diff --git a/.changeset/12126-ref-multi-permission-widget.md b/.changeset/12126-ref-multi-permission-widget.md
new file mode 100644
index 0000000000..ed18694925
--- /dev/null
+++ b/.changeset/12126-ref-multi-permission-widget.md
@@ -0,0 +1,22 @@
+---
+'@object-ui/app-shell': minor
+---
+
+A Studio form field that declares the `ref-multi:permission` widget now renders a picker of the declared permission sets instead of the JSON editor fallback (objectui#12126).
+
+The position form's "Permission sets" row is moving from a free-text tag box to this widget
+(objectstack#22794, ADR-0131 D4: a reference to a declared item is by machine name). The metadata
+forms had no renderer for `ref-multi:permission`, so that row would have become a raw JSON box with a
+"falling back to JSON" note. The new widget lists the permission sets the position names, each with a
+remove button, and offers an "Add permission set" picker of the declared sets not yet picked; a pick
+adds the set's name. The stored value stays a list of names. A stored name the permission-set
+registry does not declare stays in the list and is marked "(not found)". While the list is loading
+the add box is disabled; if it fails to load the field shows the load-failure notice beside a text
+box that still adds a typed name. A form whose host supplies no permission-set list takes typed names.
+
+The metadata editor loads the permission-set list only for a form that declares the widget, so no
+other editor sends the extra request.
+
+`SchemaForm`'s `widgetContext` prop gains one optional member, `permissionSets`, the list the new
+widget reads. It is additive: a host that passes no `permissionSets` renders exactly as before, except
+that a `ref-multi:permission` field now takes typed names instead of showing the JSON fallback.
diff --git a/packages/app-shell/src/views/metadata-admin/ResourceEditPage.permissionSetsFeed-12126.test.tsx b/packages/app-shell/src/views/metadata-admin/ResourceEditPage.permissionSetsFeed-12126.test.tsx
new file mode 100644
index 0000000000..a88beda464
--- /dev/null
+++ b/packages/app-shell/src/views/metadata-admin/ResourceEditPage.permissionSetsFeed-12126.test.tsx
@@ -0,0 +1,177 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#12126 — the generic editor feeds the permission-set catalog to a
+ * form that declares `widget: 'ref-multi:permission'`, and to no other form.
+ *
+ * The position form arrives from `/meta/types` as the type entry's `form`, so
+ * `ResourceEditPage` is the host that has to hand the `ref-multi:permission`
+ * picker its catalog. Pinned here, on the real page with a stubbed client:
+ *
+ *  - a form that declares the hint gets the registry's permission sets as the
+ *    picker's options, and a pick stores the set's name in the draft's list;
+ *  - the request is the whole registry list (`client.list('permission')`, no
+ *    package scope): a position names sets from the environment catalog;
+ *  - a FAILED list reaches the picker as a failure, not as an empty catalog;
+ *  - a form that does not declare the hint sends no request at all — the
+ *    control that makes the first case's request attributable to the hint.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { render, screen, cleanup, waitFor, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { MemoryRouter } from 'react-router-dom';
+import { t } from './i18n';
+
+const ADD = t('engine.form.addPermissionSetPlain', 'en-US');
+
+const POSITION = { name: 'sales_lead', label: 'Sales lead', permissionSets: ['sales_rep', 'retired_set'] };
+
+const listPermission = vi.fn<() => Promise<Array<Record<string, unknown>>>>();
+
+const mockClient = {
+  list: vi.fn(async (type: string) => (type === 'permission' ? listPermission() : [])),
+  listDrafts: vi.fn(async () => []),
+  get: vi.fn(async () => null),
+  getDraft: vi.fn(async () => null),
+  references: vi.fn(async () => []),
+  layered: vi.fn(async () => ({
+    code: null,
+    overlay: POSITION,
+    overlayScope: null,
+    effective: POSITION,
+    provenance: 'org',
+  })),
+};
+
+const SCHEMA = {
+  type: 'object',
+  properties: {
+    name: { type: 'string' },
+    label: { type: 'string' },
+    permissionSets: { type: 'array', items: { type: 'string' } },
+  },
+};
+
+/** The position form's row as objectstack#22794 declares it. */
+const POSITION_FORM = {
+  type: 'simple',
+  sections: [
+    {
+      label: 'Position',
+      fields: [
+        { field: 'name' },
+        { field: 'label' },
+        { field: 'permissionSets', label: 'Permission Sets', widget: 'ref-multi:permission' },
+      ],
+    },
+  ],
+};
+
+/** Today's row: a free-text tag box, which reads no catalog. */
+const TAGS_FORM = {
+  type: 'simple',
+  sections: [{ label: 'Position', fields: [{ field: 'name' }, { field: 'permissionSets', type: 'tags' }] }],
+};
+
+const form = { current: POSITION_FORM as Record<string, unknown> };
+
+vi.mock('./useMetadata', async (importOriginal) => {
