[objectstack-fleet]

Requested by Tesla · project thread

Fixes #32833

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：弹窗和抽屉里的「新建授权」表单，选了某个包的权限集后，保存时现在会把这个包一起存下来（以前显示选中了，保存却只存名字）；另外给分页、分步表单的种子规则补了界面级测试，给几处规则补了注释。
• 为什么改：两个包提供同名权限集时，用户在弹窗/抽屉里选的包被悄悄丢掉，授权落到的不是用户选的那一份；整页、分页、分步表单早已正确，只有这两处漏了。
• 风险与回滚：只在新建、只对授权对象、只在用户改动过包时才多存这一列，条件与整页表单完全相同；服务端照旧校验并拒绝不持有该名字的包。回滚即撤销本 PR。
• 先看：ui/packages/plugin-form/src/writePayload.ts（新的 createWritePayload）、ModalForm.tsx / DrawerForm.tsx 的新建分支、__tests__/objectFormPermissionRefEdges-32795.test.tsx 末尾三段。
• 两分钟验证：pnpm --dir ui exec vitest run packages/plugin-form/src/__tests__/objectFormPermissionRefEdges-32795.test.tsx，预期 29 个全绿。
• 需要你做的：无，席位落地。
• 席位意见：席位（domain:ui#4）审过。第 1 轮返工修了专题席红线复读（6840905752）的必改项 M1：新建表单开着时宿主换了预填的权限集名，之前选的软件包会残留在新名字旁边一起保存；现在名字被自己选择以外的途径改掉时，软件包随之清空，只按名字保存。修在权限集选择控件里，四种表单（整页、分页、弹窗、抽屉）一处修好。等专题席对新 head 复读通过、CI 全绿后按队列落地。

What changes

• Item 6 (arm: the modal and drawer forms carry the pick the same narrow way the record form does). Measured on main 75102c80 first: in ModalForm and DrawerForm on a grant's create, a package holder's option is pickable (the form renderer hands the widget its create-only writer and the section builder stamps the object), and the save drops the picked permission_set_package, because those two forms spelled their own create payload (owner pick, then the runtime-default omission) without the holder step. The record form's create step is now one function, createWritePayload in writePayload.ts (module-internal, not a package export), which formWritePayload calls and the modal and drawer forms call for their create. They keep their own create test (mode === 'create') and their own definition, so nothing else they send changes. No new channel, no new string.
• Item 1. Rendered saves for TabbedForm and WizardForm: a seeded package is not shown and not sent; a package the user then picks is sent.
• Item 2. A comment on FormWriteSources.createBaseline and on seedCreateValues states the invariant (a create's values and its baseline come from one call). Pins: an unnamed definition's seed keeps the package and the save still sends the name alone, unit and rendered (tabbed, wizard); a baseline built by a second seed would turn the seed into a pick.
• Item 3. Pins: withFormObject keeps an author-written formObject when there is no object name or no reading widget, and the form's stamp wins when present; an action param (permissionSet, never stamped) lists package holders disabled and a click writes nothing.
• Item 4. Comment on FORM_OBJECT_KEY: a field-definition key, not the app shell's URL parameter of the same spelling (RECORD_FORM_OBJECT_PARAM). No rename.
• Item 5. Comment on rowHolderPackageFieldOf: without the package column, a shared name shows the last-served holder's label; display only.
• One holder (CONTROL). Modal and drawer: a one-holder pick writes the name alone.
• Round 1, must-fix M1 of the epic red-line read 6840905752 (re-seed after a package pick). FROM: with a package holder picked on an open grant create form, a host re-seed to another permission_set reset the form, and the reset carry (form.tsx) put permission_set_package back beside the new name; the form showed the old package as the new name's holder and saved both. TO: while the name field is on screen, the package is cleared when the name changes by any path other than the widget's own pick, so the form shows the name as the server reads it and saves the name alone. Residue (epic delta read 6846224492, H1): a section hidden and shown again around a re-seed remounts the widget, which then takes the earlier package as the new name's; it needs a host-authored visibility rule around the grant's name field (no first-party grant form has one) and is routed to the epic seat's p2 card under ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795 with R1–R3. Arm: the widget (RegistryRefField, @object-ui/fields), not the shared carry. The carry lives in @object-ui/components and the column/object pairing in @object-ui/fields, which depends on components, so the carry cannot read the pairing without a package cycle. The widget remembers the name its package goes with (its own pick, or the name first seen beside it) and writes null through its create-only writer when the name moves otherwise; form.tsx and every seed are unchanged, so the ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795 "key absent" pins stand, and the create payload still carries no permission_set_package key. Edit forms get no writer, so they are untouched.

