hits; ADR-0094 D2, ADR-0094 D4, ADR-0110 D5, ADR-0129 D4; thread: none; repo: objectstack-ai/objectstack. The seat read each hit. All of them are other senses of "reconciliation": permission-set projection, action admission, object naming. None rules on metadata-form offers, so this card is a decision, not execution.

---

Item 1 — G1: offer 21 keys as one form row each, mirroring a row a registered form already has?

The problem in one sentence. An author who opens the Studio form for an object, field, action or permission cannot see or set 21 live settings: who may see the object, which fields search reads, when a field is required, its storage constraint, an action's error text. The platform honours all of them once they are written in code.

Keys: object.access, object.highlightFields, object.requiredPermissions, object.searchableFields, field.accept, field.currencyConfig, field.dependsOn, field.lookupColumns, field.lookupFilters, field.readonlyWhen, field.relatedListColumns, field.requiredPermissions, field.requiredWhen, field.storage, field.visibleWhen, action.bodyExtra, action.description, action.errorMessage, action.patch, action.requiredPermissions, permission.adminScope.

option	what it does	what customers notice
A	One row per key, mirroring an existing same-shape row (code/expression, json, string-tags, composite, textarea, plain). 21 rows ⇒ 168 catalogue leaves, 126 of them hand-authored translations.	The Studio form can set all 21; nothing else moves.
B	Rows only for the 9 keys the Studio has no dedicated panel for; the other 12 get a recorded reason.	The registry form stays thinner; those 12 are editable only in their panels.
C	No rows until #19188 wires the direction and each key goes red.	Nothing changes, and the gate stays unwired.

In business terms. A is "fill the gaps in an existing form, same controls". B is "point people at the specialised screen". C is "wait".

Four axes (business view).

• 实际业务需求:21 个键全部 live,且都有已核实的运行时读者。hotcrm 在 18 个文件里写了 storage.notNull,写 highlightFields 的也是 18 个文件,写 searchableFields 的 11 个;showcase 写了 lookupColumns / lookupFilters / currencyConfig 等。
• 项目长远合理性:每行照抄已登记表单上的同形行,不引入新控件、不改 schema,与刚落地的标量兄弟 feat(spec): give the 45 declared-but-unoffered scalar metadata keys a form row each #19673 同口径。长期代价是 i18n 棘轮。
• 防 AI 犯错:联合型一律用 json 而不是 string-tags。string-tags 会把已存的 map 读成空数组再覆盖,等于静默丢数据,只能用 json 防住。字段名列表用自由文本,拼错时由解析响亮拒绝,出错的人当场看得到。
• 创业阶段不扩散:不新增门禁、控件种类或 schema,只是给已声明且已兑现的键开门。

os-decision-facets

• ① 项目长远合理性:照抄既有行,不增特例,不增契约。
• ② 实际业务拉动:hotcrm、showcase 实测作者;全部 live 且有读者。
• ③ 防 AI 犯错:联合型用 json,防止静默覆盖;非法值在解析时响亮拒绝。
• ④ 创业阶段不扩散:零新门禁、零新控件,代价只是四语文案。

Recommendation: A. Fallback: B. Confidence gap: action.description's authors are NOT MEASURED, and the objectui widget bounds are the dev's reading. 只看①选 A;②③④ 是否翻转:否。
After the ruling: two flights (object + permission; field + action), each with its four-locale catalogue rows in the same PR.

---

Item 2 — G2: design a curated nested list for six keys?

The problem in one sentence. Section layout, indexes, activity milestones, public sharing, per-operation user actions and inline child columns can only be written in code today. A derived one-row control would show authors deprecated spellings (fieldGroups' three aliases, the bare unique: true) or an unreachable half of a union.

Keys: object.fieldGroups, object.indexes, object.activityMilestones, object.publicSharing, object.userActions, field.inlineColumns.

option	what it does	what customers notice
A	Hand-written sub-rows (34 rows ⇒ 272 leaves, 204 translations), plus 3 nested omit rows under fieldGroups and 1 nested subset row for inlineColumns. Two flights: fieldGroups + indexes first.	Clean editors that offer only current spellings.
B	A derived one-row face per key (6 rows).	Cheap, but deprecated aliases appear in the Studio.
C	A recorded reason; wait for demand.	Code-only authoring continues.