+  const mod = await importOriginal<typeof import('./useMetadata')>();
+  return {
+    ...mod,
+    useMetadataClient: () => mockClient,
+    useMetadataTypes: () => ({
+      loading: false,
+      error: null,
+      entries: [
+        {
+          type: 'position',
+          name: 'position',
+          label: 'Position',
+          allowOrgOverride: false,
+          allowRuntimeCreate: true,
+          schema: SCHEMA,
+          form: form.current,
+        },
+      ],
+    }),
+  };
+});
+
+import { MetadataResourceEditPage } from './ResourceEditPage';
+
+async function mountEditor() {
+  render(
+    <MemoryRouter initialEntries={['/metadata/position/sales_lead']}>
+      <MetadataResourceEditPage type="position" name="sales_lead" />
+    </MemoryRouter>,
+  );
+  await waitFor(() => expect(mockClient.layered).toHaveBeenCalled());
+}
+
+const permissionCalls = () => mockClient.list.mock.calls.filter(([type]) => type === 'permission');
+
+beforeEach(() => {
+  form.current = POSITION_FORM;
+  listPermission.mockImplementation(async () => [
+    { name: 'sales_rep', label: 'Sales rep' },
+    { name: 'admin_full_access', label: 'Full access' },
+    { label: 'a row without a name' },
+  ]);
+});
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe('the permission-set catalog reaches a form that declares `ref-multi:permission` (objectui#12126)', () => {
+  it('offers the registry sets, flags a stored name it lacks, and a pick lands in the list', async () => {
+    await mountEditor();
+    const list = await screen.findByRole('group', { name: /Permission Sets/ });
+    await waitFor(() => expect(within(list).getAllByRole('listitem')[1]).toHaveTextContent('(not found)'));
+    expect(within(list).getAllByRole('listitem')[0]).not.toHaveTextContent('(not found)');
+
+    // A form-only type opens in view mode; either Edit button (header, or the
+    // view-mode notice) enters the editable form.
+    await userEvent.click(screen.getAllByRole('button', { name: t('engine.edit.edit', 'en-US') })[0]);
+    await userEvent.click(await screen.findByRole('combobox', { name: ADD }));
+    // Sorted by name; the stored `sales_rep` is not offered again; a nameless row is not an option.
+    expect((await screen.findAllByRole('option')).map((o) => o.textContent)).toEqual(['Full accessadmin_full_access']);
+    await userEvent.click(screen.getByRole('option', { name: /admin_full_access/ }));
+    await waitFor(() =>
+      expect(within(list).getAllByRole('listitem').map((li) => li.querySelector('code')?.textContent)).toEqual([
+        'sales_rep',
+        'retired_set',
+        'admin_full_access',
+      ]),
+    );
+  });
+
+  it('asks the whole registry once, with no package scope', async () => {
+    await mountEditor();
+    await waitFor(() => expect(permissionCalls()).toHaveLength(1));
+    expect(permissionCalls()[0]).toEqual(['permission']);
+  });
+
+  it('a FAILED list reaches the picker as a failure, not as an empty catalog', async () => {
+    listPermission.mockImplementation(async () => {
+      throw new Error('HTTP 503');
+    });
+    await mountEditor();
+    expect(await screen.findByTestId('ref-multi-permission-load-failed')).toHaveTextContent('HTTP 503');
+    expect(screen.queryByText('(not found)')).toBeNull();
+  });
+});
+
+describe('a form that does not declare `ref-multi:permission` sends no request (objectui#12126)', () => {
+  it('the tag-box row reads no catalog, so the permission list is never asked for', async () => {
+    form.current = TAGS_FORM;
+    await mountEditor();
+    // The page has settled: the draft's name is on screen in the tag row's form.
+    await screen.findByDisplayValue('sales_lead');
+    expect(permissionCalls()).toEqual([]);
+  });
+});
diff --git a/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx b/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx
index 39106b97f2..cda2f3c897 100644
--- a/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx
+++ b/packages/app-shell/src/views/metadata-admin/ResourceEditPage.tsx
@@ -94,8 +94,10 @@ import {
 } from './SchemaForm.js';
 import {
   collectPageComponentIds,
+  formDeclaresWidget,
   type ObjectActionOption,
   type ObjectFieldOption,
+  type RegistryItemOption,
   type WidgetContext,
 } from './widgets.js';
 import {
@@ -990,6 +992,33 @@ function MetadataResourceEditPageImpl({
     ),
   );
 
+  // The permission-set catalog — fuels the `ref-multi:permission` picker
+  // (objectui#12126), which the position form's `permissionSets` row declares
+  // (ADR-0131 D4: a reference to a declared item is by machine name, resolved
+  // registry-first). Loaded only when the form on screen declares that widget,
+  // so no other editor sends the request. The list is the whole registry, not
+  // one package's: a position names permission sets from the environment
+  // catalog, platform-shipped sets included (ADR-0131 D3).
