[finding] the form face cannot express an enum whose members carry a hyphen or a capital — `FormSelectOptionSchema.value` is a system identifier, so `system-data`, `new-tab` and `perRecord` are unspellable as option values

[os-justin]

Ruled: 5793380467 · letter 不动 + 声明 · 2026-09-23T10:43Z

Filed by the domain:spec execution PM seat (session_01Sfe5YjBLwB9J3y8fvm2xq1), 2026-09-22T06:40Z. Met on card #19331 while giving 45 declared-but-unoffered keys a form row each; handed back rather than fixed there. The readings below are this seat's own, taken on origin/main.

⛔ Filed unassigned. ⛔ No domain:*, priority or type applied — grading is triage's.

The bound, and what it costs

FormSelectOptionSchema (packages/spec/src/ui/view.zod.ts:2761) is built from SelectOptionSchema.shape by reference — the docblock says so in as many words, and the alias-integrity audit depends on it. SelectOptionSchema.value (packages/spec/src/data/field.zod.ts:339) is SystemIdentifierSchema, which is

packages/spec/src/shared/identifiers.zod.ts:102-109
  .min(2) .regex(/^[a-z][a-z0-9_.]*$/)

⇒ a form-view select option value must be lowercase, and may carry only letters, digits, _ and . — no hyphen, no capital.

Now the enums a metadata form has to offer, all three measured in this act:

key	declared members	unspellable as an option value
object.managedBy (data/object.zod.ts:1715)	platform, config, system-data, engine-owned, append-only, better-auth	four of six
action.openIn (ui/action.zod.ts:1040)	self, new-tab	one of two
action.execution (ui/action.zod.ts:1193, BulkActionExecutionSchema)	perRecord, aggregate	one of two

⇒ these enums cannot be given an inline options list at all. Not "should not" — defineForm throws invalid_format on the option at module load, which is a build-time failure of the package that declares the form.

⭐ The failure mode is the shape that matters. A form author who does not know the bound writes the obvious option list and breaks the module's import, not a test. The workaround — omit options, let the control derive its enum from the served JSON Schema, and put the meanings in helpText — works and is what #19331 shipped for exactly these three keys. But it is a workaround discovered by hitting the wall, and the schema says nothing about it at the point where an author is writing the list.

⚠️ A sibling spelling makes it sharper, ⛔ noted not judged: action.onSuccess.openIn (ui/action.zod.ts:1639) spells the same concept 'newTab', and its own error message explicitly refuses 'new-tab'. So one repository has both spellings of one idea, and both are unspellable as form option values — one for its hyphen, one for its capital.

⛔ What is NOT claimed

• ⛔ No exit chosen. Relaxing FormSelectOptionSchema.value off SystemIdentifierSchema (the form face is a rendering vocabulary, not a stored identifier), declaring the derive-from-schema path as the supported answer for such enums, and leaving it as is with the bound documented at the point of authoring are three different decisions with different blast radii. SelectOptionSchema.value's own bound serves a real authored population — the identifiers docblock censuses 1218 authored values — so ⛔ loosening the shared shape is NOT the obvious move, and this seat picks nothing.
• ⚠️ Radius: packages/spec/src/** at origin/main. Whether objectui's form renderer would display a hyphenated value correctly if the schema allowed one is ⛔ outside it and unestablished.

Dedupe

Searched the board for this subject through the issue search, with a lit positive control (a query for #19331's own subject returns #19331 as its top hit): 0 hits for this one. The zero is a reading, not a dark probe.

Seam: spec:FormSelectOptionSchema.value → renderer:METADATA_FORM_REGISTRY option lists | consumer: the metadata-admin form renderer

Dedupe words

FormSelectOptionSchema value system identifier · option value hyphen refused · enum member unspellable form option

[objectstack-fleet]

Triage: moved to the decision box by the triage seat (session_01Tw7jnJinGHvoGSi8aFkhPJ), 2026-09-22T19:44Z. ⛔ Not dispatchable until ruled.

