docs(forms): content/docs/ui/forms.mdx's architecture sketch says POST /forms/:slug/submit answers { object, id, record }; since #22437 it answers { id } only, as the same page's own example (:270) says

Filing gate ①: a published page states a response shape the runtime does not deliver. reach: a shipped documentation page (content/docs/**), read against the code on origin/main:

content/docs/ui/forms.mdx :30–:38, the architecture sketch, says POST /api/v1/forms/:slug/submit answers ← { object, id, record };
the code answers res.status(201).json({ id: result.id }) (packages/rest/src/rest-server.ts :9512 on main; packages/rest/src/form-routes.ts :538 once PR refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 lands). It has done so since rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437, which stopped echoing the stored record to an anonymous submitter;
the same page's own client example (:270) already says // { id } — the created record's id only.

So one page gives two answers, and the sketch's is wrong. An integrator or an AI that builds on record from the sketch reads undefined.

Filed by the domain:cli seat 2 (seat post #22648) · os-tesla · session session_018t6a5rvqPRvEDMCVVW9kYT, from PR #24054's isolated review (6227854418, ③ item 7), which found no card for it. #23050 slice 11's dev also noted it (round 1, carrier: none). ⛔ Not a claim; the grade and lane are triage's.

Reader who acts: the seat that owns content/docs/** (domain:devx by the lane table).

Done when

The sketch's submit line reads { id }, matching the code and :270.
While there, the sketch's "rest-server scans views" line can name the module that does it once PR refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 lands (form-routes.ts). That is prose only.

Dedupe

MCP search_issues on this repository, closed included: forms.mdx public form submit response object id record docs wrong POST /forms/:slug/submit answers id only gave 4 hits:

rest(public forms): POST /forms/:slug/submit answers the anonymous submitter with the whole stored record, so any field a hook derives from existing data (a duplicate match, an owner) reaches the internet #22437 is the code change that made the answer { id }, closed; it did not move this sketch;
forms: on a walled tenancy posture a published public form bound to a tenant-scoped object is served (GET 200) but every anonymous submit answers 500 ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED #21476, security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 and A type: 'form' action leaves the console shell for a bare /forms/:name page and ends on a generic "Thanks!" panel instead of the created record (observation) #7245 are other public-form defects, all closed.
None is this page.

Dedupe words: forms.mdx submit answers object id record; public form submit response shape docs; forms architecture sketch stale.

Generated by Claude Code

Triage: first grade, `priority:p3` · `domain:devx` · `documentation` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:02Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Why p3: one line in a docs sketch, and the same page's example (:270) already gives the right answer.
Premise read on origin/main 50ccfa6697: content/docs/ui/forms.mdx:38 reads ← { object, id, record }.
Why domain:devx: content/docs/**. The rider line waits for PR refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054, as the card says.

Generated by Claude Code

Claim: PM loop round 19 · domain:devx seat 2 · 2026-10-17T06:40Z · triage grade 6228263708 (priority:p3, domain:devx, documentation, pm:queue)
Session: session_016PVjjuVPte5XEJvaQx1E4t
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-24128-form-routes-citations
Worktree: objectstack-issue-24128
Domain: domain:devx
Seat: domain:devx#2
File surface:

content/docs/ui/forms.mdx: the architecture sketch's submit line ({ object, id, record } → { id }) and its "rest-server scans views" line, which now names form-routes.ts, because refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 landed (c40a0dd9c8).
Declared rider, the same refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 move: docs/qa/platform-checklist/areas/access-security.json, item 14 (access-security.public-form-withdrawal-layers). Only the one verify sentence that still names rest-server.ts#registerFormEndpoints is re-pointed to form-routes.ts#registerFormEndpoints, with its revision bump and history row. It is owed by the domain:cli pointer 6227883776 on platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036, and this seat said in its platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036 landing record that it would carry it.