+  const declaresPermissionSets = formDeclaresWidget(
+    createMode && config.createSchema ? undefined : entry?.form,
+    'ref-multi:permission',
+  );
+  const permissionSetsState = usePickerLoad<RegistryItemOption[]>(
+    React.useMemo(
+      () =>
+        declaresPermissionSets
+          ? async () => {
+              const rows = (await client.list('permission')) as Array<{ name?: string; label?: string }>;
+              return rows
+                .filter((r): r is { name: string; label?: string } => typeof r?.name === 'string' && !!r.name)
+                .map((r) => ({ name: r.name, label: r.label }))
+                .sort((a, b) => a.name.localeCompare(b.name));
+            }
+          : null,
+      [client, declaresPermissionSets],
+    ),
+  );
+
   // Component ids placed on the page being edited — fuels the `ref:component`
   // picker so a page variable's `source` (the component that writes it) is
   // chosen from the real canvas components, not a free-text id. Derived from
@@ -1043,8 +1072,9 @@ function MetadataResourceEditPageImpl({
       objectActions: mapLoaded(objectCatalogState, (catalog) => catalog.actions),
       objectViews: objectViewsState,
       componentIds,
+      permissionSets: permissionSetsState,
     }),
-    [type, objectsState, objectCatalogState, objectViewsState, componentIds],
+    [type, objectsState, objectCatalogState, objectViewsState, componentIds, permissionSetsState],
   );
 
   // Load layered view + initial draft.
diff --git a/packages/app-shell/src/views/metadata-admin/SchemaForm.refMultiPermission-12126.test.tsx b/packages/app-shell/src/views/metadata-admin/SchemaForm.refMultiPermission-12126.test.tsx
new file mode 100644
index 0000000000..efd9cd73b2
--- /dev/null
+++ b/packages/app-shell/src/views/metadata-admin/SchemaForm.refMultiPermission-12126.test.tsx
@@ -0,0 +1,290 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectui#12126 — a spec-form field that declares
+ * `widget: 'ref-multi:permission'` renders a multi-picker of the declared
+ * permission sets, and stores a LIST of their names.
+ *
+ * ## The defect this lands ahead of
+ *
+ * objectstack#22794 moves the position form's `permissionSets` row from
+ * `type: 'tags'` to `widget: 'ref-multi:permission'` (ADR-0131 D4: a reference
+ * to a declared item is by machine name, resolved registry-first). `WIDGETS`
+ * had no entry for that key, so `resolveFieldFace` sent it down the announced
+ * raw-JSON face: a JSON `<textarea>` under "widget ref-multi:permission —
+ * falling back to JSON…". Landing the spec first would have turned the tag box
+ * into a JSON box.
+ *
+ * ## What this file pins
+ *
+ *  - with the catalog on the host's `WidgetContext`, the add picker offers the
+ *    declared sets not yet picked, and a pick appends that set's NAME to the
+ *    stored list — in a SECTION, and in a REPEATER row under both layouts;
+ *  - a stored name the catalog does not declare stays listed, flagged
+ *    `(not found)`; a declared one is not flagged;
+ *  - removing a name writes the list without it;
+ *  - the FAILED arm shows the shared failure notice and still adds a typed name;
+ *  - with NO catalog the field takes typed names, ⛔ never the raw-JSON face;
+ *  - the host's label names the list (`labelling: 'group'`), in both states.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { render, screen, cleanup, fireEvent, within } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { SchemaForm } from './SchemaForm';
+import { formDeclaresWidget, WIDGET_LABELLING, type WidgetContext } from './widgets';
+import { loaded, failed } from './loadState';
+import { t, tFormat } from './i18n';
+
+afterEach(cleanup);
+
+const CATALOG = [
+  { name: 'sales_manager', label: 'Sales manager' },
+  { name: 'sales_rep', label: 'Sales rep' },
+  { name: 'support_agent' },
+];
+
+const WITH_CATALOG: WidgetContext = { conditionScope: 'none', permissionSets: loaded(CATALOG) };
+
+const LABEL = 'Permission Sets';
+const ADD = t('engine.form.addPermissionSetPlain', 'en-US');
+const NOT_FOUND = t('engine.form.notFound', 'en-US');
+/** The announced fallback the unregistered hint rendered in place of a picker. */
+const RAW_JSON_NOTICE = tFormat('engine.form.fallbackJson', 'en-US', { widget: 'ref-multi:permission' });
+
+/** The position form's row, as objectstack#22794 declares it: an explicit widget and no `type`. */
+function sectionForm() {
+  return {
+    type: 'simple',
+    sections: [
+      { label: 'Position', fields: [{ field: 'permissionSets', label: LABEL, widget: 'ref-multi:permission' }] },
+    ],
+  } as never;
+}
+
+/** `PositionSchema.permissionSets`: an optional list of snake_case names. */
+function sectionSchema() {
+  return {
+    type: 'object',
+    properties: { permissionSets: { type: 'array', items: { type: 'string' } } },
+  } as never;
+}
+
+type Layout = 'grid' | 'card';
+
+function repeaterForm(layout: Layout) {
+  return {
+    type: 'simple',
+    sections: [
+      {
+        label: 'S',
+        fields: [
+          {
+            field: 'rows',
+            type: 'repeater',
+            ...(layout === 'grid' ? { widget: 'grid' } : {}),
+            fields: [
+              { field: 'name', label: 'Name' },
