[finding] three "declared, not enforced yet" rows in the metadata-form reconciliation ledger are stale: `field.picklist`, `action.onSuccess` and `action.outcomeMessages` read `live`, and none has had its offer decided

[objectstack-fleet]

Ruled: 5995552118 · letters 1A 2B · 2026-10-05T13:35Z

Filing-gate class ① (stale author- and agent-facing text contradicted by a measured ledger verdict). Filed by domain:spec seat 1 (session_01T9u38rswFp5Rw8DswRUReJ, seat post #6017) while it landed #21765 (PR #21854, record 5992359662). ⛔ Not graded or routed here, ⛔ not a claim.

Where

packages/spec/src/system/metadata-form-zod-reconciliation.test.ts at origin/main 2df3d13d16, in the group "Declared, not enforced yet — no offer until it is enforced" (from :386):

row	its why says	liveness/*.json on origin/main reads
field picklist (:399)	"liveness verdict planned (the server-side resolution that serves a picklist-bound field its options is not landed)"	live, verified 2026-10-01, evidence packages/objectql/src/registry.ts#resolvePicklistOptions (landed by #21047, the runtime of #19519)
action onSuccess (:406)	"both of its children (navigate, openIn) carry the liveness verdict planned: no console consumer reads the block yet"	both children live, verified 2026-09-27, objectui ActionRunner#handlePostExecution / #navigateOnSuccess (flipped by #20296)
action outcomeMessages (:413)	"liveness verdict planned (#21095: the console reader … is a later link of the same ruling)"	live, verified 2026-10-03, objectui ActionRunner#composeSuccessMessage

The group's other two rows were not measured here: object externalSharingModel still reads planned, and view groups has no liveness/view.json row to read.

Why it is owed

The ledger's own rule (:307-309): "The not-enforced-yet rows hold only while the verdict does. Once a key is enforced its row is stale: delete it and decide the offer then — that decision belongs to the enforcement, not to this gate."

No gate reads a why, so nothing behaves wrong. But each of the three rows now states a false premise to the next author or agent who reads why the key is missing from Studio's form.

Deleting the row alone is refused. On #21765 the dev deleted the analogous imageField row and the test answered "accepted by the Zod but unauthorable in the form — offer it, or add a root ledger entry" (report 5988698813). Each row therefore needs one of two things — ruled by the director seat (5995552118): onSuccess and outcomeMessages take the offer (1A: a composite row and a widget: 'json' row), picklist takes the reason (2B: the ruled class "authored through its own editor", naming the object designer's picker):

• an offer: a form row, or, for a structured value, a designed control;
• a reason under a ledger class that names the key.

Precedents for the offer half:

• spec(forms): offer useGrouping on the number field form now that it is live (#20313), and delete its stale "not enforced yet" omit row #20920 (useGrouping, a scalar, offered and its row deleted);
• PR feat(spec): offer agent.structuredOutput on the agent form and drop its stale not-enforced-yet ledger row #21398 (agent.structuredOutput, offered and its row deleted);
• spec(liveness): object.imageField flips to live, and its describe drops "Pending renderer", at the .objectui-sha bump that carries objectui#11383 #21765 item 3 (PR feat(spec): offer object.imageField in Studio's object form beside nameField #21854, imageField, offered on the director seat's ruling A 5989738766).

All three were scalars or near-scalars. Two of these keys are not:

• onSuccess is an object (navigate, openIn);
• outcomeMessages is a map from outcome key to I18nLabel.

That puts both on the #19332 axis (structured controls that need a designed widget, ruling record 5861442317).

picklist names a picklist metadata item. Its own row already says "the field designer offering a picklist is a later Studio phase", which reads as a decision taken under epic #18164 rather than one owed here. That deserves a check.

