@@ -539,7 +539,7 @@ Sort field and direction pair
 | **drawerWidth** | `string \| number` | optional | Drawer width (drawer) |
 | **modalSize** | `Enum<'sm' \| 'default' \| 'lg' \| 'xl' \| 'full'>` | optional | Modal size (modal) |
 | **modalCloseButton** | `boolean` | optional | Show the modal close button (modal) |
-| **contentLayout** | `any` | optional | Modal content layout config (modal) |
+| **contentLayout** | `Enum<'simple' \| 'tabbed'>` | optional | How the modal presentation lays out its sections (modal) — 'simple' stacks them (the default); 'tabbed' puts each section on its own tab once more than one section has a field to show |
 | **confirmOnDiscard** | `boolean` | optional | Confirm before discarding edits (drawer/modal) |
 | **submitText** | `string \| Record<string, string>` | optional | Submit button label |
 | **cancelText** | `string \| Record<string, string>` | optional | Cancel button label |
@@ -548,14 +548,32 @@ Sort field and direction pair
 | **showSubmit** | `boolean` | optional | Show the submit button |
 | **showCancel** | `boolean` | optional | Show the cancel button |
 | **showReset** | `boolean` | optional | Show the reset button |
-| **submitBehavior** | `any` | optional | What happens after a successful submit (`{ kind: 'thank-you' \| …, title?, message? }`) |
+| **submitBehavior** | `{ kind: 'thank-you'; title?: string; message?: string } \| { kind: 'redirect'; url: string; delayMs?: integer } \| { kind: 'continue' } \| { kind: 'next-record' }` | optional | What happens after a successful submit — the same block a form view's `submitBehavior` declares: `{ kind: 'thank-you', title?, message? }`, `{ kind: 'redirect', url, delayMs? }` (a relative `url`, interpolating declared record fields as `{{record.field_name}}`), `{ kind: 'continue' }` or `{ kind: 'next-record' }`. Takes precedence over `navigateOnSuccess` and `resetOnSuccess` |
 | **successMessage** | `string \| Record<string, string>` | optional | Toast message on successful submit |
 | **resetOnSuccess** | `boolean` | optional | Reset the form after a successful submit |
-| **navigateOnSuccess** | `any` | optional | Navigate after a successful submit |
+| **navigateOnSuccess** | `string` | optional | Relative path to navigate to after a successful create/update — `{id}` / `{recordId}` are replaced with the saved record's id, URL-escaped; an absolute URL is refused at submit and reported on the success toast. Ignored when `submitBehavior` is set — prefer `submitBehavior` |
 | **readOnly** | `boolean` | optional | Render every field read-only |
 | **initialValues** | `Record<string, any>` | optional | Prefill values (create mode) |
 | **initialData** | `Record<string, any>` | optional | Alternate spelling of `initialValues` the renderer also reads |
-| **mobile** | `any` | optional | Mobile presentation overrides |
+| **mobile** | `{ stickyActions?: boolean; stepper?: boolean \| 'auto'; stepperMinFields?: integer; stepperFieldsPerStep?: integer; … }` | optional | Phone presentation options, each opt-in — `{ stickyActions?, stepper?, stepperMinFields?, stepperFieldsPerStep?, fullscreenLongText? }`. Read by the flat (simple, sectionless) form |
+
+### Nested Shape: `ObjectFormProps.submitBehavior[kind='redirect']`
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **kind** | `'redirect'` | ✅ |  |
+| **url** | `string` | ✅ | Where the browser goes after a successful submit. Ruled 2026-08-11: (1) RELATIVE paths only — it must start with `/`, and absolute or protocol-relative URLs are refused, which is what closes the open-redirect face; (2) interpolation ONLY from declared record fields, spelled `{{record.field_name}}`, and every interpolated value is URL-escaped when the redirect is built; (3) a verbatim redirect on the resolved relative path is the intended consumption. To send the browser OUT of the app, use an app navigation item (`{ type: 'url', url }`) instead. |
+| **delayMs** | `integer` | optional |  |
+
+### Nested Shape: `ObjectFormProps.mobile`
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **stickyActions** | `boolean` | optional | Pin the submit / cancel bar to the bottom of a phone-width viewport |
+| **stepper** | `boolean \| 'auto'` | optional | One-step-at-a-time wizard for a flat form — `true` always, `'auto'` only on a phone-width viewport once the form has `stepperMinFields` fields, `false` (the default) never |
+| **stepperMinFields** | `integer` | optional | The field count at which `stepper: 'auto'` steps up (default 8) |
+| **stepperFieldsPerStep** | `integer` | optional | Fields shown per stepper step (default 1) |
+| **fullscreenLongText** | `boolean` | optional | Offer a fullscreen editor on textarea and rich-text fields |
 
 
 ---
 
@@ -21,7 +21,7 @@ The `strict` column is the one the campaign schedules against; it counts both th
 
 | Dir | Sites | strict | passthrough | catchall | strip |
 |---|---|---|---|---|---|
-| `ui/` | 191 | 180 | 4 | 0 | 7 |
+| `ui/` | 192 | 181 | 4 | 0 | 7 |
 
 ## `ui/` — sites
 
@@ -36,7 +36,7 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | `app.zod.ts` | 19 |
 | `bulk-action.zod.ts` | 4 |
 | `chart.zod.ts` | 8 |
-| `component.zod.ts` | 61 |
+| `component.zod.ts` | 62 |
 | `dashboard.zod.ts` | 11 |
 | `dataset.zod.ts` | 4 |
 | `i18n.zod.ts` | 1 |
@@ -46,23 +46,23 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | `sharing.zod.ts` | 1 |
 | `view.zod.ts` | 60 |
 | `widget.zod.ts` | 1 |
-| **total** | **191** |
+| **total** | **192** |
 
 ## `ui/` — open
 
 Per file, how many of its sites still silently discard unknown keys. The `Class`
 column that decides the bucket split is hand-written in the ledger; the arithmetic
 over it is here.
 