+              { field: 'permissionSets', label: LABEL, widget: 'ref-multi:permission' },
+            ],
+          },
+        ],
+      },
+    ],
+  } as never;
+}
+
+function repeaterSchema() {
+  return {
+    type: 'object',
+    properties: {
+      rows: {
+        type: 'array',
+        items: {
+          type: 'object',
+          properties: { name: { type: 'string' }, permissionSets: { type: 'array', items: { type: 'string' } } },
+        },
+      },
+    },
+  } as never;
+}
+
+function renderSection(
+  ctx: WidgetContext | undefined,
+  value: Record<string, unknown> = {},
+  readOnly = false,
+) {
+  const onChange = vi.fn<(next: Record<string, unknown>) => void>();
+  render(
+    <SchemaForm
+      schema={sectionSchema()}
+      form={sectionForm()}
+      value={value}
+      widgetContext={ctx}
+      onChange={onChange}
+      readOnly={readOnly}
+    />,
+  );
+  return onChange;
+}
+
+/** The named list the host label points at. */
+function theList() {
+  return screen.getByRole('group', { name: LABEL });
+}
+
+/** The names listed in the field, each with whatever flag it carries. */
+function listed(): string[] {
+  return within(theList())
+    .queryAllByRole('listitem')
+    .map((li) => li.textContent ?? '');
+}
+
+async function pick(option: RegExp) {
+  await userEvent.click(screen.getByRole('combobox', { name: ADD }));
+  await userEvent.click(await screen.findByRole('option', { name: option }));
+}
+
+/** The defect's face, read positively so a picker that renders nothing cannot pass. */
+function expectNoRawJsonFace() {
+  expect(screen.queryByText(RAW_JSON_NOTICE), 'the announced raw-JSON fallback is on screen').toBeNull();
+  expect(document.querySelector('textarea'), 'a JSON textarea renders in place of the field').toBeNull();
+}
+
+describe('`ref-multi:permission` with the catalog — a multi-picker of declared permission sets (objectui#12126)', () => {
+  it('renders the picker, not the raw-JSON face, and a pick appends that set name to the stored list', async () => {
+    const onChange = renderSection(WITH_CATALOG, { permissionSets: ['sales_manager'] });
+    expectNoRawJsonFace();
+    await pick(/sales_rep/);
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['sales_manager', 'sales_rep'] });
+  });
+
+  it('a first pick on an empty field stores a one-name list', async () => {
+    const onChange = renderSection(WITH_CATALOG);
+    await pick(/support_agent/);
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['support_agent'] });
+  });
+
+  it('offers only the declared sets not yet picked, with the label beside the name', async () => {
+    renderSection(WITH_CATALOG, { permissionSets: ['sales_manager'] });
+    await userEvent.click(screen.getByRole('combobox', { name: ADD }));
+    const options = (await screen.findAllByRole('option')).map((o) => o.textContent);
+    expect(options).toEqual(['Sales repsales_rep', 'support_agent']);
+  });
+
+  it('lists the stored names, a declared one unflagged', () => {
+    renderSection(WITH_CATALOG, { permissionSets: ['sales_manager', 'support_agent'] });
+    expect(listed()).toEqual(['Sales managersales_manager×', 'support_agent×']);
+  });
+
+  it('a stored name the catalog does not declare stays listed, flagged — never dropped', () => {
+    renderSection(WITH_CATALOG, { permissionSets: ['sales_rep', 'retired_set'] });
+    const [known, unknown] = within(theList()).getAllByRole('listitem');
+    expect(unknown).toHaveTextContent('retired_set');
+    expect(unknown).toHaveTextContent(NOT_FOUND);
+    expect(known).toHaveTextContent('sales_rep');
+    expect(known).not.toHaveTextContent(NOT_FOUND);
+  });
+
+  it('a flagged name is still picked around: a pick keeps it in the stored list', async () => {
+    const onChange = renderSection(WITH_CATALOG, { permissionSets: ['retired_set'] });
+    await pick(/sales_rep/);
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['retired_set', 'sales_rep'] });
+  });
+
+  it('removing a name writes the list without it', () => {
+    const onChange = renderSection(WITH_CATALOG, { permissionSets: ['sales_manager', 'sales_rep'] });
+    fireEvent.click(screen.getByRole('button', { name: tFormat('engine.form.removeNamed', 'en-US', { name: 'sales_manager' }) }));
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['sales_rep'] });
+  });
+
+  it('read-only: the names stay listed, flags included, with no add or remove control', () => {
+    renderSection(WITH_CATALOG, { permissionSets: ['sales_rep', 'retired_set'] }, true);
+    expect(listed()).toEqual(['Sales repsales_rep', `retired_set${NOT_FOUND}`]);
+    expect(screen.queryByRole('combobox', { name: ADD })).toBeNull();
+    expect(within(theList()).queryAllByRole('button')).toEqual([]);
+  });
+
+  for (const layout of ['grid', 'card'] as const) {
+    it(`a REPEATER row (${layout} layout) renders the picker and writes the list into that row`, async () => {
+      const onChange = vi.fn<(next: Record<string, unknown>) => void>();
+      render(
+        <SchemaForm
+          schema={repeaterSchema()}
+          form={repeaterForm(layout)}
+          value={{ rows: [{ name: 'r1' }] }}
+          widgetContext={WITH_CATALOG}
+          onChange={onChange}
+        />,
+      );
+      // The card layout keeps a row collapsed until it is opened.
