@@ -0,0 +1,13 @@
+---
+'@object-ui/console': patch
+---
+
+fix(console): a share link to a non-chat record shows the record's fields as read-only rows, not raw JSON
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** The share-link page `/s/:token` printed `JSON.stringify(record)` in a code block for every object except `ai_conversations`: field API names, unformatted values and nested objects as JSON.
+- **Now.** The page renders one read-only row per key the resolve answer carries. The label is the key humanized (`annual_revenue` reads "Annual Revenue"). The value is formatted by its JSON shape: ISO dates and date-times in the visitor's locale, numbers grouped, booleans as Yes / No, lists and nested objects as short text, and an empty value as a dash. System fields such as `id` and `created_at` are shown after the business fields. A record with no fields left reads "No data".
+- **Unchanged.** The page shows exactly the fields the server returned: redacted fields stay absent and the "Some fields are hidden by the owner" line still renders. The `ai_conversations` transcript, the resolve request, its headers and the password flow do not change.
+- **Not yet.** Field labels and field types are not in the resolve answer, and an anonymous visitor cannot read the object's metadata, so authored labels, picklist labels, currency and lookup names do not show yet.
@@ -0,0 +1,113 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * SharedRecordFields — the read-only field list a share link to a non-chat
+ * record renders (objectstack#26767), in place of the raw JSON dump it showed.
+ *
+ * What it draws from is exactly what the resolve answer carries: the record's
+ * own keys, after the server stripped the link's redacted fields. ⛔ It never
+ * adds a key the record does not carry, and never fetches anything to widen it.
+ *
+ * Why no field labels or field types. The resolve answer is `{ record, link,
+ * redactFields }` on both producers — no object schema. The one door to that
+ * schema, `GET /meta/object/:name`, refuses an anonymous caller, and this page's
+ * visitor is anonymous by design (its requests carry no bearer token). So the
+ * label is the record key humanized, and the value is formatted by its JSON
+ * shape: an ISO date or date-time string through the console's one date-display
+ * path, a number through its one number-display path, a boolean as Yes / No,
+ * and an array or object as short text — never raw JSON.
+ *
+ * System fields are shown, not hidden: the record detail view's notion of a
+ * framework-managed column (`isSystemManagedField`, `@object-ui/types`) only
+ * orders them after the business fields, the way the detail view keeps
+ * provenance out of the leading rows.
+ */
+
+import { formatDate, formatDateTime, formatDisplayNumber, humanizeLabel } from '@object-ui/core';
+import { useDisplayLocale, useObjectTranslation } from '@object-ui/i18n';
+import { isSystemManagedField } from '@object-ui/types';
+
+/** An empty value's face — the date-display path's own placeholder. */
+const EMPTY = '—';
+
+/** How deep a nested value is spelled out before it is elided. */
+const MAX_DEPTH = 2;
+
+const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+const DATE_TIME = /^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?$/;
+
+type Translate = ReturnType<typeof useObjectTranslation>['t'];
+
+function formatString(value: string, locale: string): string {
+  if (value === '') return EMPTY;
+  if (DATE_ONLY.test(value)) {
+    const text = formatDate(value, undefined, { locale });
+    return text === EMPTY ? value : text;
+  }
+  if (DATE_TIME.test(value)) {
+    const text = formatDateTime(value, { locale });
+    return text === EMPTY ? value : text;
+  }
+  return value;
+}
+
+/** One value as display text, by its JSON shape. */
+function formatValue(value: unknown, locale: string, t: Translate, depth = 0): string {
+  if (value === null || value === undefined) return EMPTY;
+  if (typeof value === 'string') return formatString(value, locale);
+  if (typeof value === 'number') return Number.isFinite(value) ? formatDisplayNumber(value, { locale }) : String(value);
+  if (typeof value === 'boolean') {
+    return value ? t('common.yes', { defaultValue: 'Yes' }) : t('common.no', { defaultValue: 'No' });
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) return EMPTY;
+    if (depth >= MAX_DEPTH) return '…';
+    return value.map((item) => formatValue(item, locale, t, depth + 1)).join(', ');
+  }
+  if (typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>);
+    if (entries.length === 0) return EMPTY;
+    if (depth >= MAX_DEPTH) return '…';
+    return entries.map(([k, v]) => `${humanizeLabel(k)}: ${formatValue(v, locale, t, depth + 1)}`).join('; ');
+  }
+  return String(value);
+}
+
+export interface SharedRecordFieldsProps {
+  /** The record as the resolve answer carried it, redacted fields already stripped. */
+  record: Record<string, unknown>;
+}
+
+export function SharedRecordFields({ record }: SharedRecordFieldsProps) {
+  const { t } = useObjectTranslation();
+  const locale = useDisplayLocale();
+  const keys = Object.keys(record);
+
+  if (keys.length === 0) {
+    return <p className="text-sm text-muted-foreground">{t('common.noData', { defaultValue: 'No data' })}</p>;
+  }
+
+  const business = keys.filter((key) => !isSystemManagedField(key));
+  const system = keys.filter((key) => isSystemManagedField(key));
+
+  const rows = (group: string[]) =>
+    group.map((key) => (
+      <div key={key} className="grid grid-cols-1 gap-1 py-2 sm:grid-cols-[minmax(8rem,1fr)_2fr] sm:gap-4">
+        <dt className="text-xs font-medium text-muted-foreground">{humanizeLabel(key)}</dt>
+        <dd className="min-w-0 whitespace-pre-wrap break-words text-sm text-foreground">
+          {formatValue(record[key], locale, t)}
+        </dd>
+      </div>
+    ));
+
+  return (
+    <div className="rounded-md border bg-card px-4">
+      {business.length > 0 && <dl className="divide-y">{rows(business)}</dl>}
+      {system.length > 0 && (
+        <dl data-testid="shared-record-system-fields" className={business.length > 0 ? 'divide-y border-t' : 'divide-y'}>
+          {rows(system)}
+        </dl>
+      )}
+    </div>
+  );
+}
@@ -0,0 +1,181 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * objectstack#26767 — a share link to any object other than `ai_conversations`
+ * renders the shared record read-only, as labelled rows, and never as the raw
+ * `JSON.stringify(record)` dump it used to print in a `pre` block.
