@@ -0,0 +1,10 @@
+---
+'@objectstack/spec': patch
+'@objectstack/metadata-core': patch
+'@objectstack/lint': patch
+---
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+`@objectstack/spec/ui` now exports `anonymousFormObjectName`, the object an open anonymous form candidate submits into (the form's `data.object`, else the view's `list.data.object`, `form.data.object`, `object`). `@objectstack/metadata-core` re-exports the same function, and the public-form file-field lint rule in `@objectstack/lint` resolves the object through it instead of a retyped copy, so the doors and the lint cannot disagree.
@@ -7,6 +7,8 @@
 // `view` write (`runRuntimeAuthoringRules`, the function the metadata write
 // path calls) resolving the field's type against its `objects` context.
 
+import { readFileSync } from 'node:fs';
+
 import { describe, expect, it } from 'vitest';
 
 import { FILE_REFERENCE_TYPES } from '@objectstack/spec/data';
@@ -163,3 +165,13 @@ describe('the runtime publish gate on a view write', () => {
     expect(errors.filter((e) => e.rule === PUBLIC_FORM_FILE_FIELD)).toEqual([]);
   });
 });
+
+describe('the object a candidate submits into is the doors\' own function', () => {
+  const source = readFileSync(new URL('./validate-public-form-file-fields.ts', import.meta.url), 'utf8');
+
+  it('imports anonymousFormObjectName from @objectstack/spec/ui and keeps no retyped rung order', () => {
+    expect(source).toMatch(/anonymousFormObjectName,[\s\S]*?\} from '@objectstack\/spec\/ui'/);
+    expect(source).not.toContain('candidateObjectName');
+    expect(source).not.toContain('viewObjectName');
+  });
+});
@@ -42,11 +42,14 @@
  */
 
 import { FILE_REFERENCE_TYPES } from '@objectstack/spec/data';
-import { anonymousFormIntakeCandidates, type AnonymousFormIntakeCandidate } from '@objectstack/spec/ui';
+import {
+  anonymousFormIntakeCandidates,
+  anonymousFormObjectName,
+  type AnonymousFormIntakeCandidate,
+} from '@objectstack/spec/ui';
 
 import { collectionEntries } from './collection-entries.js';
 import { recordsOf } from './object-graph.js';
-import { viewObjectName } from './view-walk.js';
 
 export const PUBLIC_FORM_FILE_FIELD = 'public-form-file-field';
 
@@ -98,21 +101,6 @@ function candidateSlot(view: AnyRec, candidate: AnonymousFormIntakeCandidate): s
   return 'config';
 }
 
-/**
- * The object an open candidate submits into, in the order the anonymous doors
- * resolve it (`anonymousFormObjectName`, `@objectstack/metadata-core`): the
- * form's own binding, then the view's list block, its default form, and the
- * view itself.
- */
-function candidateObjectName(view: AnyRec, form: AnyRec): string | undefined {
-  return (
-    viewObjectName(form) ??
-    (isRec(view.list) ? viewObjectName(view.list) : undefined) ??
-    (isRec(view.form) ? viewObjectName(view.form) : undefined) ??
-    viewObjectName(view)
-  );
-}
-
 /** A section field entry is a bare field name or `{ field, … }`. */
 function fieldNameOf(entry: unknown): string | undefined {
   if (typeof entry === 'string') return strName(entry);
@@ -127,7 +115,7 @@ export function validatePublicFormFileFields(stack: AnyRec): PublicFormFileField
   for (const { rec: view, path: viewPath } of collectionEntries(stack.views, 'views')) {
     const viewName = strName(view.name) ?? strName(view.object) ?? viewPath;
     for (const candidate of anonymousFormIntakeCandidates(view)) {
-      const objectName = candidateObjectName(view, candidate.form);
+      const objectName = anonymousFormObjectName(view, candidate.form);
       const types = objectName ? fieldTypes.get(objectName) : undefined;
       if (!types) continue;
       const slot = candidateSlot(view, candidate);
 
@@ -322,12 +322,13 @@ describe('anonymousFormIntakeWithdrawnIn — an explicit withdrawal of the same
 // The candidates half is declared in `@objectstack/spec/ui` and re-exported by
 // this package. "One copy" is checkable only as IDENTITY: a wrapper or a copy
 // answers the same today and drifts tomorrow, while the same binding cannot.
-describe('the candidates half is the spec binding itself, re-exported (one copy, not a copy)', () => {
+describe('the candidates and object-name halves are the spec bindings themselves, re-exported (one copy, not a copy)', () => {
     const NAMES = [
         'publicFormSlug',
         'anonymousFormIntakeSlug',
         'anonymousFormIntakeCandidates',
         'anonymousFormIntakeSlugs',
+        'anonymousFormObjectName',
     ] as const;
 
     it.each(NAMES)('%s: this module and the package barrel export the @objectstack/spec/ui function', (name) => {
 