+      if (layout === 'card') fireEvent.click(screen.getByText(/#1/));
+      expectNoRawJsonFace();
+      await pick(/sales_rep/);
+      expect(onChange).toHaveBeenLastCalledWith({ rows: [{ name: 'r1', permissionSets: ['sales_rep'] }] });
+    });
+  }
+});
+
+describe('`ref-multi:permission` when the catalog has not answered (objectui#12126)', () => {
+  it('FAILED: the shared failure notice, the stored names unflagged, and a box that still adds a typed name', () => {
+    const onChange = renderSection(
+      { conditionScope: 'none', permissionSets: failed('HTTP 503') },
+      { permissionSets: ['sales_rep'] },
+    );
+    expect(screen.getByTestId('ref-multi-permission-load-failed')).toHaveTextContent('HTTP 503');
+    expect(listed()).toEqual(['sales_rep×']);
+    const box = screen.getByRole('textbox', { name: ADD });
+    fireEvent.change(box, { target: { value: 'support_agent' } });
+    fireEvent.keyDown(box, { key: 'Enter' });
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['sales_rep', 'support_agent'] });
+  });
+
+  it('LOADING: the add box is disabled, and no stored name is flagged', () => {
+    renderSection({ conditionScope: 'none', permissionSets: { status: 'loading' } }, { permissionSets: ['sales_rep'] });
+    expect(screen.getByRole('textbox', { name: ADD })).toBeDisabled();
+    expect(listed()).toEqual(['sales_rep×']);
+  });
+
+  it('NO catalog: typed names are added to the list, ⛔ never the raw-JSON face', () => {
+    const onChange = renderSection(undefined, { permissionSets: ['sales_rep'] });
+    expectNoRawJsonFace();
+    const box = screen.getByRole('textbox', { name: ADD });
+    fireEvent.change(box, { target: { value: 'support_agent, sales_rep' } });
+    fireEvent.blur(box);
+    expect(onChange).toHaveBeenLastCalledWith({ permissionSets: ['sales_rep', 'support_agent'] });
+  });
+});
+
+describe('`ref-multi:permission` is named by the host label as a list (objectui#12126)', () => {
+  it('is declared `group`, and the host label names the list in both states', () => {
+    expect(WIDGET_LABELLING['ref-multi:permission']).toBe('group');
+    for (const readOnly of [false, true]) {
+      renderSection(WITH_CATALOG, { permissionSets: ['sales_rep'] }, readOnly);
+      expect(theList()).toBeInTheDocument();
+      cleanup();
+    }
+  });
+});
+
+describe('formDeclaresWidget — the gate on the catalog request (objectui#12126)', () => {
+  it('finds the hint in a section row, in a legacy `groups` entry and on a repeater sub-field', () => {
+    expect(formDeclaresWidget(sectionForm(), 'ref-multi:permission')).toBe(true);
+    expect(formDeclaresWidget(repeaterForm('grid'), 'ref-multi:permission')).toBe(true);
+    expect(
+      formDeclaresWidget(
+        { groups: [{ fields: [{ field: 'p', widget: 'ref-multi:permission' }] }] } as never,
+        'ref-multi:permission',
+      ),
+    ).toBe(true);
+  });
+
+  it('answers no for a form without it, and for no form', () => {
+    expect(formDeclaresWidget(sectionForm(), 'ref:dataset')).toBe(false);
+    expect(
+      formDeclaresWidget({ sections: [{ fields: ['name', { field: 'tags', type: 'tags' }] }] } as never, 'ref-multi:permission'),
+    ).toBe(false);
+    expect(formDeclaresWidget(undefined, 'ref-multi:permission')).toBe(false);
+  });
+});
diff --git a/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx b/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
index d6715d85dd..d7f4578586 100644
--- a/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
+++ b/packages/app-shell/src/views/metadata-admin/SchemaForm.widgetLabelling.test.tsx
@@ -146,6 +146,9 @@ const CASES: Case[] = [
   { key: 'ref:dataset', schema: { type: 'string', title: TITLE }, ctx: { datasets: loaded([{ name: 'sales_metrics', label: 'Sales metrics', dimensions: [], measures: [] }]) }, value: 'sales_metrics' },
   // No `ctx` at all: the hosts that feed no catalog get the labelled text input (objectui#11601).
   { key: 'ref:dataset', variant: 'no-catalog', schema: { type: 'string', title: TITLE }, value: 'sales_metrics' },
+  { key: 'ref-multi:permission', schema: { type: 'array', title: TITLE, items: { type: 'string' } }, ctx: { permissionSets: loaded([{ name: 'sales_rep' }, { name: 'support_agent' }]) }, value: ['sales_rep'] },
+  // No `ctx` at all: the hosts that feed no catalog get the typed-name box inside the same named list (objectui#12126).
+  { key: 'ref-multi:permission', variant: 'no-catalog', schema: { type: 'array', title: TITLE, items: { type: 'string' } }, value: ['sales_rep'] },
   { key: 'filter-mode', schema: { type: 'object', title: TITLE }, ctx: { objectFields: loaded([{ name: 'status' }]) }, value: { element: 'dropdown' } },
   { key: 'object-selector', schema: { type: 'string', title: TITLE }, ctx: { objectNames: loaded(['account']) }, value: 'account' },
   { key: 'object-selector', variant: 'multiple', schema: { type: 'array', title: TITLE }, spec: { multiple: true }, ctx: { objectNames: loaded(['account', 'contact']) }, value: ['account'] },
diff --git a/packages/app-shell/src/views/metadata-admin/i18n.ts b/packages/app-shell/src/views/metadata-admin/i18n.ts
index 7c170aec0f..001d79fa29 100644
--- a/packages/app-shell/src/views/metadata-admin/i18n.ts
+++ b/packages/app-shell/src/views/metadata-admin/i18n.ts
@@ -2166,6 +2166,12 @@ const ENGINE_STRINGS_EN: Record<string, string> = {
   'engine.form.addFieldPlain': 'Add field',
   'engine.form.searchFields': 'Search fields…',
   'engine.form.allFieldsAdded': 'All fields added',
+  // objectui#12126 — the `ref-multi:permission` picker's add control: its
+  // accessible name, its placeholder, and the placeholder once every declared
+  // permission set is picked.