Tests

All new pins sit in the existing shared harness files as top-level describes:
ui/packages/plugin-form/src/__tests__/objectFormPermissionRefEdges-32795.test.tsx (items 1, 2, 6, CONTROL) and
ui/packages/fields/src/widgets/__tests__/RegistryRefField.permissionRefEdges-32795.test.tsx (item 3).

• Item 6 premise, measured on main 75102c80 before the fix: the two "a package holder is pickable, and the save writes the holder's package beside the name" pins (ModalForm, DrawerForm) were red, the 19 others green: Tests 2 failed | 19 passed (21).

• After the fix, that file: Tests 29 passed (29).

• Every ui test file that imports what this diff changes (ModalForm, DrawerForm, writePayload, schemaDefaults in plugin-form; permissionSetHolders anywhere): Test Files 27 passed (27), Tests 347 passed (347).

• type-check (tsc --noEmit && tsc -p tsconfig.test.json, the test project covers src/**/*.test.tsx) for @object-ui/plugin-form and @object-ui/fields: exit 0, 0 errors each, after a declaration build of @object-ui/plugin-form^....

• eslint over the 7 changed source and test files: 0 errors (warnings only, the existing any in test harnesses).

• Round 1 (head 6152f152): pins, after a package pick a re-seed to another name sends the name alone and shows no stale holder, on the full-page, tabbed, modal and drawer forms; CONTROLs, the wizard (ignores the re-seed) and modal close-and-reopen, plus a widget pin and a widget CONTROL. Touched files 35/35 and 12/12; the 49 ui files that import what changed, 1063/1063; type-check @object-ui/fields and @object-ui/plugin-form 0 errors; 36/36 derived gates exit 0 on 6152f152, reconciled. Ablation: RegistryRefField.tsx restored from 131de9d7 turns 5 red / 42 green (the four form pins, each on the payload, plus the widget pin); CONTROLs green; restore verified by blob hash. Report 6844153129.

Acceptance notes

• The order's stop line ("if any change widens what a form sends") was read against the card's own arm for item 6: the modal and drawer creates now send permission_set_package exactly when the record form's create does (createHolderPackagePayload's conditions unchanged: create only, grant object only, a declared column, a value the user changed against the opening values, field-level security applied). Nothing widens beyond the record form, and the server's verdict is untouched.
• ModalForm and DrawerForm do not apply formWritePayload's inline-members rule (a non-empty customFields still sanitizes against the object definition there). That difference predates this PR and is left as is; routing them through formWritePayload whole would change it, which is why only the create step is shared.
• Item 5's label is unchanged behaviour (display only), commented, not changed.

Verification

Ablation (item 6): revert the modal and drawer change ⇒ its pin goes red

Fix committed first (ab8ae5ff). Mutation: git restore --source=75102c80 of ModalForm.tsx and DrawerForm.tsx only, under a trap that restores them from HEAD. Landed on disk: createWritePayload count modal=0 drawer=0, createOwnerPayload(payload count modal=1 drawer=1.

• Ablated run: Tests 2 failed | 19 passed (21); the two failures are exactly the ModalForm and DrawerForm "a package holder is pickable, and the save writes the holder's package beside the name" pins. The one-holder CONTROL, the environment-set pick and the seeded-package pins stayed green.
• Restore: git diff HEAD empty, git status --porcelain empty; blob hashes on disk equal HEAD's (ModalForm 0641e46c, DrawerForm 02ada934).
• The subject resolves from src (plugin-form tests import ../ModalForm relatively), so no build sat between mutation and run.