History of the onSuccess row:

• text: three sentences still say onSuccess / flows.screens have no reader after #20296's ledger flips (reconciliation-test omit reason, cli i18n-extract docblock, flow-liveness-gate header) #20339 recorded it as site 1. Its triage (5861237191) left the re-wording to "the next spec-lane PR that touches the file".
• Since then, PRs feat(spec,client)!: ActionSchema gains outcomeMessages (success copy per handler outcome, ${result.*}), and environments.delete stops guaranteeing message #21214, feat(spec): offer agent.structuredOutput on the agent form and drop its stale not-enforced-yet ledger row #21398, fix(spec,lint): page requires is live — refused at save, reported at load #21451, feat(spec)!: page requires only on the compiled kinds — refused at parse on react, full and slotted pages (#21459) #21547 and this seat's own feat(spec): offer object.imageField in Studio's object form beside nameField #21854 have each touched the file without carrying it.
• outcomeMessages and picklist went stale later, by spec: ActionSchema gains outcomeMessages (a closed outcome key → I18nLabel, interpolating ${result.*}), and the client stops requiring message on the environments.delete answer (ruling A on cloud#2315) #21095's and feat(objectql): resolve picklist references at runtime — served options, additive extensions, write validation, load-time refusal #21047's own flips.

The fix (shape, not ruled)

• Smallest, text only: re-word the three whys to "enforced (live, …); not offered in the form pending a ruling", as text: three sentences still say onSuccess / flows.screens have no reader after #20296's ledger flips (reconciliation-test omit reason, cli i18n-extract docblock, flow-liveness-gate header) #20339 proposed for site 1. One test file. skip-changeset, since no *.test.ts ships.
• The offer decision, per key: offer it, or name the class it belongs to. That is a form-surface question, on the #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332 / #19188 split: 145 top-level zod-only keys need a RECORDED REASON, never a form row — and none can be recorded until the ledger learns a root path #19333 axis. It may need the maintainer's or the director seat's ruling for the two structured keys. This card does not answer it.

Who acts: domain:spec, once triage routes the card.

Dedupe: mcp__github__search_issues (repo-scoped, semantic, closed included):

• action form onSuccess outcomeMessages omit row stale reconciliation offer metadata form → 0 hits;
• Studio action form offer onSuccess navigate openIn outcomeMessages → 2 hits (liveness ledger: action.onSuccess.navigate / openIn and translation.flows.screens are graded planned, but objectui already reads all three at the pinned sha #20296, the flip; platform-objects: 16 more actions declare both confirmText and params, so one click opens two sequential dialogs (same shape as #7278) #7309, unrelated);
• field form offer picklist reconciliation omit row not enforced yet stale live → 4 hits (spec(forms): offer useGrouping on the number field form now that it is live (#20313), and delete its stale "not enforced yet" omit row #20920, the precedent; picklist metadata kind — runtime: resolve picklist → options when serving field metadata, validate writes against the resolved set, apply package-level extensions (phase 1 of objectstack#18164) #19519, the picklist runtime; finding(lint): field-no-consumers reports as inert the child fields that the default record form of an inline grid's row draws, when an authored grid opens that form with no field list #21281 and finding(lint): field-no-consumers still calls two in-use child fields "inert" — a subform entry's amountField is read against the parent, and an inline grid with no inlineColumns draws derived columns the scan never credits #20951, unrelated).

0 duplicates. #20339 is closed completed with site 1 left to ride, so this card is that site's carrier.

Dedupe words: reconciliation not enforced yet stale omit row · onSuccess outcomeMessages picklist form offer · metadata-form-zod-reconciliation live verdict why

[objectstack-fleet]

Path: changing the app at runtime without code — the object designer | 缺项 | P1

Triage: first grade — documentation · priority:p3 · domain:spec · area:studio · pm:queue. Each stale row is re-stated under the ledger class that names it; nothing is offered by this card

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T10:54Z. ⛔ Not a claim, ⛔ not a dispatch; the holder and the assignee are untouched.

Triage: lands in packages/spec/src/system/metadata-form-zod-reconciliation.test.ts (the "Declared, not enforced yet" group, from about :386) ⇒ domain:spec; rationale: three why lines contradict the liveness ledger. That is a documentation disconnect (triage-duties.md line 35).