Path: 不写代码在运行中改应用 | studio-authoring.object-designer-roundtrip(P1) | P① | 待裁
Governing text: ADR-0049 enforce-or-remove;〈升级与决策〉四棱「创业阶段不扩散」;SKILL.md「扩大接受集 ⇒ Feature」
Prior rulings on this card: none on this shape

维护者速读

表单里的下拉选项,值必须是「小写字母开头、只含字母数字下划线」的标识符。但平台自己有好几个枚举值不长这样 —— 带连字符的、带大写的。于是这些枚举没法用内联选项列表写出来,作者在包构建时就直接抛错。

三条路,代价完全不同:放宽这个值的字符集(影响面最大,已有 1218 个已写的值在用同一个形状)、给表单面单独一套值规则(两套规则要一直同步)、或者不动、让这些枚举只能用别的方式表达(作者继续绕)。

席位不替您选:三条路是关于同一个共享形状的三个相反决定,不是实现细节。

要您定的一件事:放宽、分开、还是不动?

The reading

Verified on origin/main: the form option's value inherits the system-identifier shape (a .min(2) plus a lowercase-alnum-underscore-dot pattern), while the platform itself declares members carrying a hyphen and a capital in at least three places — an object lifecycle enum, an action target enum, and an action execution enum. ⇒ those members cannot be authored as inline option values, and the failure is a module-load throw for the form author, ⛔ not a runtime refusal for an end user.

四棱

• 实际业务需求:有具体触发者(写表单的作者),但⛔ 没有测到终端用户受影响 —— 失败在包构建期。
• 项目长远合理性:两套规则(选项二)是最贵的长期形态 —— 每加一个枚举都要问「这条走哪套」。放宽或不动都只有一处真相。
• 防 AI 写错:⚠️ 这一轴指向不放宽。字符集收紧正是让 AI 写不出歪值的东西;为了表达方便放宽它,是在消费端放松而不是在声明端解决。
• 创业阶段不扩散:放宽是扩大接受集(条款② yes),按阶段姿态默认从紧。

席位推荐:⛔ 无推荐 —— 四棱在「放宽」与「不动」之间真实分歧(业务便利 vs 防错与不扩散),而 1218 个已写值意味着选错的回滚成本不对称。这正是决策箱存在的理由。

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #217 item 5 · letter 不动 + 声明 · maintainer 「217 同意」 2026-09-23T10:41Z

Director seat, summon #28 (session_01GLdRPcbaCBQCTvVmU6YEUY). Presented in this seat's chat with recommendation 不动 + 声明 (the bound stays; the derive-from-schema path is declared as THE answer for enum-typed keys); the maintainer approved the batch as presented. 放宽 ⛔ (loosens a shared shape that bounds 1218 authored values, or forks it); 分开 is the fallback, ⛔ not taken (two vocabularies to keep in step).

Governing text: SystemIdentifierSchema (packages/spec/src/shared/identifiers.zod.ts:102-109) and SelectOptionSchema.value (field.zod.ts:339), which FormSelectOptionSchema (view.zod.ts:2761) reuses by reference; #19331 (shipped the derive-from-schema path for managedBy, openIn, execution); 〈四轴〉③ (a tight charset is what keeps an AI from writing a crooked value). Prior rulings read: formselectoptionschema.value,formselectoptionschema,value,system-data,new-tab,perrecord,form,face,express,enum,whose,members (+8 more) → 156 hits; ADR-0035 Decision §3, ADR-0041 Decision §4, ADR-0054 Decision §1, ADR-0056 D6, ADR-0061 D4, ADR-0109 Decision §2, ADR-0120 D5, ADR-0003 Decision §2; thread: none — none rules on this bound.

Ruled — 不动 + 声明: enum members come from the schema, never hand-listed

1. FormSelectOptionSchema.value keeps the system-identifier bound. For a metadata-form row whose key is a spec enum, options is omitted and the control derives the members from the served JSON Schema; meanings go in helpText (the #19188 split: 47 top-level zod-only keys are scalar controls needing one form row each #19331 shape).
2. That rule is written where an author meets it: the form field's options describe states it, and the module-load refusal for an unspellable option value names the derive path as the remedy — the wall says what to do.
3. newTab vs new-tab (two spellings of one idea in action.zod.ts) is recorded as a boundary, ⛔ not in this ruling; it is a separate finding if anyone ever needs it, zero pull today.

Execution

needs-user-decision → pm:queue in this stroke; domain:spec · priority:p3 · size S · Clause-②: no (describe + error text; no shape change).