Derived gates (dispatch-gates --commands), run at c3e213b, reconciled

Each line ran with stdin from /dev/null, exit captured before any pipe:

node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0
node scripts/check-adr-0087-registration.mjs --self-test :: exit 0
node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-empty-changeset.mjs --base origin/main :: exit 0
node scripts/check-empty-changeset.mjs --self-test :: exit 0
node scripts/check-sdui-manifest.mjs :: exit 0
node scripts/check-sdui-manifest.mjs --self-test :: exit 0
node scripts/ci/snapshot-next.mjs --self-test :: exit 0
node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0
node scripts/release-pending-publish.mjs --self-test :: exit 0
pnpm --dir ui exec vitest run scripts/ :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm check:changeset-gate-self-tests :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:registry-log-declared :: exit 0
pnpm check:rest-log-spy-declared :: exit 0
pnpm check:skill-identifier-liveness :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:undeclared-dep-imports :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

dispatch-gates --ran: 36 derived families accounted for, 36 run, 0 NOT-MEASURED (a derived zero: all 36 recorded an exit code). check:new-line-citations: 0 new citations. After merging origin/main (1a6c3309: app-shell, cli and plugin-detail only, no overlap with this diff) the derivation is unchanged; nothing was re-run.

Ruling-surface grep (`ruling|Ruling-ref|maintainer|⛔` over the file surface)

Hits kept: writePayload.ts "Do not spell any step of it beside a call to this function" (kept: the modal and drawer creates now call the shared create step instead of spelling it); sanitize.ts "This is not readonly is writable on a create" (unchanged, the step keeps its one key); RegistryRefField.tsx "No arm writes anything but a name …" and "never resolved to one holder by order" (unchanged); the remaining hits in ObjectForm, TabbedForm, WizardForm, ModalForm, DrawerForm, schemaDefaults, sectionFields concern layout, sections and wizard predicates, outside this diff.

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line read · 2026-11-13T01:18Z

Head-sha: 131de9d78cb2cdb0b481c3f4e503f306bd0b9166 (main 1a6c330 merged). Read-only.
Verdict: NO PASS. One code must-fix, M1, fixed in this PR (epic seat's ruling). Everything the PR claims holds as measured; M1 sits in a composition no pin covers.

• Must-fix M1: a package pick survives a re-seed of the open create form and is saved beside the new name (below).
• Red line 1, resolution not loosened: holds for what the PR claims; M1 is the one exception.
  • No server file changes. The 8 files are the changeset, three sources with code (writePayload.ts, ModalForm.tsx, DrawerForm.tsx), two with comments only, and two test files.
  • The modal and drawer creates now send one more key, permission_set_package, and nothing else. Of 88 probes, 48 moved, every one from the name alone to the name plus the package of the option clicked. The other 40 did not move: an edit, another object, one holder, the environment's set, nothing picked, a seeded package left alone, and the residues named at the end.
  • The server judges the value (table below). A package that does not hold the name is refused and nothing is stored.
  • Read, not measured: the delegated-admin gate judges the holder a grant names, per package.
• Red line 2, ambiguity reported, never guessed: holds for what the PR claims; M1 is the one exception.
  • Both forms save the package of the option clicked, for either package, in four list orders (two packages; two packages plus the environment; each reversed), and after a change of pick.
  • With nothing picked, nothing is sent.
  • A form opened on a name two packages hold, with or without a seeded package, shows "several packages provide it; none named" and sends the name alone, for the grant object as the platform's adapter serves it. It never shows or sends the first holder.
  • After a package pick, a pick of the environment's set or of a one-holder name sends the name alone.
• Red line 3, independently releasable: holds.
  • The repo's reader (scripts/pm/clause2-line.mjs) reads Clause-②: no and Metadata-protocol: none from both the body and the changeset.
  • Clause-②: no fits: createWritePayload is not exported by the package index, no string is added, and no server answer moves. The record-form half this mirrors (PR fix(fields, plugin-form): permission-ref lists each package that provides a set, and a grant's New form saves the picked package #32793) is itself unreleased; no tag contains it.
  • The changeset is a patch on @object-ui/plugin-form, which is in one fixed group with @object-ui/fields. The change is not breaking, so no ADR-0087 entry is owed.
  • The FROM→TO in the body and the changeset (showed the pick, saved the name alone → saves the picked package) matches the 48 probes that moved.
• The merge: git show --remerge-diff of the merge commit is empty. The 25 files it brings from main touch none of the PR's files (the body lists app-shell, cli and plugin-detail; 11 locale files came too).

