@@ -0,0 +1,19 @@
+---
+"@objectstack/spec": minor
+"@objectstack/platform-objects": patch
+---
+
+Clause-②: no
+
+Five live structured metadata keys are authorable in the metadata form: `object.access`, `object.highlightFields`, `object.requiredPermissions`, `object.searchableFields` and `permission.adminScope`. Each was **declared** by its schema, graded `live` by the liveness ledger, and offered by **no** form in `METADATA_FORM_REGISTRY`, so an author's only door was the Source tab. Each now has exactly one row, whose control mirrors a row a registered form already carries for the same node shape:
+
+- `highlightFields` and `searchableFields` (Basics, beside `nameField`) — `widget: 'string-tags'`, the view form's `searchableFields` row: a free-text chip list over `string[]`. A field picker is not offered because the object draft carries no source object for one to read its catalog from. A misspelt entry is not dropped quietly: publishing refuses it (`object-field-ref-unknown`, `searchable-field-unknown`, both at `error`), and so does `os validate`. The object schema's own parse does not judge these names.
+- `access` (Advanced, beside `sharingModel`) — a `composite` over one declared `default` select (`public` / `private`), the `lifecycle` row's shape. Absent still resolves to `public`.
+- `requiredPermissions` (Advanced) — `widget: 'json'`, **never** `string-tags`: the value is a union of `string[]` and a `{read, create, update, delete}` map, and the tag widget reads a non-array as an empty list and writes the list back, which would silently replace a stored per-operation map. With the `json` hint the renderer resolves the face from the stored value's branch, so a stored map is edited as a map.
+- `permission.adminScope` (System Permissions) — `widget: 'json'`, the hint every structured row on the permission form carries; the renderer derives a nested form over its six keys, and edits merge into the stored scope.
+
+The help text states what the runtime does with each value, including what absence resolves to. The renderer behaviour described above is objectui's metadata-admin form engine at this repository's `.objectui-sha` pin.
+
+⛔ **No schema accept set moves and no export changes.** `METADATA_FORM_REGISTRY` is declared as an opaque `Readonly<Record<string, FormView>>`, so row contents were never part of the declared surface. What changes is the **form payload** `getMetaTypes()` serves and the translation keys `os i18n extract` walks — hence the regenerated `platform-objects` metadata-form bundles, whose 12 new leaves are authored in `zh-CN`, `ja-JP` and `es-ES` rather than left as extractor fills.
+
+⛔ **The gate that would notice a missing row is NOT landed here.** The reconciliation gate's top-level `zodOnly` direction stays unwired; this change lands offers only.
@@ -64,6 +64,14 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Is System",
         helpText: "System object (protected from deletion; defaults sharing to public)"
       },
+      highlightFields: {
+        label: "Highlight Fields",
+        helpText: "Field names of this object, most important first — the first entry wins where only one fits (ADR-0085). Drives the default list columns, cards, child-record previews and the detail highlight strip. A name that is not a field of this object is refused at publish."
+      },
+      searchableFields: {
+        label: "Searchable Fields",
+        helpText: "Field names the $search query matches (ADR-0061): the default for the record picker, list quick-search and global search; a view may narrow it. Unset, search uses the name/title field plus short-text fields. Each entry must name a stored field of this object — an unknown name or a virtual formula field is refused at publish."
+      },
       fields: {
         label: "Fields",
         helpText: "Add the columns this object will store"
@@ -269,6 +277,18 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Sharing Model",
         helpText: "Org-Wide Default record visibility for internal users. A custom object that omits it resolves to private at runtime (ADR-0090 D1)."
       },
+      access: {
+        label: "Access",
+        helpText: "Wildcard-grant posture (ADR-0066 D2). Absent resolves to public. It decides whether a permission set's '*' object grant covers this object; record visibility between users is sharingModel."
+      },
+      "access.default": {
+        label: "Default",
+        helpText: "public: covered by '*' wildcard grants. private: needs an explicit per-object grant, and is exempt from wildcard row-level security."