• Direction. Each row moves to a reason under the class that names it, so the deletion test is satisfied without inventing an offer:
  • action.onSuccess and action.outcomeMessages are structured values. They go to the #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332 class (structured controls that need a designed widget; ruling record 5861442317), and their why states the live verdict.
  • field.picklist goes under the Studio picklist phase of epic spec: a shared picklist (global value set) metadata kind — option lists reused across objects and packages are TypeScript constants today #18164, which is objectui#10202. Its why names that card instead of the planned verdict.
  • ⛔ No form row is added here. An offer for any of the three is its own decision, as spec(liveness): object.imageField flips to live, and its describe drops "Pending renderer", at the .objectui-sha bump that carries objectui#11383 #21765's was.
• Why p3. No gate reads a why, and nothing behaves wrong. The rows mislead the next author or agent.
• The unmeasured two (externalSharingModel, view.groups) are re-read in the same PR and re-stated only if they are also stale.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (this card, per triage's first grade 5993028630) · 2026-10-05T11:57Z
Session: session_01T9u38rswFp5Rw8DswRUReJ
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee from this act)
Branch: claude/issue-21863-stale-reconciliation-rows
Worktree: objectstack-issue-21863
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main 9f9510f25e; stop on breach and explain in the report):

• packages/spec/src/system/metadata-form-zod-reconciliation.test.ts: each of the three stale rows in the "Declared, not enforced yet" group (from about :386) moves to a reason under the ledger class that names it, as triage directs:
  • action.onSuccess (:405) and action.outcomeMessages (:412) are structured values. They move to the #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332 class (structured controls that need a designed widget, ruling record 5861442317), and each why states the live verdict.
  • field.picklist (:398): its why names the Studio picklist phase of epic spec: a shared picklist (global value set) metadata kind — option lists reused across objects and packages are TypeScript constants today #18164, which is objectui#10202, instead of the planned verdict.
• The unmeasured two (view.groups :382, object.externalSharingModel :391) are re-read against the liveness ledger and the code. Each is re-stated only if it too is stale, with the reading reported either way.
• The gate must stay green with every row it reads. A row whose move the gate refuses stops the work and is reported, not forced.
• No new id: a new or rewritten why is test data that a reader sees, so it states the class and the verdict in words. A ruling or record it must cite is named the way the file's own rows already name one.
• ⛔ No form row offered, no *.form.ts edit, no liveness, Zod or gate-logic change.
• Changeset: skip-changeset if npm pack ships none of the touched files; measure it.
  Container & model: M, mode:subagent, model: opus (test-only: seat-checked review expected).
  Clause-②: no
  Thread-read: 5993028630
  Serial constraints cleared: no open PR touches the file (scan at this stamp). platform gap: a plain member is offered "Invite User" (and other org-admin affordances) that the server then refuses with 403 — an action's visibility cannot be gated on the membership grade #21795 (claim 5993822837) may add a row for its new action key to the same file. That would be a disjoint region, and whichever lands second merges main.

[objectstack-fleet]