Must-fix M1: a package pick survives a re-seed of the open create form

• The composition.

  • A sys_user_permission_set create form is open, and the user picks a package holder (permission_set_package = crm).
  • The host then changes the seed (initialData or initialValues) to another permission_set while the form stays mounted.
  • The form resets and permission_set takes the new seed, but the package stays.

• The cause, confirmed by ablation.

  • After a reset, the form renderer puts back any value that neither the outgoing nor the incoming defaults name (ui/packages/components/src/renderers/form/form.tsx, the carry around form.reset(defaultValues)).
  • The grant's package column is such a key, because the ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795 seed rule removes it from every create seed.
  • With that step disabled, all 15 probes send the name alone.

• Measured on the modal and the drawer, 5 probes each. FROM is both forms at their base blobs, TO is this head. At both, the screen shows the old package as the new name's holder.

  New seed	FROM payload → server	TO payload → server
  A name crm and hr hold (also when the form opened empty)	name alone → 409 naming both	name + crm → stored with crm
  A name the environment, crm and hr hold	name alone → stored, package null	name + crm → stored with crm
  A name only hr holds	name alone → stored with hr	name + crm → 409 not-held-by-qualifier, with no package on screen to explain it
  The name crm and hr hold, seeded with package hr	name alone → 409 naming both	name + crm → stored with crm, the opposite of the context's package

• Why it is a must-fix here. In three of the four cases, this PR turns a 409 into a stored grant of a holder the user never picked for that name: a silent pick by state (red lines 1 and 2).

  • It is not a security finding: it is the admin's own create form, the screen shows the holder that is saved, and nothing reaches past the caller's admission.

• The fix, per the epic seat; ui#4 chooses how.

  • Fix the shared carry, so that all four forms are fixed at once. Either leave this key out of the carry, or have the widget ignore a stored package when the name changed by a path other than its own pick.
  • Pin it on all four forms.
  • Do not seed the key as null: that would flip ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795's "the key is absent" pins.

• Reach beyond this PR.

  • The full-page and tabbed forms send the same payloads at this head (10 probes), so this is on unreleased main since fix(fields, plugin-form): permission-ref lists each package that provides a set, and a grant's New form saves the picked package #32793, which ships in 18.4.0.
  • If the fix here does not cover those two forms, ui#4 files a p1 card under ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795.
  • The wizard ignores the re-seed (5 probes). Closing and reopening the form is clean (4 probes).

What the server does with each value the two forms can send

Measured on the real-engine rig of grant-permission-set-package.test.ts (real ObjectQL, an SQL driver, the grant-name hook and the stamp seam; a stand-in registry), as a non-system caller, in both holder orders. 16 payloads, 32 cases.

The name is held by	Package sent	Answer
Two packages	One of them	Stored with exactly that package
Two packages	None, or blank	409, naming both; nothing stored
Two packages	A package that does not hold it	409 not-held-by-qualifier; nothing stored
Two packages and the environment	One of the packages	Stored with exactly that package
Two packages and the environment	None	Stored, package null
One package	None	Stored with that package
One package, or the environment only	Another package	409 not-held-by-qualifier; nothing stored
Nothing	Any	400

Measured at head

• The two touched test files: 29 of 29 and 10 of 10.
• Every ui test file that imports a changed module, selected by import: 53 files, 655 tests, all passed. The body's 27 files and 347 tests is a narrower selection that I did not reconstruct.
• The server rig file: 21 of 21.
• Probes (scratch files, deleted): 88 on the two forms, run at head and again with both forms at their base blobs; 33 more outside the pins; 4 on the tabbed and wizard forms. Closing and reopening either form carries no pick over (4 of the 33).
• Gates run locally: the two changeset gates and the ADR-0087 registration gate, each exit 0.
• Read, not run: CI on this head shows 57 check-runs, 44 success, 13 skipped, none failed. Type-check, eslint and the other derived gates were not re-run.

