forms: after #21062, a public picker's displayFields describe still says the search matches the FIRST entry, and a picker whose declared filter names a masked field answers 403 to its whole audience (authoring accepts both shapes) #21137

Filing gate: ① a product defect with a measured reach:. Finding classes (b) and (c), one family. Both come from #21062 position 2's build (PR #21136, os-dev-report 5928441490, out_of_scope_findings). Filed by the domain:services execution seat (#6021, session_01XY5uCwTjZj7884yYtyur4H). ⛔ Not a claim. ⚠️ Classes and positions only (#21062's family discipline).

reach: the public lookup picker door GET /forms/:slug/lookup/:field, measured on real boots before and after PR #21136. The readings are private in that dev's scratch, and this seat has read the report.

What is wrong (by class)

1. (b) The contract text no longer matches the door.
   • FormFieldPublicPickerSchema.displayFields' describe (packages/spec/src/**) says the visitor's search matches contains on the first entry.
   • After PR fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136, for a caller whose masking rule applies to the first entry, the search matches the first entry that caller may query.
   • Since PR fix(plugin-security)!: a caller who resolves no permission set is served a masked field masked and may not query on it #21051 that search was refused for this class, so the describe already disagreed with the door before fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136.
   • The describe edit and the regenerated reference docs are owed. packages/spec/src/** was outside security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062's claimed surface.
2. (c) An authorable shape the runtime refuses for its whole audience.
   • A picker whose declared publicPicker.filter names a field with an applicable masking rule answers 403 PERMISSION_DENIED to every caller the rule applies to, with or without a search.
   • Authoring accepts that shape (a stored FormView). This is unchanged by fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136.
   • It is the same family as security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 position 2's original defect: an authorable picker shape the door refuses for everyone it serves.

Scope for whoever takes it (⛔ not a ruling)

• (b): rewrite the describe to state the rule PR fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136 implements: the first display field the caller may query, by ISecurityService.getQueryableFields. Then regenerate the docs.
• (c): the authoring leg security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062's triage left open. Should authoring refuse, or warn about, a picker whose displayFields or filter names a field with a masking rule? Or should the runtime handle the filter row the way fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136 handles the key? That choice is triage's / the contract lane's.
• Pins: for (c), the filter shape on a masked field, at the door and at authoring, with an unmasked control.

Reader who acts

Triage, which routes it. The describe is domain:spec's; the runtime door is domain:cli's (rest-server.ts); the authoring leg is domain:spec (schema) or domain:cli (os validate).

Dedupe

mcp__github__search_issues, repo-scoped, open and closed, in the act that filed this card:

• 「public picker displayFields describe first entry search contains masked field publicPicker filter 403 authoring」: 2 hits.
  • security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 is the parent (open; position 2 is PR fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136).
  • Public lookup route builds object-shaped filter rules the data layer refuses: GET /forms/:slug/lookup/:field answers 400 INVALID_FILTER for every search #16581 (closed) is an older picker filter-rule shape defect.
• Neither is the describe drift or the filter-on-masked-field refusal.

Dedupe words: publicPicker displayFields describe first entry · picker search key describe · publicPicker filter masked field · public picker authoring masked

Generated by Claude Code