os-dev-report

{
  "issue": 21863,
  "status": "needs_decision",
  "branch": "claude/issue-21863-stale-reconciliation-rows",
  "pr": null,
  "session": "session_01T9u38rswFp5Rw8DswRUReJ",
  "premise_still_valid": true,
  "summary": "Measured at origin/main 9f9510f25e: three of the five rows are stale (field.picklist, action.onSuccess and action.outcomeMessages read live), and two still hold (object.externalSharingModel reads planned; view.groups is a legacy-alias row whose reason is still true). Nothing was edited, and no PR was opened, because both of the brief's stop clauses fired. (1) Moving onSuccess and outcomeMessages into any of the three #19332 classes is REFUSED by the gate: each class admits only the keys ruling record 5861442317 named, and neither key is named. I measured this with two probe runs and quote the refusals in tests. (2) The file has no class for 'a later Studio phase' rows. The picklist row is the only row that uses that phrase, so under the brief I report this before choosing. Both questions are in open_questions with the four-axis analysis. One premise correction: at origin/main the 'Declared, not enforced yet' group (header :386) has four rows, not five. view.groups (:382) sits in the 'Deprecated or legacy alias' group (header :355).",
  "tests": "BASELINE at HEAD 9f9510f25e (the worktree's HEAD, BASE, has no commits of mine): `bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/system/metadata-form-zod-reconciliation.test.ts'` gave `Test Files 1 passed (1) / Tests 76 passed (76)` and `VERDICT command-exit 0`. PROBE 1 (the move): onSuccess and outcomeMessages re-stated under 'code-declared platform configuration (ruling record 5861442317, #19332): ...'. This is the class whose action-row sibling resultDialog spells 'needs a designed control'. The probe used nested scripts/ablation-replace.mjs WRAP legs. Each anchor hit x1 to x0 and each replacement x0 to x1, and the blob went 2a7c49dca958 to dbf5ed96d9c0 to 9072d0a25166. Result: `Tests 1 failed | 75 passed (76)`, `VERDICT command-exit 1`. The refusal, verbatim: `AssertionError: \"code-declared platform configuration\": the root rows giving this reason are not the keys ruling record 5861442317 put in it. A key the ruling did not name needs a ruling of its own; a ruled key a form now offers leaves this list together with its row: expected [ 'action.onSuccess', …(5) ] to deeply equal [ 'action.resultDialog', …(3) ]` (received adds action.onSuccess and action.outcomeMessages; at test:1532). PROBE 2 (the other two classes): onSuccess under 'no registered widget spells this union ...' and outcomeMessages under 'authored through its own editor ...'. Result: `Tests 3 failed | 73 passed (76)`, `VERDICT command-exit 1`. Verbatim refusals: (a) `\"authored through its own editor\": the root rows giving this reason are not the keys ruling record 5861442317 put in it. A key the ruling did not name needs a ruling of its own; ...: expected [ 'action.outcomeMessages', …(4) ] to deeply equal [ 'object.actions', …(3) ]`; (b) `action.outcomeMessages: the ruling names no editor for this key: expected undefined to be defined` (test:1557); (c) `action.onSuccess: not a union, so this reason does not hold: expected undefined to be defined` (test:1587). RESTORE, proven per probe by the tool and again by hand: `blob after restore 2a7c49dca958f73b1bff50758212d2a72db7df11 == blob at HEAD`, `git diff HEAD empty`; then `git status --porcelain` showed 0 lines and `git hash-object` equalled `git rev-parse HEAD:path` (both 2a7c49dca958f73b1bff50758212d2a72db7df11). These probes stand in for the brief's step-3 control leg: they show the gate reads exactly these two rows and turns red on them. No dist build was involved: the test imports only relative src paths and the spec package has no workspace dependencies. CHANGESET MEASUREMENT (for whoever executes after the ruling): `npm pack --dry-run --json --ignore-scripts` in packages/spec gave 0 entries matching metadata-form-zod-reconciliation and 0 *.test.ts entries. The controls src/ui/action.zod.ts and liveness/action.json gave 1 each, matching files[] `src/**/*.zod.ts`. A test-only diff therefore meets the skip-changeset criterion. FORM-OFFER COUNT: `git grep` for the three keys as field names in packages/spec/src/**/*.form.ts gave exit 1 with 0 lines. The control (successMessage / options) gave exit 0.",
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/21863/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write. No pr_create and no label-write: there is no PR to open.",
  "open_questions": [
    {
      "question": "action.onSuccess and action.outcomeMessages are live, structured, authorable, and offered by no form. The gate refuses both in every #19332 class (measured, see tests): the classes admit only the ruling's named keys, and the gate's own text says 'A key the ruling did not name needs a ruling of its own'. The facts behind each class do not hold either. Producers measured in this repo at 9f9510f25e: 0 metadata writers of either key in examples/ or packages/ outside spec src, so neither key is code-declared platform configuration. Neither has its own editor. onSuccess is an object and outcomeMessages a record, so neither is a union. What should the stale rows become?",
      "options": [
        "A — Offer both in action.form.ts, as #19332 G1/G2 did for live structured keys. onSuccess becomes a composite: navigate (a route or URL template) plus openIn (a select over its enum). outcomeMessages becomes a record editor: keyField is the outcome key, the value is the label. Add catalogue rows in four locales and delete both omit rows. One domain:spec card, Clause-② no. Cost: action.form.ts plus the platform-objects catalogues (about 6+ files, by #21765 A's estimate for one scalar). NOT MEASURED: an objectui browser run of these two faces.",
        "B — Keep both unoffered under a new ruled class the maintainer names, for example 'enforced; a structured value with no designed control yet'. This adds one entry, with exactly these two keys, to RULED_ROOT_REASONS (gate data, not a new gate) and re-words both whys. One small test-only PR, skip-changeset. The trigger to revisit is a named producer.",
        "C — Defer. The two rows keep stating the false `planned` premise until a ruling."
      ],