In business terms. A is "build the six small editors properly". B is "expose the raw shape, warts included". C is "not now".

Four axes.

• 实际业务需求:fieldGroups 在 hotcrm 18 个文件出现,indexes 在 hotcrm 15 个、平台 77 个,都是强拉动;其余四个轻拉动;inlineColumns 只有 showcase 一处。
• 项目长远合理性:手写子行加嵌套 omit/subset 是对账门现成的词汇。派生一行会把 [DEPRECATED] 键摆给作者,违背 contract-first。
• 防 AI 犯错:精选子行让已废弃别名在结构上不可达;indexes.unique 只给 global / organization 两个选项。
• 创业阶段不扩散:不改 schema,不加门禁;inlineColumns 只做 subset,按拉动收紧。

os-decision-facets

• ① 项目长远合理性:只提供现行拼写,废弃别名不可达,契约面收窄。
• ② 实际业务拉动:fieldGroups、indexes 强拉动,其余轻拉动。
• ③ 防 AI 犯错:闭合子行优于派生自由结构。
• ④ 创业阶段不扩散:分两批,低拉动项可后置。

Recommendation: A, in two flights. Fallback: A for fieldGroups + indexes only, and C for the other four. Confidence gap: no browser run of the objectui repeater face. 只看①选 A;②③④ 是否翻转:否(④ 只调分期)。

---

Item 3 — G3: record a new reason class, "authored through its own editor", for four keys?

The problem in one sentence. An object's actions and list views, a page's slots, and an object's external-datasource mapping each already have a richer editor elsewhere: the action type, the view type, the page designer, the import flow. A second, poorer copy inside the object or page form would drift from it.

Keys: object.actions, object.listViews, page.slots, object.external.

option	what it does	what customers notice
A	4 root omit rows under a new reason class, with 0 translations.	No change: authors keep using the dedicated editors.
B	A curated inline subset (e.g. actions: name / label / type).	A second, partial editor beside the real one.
C	The full shape inline.	A 40-key editor inside a form row.

Four axes.

• 实际业务需求:actions、listViews 由平台代码大量写,应用作者走 action / view 类型;slots 用页面设计器写;external 由导入流程生成,showcase 手写过 2 处。
• 项目长远合理性:[Decision] is view reconciled per metadata type or per union arm? 36 keys of the #19188 census cannot be filed until this is settled #19330 已裁 view 按臂建表单;在对象表单里再放一个编辑器,就违背「一条路由一个所有者」。
• 防 AI 犯错:omit 行点名该去哪里写,比一个只能写一半的控件更不容易出错。
• 创业阶段不扩散:零 i18n 成本,零新控件。

os-decision-facets

• ① 项目长远合理性:一个面一个编辑器,不造第二套。
• ② 实际业务拉动:门已在别处开着,拉动由专属编辑器承接。
• ③ 防 AI 犯错:不给残缺副本。
• ④ 创业阶段不扩散:只多 4 条账本行和一个理由类。

Recommendation: A. Fallback: B for object.external alone, since it is the weakest case. Confidence gap: the import flow's coverage of every external sub-key was not measured. 只看①选 A;②③④ 是否翻转:否。

---

Item 4 — G4: record four keys as "code-declared platform configuration"?

The problem in one sentence. Four settings are written only by the platform's own code-declared objects, and no example or HotCRM writes them. Two of them are isolation switches: tenancy.enabled: false turns organisation scoping off, and systemFields: false stops injecting organization_id and the audit columns. A form row would put those switches one click away.

Keys: object.tenancy, object.systemFields, app.contextSelectors, action.resultDialog.

option	what it does	what customers notice
A	4 root omit rows naming the platform writers (the lifecycle.*.onlyWhen precedent).	Nothing; the switches stay code-only.
B	Design controls for them.	Isolation switches become editable in the Studio.

Four axes.