[os-support-ai]

Claim: PM loop — execute ruling 不动 + 声明: enum-typed form rows omit options and derive members from the served JSON Schema; the options describe and the module-load refusal name that derive path, dispatched at 2026-09-23T15:58Z
Session: session_013RDBh5DqXd2xnLwvHLgLFr
Branch: claude/issue-19678-enum-options-derive-declared
Worktree: objectstack-issue-19678
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/spec/src/ui/view.zod.ts, region only: FormSelectOptionSchema and the form field's options describe; the module-load refusal for an unspellable option value, wherever it lives in packages/spec/src (the dev locates it by content); their tests; whatever the generators rewrite (regenerated, ⛔ never hand-edited); .changeset/. ⛔ FormSelectOptionSchema.value's system-identifier bound is unchanged (ruling item 1). ⛔ newTab / new-tab is out (ruling item 3).
Container & model: S, mode:subagent, model: opus (default judgment tier)
Clause-②: no
Thread-read: 5793380467
Serial constraints cleared: census over all 22 open PRs at 2026-09-23T15:58Z (259 file rows). view.zod.ts is also edited by PR #19861 (this seat's; region checkViewFilterRuleValueShape / ViewFilterRuleSchema) and PR #19809 (the row-limit region). FormSelectOptionSchema sits in neither, so the regions are disjoint. PR #19809 also regenerates content/docs/references/ui/view.mdx. If a describe change here moves that page, the move is generator output only, and a merge is resolved by scripts/pm/os-regen-merge.sh plus a quoted-exact assertion, ⛔ never by hand.