+      },
+      requiredPermissions: {
+        label: "Required Permissions",
+        helpText: "Capabilities (permission-set systemPermissions) a caller must hold to reach this object, checked in addition to CRUD grants (ADR-0066 D3). A list gates every operation; a {read, create, update, delete} map gates only the operations it lists. Absent or empty: no capability gate."
+      },
       managedBy: {
         label: "Managed By",
         helpText: "Lifecycle bucket: platform (user CRUD), config (admin authored), system-data (platform-defined schema with admin/user-writable data), engine-owned (no user writes), append-only (audit), better-auth (identity). UI clients derive their CRUD affordances from it, so it decides what a user is offered on records of this object."
@@ -2079,6 +2099,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "System Permissions",
         helpText: "List of system capability keys"
       },
+      adminScope: {
+        label: "Admin Scope",
+        helpText: "Delegated administration (ADR-0090 D12): lets holders of this set administer one business-unit subtree. businessUnit is the subtree root (sys_business_unit.name) and is required, non-blank; includeSubtree defaults to true; manageAssignments, manageBindings and authorEnvironmentSets default to false; a delegate may hand out only the sets named in assignablePermissionSets. Leave empty for a set that delegates nothing."
+      },
       objects: {
         label: "Objects",
         helpText: "{ \"account\": { allowRead: true, allowEdit: true, ... } }"
 
@@ -64,6 +64,14 @@ export const esESMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "Integrado del sistema",
         helpText: "Objeto de sistema (protegido contra eliminación; el uso compartido predeterminado es público)"
       },
+      highlightFields: {
+        label: "Campos destacados",
+        helpText: "Nombres de campo de este objeto, del más importante al menos; donde solo cabe uno, gana la primera entrada (ADR-0085). Determinan las columnas de lista predeterminadas, las tarjetas, las vistas previas de registros hijos y la franja destacada del detalle. Un nombre que no sea un campo de este objeto se rechaza al publicar."
+      },
+      searchableFields: {
+        label: "Campos buscables",
+        helpText: "Nombres de campo con los que coincide la consulta $search (ADR-0061): el valor predeterminado del selector de registros, la búsqueda rápida de listas y la búsqueda global; una vista puede acotarlo. Sin definir, la búsqueda usa el campo de nombre/título más los campos de texto corto. Cada entrada debe nombrar un campo almacenado de este objeto: un nombre desconocido o un campo formula virtual se rechaza al publicar."
+      },
       fields: {
         label: "Campos",
         helpText: "Añade las columnas que almacenará este objeto"
@@ -269,6 +277,18 @@ export const esESMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "Modelo de uso compartido",
         helpText: "Visibilidad predeterminada de la organización (OWD) para usuarios internos. Un objeto personalizado que lo omita se resuelve como private en tiempo de ejecución (ADR-0090 D1)."
       },
+      access: {
+        label: "Acceso",
+        helpText: "Postura ante las concesiones comodín (ADR-0066 D2). Si se omite, se resuelve como public. Decide si la concesión de objeto '*' de un conjunto de permisos cubre este objeto; la visibilidad de registros entre usuarios la decide sharingModel."
+      },
+      "access.default": {
+        label: "Exposición predeterminada",
+        helpText: "public: cubierto por las concesiones comodín '*'. private: necesita una concesión explícita por objeto y queda exento de la seguridad a nivel de fila comodín."
+      },
+      requiredPermissions: {
+        label: "Permisos requeridos",
+        helpText: "Capacidades (systemPermissions de conjuntos de permisos) que quien llama debe tener para acceder a este objeto, comprobadas además de las concesiones CRUD (ADR-0066 D3). Una lista restringe todas las operaciones; un mapa {read, create, update, delete} restringe solo las operaciones que enumera. Ausente o vacío: sin restricción por capacidad."
+      },
       managedBy: {
         label: "Gestionado por",
         helpText: "Categoría de ciclo de vida: platform (CRUD de usuario), config (escrito por el administrador), system-data (esquema definido por la plataforma con datos escribibles por administrador o usuario), engine-owned (sin escrituras de usuario), append-only (auditoría), better-auth (identidad). Los clientes de UI derivan de aquí las acciones CRUD disponibles, así que decide qué se ofrece al usuario en los registros de este objeto."