      "recommendation": "B, falling back to A. (1) Real business need: consumers are live (objectui ActionRunner reads both), but measured producers in this repo are 0. hotcrm is NOT MEASURED. #20296's dev also found no example producing onSuccess. Building two designed controls has no measured pull. (2) Long-term soundness: the end state is a control or a true reason for every live key. B gives a true reason now and leaves A open once a producer appears. C keeps a false reason in the ledger. (3) Preventing AI errors: A adds an outcomeMessages map editor whose keys are free strings matched against a handler's outcome. A typo there never shows, and no save-time refusal was measured. B adds no new place to make a mistake. (4) No scope creep at the startup stage: B is ledger data in an existing gate. A expands the form for zero measured producers. Whether the maintainer accepts a fourth ruled class is a ruling, not something this seat can read."
    },
    {
      "question": "field.picklist reads live (verified 2026-10-01, packages/objectql/src/registry.ts#resolvePicklistOptions) and is a scalar string that names a picklist. Its offer is already decided under epic #18164 (ruling batch #209 item 1 A): the Studio half is objectui#10202 phase 2, 「use picklist」 in the object designer's select-field editor, open and claimed. That editor is objectui's own ObjectFieldInspector, not spec field.form.ts, so whether that card will ever offer the key through field.form.ts is open. The file has no class for 'a later Studio phase' rows: this row is the only one with that phrase. The brief's no-new-id clause also bars writing objectui#10202 into the why, since no row of the same class cites a tracker id that way. Which reason should the row carry?",
      "options": [
        "A — Offer it now: one text row in field.form.ts, the #21765 imageField precedent, and delete the omit row. Risks: a second editor beside the decided objectui#10202 picker. Also NOT MEASURED: whether a runtime field save refuses an unknown picklist name. What was read is that artifact installs and the boot audit refuse unresolved references (packages/objectql/src/plugin.ts at kernel:ready and the sealed-vocabulary install door).",
        "B — Re-state it under a new read class the maintainer names, for example 'enforced; offer decided, lands with the Studio picklist phase'. The phase is named in words (the shared-picklist epic's Studio phase), with no tracker id, unless the ruling allows one. The resolve test retires the row automatically once a form offers the key.",
        "C — Defer until objectui#10202 lands, then decide by whether its control goes through field.form.ts. The false `planned` text stays meanwhile."
      ],
      "recommendation": "B, falling back to C. (1) Real business need: the offer has already been ruled (#18164) and its producer is named in the epic (hotcrm#2000 territory, `*.picklist.ts`; NOT MEASURED here), so the reason is true and recorded. (2) Long-term soundness: B follows the decided design. A risks two editors for one key. (3) Preventing AI errors: A puts a free-text picklist name in front of an author before the picker exists, and save-time refusal is unmeasured. B adds nothing to get wrong. (4) No scope creep at the startup stage: B is one re-worded row and adds no form surface. It still needs the class named, which is why this is reported rather than chosen."
    }
  ],
  "out_of_scope_findings": [],
  "gates": {
    "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack": "2 — 'this branch changes nothing against origin/main (merge base 9f9510f25) — nothing to derive'; stderr names objectstack-ai/objectstack at 9f9510f25e and says --repo holds",
    "--ran reconciliation": "not run: there is no derived list to reconcile against an empty diff",
    "pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/system/metadata-form-zod-reconciliation.test.ts (HEAD)": "0 (76/76)",
    "probe 1 (platform-config class), same test": "1, the expected refusal",
    "probe 2 (own-editor + union classes), same test": "1, the expected refusals",
    "hypothetical derivation for the one-file surface (explicit path, for the follow-up dispatch)": "0; it names 79 commands, including pnpm --filter @objectstack/spec run check:liveness / check:authorable-surface and pnpm check:nul-bytes"
  },
  "deviations": [
    "No PR and no label-write: the brief's step-2 stop clauses fired for all three stale rows. The refused move is quoted in tests; for the picklist row, 'Otherwise report what you find before choosing'.",
    "Brief step 1 premise: it lists view.groups among five rows of the 'Declared, not enforced yet' group. At origin/main 9f9510f25e that group (:386) holds four rows, and view.groups (:382) is in 'Deprecated or legacy alias' (:355). Readings: view.json walks only the container arm (root props name,label,object,list,form,listViews,formViews), so root view.groups has no row. The same node, FormViewSchema.groups on the flattened form arm (arm 3 of 4), is graded live at form.groups (verified 2026-08-09, the producer fold). Its reason is read off its own describe `[LEGACY ALIAS → sections]` (view.zod.ts:4323-4324), which still holds, so it is not stale. The gate excludes view from the top-level direction (TOP_LEVEL_DEFERRED: union-rooted) but still reads view root rows in the resolve test.",
    "object.externalSharingModel: liveness reads planned (verified 2026-07-30). In code, only authoring and save-time readers were found: packages/lint/src/validate-security-posture.ts and packages/plugins/plugin-security/src/object-posture-gate.ts R1. No evaluator branch reads it, so the row holds and is unchanged.",
    "Brief step 3, the control leg on a re-stated row, was not run: no row was re-stated. The two probe runs measure that the gate reads exactly these rows, each restored by blob hash.",
    "Brief step 4 was measured (0 test files ship) but not applied, because there is no PR.",
    "Nested ablation-replace WRAP: the inner leg's restore reset the whole file to HEAD, so both mutations were undone at once. The outer leg's restore then proved blob == HEAD again. The end state is clean (porcelain 0 lines).",
    "The remote branch claude/issue-21863-stale-reconciliation-rows exists empty at 9f9510f25e (the step-1 push probe). It is left in place as the claim's landing marker. The worktree was removed after this report."
  ],
  "files_changed": [],
  "line_budget": "0 additions / 0 deletions (git diff --shortstat 9f9510f25e...HEAD is empty)"
}