+ *
+ * The stub answers `/share-links/:token/resolve` the way both producers do: the
+ * enveloped `{ success, data: { record, link, redactFields } }`, with the
+ * redacted fields already stripped from `record`. Every visitor is anonymous.
+ */
+
+import '@testing-library/jest-dom/vitest';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { cleanup, render, screen, within } from '@testing-library/react';
+import { MemoryRouter, Route, Routes } from 'react-router-dom';
+import { formatDate } from '@object-ui/core';
+import { I18nProvider } from '@object-ui/i18n';
+import { builtInLocales } from '@object-ui/i18n/locales';
+import SharedRecordPage from './SharedRecordPage';
+
+const TOKEN = 'tok_26767';
+
+/** An `account`-like record as resolve hands it over, `ssn` already redacted. */
+const ACCOUNT = {
+  id: 'acc_1',
+  name: 'Acme Corporation',
+  annual_revenue: 1250000,
+  is_active: true,
+  founded_on: '2026-03-15',
+  tags: ['enterprise', 'emea'],
+  billing_address: { city: 'Paris', zip: '75001' },
+  parent_id: null,
+  created_at: '2026-01-02T03:04:05.000Z',
+};
+
+const json = (status: number, body: unknown) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+function shareServer(objectName: string, record: Record<string, unknown>, redactFields: string[]) {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (input: string | URL | Request) => {
+      const raw = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+      const { pathname } = new URL(raw, 'http://localhost');
+      if (pathname === `/api/v1/share-links/${TOKEN}/resolve`) {
+        return json(200, {
+          success: true,
+          data: {
+            record,
+            link: {
+              id: 'sl_1',
+              token: TOKEN,
+              object_name: objectName,
+              record_id: String(record.id),
+              permission: 'view',
+              audience: 'anyone',
+            },
+            redactFields,
+          },
+        });
+      }
+      if (pathname === `/api/v1/share-links/${TOKEN}/messages`) return json(200, { success: true, data: [] });
+      return new Response(null, { status: 404 });
+    }),
+  );
+}
+
+function renderLink(language?: 'zh') {
+  const routed = (
+    <MemoryRouter initialEntries={[`/s/${TOKEN}`]}>
+      <Routes>
+        <Route path="/s/:token" element={<SharedRecordPage />} />
+      </Routes>
+    </MemoryRouter>
+  );
+  return render(
+    language ? (
+      <I18nProvider config={{ defaultLanguage: language, detectBrowserLanguage: false }} persistLanguage={false}>
+        {routed}
+      </I18nProvider>
+    ) : (
+      routed
+    ),
+  );
+}
+
+/** The value cell beside the row whose label reads `label`. */
+function valueOf(label: string): string {
+  const term = screen.getByText(label, { selector: 'dt' });
+  const value = term.parentElement?.querySelector('dd');
+  expect(value).not.toBeNull();
+  return value!.textContent ?? '';
+}
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe('SharedRecordPage — a shared non-chat record renders as read-only rows (objectstack#26767)', () => {
+  it('renders each record key as a labelled, formatted row, and no pre block or JSON', async () => {
+    shareServer('account', ACCOUNT, ['ssn']);
+    const { container } = renderLink();
+
+    expect(await screen.findByText('Shared account')).toBeInTheDocument();
+
+    expect(container.querySelector('pre')).toBeNull();
+    expect(container.textContent).not.toContain('"name"');
+    expect(container.textContent).not.toContain('{');
+
+    expect(valueOf('Name')).toBe('Acme Corporation');
+    expect(valueOf('Annual Revenue')).toBe('1,250,000');
+    expect(valueOf('Is Active')).toBe('Yes');
+    expect(valueOf('Founded On')).toBe(formatDate('2026-03-15', undefined, { locale: 'en' }));
+    expect(valueOf('Founded On')).not.toBe('2026-03-15');
+    expect(valueOf('Parent Id')).toBe('—');
+    expect(valueOf('Created At')).not.toContain('T03:04:05');
+
+    // Exactly the keys the record carried: no row is added, none is dropped.