@@ -2079,6 +2099,10 @@ export const esESMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "Permisos del sistema",
         helpText: "Lista de claves de capacidades del sistema"
       },
+      adminScope: {
+        label: "Ámbito de administración delegada",
+        helpText: "Administración delegada (ADR-0090 D12): permite a quienes tienen este conjunto administrar un subárbol de unidades de negocio. businessUnit es la raíz del subárbol (sys_business_unit.name), es obligatorio y no puede estar en blanco; includeSubtree vale true por defecto; manageAssignments, manageBindings y authorEnvironmentSets valen false por defecto; un delegado solo puede asignar los conjuntos nombrados en assignablePermissionSets. Déjalo vacío en un conjunto que no delega nada."
+      },
       objects: {
         label: "Permisos de objeto",
         helpText: "Ejemplo: { \"account\": { allowRead: true, allowEdit: true, ... } }"
 
@@ -64,6 +64,14 @@ export const jaJPMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "システム組み込み",
         helpText: "システムオブジェクト（削除から保護。共有の既定は公開）"
       },
+      highlightFields: {
+        label: "ハイライト項目",
+        helpText: "このオブジェクトの項目名を重要な順に並べます。1 つしか表示できない場所では先頭の項目が使われます（ADR-0085）。既定の一覧列、カード、子レコードのプレビュー、詳細画面のハイライト帯を決めます。このオブジェクトの項目でない名前は公開時に拒否されます。"
+      },
+      searchableFields: {
+        label: "検索対象項目",
+        helpText: "$search クエリが照合する項目名（ADR-0061）。レコードピッカー、一覧のクイック検索、グローバル検索の既定値で、ビューで絞り込めます。未設定の場合は名前／タイトル項目と短いテキスト項目で検索します。各項目はこのオブジェクトの保存済みの項目を指す必要があり、不明な名前や仮想の formula 項目は公開時に拒否されます。"
+      },
       fields: {
         label: "フィールド",
         helpText: "このオブジェクトが保存する列を追加"
@@ -269,6 +277,18 @@ export const jaJPMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "共有モデル",
         helpText: "社内ユーザー向けの組織既定のレコード可視性（OWD）。カスタムオブジェクトで省略した場合、実行時は private として解決されます（ADR-0090 D1）。"
       },
+      access: {
+        label: "アクセス設定",
+        helpText: "ワイルドカード付与の方針（ADR-0066 D2）。省略時は public として解決されます。権限セットの '*' オブジェクト付与がこのオブジェクトに及ぶかどうかを決めます。ユーザー間のレコード可視性は sharingModel が決めます。"
+      },
+      "access.default": {
+        label: "既定の公開範囲",
+        helpText: "public: '*' ワイルドカード付与の対象になります。private: オブジェクトごとの明示的な付与が必要で、ワイルドカードの行レベルセキュリティの対象外になります。"
+      },
+      requiredPermissions: {
+        label: "必要な権限",
+        helpText: "このオブジェクトにアクセスするために呼び出し元が保持すべき機能（権限セットの systemPermissions）。CRUD 付与に加えてチェックされます（ADR-0066 D3）。リストはすべての操作を制限し、{read, create, update, delete} マップは列挙した操作だけを制限します。省略または空の場合、機能による制限はありません。"
+      },
       managedBy: {
         label: "ライフサイクル区分",
         helpText: "ライフサイクル区分: platform（ユーザーによる CRUD）、config（管理者が記述）、system-data（プラットフォーム定義のスキーマで、データは管理者／ユーザーが書き込み可）、engine-owned（エンジン所有、ユーザー書き込み不可）、append-only（監査）、better-auth（ID）。UI クライアントはこの値から CRUD の可否を導くため、このオブジェクトのレコードでユーザーに何が提供されるかを決めます。"
@@ -2079,6 +2099,10 @@ export const jaJPMetadataForms: NonNullable<TranslationData['metadataForms']> =
         label: "システム権限",
         helpText: "システム機能キーのリスト"
       },
+      adminScope: {
+        label: "委任管理スコープ",
+        helpText: "委任管理（ADR-0090 D12）: この権限セットの保持者が 1 つのビジネスユニットのサブツリーを管理できるようにします。businessUnit はサブツリーのルート（sys_business_unit.name）で、必須かつ空白不可です。includeSubtree の既定値は true、manageAssignments・manageBindings・authorEnvironmentSets の既定値は false です。委任先が付与できるのは assignablePermissionSets に挙げた権限セットだけです。何も委任しない権限セットでは空のままにしてください。"
+      },
       objects: {
         label: "オブジェクト権限",
         helpText: "例: { \"account\": { allowRead: true, allowEdit: true, ... } }"
 
@@ -895,10 +895,15 @@ describe('#19403 round 8 — the population, DERIVED from the form and a shape',
     // ratchet further down still reads zero. The population is DERIVED from the
     // form, so the arrival needed no edit here; these counts are the measured
     // facts that moved with it.