-**7 strip of 191**, in 4 file(s).
+**7 strip of 192**, in 4 file(s).
 
 | File | Strip | Sites |
 |---|---|---|
 | `action-params.zod.ts` | 1 | 1 |
 | `app.zod.ts` | 1 | 19 |
 | `view.zod.ts` | 4 | 60 |
 | `widget.zod.ts` | 1 | 1 |
-| **total** | **7** | **191** |
+| **total** | **7** | **192** |
 
 | Bucket | Sites |
 |---|---|
 
@@ -19486,6 +19486,55 @@ const step18: MigrationStep = {
         + 'group per value of that field, and a board that showed one swimlane shows one swimlane per value — '
         + 'check that this is the grouping you meant.',
     },
+    // #21464 — four members of the `object-form` page block were `z.unknown()`
+    // although the form reads each with a fixed shape, so an off-shape value passed
+    // the component-props gate and the form fell back or ignored it in silence. The
+    // row now takes the form view's own `submitBehavior` by reference and the
+    // measured shape for `contentLayout`, `navigateOnSuccess` and `mobile`. The
+    // form's `fields` and `sections` and the master-detail form's two are held at
+    // `z.unknown()` (the form draws a `{ name }` field entry and an inline runtime
+    // field inside a section, which the typed shapes would refuse), and
+    // `customFields` waits for the spec to declare objectui's runtime form field.
+    // D3 only: page-component `properties` is not parsed on the metadata save or
+    // load path, so a stored page is never refused; an off-shape value has no
+    // rewrite that says what the author meant; and the authored census found no
+    // authored value to respell — the refused values are fixtures probing that the
+    // form refuses them.
+    {
+      id: 'ui-object-form-members-typed',
+      surface: 'page `object-form` components — `properties.contentLayout`, `.submitBehavior`, '
+        + '`.navigateOnSuccess` and `.mobile` (which used to accept any value)',
+      replacement: 'the shape the form reads: `contentLayout` `\'simple\'` or `\'tabbed\'`; `submitBehavior` the '
+        + 'form view\'s own block — `{ kind: \'thank-you\', title?, message? }`, `{ kind: \'redirect\', url, '
+        + 'delayMs? }` with a relative `url`, `{ kind: \'continue\' }` or `{ kind: \'next-record\' }`; '
+        + '`navigateOnSuccess` a relative path string; `mobile` `{ stickyActions?, stepper?, stepperMinFields?, '
+        + 'stepperFieldsPerStep?, fullscreenLongText? }`, with `stepper` `true`, `false` or `\'auto\'` and the two '
+        + 'counts positive integers. Write a `submitBehavior` `kind` as one of the four; move a `redirect` '
+        + 'destination to a relative path; write `heading` as `title`.',
+      reason: 'The form reads these members with one shape, and the page-component row declared them '
+        + '`z.unknown()`, so any value passed the component-props gate and the form answered an off-shape one '
+        + 'with a silent default: a `submitBehavior` `kind` it does not know fell through to the thank-you panel; '
+        + 'a misspelled `contentLayout` such as `\'tabs\'` stacked the sections; a `navigateOnSuccess` that is not a '
+        + 'string threw after the record was written, so the submit reported a failure; and a `mobile` member it '
+        + 'does not read, or a `stepper` outside `true` / `false` / `\'auto\'`, was ignored. The row now takes '
+        + 'the form view\'s own `submitBehavior` by reference — the block the renderers already judge a redirect '
+        + '`url` through — so one value is judged the same way on the form view and the block, and the measured '
+        + 'shape for the other three. The form\'s `fields` and `sections` and the master-detail form\'s two stay '
+        + 'open, because the form draws a `{ name }` field entry and an inline runtime field inside a section, '
+        + 'which the typed shapes would refuse; and `customFields` stays open until the spec declares the '
+        + 'runtime form field its entries are. It is read where every page component\'s props are: the '
+        + 'component-props gate reports a refused value as an advisory `component-props-invalid` / '
+        + '`component-props-unknown-key` finding on `objectstack validate`, `objectstack build` and '
+        + '`objectstack lint`, and a stored page still saves and loads, because a page component\'s '
+        + '`properties` is not parsed on the metadata save or load path. No conversion is registered: nothing '
+        + 'on the load path refuses the shape, and an off-shape value has no rewrite that both keeps what the '
+        + 'form shows today and honours what the author wrote — which is the judgment this entry leaves to the '
+        + 'upgrader. Deployed metadata NOT MEASURED.',
+      acceptanceCriteria: 'Every `object-form` node validates: `objectstack validate` reports no '
+        + '`component-props-invalid` / `component-props-unknown-key` finding under the four members\' paths. '
+        + 'Each form that set one of them now shows it: the post-submit behaviour it names, the modal\'s tabbed '
+        + 'sections, the navigation after a save, and the phone presentation.',
+    },
     // #21229 — an `object-grid` page block's `exportOptions` was `z.unknown()`, so a
     // bare format array (the list view's legacy spelling, which the list view lifts
     // to `{ formats }`) was accepted on the grid, whose renderer reads