+    expect(container.querySelectorAll('dt')).toHaveLength(Object.keys(ACCOUNT).length);
+    // System fields are shown, ordered after the business fields.
+    const system = screen.getByTestId('shared-record-system-fields');
+    expect(within(system).getByText('Id', { selector: 'dt' })).toBeInTheDocument();
+    expect(within(system).getByText('Created At', { selector: 'dt' })).toBeInTheDocument();
+    expect(within(system).queryByText('Name', { selector: 'dt' })).toBeNull();
+  });
+
+  it('a nested value renders as text, never as [object Object] or JSON', async () => {
+    shareServer('account', ACCOUNT, []);
+    const { container } = renderLink();
+
+    await screen.findByText('Shared account');
+    expect(valueOf('Tags')).toBe('enterprise, emea');
+    expect(valueOf('Billing Address')).toBe('City: Paris; Zip: 75001');
+    expect(container.textContent).not.toContain('[object Object]');
+  });
+
+  it('a redacted field stays absent, and the hidden-fields line still shows', async () => {
+    shareServer('account', ACCOUNT, ['ssn']);
+    renderLink();
+
+    await screen.findByText('Shared account');
+    expect(screen.queryByText('Ssn', { selector: 'dt' })).toBeNull();
+    expect(screen.getByText('Some fields are hidden by the owner: ssn')).toBeInTheDocument();
+  });
+
+  it('a record with no fields left says so instead of an empty box', async () => {
+    shareServer('account', {}, ['name']);
+    const { container } = renderLink();
+
+    await screen.findByText('Shared account');
+    expect(screen.getByText('No data')).toBeInTheDocument();
+    expect(container.querySelector('dt')).toBeNull();
+  });
+
+  it('the ai_conversations branch is unchanged: the transcript, not a field list', async () => {
+    shareServer('ai_conversations', { id: 'conv_1', title: 'Quarterly plan' }, []);
+    const { container } = renderLink();
+
+    expect(await screen.findByText('Quarterly plan')).toBeInTheDocument();
+    expect(await screen.findByText('This conversation has no messages yet.')).toBeInTheDocument();
+    expect(container.querySelector('dt')).toBeNull();
+    expect(container.querySelector('pre')).toBeNull();
+  });
+
+  it('under zh the value words come from the zh pack', async () => {
+    const { zh, en } = builtInLocales;
+    // Guard: these are real zh rows, not English copies.
+    expect(zh.common.yes).not.toBe(en.common.yes);
+    expect(zh.sharedRecord.redactedFields).not.toBe(en.sharedRecord.redactedFields);
+
+    shareServer('account', { id: 'acc_1', is_active: true, is_vip: false }, ['ssn']);
+    renderLink('zh');
+
+    expect(await screen.findByText('分享的 account')).toBeInTheDocument();
+    expect(valueOf('Is Active')).toBe(zh.common.yes);
+    expect(valueOf('Is Vip')).toBe(zh.common.no);
+    expect(screen.getByText(zh.sharedRecord.redactedFields.replace('{{fields}}', 'ssn'))).toBeInTheDocument();
+  });
+});
@@ -13,7 +13,9 @@
  * a read-only transcript with the SAME `ChatbotEnhanced` renderer the live
  * chat uses (in `readOnly` mode — no composer), so assistant tool calls show
  * as proper proposed-plan / draft cards instead of a raw tool-result JSON
- * dump. Other object kinds fall back to a generic JSON preview.
+ * dump. Every other object renders its fields read-only through
+ * `SharedRecordFields`: the record's own keys, labelled and formatted, and
+ * never the raw JSON (objectstack#26767).
  *
  * A link's password travels in the `X-Share-Password` request header, never in
  * the request URL (objectui#11649) — see `SHARE_PASSWORD_HEADER`. A `401` is
@@ -49,6 +51,7 @@ import {
   type ResolvedShare,
   type ResolveErrorBody,
 } from './shared-record-shape';
+import { SharedRecordFields } from './SharedRecordFields';
 
 /**
  * Why the link did not open. The server's own message is shown as it came;
@@ -333,7 +336,7 @@ export default function SharedRecordPage() {
     );
   }
 
-  // Generic fallback: dump the JSON record.
+  // Every other object: the record's fields, read-only.
   return (
     <div className="mx-auto flex h-svh max-w-3xl flex-col bg-background">
       <header className="border-b px-4 py-3">
@@ -342,9 +345,7 @@ export default function SharedRecordPage() {
         </h1>
       </header>
       <main className="flex-1 overflow-y-auto p-4">
-        <pre className="overflow-x-auto rounded-md border bg-muted/30 p-3 text-[12px]">
-          {JSON.stringify(data.record, null, 2)}
-        </pre>
+        <SharedRecordFields record={data.record} />
         {data.redactedFields && data.redactedFields.length > 0 && (
           <p className="mt-2 text-[11px] text-muted-foreground">
             {t('sharedRecord.redactedFields', {