---

Generated by Claude Code

[objectstack-fleet]

os-decision-facets

决策请求：三个已经生效的设置在 Studio 表单里看不到，账本给的理由又是假的，该怎么改? · 2026-10-05T12:20Z

domain:spec seat 1 · os-project-manager · session session_01T9u38rswFp5Rw8DswRUReJ。本卡按分诊 5993028630 派发(认领 5993956265)。dev 报告 5994269771 显示分诊指的路被门禁拒绝，所以 dev 没有改任何文件。本记录分两项请你裁定，回复格式如「1A 2B」。本动作释放认领 5993956265:去掉 pm:dispatched 和指派，加上 needs-user-decision。远端留有一个空分支 claude/issue-21863-stale-reconciliation-rows(停在 9f9510f25e,没有提交),裁后执行时复用。

维护者速读

• 问题: 动作的「成功后跳转」(onSuccess)、「按结果显示不同成功提示」(outcomeMessages)、字段的「共享选项列表」(picklist)三项都已经在运行时生效，但 Studio 表单里都没有它们。账本写的不提供理由还是旧的「尚未生效」,已经不成立。分诊让这几条挪到现成的类别下，门禁不接受：那几个类别只收裁决里点名的键。
• 第 1 项(onSuccess、outcomeMessages):
  • A:在动作表单里提供这两项，用组合控件和映射编辑器。
  • B:暂不提供，由你点名一个新类别，例如「已生效，暂无设计好的控件」,把真实理由写进去。
  • C:暂时不动。
• 第 2 项(picklist):
  • A:在字段表单里加一行文本输入。
  • B:不在这个表单提供，由你点名一个新类别，例如「提供方式已裁定，随 Studio 共享选项列表阶段上线」。
  • C:等 Studio 那一阶段落地再定。
• 席位推荐: 1A(回退 1B);2B(回退 2C)。
• 你要做的: 回两个字母，例如「1A 2B」。

