@@ -0,0 +1,11 @@
+---
+'@objectstack/service-settings': patch
+---
+
+The settings routes' identity door resolves through `@objectstack/core`'s `resolveRequestExecutionContext`, the one request-to-`ExecutionContext` composition
+
+Clause-②: no
+
+- `SettingsServicePlugin` resolves the caller of every `/api/settings` route by calling `resolveRequestExecutionContext` with this door's differences as named parameters: `anonymous: 'fail-closed'`, `authGate: 'resolved'`, `credentials: 'api-key-and-session'`, `sessionApi: 'optional'`, `session: 'request'`, its own way to reach the `tenancy` service, `localization: 'withhold'`, no request locale, `accessToken: 'withhold'`, and no OAuth provenance or admission channel. The engine and auth-service lookups, the header normalisation, the tenancy wiring, the projection to `SettingsContext` and the fail-closed `catch` stay at the door.
+- The answers are the ones the door gave before: an anonymous caller, an unrecognised cookie, a failed session read and a refused API key get `401 UNAUTHENTICATED`; a session or an API key owner the authentication policy holds gets `403` with its code and message; an unreadable permission store or tenancy service gets `503 SERVICE_UNAVAILABLE`; and an API key its own lifecycle refuses gets its `403` and code. A one-off probe of 29 fault wirings through the listing route read the same answer on both sides of the change.
+- Nothing to do for a consumer: no export, route, configuration key or response shape changed.
@@ -0,0 +1,11 @@
+---
+'@objectstack/spec': patch
+---
+
+The liveness ledger's `form.sharing` and `formViews` rows quote the code that reads their keys as it now reads
+
+Clause-②: no (only the two rows' evidence text changes and both statuses stay `live`: `ViewSchema` accepts `form.sharing` and `formViews` exactly as before, and no state count moves)
+
+- `liveness/view.json`, row `form.sharing`: the evidence quoted a `slugMatchesPublicLink(sharing.publicLink, slug)` call that no longer exists. It now cites `packages/rest/src/form-routes.ts#findPublicFormView`, which loops over `anonymousFormIntakeCandidates(view)`, and the two rules in `packages/spec/src/ui/anonymous-form-intake.ts` it reads: `anonymousFormIntakeCandidates`, which hands each form's `sharing` to the slug rule, and `anonymousFormIntakeSlug`, which reads all three keys (`enabled`, `allowAnonymous` and `publicLink`). The `resolveFormBySlug` clause now says where `publicFormGrant` is set: in the submit door, for the match that `resolveFormBySlug` returns.
+- `liveness/view.json`, row `formViews`: the evidence quoted `const formViews = view.formViews`, which no longer exists. It now quotes the line of `anonymousFormIntakeCandidates` that makes every `formViews` entry a candidate.
+- The verdicts, the notes and every other row are unchanged.
@@ -111,8 +111,16 @@ test('grouped: fieldGroup sections render and Money starts collapsed', async ({
 
   // objectui#2577: fieldGroups[].icon renders as a real (Lucide svg) icon in
   // the section header — not as literal icon-name text.
+  // A collapsible section's header is a disclosure button named by its title
+  // (objectui#12625); the icon sits beside the title span inside it, and the
+  // chevron in a SIBLING element. So the svg is looked up under whatever
+  // element directly holds the title span: a bare `button svg` would also
+  // match the chevron and stay green with no icon at all.
   await expect(
-    page.locator('div:has(> span:text-is("Money")) svg').first(),
+    page
+      .getByRole('button', { name: 'Money' })
+      .locator('*:has(> span:text-is("Money")) svg')
+      .first(),
     'Money header icon svg',
   ).toBeVisible();
   await expect(page.getByText('banknote', { exact: true })).toHaveCount(0);
 
@@ -182,12 +182,13 @@ const TRANSPORT_LEDGER: Record<string, 'guarded' | 'propagates'> = {
   // The one request-to-ExecutionContext composition (ruling record 6227928430,
   // letter A). It catches nothing around the resolver: every door that calls
   // it — the runtime dispatcher's `resolve-execution-context.ts` first, REST's
-  // `rest-server.ts` second, whose fail-closed `catch` re-raises the outage —
-  // receives the outage and answers it at its own net.
+  // `rest-server.ts` second and the settings door's
+  // `settings-service-plugin.ts` third, each of the last two through a
+  // fail-closed `catch` that re-raises the outage — receives the outage and
+  // answers it at its own net.
   'packages/core/src/security/request-execution-context.ts': 'propagates',
   'packages/mcp/src/plugin.ts': 'propagates',
   'packages/services/service-datasource/src/admin-routes.ts': 'guarded',
-  'packages/services/service-settings/src/settings-service-plugin.ts': 'guarded',
   'packages/services/service-storage/src/storage-service-plugin.ts': 'guarded',
   'packages/plugins/plugin-sharing/src/sharing-plugin.ts': 'guarded',
   'packages/plugins/plugin-hono-server/src/current-user-endpoints.ts': 'guarded',
 
@@ -69,6 +69,7 @@
     "@objectstack/service-job": "workspace:*",
     "@objectstack/service-messaging": "workspace:*",
     "@objectstack/service-package": "workspace:*",
+    "@objectstack/service-settings": "workspace:*",
     "typescript": "^6.0.3",
     "vitest": "^4.1.11"
   },