• 实际业务需求:examples 与 hotcrm 对这四个键的作者数都是 0,写者只有平台代码。
• 项目长远合理性:与 lifecycle onlyWhen 的 omit 行同一理由;有产品卡拉动时,删行再设计。
• 防 AI 犯错:放进表单,就等于一键关掉组织隔离、停止注入审计列;记理由让这两个开关只出现在经评审的代码里。
• 创业阶段不扩散:零拉动,按 implementation-first 处置。

os-decision-facets

• ① 项目长远合理性:沿用既有先例,不增特例。
• ② 实际业务拉动:零应用作者。
• ③ 防 AI 犯错:隔离开关不进表单。
• ④ 创业阶段不扩散:只加 4 条账本行。

Recommendation: A. Fallback: B for action.resultDialog alone, if a product card asks. Confidence gap: none material. 只看①选 A;②③④ 是否翻转:否。

---

Item 5 — G5: for three unions with a boolean / false arm and for action.aria, record a reason now?

The problem in one sentence. The form face cannot honestly offer these today:

• An option value must be a lowercase identifier, so true / false cannot be options, and a union shows only its first branch when a record is created. relatedList: 'primary', inlineEdit: 'grid' | 'form' and stageField: false would silently be unreachable.
• action.aria has no measured reader on any action surface (lit control: action.variant hits 14 files).

Keys: object.stageField, field.inlineEdit, field.relatedList, action.aria.

option	what it does	what customers notice
A	Record a reason now for the three unions, under a new class: "no registered widget spells this union". action.aria waits for its liveness re-grade (#20323), then takes #19333's not-enforced bucket or the retirement playbook.	No change.
B	Build a union-aware select in objectui first, then offer all three.	A cross-repo form-face addition before any product card asks for it.
C	Offer the first arm only.	Controls that silently cannot reach primary, grid / form or false.

Four axes.

• 实际业务需求:三个联合键只有 showcase 轻拉动,hotcrm 为 0;action.aria 作者为 0,实测读者也为 0。
• 项目长远合理性:联合感知控件应随第一张需要它的产品卡落地,不为对账门提前造。
• 防 AI 犯错:只给第一臂的控件会让作者以为另一臂不存在,属于静默的部分能力;声明即强制,不给一个运行时不读的 aria 控件。
• 创业阶段不扩散:不为轻拉动的键新造控件种类。

os-decision-facets

• ① 项目长远合理性:不造半能力控件。
• ② 实际业务拉动:轻拉动或零拉动。
• ③ 防 AI 犯错:不做静默不可达的臂。
• ④ 创业阶段不扩散:延后到有产品卡拉动时。

Recommendation: A. Fallback: B, if a product card for one of these keys lands first. Confidence gap: stageField already has its own Studio control (ObjectSettingsPanel); it was not browser-run. 只看①选 A;②③④ 是否翻转:否。

---

What happens after the ruling.

• Each letter becomes flights on this card: Items 1–2 as form-row flights, and Items 3–5 as one ledger flight.
• Once the ledger rows land, #19188 split: 145 top-level zod-only keys need a RECORDED REASON, never a form row — and none can be recorded until the ledger learns a root path #19333 item 2 (wiring the top-level zodOnly direction, [finding] metadata-form ↔ zod 对账门的 top-level zodOnly 方向**根本没接线**(只有嵌套列表有),这就是两个已声明键在全门禁绿的情况下缺席表单的原因 —— 本树实测 276 个 top-level zod-only 键 #19188) becomes dispatchable.
• action.aria's liveness verdict is filed as its own finding card, [finding] action.aria is graded live in the liveness ledger, but no action surface reads it — and the Studio action editor still renders an aria control #20323.

State. This card moves from pm:dispatched to needs-user-decision in one write, and this seat's assignee comes off. The analysis round is complete, and ⛔ nothing is in flight on the card.

[objectstack-fleet]

Ruling: batch #229 item 3 · letter A (all five groups) · maintainer 「同意」 2026-09-28T00:53Z

Director seat, summon #30 续 2, session_01AsCNgFBs8HCjwhyHQsFbx3. Batch #229 was presented in the seat chat with the full analysis of each item (the domain:spec seat 4 box 5860033210 and the dev's per-key table 5859943900 re-read, four axes not flipped); the maintainer answered 「同意」 (verbatim, recorded here per the charter).