+  'engine.form.addPermissionSetPlain': 'Add permission set',
+  'engine.form.addPermissionSet': 'Add permission set…',
+  'engine.form.allPermissionSetsAdded': 'All permission sets added',
   'engine.form.noObjectFields': 'No object fields ({error}).',
   // objectui#10862, slice 4 — the not-found `error` the field and dataset
   // catalogue hooks (`useObjectFields`, `useDatasetSemantics`) publish, read
@@ -5445,6 +5451,10 @@ const ENGINE_STRINGS_ZH: Record<string, string> = {
   'engine.form.addFieldPlain': '添加字段',
   'engine.form.searchFields': '搜索字段…',
   'engine.form.allFieldsAdded': '已添加全部字段',
+  // objectui#12126 — zh half of the `ref-multi:permission` add control.
+  'engine.form.addPermissionSetPlain': '添加权限集',
+  'engine.form.addPermissionSet': '添加权限集…',
+  'engine.form.allPermissionSetsAdded': '已添加全部权限集',
   'engine.form.noObjectFields': '没有对象字段（{error}）。',
   // objectui#10862, slice 4.
   'engine.form.objectNotFound': '未找到对象',
diff --git a/packages/app-shell/src/views/metadata-admin/widgets.tsx b/packages/app-shell/src/views/metadata-admin/widgets.tsx
index cbdc8e2f77..cbaf0d33c7 100644
--- a/packages/app-shell/src/views/metadata-admin/widgets.tsx
+++ b/packages/app-shell/src/views/metadata-admin/widgets.tsx
@@ -47,7 +47,7 @@ import { iconNames } from 'lucide-react/dynamic.mjs';
 import { toast } from 'sonner';
 import { useObjectTranslation } from '@object-ui/i18n';
 import { useMetadataLocale, t, tFormat } from './i18n.js';
-import type { FormFieldSpec, VisibilityPredicate } from './form-spec.js';
+import type { FormFieldSpec, FormViewSpec, VisibilityPredicate } from './form-spec.js';
 import { usePredicateScope } from '@object-ui/react';
 import { buildPredicateCtx, visibleOptions, type PredicateCtx } from './predicate.js';
 import { foldFilterGroupToSpecRules, FILTER_FOLD_REFUSAL_KEYS } from '../viewFilterFold.js';
@@ -93,6 +93,16 @@ export interface ObjectActionOption {
   locations?: string[];
 }
 
+/**
+ * One declared item of a metadata registry, as a `ref-multi:<type>` picker
+ * offers it (objectui#12126): the item's machine name, which is what the picker
+ * stores, and the author's label for it.
+ */
+export interface RegistryItemOption {
+  name: string;
+  label?: string;
+}
+
 /**
  * A catalog handed to the pickers, in whichever of the four states its load is
  * actually in (objectui#5228).
@@ -261,6 +271,21 @@ export interface WidgetContext {
    * no datasets.
    */
   datasets?: LoadState<DatasetCatalogEntry[]>;
+  /**
+   * The permission-set catalog (objectui#12126): every permission set the
+   * environment registry serves (metadata type `permission`). Drives the
+   * `ref-multi:permission` picker, so a spec-form field that declares that hint
+   * (the position form's `permissionSets`, ADR-0131 D4: a reference to a
+   * declared item is by machine name, resolved registry-first) is chosen from
+   * the declared sets instead of typed as free text. The picker stores the
+   * picked sets' names, as a list.
+   *
+   * `ResourceEditPage` loads it only for a form that declares the hint
+   * (`formDeclaresWidget`). A host that never fetches it omits this member;
+   * absence is {@link NOT_ASKED}, and the widget then takes typed names, as it
+   * does for a completed load that found no permission sets.
+   */
+  permissionSets?: LoadState<RegistryItemOption[]>;
 }
 
 /* Stable empties for the arms that have no catalog to offer yet — `idle` and
@@ -272,6 +297,7 @@ const NO_OBJECT_FIELDS: ObjectFieldOption[] = [];
 const NO_OBJECT_VIEWS: ObjectViewOption[] = [];
 const NO_OBJECT_ACTIONS: ObjectActionOption[] = [];
 const NO_DATASETS: DatasetCatalogEntry[] = [];
+const NO_REGISTRY_ITEMS: RegistryItemOption[] = [];
 
 export interface WidgetProps {
   /**
@@ -738,6 +764,189 @@ function RefDatasetWidget({ id, ariaLabelledBy, required, value, onChange, readO
   );
 }
 
+/* -------------------------------------------------------------------------- */
+/* ref-multi:<type> — pick declared registry items by name, as a list         */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * What one `ref-multi:<type>` registration binds (objectui#12126): the catalog
+ * it reads off {@link WidgetContext} and the copy that names its add control.