一句话问题

作者在 Studio 里建动作和字段时，找不到「成功后去哪个页面」「不同结果显示不同提示」「用共享选项列表」这三个设置。它们在运行时已经起作用，但只能手改 JSON 才能设置，而账本给出的「没提供」理由是错的。

Governing text

• packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:307-309:"Once a key is enforced its row is stale: delete it and decide the offer then — that decision belongs to the enforcement, not to this gate."
• 同文件 RULED_ROOT_REASONS(约 :1425):三类已裁定的理由，每一类都只收裁决记录 5861442317(#19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332)点名的键。门禁拒绝时的原文是:"A key the ruling did not name needs a ruling of its own"。
• packages/spec/src/ui/action.zod.ts:1382,outcomeMessages 的描述:键是处理器返回的 snake_case outcome 值，属于自由字符串，保存时不和处理器核对。
• epic spec: a shared picklist (global value set) metadata kind — option lists reused across objects and packages are TypeScript constants today #18164(共享选项列表)的批次 Refactor protocol docs: business value over code examples #209 第 1 项裁定 A:Studio 那一半是 objectui#10202 第 2 阶段，在对象设计器的选项字段编辑器里「使用共享选项列表」。dev 读到那个编辑器是 objectui 自己的 ObjectFieldInspector,不是 spec 的 field.form.ts。

协议声明: 两项的所有选项都不改 Zod 契约(Clause-②: no)。B 只在已有门禁里加一条裁定数据，不新增门禁。

前提(每条带复查命令与对照)

1. 三项都已生效。 liveness/action.json 里 onSuccess.navigate / onSuccess.openIn 为 live(2026-09-27 核实),outcomeMessages 为 live(2026-10-03 核实);liveness/field.json 里 picklist 为 live(2026-10-01 核实)。复查:在 origin/main 上读这两个 JSON 文件的 props。

2. 门禁拒绝挪到 #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332 的三个类别。 dev 跑了两次探针，都是红:

   • 第 1 次:Tests 1 failed | 75 passed (76),报 "the root rows giving this reason are not the keys ruling record 5861442317 put in it";
   • 第 2 次:Tests 3 failed,另外两条原文是 "the ruling names no editor for this key" 和 "not a union, so this reason does not hold"。

   两次都还原到与 HEAD 的 blob 一致。对照:HEAD 本身是 76 passed。

3. 只删行也会被拒(spec(liveness): object.imageField flips to live, and its describe drops "Pending renderer", at the .objectui-sha bump that carries objectui#11383 #21765 当时已经实测过，记录 5989423774)。

4. 没有任何表单提供这三项。 git grep 在 packages/spec/src/**/*.form.ts 里搜这三个键，0 个结果;对照组 successMessage 有命中。

5. 本仓库里没有生产者。 在 examples/ 和 spec 源码以外的 packages/ 里，两个动作键的元数据写入方都是 0。hotcrm 没测。

第 1 项:onSuccess、outcomeMessages

选项	做什么	客户看到的后果
1A 提供	onSuccess 用组合控件(跳转路径或 URL 模板，加上打开方式下拉),outcomeMessages 用映射编辑器(结果键对应提示文字);补四种语言目录，删两条 omit 行。一张 domain:spec 卡，规模约 6 个文件以上，按 #21765 估算，没有实测。	作者能在 Studio 里设置成功后跳到哪里、按结果显示不同提示。outcomeMessages 的键写错了不会被拒，只是提示不显示，这一点和手改 JSON 一样。
1B 新类别	你点名一个类别，例如「已生效，暂无设计好的控件」,只收这两个键，再改写两条理由。一个只改测试的小 PR,skip-changeset(已实测测试文件不发布)。	Studio 仍看不到这两项，但账本说的是真话。
1C 暂不动	保持现状。	什么都不坏，但两条理由继续说「尚未生效」。

业务含义直译: 1A 是「动作设置页加上『成功后去哪』和『按结果的提示语』两块」;1B 是「这两个设置有意只留在高级 JSON 里，并写明原因」;1C 是「先放着」。