Ruled: A on every group. The 39 live structured zodOnly keys are dispositioned as follows, so the metadata-form ↔ zod reconciliation gate can wire its top-level zodOnly direction (#19333 item 2):

• G1 (21 keys: object.access, object.highlightFields, object.requiredPermissions, object.searchableFields, field.accept, field.currencyConfig, field.dependsOn, field.lookupColumns, field.lookupFilters, field.readonlyWhen, field.relatedListColumns, field.requiredPermissions, field.requiredWhen, field.storage, field.visibleWhen, action.bodyExtra, action.description, action.errorMessage, action.patch, action.requiredPermissions, permission.adminScope) — one form row each, mirroring a row a registered form already has (code/expression, json, string-tags, composite, textarea, plain), with the four-locale catalogue rows in the same PR. Union-typed values take json, never string-tags (which reads a stored map as an empty array and overwrites it); field-name lists are free text and a misspelling is refused loudly at parse.
• G2 (object.fieldGroups, object.indexes, object.activityMilestones, object.publicSharing, object.userActions, field.inlineColumns) — hand-written curated sub-rows, plus the three nested omit rows under fieldGroups (the [DEPRECATED → collapse] aliases, object.zod.ts:1206-1210) and one nested subset row for inlineColumns; indexes.unique offers global / organization only. Two flights: fieldGroups + indexes first, the other four after.
• G3 (object.actions, object.listViews, page.slots, object.external) — four root omit rows under a new reason class, "authored through its own editor", naming the editor (the action type, the view type per [Decision] is view reconciled per metadata type or per union arm? 36 keys of the #19188 census cannot be filed until this is settled #19330 A, the page designer, the import flow). No inline copy.
• G4 (object.tenancy, object.systemFields, app.contextSelectors, action.resultDialog) — four root omit rows as "code-declared platform configuration", the lifecycle.*.onlyWhen precedent; the two isolation switches stay out of the form.
• G5 (object.stageField, field.inlineEdit, field.relatedList; action.aria) — a recorded reason now: the three unions under a new class "no registered widget spells this union" (an option value must be a lowercase identifier and a union shows only its first arm on create); action.aria waits for its liveness re-grade ([finding] action.aria is graded live in the liveness ledger, but no action surface reads it — and the Studio action editor still renders an aria control #20323), then #19188 split: 145 top-level zod-only keys need a RECORDED REASON, never a form row — and none can be recorded until the ledger learns a root path #19333's not-enforced bucket or the retirement playbook.

Readings: the population (39 = 84 unexplained − view 44 − field.format) was re-derived with the gate's own helper block and lit/dark controls at 4e0f72e8d, 0 added, 0 removed; the spec-side citations spot-checked by the seat and by this seat at ab820016b3 (object.zod.ts:1206-1210, liveness/action.json:215-217 aria PARTIAL). The objectui widget bounds (string-tags reads a non-array as []; field-multi binds nothing on an object draft) are the dev's reading at the .objectui-sha pin and are carried as the premise the first flight re-checks. Prior-ruling sweep: ADR-0094 D2/D4, ADR-0110 D5, ADR-0129 D4 are other senses of 「reconciliation」; #19330 A and #19678 乙 are honoured by G3 and G5. No option changes the protocol.

Mainstream reading the ruling rests on: Salesforce's object and field setup pages give every declared property a control of its own kind or keep it on its own page (sharing settings are not inside the field editor); ServiceNow's dictionary entries take typed controls per attribute rather than a generic JSON box. One surface, one editor; a declared setting either has a real control or a recorded reason, never a half-capable one.

Execution parameters: G1 and G2 land as form-row flights (G1: object + permission, then field + action; G2: fieldGroups + indexes, then the rest), each with its catalogue rows; G3–G5 land as one ledger flight; once the ledger rows are in, #19333 item 2 wires the direction. Every flight is Clause-②: no (form face and ledger text). Confidence gaps carried: action.description's authors NOT MEASURED; no browser run of the objectui repeater face; stageField's existing ObjectSettingsPanel control not browser-run.

State: needs-user-decision → pm:queue in this act (domain:spec · p2 kept); body first line set to this ruling.

---

Generated by Claude Code