+ * The key's grammar is the list form of the `ref:` pickers: arity in the
+ * prefix, the exact registry type after the colon.
+ */
+interface RefMultiRegistry {
+  /** The registry type after `ref-multi:`. Names the widget's test ids. */
+  type: string;
+  catalog: (context: WidgetContext | undefined) => LoadState<RegistryItemOption[]> | undefined;
+  /** The add control's accessible name. */
+  addLabelKey: string;
+  /** The add picker's placeholder while declared items remain unpicked. */
+  addPlaceholderKey: string;
+  /** The add picker's placeholder once every declared item is picked. */
+  allAddedKey: string;
+}
+
+/**
+ * Multi picker for a field that declares `widget: 'ref-multi:<type>'`
+ * (objectui#12126). The value is a LIST of the picked items' machine names,
+ * in the order they were added; picking appends a name, removing drops it.
+ *
+ * The catalog's four arms, as {@link RefDatasetWidget} reads them, with the
+ * names already stored listed in every arm, each removable while editable:
+ *
+ *  - FAILED — the shared failure notice beside a text box that stays enabled,
+ *    so a failed catalog does not also block authoring (objectui#5170);
+ *  - LOADING — the add box disabled, saying the options are loading;
+ *  - `idle` (no host feeds a catalog) or a completed load that found nothing —
+ *    a text box that adds the typed names. ⛔ Never the raw-JSON face an
+ *    unregistered hint falls back to;
+ *  - LOADED — an add picker offering the declared items not yet picked.
+ *
+ * A stored name the LOADED catalog does not declare stays in the list, flagged
+ * `(not found)`, so it is neither dropped nor read as a declared item
+ * (objectui#8488). The flag is a claim about the registry's answer, so it is
+ * made only once the catalog has answered.
+ *
+ * Labelled `'group'`, as `field-multi` / `action-multi` are (objectui#4871):
+ * the add control is gated behind `!readOnly`, so no one labelable element
+ * carries the field in both states, and the host's label names the list.
+ */
+function RefMultiWidget({
+  registry,
+  value,
+  onChange,
+  readOnly,
+  context,
+  ariaLabelledBy,
+}: WidgetProps & { registry: RefMultiRegistry }) {
+  const locale = useMetadataLocale();
+  const catalogState = registry.catalog(context) ?? NOT_ASKED;
+  const testId = `ref-multi-${registry.type}`;
+  const selected = Array.isArray(value)
+    ? (value as unknown[]).filter((v): v is string => typeof v === 'string')
+    : [];
+  const loadError = loadErrorOf(catalogState);
+  const loading = isLoading(catalogState);
+  // The flag needs an answered question: only a LOADED catalog can say that a
+  // name is not declared.
+  const declared =
+    catalogState.status === 'loaded' ? offeredOptions(catalogState, NO_REGISTRY_ITEMS) : null;
+  const [draft, setDraft] = React.useState('');
+
+  const add = (names: string[]) => {
+    const next = [...selected];
+    for (const name of names) if (!next.includes(name)) next.push(name);
+    if (next.length !== selected.length) onChange(next);
+  };
+  const commitDraft = () => {
+    const names = draft.split(/[,\n]/).map((s) => s.trim()).filter(Boolean);
+    setDraft('');
+    if (names.length) add(names);
+  };
+  const removeAt = (i: number) => {
+    const next = selected.slice();
+    next.splice(i, 1);
+    onChange(next);
+  };
+
+  const addLabel = t(registry.addLabelKey, locale);
+  const remaining = (declared ?? NO_REGISTRY_ITEMS).filter((o) => !selected.includes(o.name));
+  const freeform = (
+    <Input
+      data-testid={`${testId}-freeform`}
+      aria-label={addLabel}
+      value={draft}
+      disabled={loading}
+      placeholder={loading ? t('engine.form.loadingOptions', locale) : t('engine.form.tagsPlaceholder', locale)}
+      onChange={(e) => setDraft(e.target.value)}
+      onKeyDown={(e) => {
+        if (e.key === 'Enter' || e.key === ',') {
+          e.preventDefault();
+          commitDraft();
+        }
+      }}
+      onBlur={commitDraft}
+    />
+  );
+
+  return (
+    <div className="space-y-2" data-testid={testId} role="group" aria-labelledby={ariaLabelledBy}>
+      {selected.length > 0 && (
+        <ul className="flex flex-wrap gap-1.5">
+          {selected.map((name, i) => {
+            const entry = declared?.find((o) => o.name === name);
+            const notFound = declared !== null && !entry;
+            return (
+              <li
+                key={name}
+                data-not-found={notFound || undefined}
+                className={
+                  'inline-flex items-center gap-1.5 rounded border px-2 py-0.5 text-xs ' +
+                  (notFound ? 'border-amber-300 bg-amber-50 text-amber-900' : 'border-input bg-muted')
+                }
+              >
+                {entry?.label && entry.label !== name && <span>{entry.label}</span>}
+                <code className="font-mono">{name}</code>
+                {notFound && (
+                  <span className="text-amber-700">{t('engine.form.notFound', locale)}</span>
+                )}
+                {!readOnly && (
+                  <button