@@ -14,7 +14,9 @@
  * `allowAnonymous === true` and a non-empty `publicLink` naming the slug) and
  * the three shapes a view carries a form in — is declared in
  * `@objectstack/spec/ui` (`anonymous-form-intake.ts`, beside the
- * `SharingConfigSchema` it reads), whose docblock is the authority on it. This
+ * `SharingConfigSchema` it reads), whose docblock is the authority on it. So is
+ * the object-name half, `anonymousFormObjectName` (the object a candidate
+ * submits into), which the authoring lint reads as well. This
  * module re-exports those bindings unchanged, so a console that imports them
  * from the spec reads the same rule the doors serve. Clearing either switch
  * withdraws the form from every anonymous door.
@@ -44,7 +46,8 @@ import { applyInjectedSystemColumns } from './injected-system-columns.js';
 import { resolveRecordWallOrganizationField } from './record-organization.js';
 
 // The candidates half of the rule — which form candidates a `view` body opens
-// to anonymous intake — lives in `@objectstack/spec/ui` beside the
+// to anonymous intake — and the object-name half (`anonymousFormObjectName`,
+// the object a candidate submits into) live in `@objectstack/spec/ui` beside the
 // `SharingConfigSchema` it reads, so a console can import the same rule the
 // doors serve. Re-exported here as the SAME bindings (never a wrapper or a
 // copy), so every server caller keeps importing it from this package and the
@@ -53,17 +56,11 @@ export {
     anonymousFormIntakeCandidates,
     anonymousFormIntakeSlug,
     anonymousFormIntakeSlugs,
+    anonymousFormObjectName,
     publicFormSlug,
 } from '@objectstack/spec/ui';
 export type { AnonymousFormIntakeCandidate } from '@objectstack/spec/ui';
 
-/** The object an open form candidate submits into: the form's own `data.object`, else the view's. */
-export function anonymousFormObjectName(view: unknown, form: unknown): string | undefined {
-    const v = (view && typeof view === 'object' ? view : {}) as Record<string, any>;
-    const f = (form && typeof form === 'object' ? form : {}) as Record<string, any>;
-    return f.data?.object ?? v.list?.data?.object ?? v.form?.data?.object ?? v.object;
-}
-
 /**
  * Where a candidate's `sharing` sits in the `view` body — `form.sharing`,
  * `formViews.KEY.sharing` or `config.sharing`. Item-relative: the admin read
 
@@ -507,6 +507,7 @@
     "anonymousFormIntakeCandidates (function)",
     "anonymousFormIntakeSlug (function)",
     "anonymousFormIntakeSlugs (function)",
+    "anonymousFormObjectName (function)",
     "appForm (const)",
     "bulkConfirmTemplateRoots (function)",
     "chartAggregateCategoryKey (function)",
 
@@ -491,6 +491,7 @@
     "anonymousFormIntakeCandidates": "src/ui/anonymous-form-intake.ts#anonymousFormIntakeCandidates (function)",
     "anonymousFormIntakeSlug": "src/ui/anonymous-form-intake.ts#anonymousFormIntakeSlug (function)",
     "anonymousFormIntakeSlugs": "src/ui/anonymous-form-intake.ts#anonymousFormIntakeSlugs (function)",
+    "anonymousFormObjectName": "src/ui/anonymous-form-intake.ts#anonymousFormObjectName (function)",
     "appForm": "src/ui/app.form.ts#appForm (const)",
     "bulkConfirmTemplateRoots": "src/ui/bulk-action.zod.ts#bulkConfirmTemplateRoots (function)",
     "chartAggregateCategoryKey": "src/ui/chart-aggregate.ts#chartAggregateCategoryKey (function)",
 
@@ -44,12 +44,10 @@
  * (`anonymousFormIntakeWithdrawnIn`, a kill switch that layering may only
  * narrow, never re-open), and whether the deployment's tenancy posture lets an
  * open form take an anonymous submission (`anonymousFormIntakeUnavailability`).
- * Kept beside them is the object a candidate submits into
- * (`anonymousFormObjectName`): a pure read of the form's `data.object` and the
- * view's `list.data.object`, `form.data.object` and `object`, which reads no
- * server state and stays there because that is where this export's surface
- * was drawn. An open candidate here is therefore what the view body itself
- * declares, before any other layer or the posture is consulted.
+ * An open candidate here is what the view body itself declares, before any
+ * other layer or the posture is consulted. The object a candidate submits into
+ * (`anonymousFormObjectName`) reads no server state, so it is declared here
+ * too, and `@objectstack/metadata-core` re-exports it.
  *
  * Pure functions with no imports and no module-load work: this module links no
  * schema, so a browser bundle that reaches it pays for these functions alone.
@@ -80,6 +78,17 @@ export function anonymousFormIntakeSlug(sharing: unknown): string | null {
   return publicFormSlug(s.publicLink);
 }
 
+/**
+ * The object an open form candidate submits into: the form's own `data.object`,
+ * else the view's `list.data.object`, `form.data.object` and `object`. The one
+ * rung order both anonymous doors and the authoring lint resolve by.
+ */
+export function anonymousFormObjectName(view: unknown, form: unknown): string | undefined {
+  const v = (view && typeof view === 'object' ? view : {}) as Record<string, any>;
+  const f = (form && typeof form === 'object' ? form : {}) as Record<string, any>;
+  return f.data?.object ?? v.list?.data?.object ?? v.form?.data?.object ?? v.object;
+}
+
 /** Every form candidate of a `view` body that is open to anonymous intake, in scan order. */
 export function anonymousFormIntakeCandidates(view: unknown): AnonymousFormIntakeCandidate[] {
   if (!view || typeof view !== 'object') return [];