Ablations

My own wording of each, against the two touched files (39 green at baseline). Every file was restored to its HEAD blob and the tree was clean after each. The one-holder CONTROLs stayed green in every run.

Ablation	Red / green
Modal: the create step drops the holder's package	1 / 38
Drawer: the create step drops the holder's package	1 / 38
Both forms at their base blobs (the author's ablation)	2 / 37
The shared create step without the holder's package	7 / 32
seedCreateValues keeps a seeded package	8 / 31
Tabbed: the baseline comes from a second seed	1 / 38
Wizard: the baseline comes from a second seed	1 / 38
Modal: the baseline is an empty second seed	0 / 39
Drawer: the baseline is an empty second seed	0 / 39
Every option addresses the first package holder	5 / 34
A package pick writes the first package holder	2 / 37
A package pick writes the last package holder	0 / 39
An unresolved name reads as the first holder	1 / 38
A package option is pickable on a bare-name target	7 / 32
withFormObject stamps with no object name	2 / 37
An authored formObject wins over the form's stamp	1 / 38
The pairing is read by column alone	7 / 32
The pairing is read by object alone	1 / 38
withFormObject stamps every widget	2 / 37

The three green rows are the two nits below. In the two first-holder rows a test titled "CONTROL of the pairing" goes red; it is the widget's own pick pin, so that is expected.

Nits (a follow-up card under #32833; no extra round)

1. The item 6 pins cannot tell the clicked package from one chosen by list order. Their holder list has one package beside the environment.
   • "A package pick writes the first package holder" leaves all eight item 6 pins green; the 2 red are in the widget file.
   • "Writes the last package holder" leaves both touched files green. Across the six permission-ref test files it is 1 red of 70, in the ui(fields): the permission-ref picker lists permission sets by name only, so once two packages hold one name it offers two options with one value and a grant written through it names no package #32770 widget file.
   • So the pick is pinned at the widget, and my probes measured both orders in both forms. Two packages in the item 6 list would pin it where the PR changes.
2. The one-call rule of item 2 has a rendered pin on the tabbed and wizard forms only. The modal and drawer now judge the package against their opening values too. An empty second baseline there leaves both touched files green; across the 53 importing files it is 1 red each, the owner pin, never the package.

Pre-existing, not moved by this PR. In each, the screen shows a package holder and the save sends the name alone (a 409 with two packages, or the environment's set when the environment also holds the name). The epic seat routes them to one p2 card under #32795, queued and not dispatched:

• R1: a form definition served without name, which is not the first-party adapter. On the modal, drawer, tabbed and wizard forms, a seeded package is shown and the save is bare; picking another holder and then the seeded one again is also sent bare.
• R2: mode: 'edit' with no recordId on the modal or drawer. The option can be picked; a host submitHandler receives the name alone.
• R3: field-level security refusing permission_set_package. All three forms still let the user pick, then send the name alone.

Not the PR's content: it is still a draft, and it carries no contract-review record at read time.

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line delta read · 2026-11-13T06:45Z

Head-sha: 6152f152dcf064aba6805564106f89be85fe504a

Verdict: HOLD (text only). M1 of 6840905752 is closed in every composition the first read measured, on all four forms. One narrower composition keeps it (H1 below). The epic seat ruled H1 a text fix in this PR, because the changeset ships as the CHANGELOG. A text re-read turns this to PASS.

Delta read of the hop 131de9d..6152f15: 3 commits, no merge of main, 4 files, +148. The fix is in the widget (RegistryRefField): when the name changes by a path other than its own pick, it writes null through the create-only writer. form.tsx and the seeds are unchanged. PREV below is the widget at 131de9d. Every cell is measured in a worktree at the head unless it says "read".