-    expect(PANEL_LEAVES.length).toBe(55);
+    // 61 since #20349: that card gave `advanced` the two ADR-0066 access rows —
+    // `access` (a composite over one declared `default` select) and
+    // `requiredPermissions` — a label and a help text each, three rows and six
+    // leaves, all eighteen translated leaves authored by the same card. `advanced`
+    // reads 46 → 52; `capabilities` is untouched.
+    expect(PANEL_LEAVES.length).toBe(61);
     expect(PANEL_LEAVES.every((l) => l.prop === 'label' || l.prop === 'helpText')).toBe(true);
     expect(PANEL_LEAVES.filter((l) => l.section === 'capabilities').length).toBe(9);
-    expect(PANEL_LEAVES.filter((l) => l.section === 'advanced').length).toBe(46);
+    expect(PANEL_LEAVES.filter((l) => l.section === 'advanced').length).toBe(52);
   });
 
   it('⭐ DARK, OUTWARD — the open sections are excluded, and `fields.placeholder` is the one that proves it', () => {
@@ -908,8 +913,11 @@ describe('#19403 round 8 — the population, DERIVED from the form and a shape',
     // 96 since #19331 gave `basics` its `nameField` row — the ADR-0079
     // record-title pointer the schema declared and no control offered — whose
     // label and help text are authored in all three locales by that same card,
-    // so the `openEchoes` reading below is unchanged at zero.
-    expect(OPEN_LEAVES.length).toBe(96);
+    // so the `openEchoes` reading below is unchanged at zero. 100 since #20349
+    // gave `basics` the object's two own field-name lists, `highlightFields` and
+    // `searchableFields`, beside `nameField` — four leaves, their twelve
+    // translated leaves authored by that card, so `openEchoes` stays at zero.
+    expect(OPEN_LEAVES.length).toBe(100);
     expect(PANEL_LEAVES.some((l) => l.path === 'fields.placeholder')).toBe(false);
     expect(OPEN_LEAVES.some((l) => l.path === 'fields.placeholder')).toBe(true);
     for (const path of ['name', 'label', 'fields', 'fields.valueDomain', 'fields.deleteBehavior', 'fields.expression']) {
 
@@ -1115,8 +1115,11 @@ describe('#19403 round 10 — the verdicts, on the live bundles', () => {
       // form's `columns` / `sort` / `tabs` repeaters, authored in all three
       // locales. 608 since #20161: the report form's joined-block `chart` row
       // left with its key (nothing ever drew a block chart), taking its label
-      // — authored in all three locales — out of the catalog.
-      expect(translated.length, `${locale} positive control`).toBe(608);
+      // — authored in all three locales — out of the catalog. 614 since #20349:
+      // six new row labels (the object form's `highlightFields`,
+      // `searchableFields`, `access`, `access.default` and `requiredPermissions`,
+      // and the permission form's `adminScope`), authored in all three locales.
+      expect(translated.length, `${locale} positive control`).toBe(614);
     }
     // ⭐ DARK — the blindness, executable. On a synthetic two-locale catalog the
     // all-three predicate returns 0 while the per-locale one returns 1, so the