+                    type="button"
+                    aria-label={tFormat('engine.form.removeNamed', locale, { name })}
+                    onClick={() => removeAt(i)}
+                    className="text-muted-foreground hover:text-destructive"
+                  >
+                    ×
+                  </button>
+                )}
+              </li>
+            );
+          })}
+        </ul>
+      )}
+      {loadError && <PickerLoadFailure message={loadError} testId={`${testId}-load-failed`} />}
+      {!readOnly &&
+        (declared && declared.length > 0 ? (
+          <Select value="" onValueChange={(name) => add([name])} disabled={remaining.length === 0}>
+            {/* No host id: the group above is the named surface, as on
+                {@link FieldRefMultiWidget}'s add trigger. */}
+            <SelectTrigger data-testid={`${testId}-add`} aria-label={addLabel}>
+              <SelectValue
+                placeholder={t(remaining.length ? registry.addPlaceholderKey : registry.allAddedKey, locale)}
+              />
+            </SelectTrigger>
+            <SelectContent>
+              {remaining.map((o) => (
+                <SelectItem key={o.name} value={o.name}>
+                  <span className="flex items-center gap-2">
+                    {o.label && o.label !== o.name && <span>{o.label}</span>}
+                    <code className="text-xs text-muted-foreground">{o.name}</code>
+                  </span>
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+        ) : (
+          freeform
+        ))}
+    </div>
+  );
+}
+
+/** The `ref-multi:permission` registration: the permission-set registry (objectui#12126). */
+const PERMISSION_REGISTRY: RefMultiRegistry = {
+  type: 'permission',
+  catalog: (context) => context?.permissionSets,
+  addLabelKey: 'engine.form.addPermissionSetPlain',
+  addPlaceholderKey: 'engine.form.addPermissionSet',
+  allAddedKey: 'engine.form.allPermissionSetsAdded',
+};
+
+function RefMultiPermissionWidget(props: WidgetProps) {
+  return <RefMultiWidget {...props} registry={PERMISSION_REGISTRY} />;
+}
+
 /* -------------------------------------------------------------------------- */
 /* object-selector — multi-select object picker                               */
 /* -------------------------------------------------------------------------- */
@@ -3034,6 +3243,7 @@ export const WIDGETS = {
   'ref:object': RefObjectWidget,
   'ref:component': RefComponentWidget,
   'ref:dataset': RefDatasetWidget,
+  'ref-multi:permission': RefMultiPermissionWidget,
   'filter-mode': FilterModeWidget,
   'object-selector': ObjectSelectorWidget,
   'field-selector': FieldSelectorWidget,
@@ -3129,7 +3339,9 @@ export type WidgetLabelling = Exclude<NonNullable<RegistryComponentMeta['labelli
  *  - real composites — `filter-mode` (mode radiogroup + field/tab pickers),
  *    `master-detail` (a table of per-cell inputs), `condition` (predicate rows),
  *    `dynamic-config` (a driver-shaped sub-form), `field-multi` / `action-multi`
- *    (an ordered set with reorder/remove buttons plus an auxiliary add picker);
+ *    (an ordered set with reorder/remove buttons plus an auxiliary add picker),
+ *    `ref-multi:permission` (a list of names with remove buttons plus an
+ *    auxiliary add control, objectui#12126);
  *  - single non-labelable surfaces — `color-picker`'s `div[role="radiogroup"]`,
  *    `multiselect`'s `div[role="group"]` of checkbox buttons, and `code`, whose
  *    only focusable is Monaco's internal textarea that this widget never renders.
@@ -3143,6 +3355,7 @@ export const WIDGET_LABELLING: Record<RegisteredWidgetKey, WidgetLabelling> = {
   'ref:object': 'control',
   'ref:component': 'control',
   'ref:dataset': 'control',
+  'ref-multi:permission': 'group',
   'filter-mode': 'group',
   'object-selector': 'control',
   'field-selector': 'control',
@@ -3174,6 +3387,21 @@ export function widgetLabelling(widget: string | undefined): WidgetLabelling {
   return WIDGET_LABELLING[widget as RegisteredWidgetKey] ?? 'control';
 }
 
+/**
+ * Does a form layout declare `widget` on any of its fields — in a section, in a
+ * legacy `groups` entry, or on a sub-field of a composite or repeater row
+ * (objectui#12126)?
+ *
+ * A host asks this before it loads a catalog only that widget reads, so the
+ * request is sent for the forms that use the catalog and for no other. Typed on
+ * {@link RegisteredWidgetKey}: a host asks about a widget this registry renders.
+ */
+export function formDeclaresWidget(form: FormViewSpec | undefined, widget: RegisteredWidgetKey): boolean {
+  const declares = (fields: Array<string | FormFieldSpec> | undefined): boolean =>
+    (fields ?? []).some((f) => typeof f !== 'string' && (f.widget === widget || declares(f.fields)));
+  return [...(form?.sections ?? []), ...(form?.groups ?? [])].some((s) => declares(s.fields));
+}
+
 /* -------------------------------------------------------------------------- */
 /* CodeWidget — Monaco editor (textarea fallback) for `type: 'code'` fields   */
 /* -------------------------------------------------------------------------- */