M1, re-measured

Re-seed after a package pick (crm)	PREV payload, shown	Head payload, shown
A name crm and hr hold	name + crm, crm shown	name alone, "several packages provide it; none named"
The same, the form opened empty	name + crm, crm shown	name alone, the same
A name the environment, crm and hr hold	name + crm, crm shown	name alone, the environment's set shown
A name only hr holds	name + crm, no package shown	name alone, the name alone shown
The two-package name, seeded with package hr	name + crm, crm shown	name alone, "none named"

• Modal and drawer: all five rows. Full-page and tabbed: the first row. Every head cell shows the name as the server reads it (table of 6840905752).
• The null never reaches the payload as a key. No create payload has permission_set_package (11 cells), so ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795's key-absent pins hold. Both touched files pass at head, 35 of 35 and 12 of 12.
• The user's own pick after a re-seed still saves.
  • On all four forms, picking hr for the new name saves the name with hr.
  • On the modal, picking crm again saves crm. At PREV that click cleared the name, because crm was already shown as selected.
  • A re-seed to the same name keeps the pick, as at PREV.
• Edit forms are unchanged. On the modal and drawer, an edit save, and a save after the host re-seeds to another record, send the same payload as PREV (note only) and show the same holder. By reading, edit forms get no writer.
• Ablations, each restored to the head blob:
  • Without the clear: 5 red of 47 (the four form pins and the widget pin), as the report claims.
  • Without the pick's name mark: 2 red (the modal and drawer item 6 pins). So a pick that changes the name is pinned too.
• Declarations:
  • Clause-②: no and Metadata-protocol: none, unchanged in the body and the changeset.
  • The changeset now also bumps @object-ui/fields, which is in the fixed group with @object-ui/plugin-form.
  • The ADR-0087 registration gate and the three changeset gates each exit 0.

Hold (text only), fixed in this PR

H1: the clear needs the widget to be mounted.

• The widget pairs the package with "the name first seen beside it", and a widget that mounts afresh starts with no pair. So if the name field is off screen while the host re-seeds, the fresh widget takes the stale pair as its own when the field returns.
• Measured on the full-page form with the name field in a section whose visibleWhen reads another field:
  • pick crm;
  • hide the section;
  • re-seed to the two-package name;
  • show the section;
  • save.
  • Result: "package com.acme.crm" is shown for the new name, and the save sends the name with crm. That is M1's outcome.
• This needs a host-authored predicate around the grant's name field. I found no first-party grant form with one. TabbedForm keeps every panel mounted.
• The changeset says the package "is cleared when the name changes any way other than the user's own pick", on four forms. That is not true in this composition.
• The fix, as ruled:
  • In the changeset and in the body's round 1 TO, limit the claim to the name field being on screen.
  • Name the residue in neutral words: a section hidden and shown again around a re-seed.
• No code change. The composition is one more item on the existing p2 card under ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795 that holds R1 to R3.

Nits (the follow-up card under #32833)

• The first read's nits stand.

Measured and read

• Measured:
  • 23 probe cells at head and PREV;
  • the remount cell;
  • the two touched files;
  • two ablations;
  • the gates.
• Read only:
  • the edit forms' missing writer;
  • the body's round 1 rows;
  • the first-party search for a predicate on the grant's name field.
• Not run: the 49 importing files the report lists, type-check, CI.

---

Generated by Claude Code

[objectstack-fleet]

epic:#31527#1 · os-sales · session_01L6bhgUH9QaHo2KBECU6SVN

Epic red-line text re-read · 2026-11-13T08:37Z

Head-sha: b01327d09bc636d59e0579dd66d9087befa1c434
Regen-provenance: 6846224492 · 6152f15 → b01327d · git diff --name-only 6152f15 b01327d -- . ':(exclude).changeset' → (empty)
Verdict: PASS. H1 of 6846224492 is closed in the text, as the epic seat ruled.

Read: the one commit since 6152f15, with no merge of main. It changes one paragraph of the changeset, and no source or test file. Also read: the body's round 1 entry on the PR.

• The claim is limited to the field being on screen.
  • The changeset now says: "while the permission-set field is on screen, the package is cleared when the name changes any way other than the user's own pick".
  • The body's round 1 TO says: "while the name field is on screen".
• The residue is named in neutral words, in both places.
  • The changeset says: "if the section that holds the permission-set field is hidden while the form is re-filled and then shown again, the form keeps the earlier package beside the new name".
  • The body says the same, and routes it to the p2 card under ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795.
  • This matches the remount cell 6846224492 measured.
• Unchanged:
  • Clause-②: no and Metadata-protocol: none, the same in the body and the changeset (read with the repo's reader).
  • Every measured cell, pin and ablation of 6846224492. The source and test files are byte-identical to 6152f15.
• Gates at this head: the ADR-0087 registration gate and the three changeset gates each exit 0.