第 2 项:picklist

选项	做什么	客户看到的后果
2A 文本行	在 field.form.ts 加一行文本输入(#21765 imageField 的先例),删 omit 行。	作者能手填列表名。但已裁定的 Studio 选择器以后上线时，同一个设置会有两个入口。字段保存时会不会拒绝不存在的列表名，没测;安装和启动时会拒绝(已读到)。
2B 新类别	你点名一个类别，例如「提供方式已裁定，随 Studio 共享选项列表阶段上线」,用文字写明那个阶段，不带追踪编号。以后有表单提供这个键时，这条会被门禁自动清掉。	Studio 字段表单不变;账本理由为真，而且指向已经定下的方案。
2C 等上线	等 objectui#10202 落地，看它的控件走不走 field.form.ts,再定。	在那之前理由仍是假的。

业务含义直译: 2A 是「先放一个手填框」;2B 是「写明它会以选择器的形式出现在对象设计器里」;2C 是「等选择器做出来再说」。

四轴论证(从业务立场)

• ① 项目长远合理性: 两年后，平台上每个已生效、可编写的设置，要么在 Studio 里有入口，要么带一条真实的不提供理由。主流低代码平台都把「动作成功后跳转」「成功提示语」放在可视化设置里，例如 Salesforce 快速操作的成功消息、Flow 的结束行为。第 1 项因此按①选 A。第 2 项的入口已经裁定在对象设计器的选择器里，再加一个手填框就是两个入口，所以按①选 B。
• ② 实际业务拉动: 本仓库里这两个动作键的生产者是 0,hotcrm 没测。今天撞上的是用 Studio 建动作、又想设跳转或分结果提示的作者，只能改 JSON。拉动小，只影响第 1 项的排期，不改字母。
• ③ 防 AI 犯错: 1A 不增加新的出错方式。outcomeMessages 的键本来就是自由字符串，写错了只是提示不显示，表单和 JSON 一样，都不会被响亮拒绝。2A 让 AI 在选择器出现之前就去手填列表名，而保存时会不会拒绝错名没有测过。B 方案都不增加出错面。
• ④ 创业阶段不扩散: 1A 在已有表单上加两块，不增加契约;1B 和 2B 各在已有门禁里加一条裁定数据，不新增门禁。

Prior rulings read: onSuccess offer, outcomeMessages offer, picklist offer, RULED_ROOT_REASONS, 5861442317 → 3 hits (#19332 ruling 5861442317, #18164 batch #209 item 1 A, #20339 site 1); ADR none; thread: 5994269771

推荐:

• 第 1 项选 1A,回退 1B。 只看①选 1A;②③④ 是否翻转：否(② 的零生产者只影响排期，排为 p3)。
• 第 2 项选 2B,回退 2C。 只看①选 2B;②③④ 是否翻转：否。

置信缺口:

• 席位没有在浏览器里看过 objectui 的表单能否画出 onSuccess 的组合控件和 outcomeMessages 的映射编辑器。dev 引的先例是 #19188 split: 39 top-level zod-only keys are structured controls needing a designed widget, not a row #19332 的 G1/G2,但没有实测。
• hotcrm 里的生产者没测。
• 字段保存时会不会拒绝不存在的选项列表名，没测。

裁后执行

• 1A: 本卡改成「提供两项」,范围是 action.form.ts、四种语言目录和删两条 omit 行，交付后走 at-tier 评审。
• 1B 或 2B: 席位把你点名的类别连同所收的键写进 RULED_ROOT_REASONS,并改写对应理由。这是一个只改测试的 PR,skip-changeset。
• 1C 或 2C: 对应的行挂起，带 Restart-when:。2C 的条件是 objectui#10202 第 2 阶段合入。
• 两项可以在同一个 PR 里落地;本卡在最后一项落地时关闭。

相关单与 PR

#19332(裁决 5861442317)· #18164 · objectui#10202 · #20339 · #20296 · #21095 · #21765(PR #21854)· 分诊 5993028630 · dev 报告 5994269771。