The ruling this executes: 5793380467 (batch #217 item 5, 「217 同意」); triage recorded it as describe plus error text, with no shape change.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 19678,
  "status": "done",
  "branch": "claude/issue-19678-enum-options-derive-declared",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/19906",
  "session": "session_013RDBh5DqXd2xnLwvHLgLFr",
  "premise_still_valid": true,
  "summary": "Executes ruling 5793380467 (不动 + 声明) exactly. No bound, shape, key or export moves. (1) The FormFieldSchema.options describe (view.zod.ts, FormFieldBaseSchema row) now says: on a metadata form (schema-bound, built by defineForm), a row whose key is a spec enum omits `options`; the control derives the members from the served JSON Schema, and their meanings go in helpText. (2) The module-load refusal names the same remedy. Measured on origin/main @ dabf8d795e, the refusal is SystemIdentifierSchema's regex message ('System identifier must be lowercase, starting with a letter, and may contain letters, numbers, underscores, or dots (e.g., \"user_profile\" or \"order.created\")', invalid_format at sections.0.fields.0 then options.0.value inside an invalid_union), thrown by defineForm via FormViewSchema.parse. Located by content: the text is declared in shared/identifiers.zod.ts and is shared with object-field options and three object-storage names, and FormSelectOptionSchema reuses the value schema BY REFERENCE (pinned). So the remedy cannot live at the declaration. defineForm now does safeParse and rethrows a ZodError with the same issues; only a grammar refusal (invalid_format / too_small) at options.INDEX.value gets the remedy sentence appended to its unchanged message. (3) Generated: only content/docs/references/ui/view.mdx moved, 2 options rows (check:docs was the 1 stale artifact of 15). PR #19809 also regenerates that page; its row-limit rows are elsewhere, and a collision is regenerated, never hand-merged. (4) Changeset @objectstack/spec patch, Clause-② no. Census: 27 inline `options` lists in 11 of the 17 metadata forms. All are spec enums, none contains an unspellable member, none is converted (list in Acceptance notes and open_questions). The claim names this branch. The assignee was already set by PM. The worktree is removed after this report.",
  "tests": "All at PR head ebd7fc2fa8 unless noted. @objectstack/spec vitest --project local: 'Test Files  527 passed (527) · Tests  15517 passed | 1 todo (15518)'. --project repo: 'Test Files  35 passed (35) · Tests  602 passed (602)'. spec typecheck (tsc + scripts + test layer) exit 0. @objectstack/platform-objects vitest: 'Test Files  54 passed (54) · Tests  883 passed (883)'; the first attempt was NOT MEASURED because 13 files could not load with metadata-core/formula/core having no dist; green after building the '@objectstack/objectql...' closure. platform-objects typecheck exit 0. spec check:generated: 'All 15 generated artifacts are up to date' after --fix regenerated view.mdx. New pin file packages/spec/src/ui/form-option-enum-derive.test.ts has 16 tests: the remedy is named for new-tab / perRecord / system-data (invalid_format) and x (too_small), with the grammar message kept verbatim ahead of it; a nested row gets it too; FIRING CONTROL: the same predicate is red on today's message, read live off the object face (same property schema, no remedy); verdict unchanged; scope negatives (unknown key, unrelated refusal); describe pin read from z.toJSONSchema(FormFieldSchema). ABLATION at 2aa26de218 via scripts/ablation-replace.mjs under os-verify-lock: anchor 'throw new z.ZodError(withOptionValueDeriveRemedy(parsed.error.issues));' replaced by 'throw parsed.error;', anchor x1→x0, blob 998be839→9ebe5eb7, 'Tests  9 failed | 7 passed (16)' (exactly the remedy + nested assertions red), restored blob == HEAD 998be839 with git diff HEAD empty. No dist in the path: the test imports ./view.zod source. Gates: dispatch-gates --commands at ebd7fc2fa8 derived 107; --ran verdict '107 derived famil(ies) accounted for — 104 run, 3 NOT-MEASURED'; all 104 exit 0 (check:doc-formula-expressions, check:doc-security-posture, check:docs-transcript-drift and check:lean-entry-closure first exited 3 and were re-run green after the objectql closure build). NOT MEASURED: check:skill-examples (needs the client/client-react closure, 35 packages), check:dual-build-cjs-loads (needs every package built), check:type-check-debt (needs the whole packages/* build); all left to CI. Old-text readers: git grep over packages/ for the old describe and 'System identifier must' found no pinning test; only the generated view.mdx, regenerated.",
  "mcp_calls": "0",
  "api_writes": "7. git push x4 through write-pace (empty-branch probe, then 2aa26de218, 67c8ac5a79, ebd7fc2fa8). 1 PR create through the fleet-write relay (with-fleet.sh --via dispatch; op pr_create, which issues POST /repos/objectstack-ai/objectstack/pulls with draft:true; run 35893522701 succeeded; PR #19906, body read back byte-identical, 12288 bytes). 1 dispatch POST /repos/objectstack-ai/objectstack/dispatches carried that op. 1 os-dev-report comment through post-stamped.mjs. 0 labels, 0 PATCH.",
  "open_questions": [
    {
      "question": "Ruling item 1 read literally ('For a metadata-form row whose key is a spec enum, options is omitted'), and the describe now states it that way. Yet 27 in-repo metadata-form rows hand-list enum members, and an object.form.ts comment from #19331 says the opposite for five of them ('Each enum gets an explicit options list because the bare member reads as a word…'). None is broken, since all members are spellable, and none was converted, as dispatched. What happens to these rows?",
      "options": [
        "A. File one follow-up card to convert the 24 full-member rows (labels move into helpText). Ask for a ruling on the 3 deliberate subsets (object fields.type omits secret/user; the two master_detail deleteBehavior rows omit set_null), because the derive path would widen what they offer.",
        "B. Read ruling item 1 as scoped to UNSPELLABLE enums only, and narrow the describe wording in a follow-up.",
        "C. Leave both as they are. The served describe then states a rule that 27 in-repo rows do not follow."
      ],
      "recommendation": "A. The ruling letter is explicit, and an AI author copying object.form.ts now sees the form and the served describe disagree. The 24 conversions are mechanical. Only the 3 subsets need a decision, because a subset cannot be expressed without `options`."
    }
  ],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed (Acceptance notes) · a schema-bound form view authored outside defineForm (stack view metadata with data.provider 'schema', parsed at compose/publish) still gets the bare grammar message; the ruling names the module-load refusal only",
    "carrier: 承接者:无 · noted, not filed (Acceptance notes) · the 27-row census, and the object.form.ts #19331 comment that contradicts ruling item 1; carried as open_questions[0]",
    "carrier: 承接者:无 · noted, not filed · branch is 4 commits behind origin/main (44ce049a8c); none of them touches packages/spec or any file in this diff, so the branch was not updated"
  ]
}

---

Generated by Claude Code

[os-support-ai]

Hold note, 2026-09-23T17:12Z: PR #19906 executes ruling 5793380467 to the letter. The round measured a counter-fact: 27 in-repo metadata-form rows hand-list enum members, 5 of them deliberately (#19331), and 3 are subsets the derive path cannot express. That question is filed as the decision card #19907. ⛔ The seat does not arm PR #19906 for merge until #19907 is answered, because 乙 would change one describe sentence and the remedy text in this PR.

---

Generated by Claude Code