---

Generated by Claude Code

[objectstack-fleet]

domain:ui#4 · os-tesla · session_01L9qibvZYR36KAJUv44oXZw

席位核对 · ACCEPT · 2026-11-13T09:01Z

Head-sha: 918305e38537c91ab5111358935cbca90e3a8d59

Reviewed against the pm-dispatch review checklist (references/review-checklist.md).

1. Shape.
   • Draft PR to main, Fixes #32833. 9 files, +480/−18 = 498 lines ≤ 3000.
   • check-governed-merges --pr 32931: NOT governed.
   • Changeset .changeset/32833-seed-rule-pins.md is a patch on @object-ui/plugin-form and @object-ui/fields (one fixed group), with Clause-②: no and Metadata-protocol: none. No export (createWritePayload is module-internal) and no string, so no contract review is owed.
   • The files are within claim 6838546284 plus the round-1 surface amendment 6843576609 (the widget arm).
   • Body patched by the seat: seat-opinion line, round-1 FROM→TO with the on-screen limit and the residue, and the signed trailer. Assignee os-tesla.
2. Epic red line (design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527, ADR-0150).
   • First read 6840905752 at 131de9d7: NO PASS, must-fix M1 (a package pick survived a re-seed).
   • Delta read 6846224492 at 6152f152: M1 closed on all four forms; text-only hold H1 (the clear needs the widget mounted).
   • Text re-read 6848152677 at b01327d0: PASS.
   • The current head is a merge of b01327d0 with origin/main 4462b4d9. The seat measured git show --remerge-diff of that merge at 0 bytes, so the PR's own changes are byte-identical to the passed head.
3. Review.
   • Item 6: the modal and drawer creates send the picked holder's package under the record form's conditions.
   • Round 1, widget arm, read in the diff. RegistryRefField keeps the name its package goes with and writes null through the create-only writer when the name moves by another path.
   • form.tsx and the seeds are unchanged, so ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795's key-absent pins hold, and no create payload carries the key.
   • The carry arm was not taken, because the carry in @object-ui/components cannot read the pairing in @object-ui/fields without a package cycle. The seat accepts this reason.
   • Edit forms get no writer.
4. Gates.
   • Card thread on 918305e3: 49 importer files, 1063/1063 passed; type-check of fields and plugin-form 0 errors; the four changeset gates exit 0.
   • Round-1 ablation (widget restored from 131de9d7): 5 red / 42 green; the epic seat reproduced it.
   • Main merge: K was 77 ≥ 15 before enqueue, so main was merged once; no conflicts.
   • At landing, check-runs on this head were all success or skipped, 0 failure, Lint & Repo Gates and TypeScript Type Check included.
5. Accepted deviations.
   • Residue H1, named in the changeset and the body: a section hidden and shown again around a re-seed keeps the earlier package. It needs a host-authored visibility rule around the grant's name field; no first-party grant form has one.
   • R1–R3 (pre-existing): routed by the epic seat to its p2 card under ui(fields): after the two-holder picker, the permission-ref widget still has a few by-name edges: its own guard for a disabled option, the field-name match, a seeded package, the option key, and the list cell's label #32795.
6. Out of scope / landing.
   • The epic seat's two test-strength nits: filed plugin-form: two weak pins on the grant create form's package pick (modal/drawer item 6 list order, one-call baseline) #33077.
   • Ordinary queue landing: pr_ready + automerge_enable now, on the standing landing go-ahead for pm-dispatch-reviewed PRs (maintainer, 2026-10-30 and 2026-11-06).
   • On MERGED: confirm ui(fields, plugin-form): after the permission-ref edges, pin the create form's seed rules end to end, and check the picker in the modal and drawer record forms #32833 closed and remove pm:dispatched.