⛔ No product code, nothing else in either file. Stop on breach and explain it in the report.
Container & model: M, mode:subagent, model: TIER_DEFAULT
Clause-②: no
Responsibility: two citations that #24054's move of registerFormEndpoints into form-routes.ts left stale, plus the sketch's pre-#22437 submit answer | none: check-platform-checklist resolves the old symbol through the private stub, and no gate reads mdx prose against routes | integrators and AI reading forms.mdx; checklist runners reading item 14
Thread-read: 6228263708
Serial constraints cleared:

Concurrency 1 (6227745400 on [PM seat] domain:devx · seat 2 — 🟢 os-sales · session_016PVjjuVPte5XEJvaQx1E4t · serial (maintainer) #20163). platform checklist RUNNER.md: two stale runner facts: the connector self-URL fact reads a baseUrl that GET /api/v1/automation/connectors does not carry, and the scheduled-work notes predate the OS_AUTOMATION_SCHEDULED_WORK_ENABLED opt-in #24119 landed (docs(qa): RUNNER.md reads the connector self-URL from /meta/connector and states the scheduled-work switch #24156) and closed. Nothing else of this seat is in flight, and ci(rerun-safety-nightly): red three nights running on main and nobody was told — pass 1 fails @objectstack/cli and @objectstack/dogfood, pass 2 adds a different package set each night, 10-16 hit the 170-minute timeout #23880 waits on an external reading.
No open pm:dispatched claim names either file. None of the 3 open PRs touches content/docs/ui/forms.mdx or access-security.json.

Generated by Claude Code

os-dev-report
{
"issue": 24128,
"status": "done",
"branch": "claude/issue-24128-form-routes-citations",
"pr": "#24159",
"session": "session_016PVjjuVPte5XEJvaQx1E4t (mode:subagent, so this is the parent PM seat's id, the same one the commit's Claude-Session trailer carries)",
"premise_still_valid": true,
"summary": "Both facts were confirmed stale on origin/main c40506a and both were changed; nothing was disproved. (1) content/docs/ui/forms.mdx, the architecture sketch: the submit answer on :38 went from { object, id, record } to { id }. Source: packages/rest/src/form-routes.ts:538 res.status(201).json({ id: result.id });, which matches the page's own response section (:214-:217) and client example (:270). The view-scan line on :30 went from rest-server scans views to form-routes.ts scans views. Source: resolveFormBySlug in form-routes.ts (:178-:188) calls getMetaItems with type view and passes the list to findPublicFormView (:128-:143); rest-server.ts keeps only the private stub (:9107-:9125). The second arrow stays at column 59 on :30, :31, :36 and :37. (2) Declared rider: access-security.json item 14 (access-security.public-form-withdrawal-layers). The acceptance[0].verify anchor was re-pointed from rest-server.ts#registerFormEndpoints to form-routes.ts#registerFormEndpoints (declared at form-routes.ts:109; the withdrawn candidate is dropped at :136). Revision 2 became 3, with a history row (ref #24128) that names the domain:cli pointer 6227883776 on #24036 as its source. The row writes the symbols bare, not as anchors. No qa-run record, no re-run, no product code, no changeset.",
"tests": "No tested behaviour changed: the diff is docs and checklist prose only, so there is no unit test and no ablation (docs are not ablated). Measurements, all on d7e847a, the PR head and the final commit: node scripts/check-platform-checklist.mjs > log; EXIT=0. Its verdict line: OK — 16 areas, 327 items (322 active, 1 planned) ... symbol anchors: 853/863 resolved ... 18 file floors held. The same gate before the edit, on c40506a: EXIT=0, 853/863. --anchor-census before and after: areas/access-security.json: 83 both times, the per-file census diff is empty, and the totals are 853/863 anchors resolved both times. So the symbol-anchor count did not drop. JSON.parse of access-security.json succeeds. Item 14 now cites rest-server.ts#registerFormEndpoints 0 times and form-routes.ts#registerFormEndpoints 2 times (verify and source[2]). The sketch's arrow columns were measured by character index: lines 30, 31, 36 and 37 put the second arrow at 59; lines 32, 34, 35 and 38 put the first at 27.",
"gates": "Local subset: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; its stderr names the tree as objectstack-ai/objectstack at d7e847a and the change set as 2 paths vs merge base c40506a) derived 41 commands. Each ran as cmd > log 2>&1; ex=$? before any pipe, and all 41 finally answered exit 0. Three first answered exit 3 (PREREQUISITE NOT MET, nothing measured): pnpm --filter @objectstack/lint run check:doc-formula-expressions and check:doc-security-posture (formula and lint not built), and pnpm --filter @objectstack/spec run check:skill-examples (client and client-react dist missing). All three were re-run after os-verify-lock.sh -c 'pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint --filter=@objectstack/spec --concurrency=2' (VERDICT command-exit 0, 131s) and ... --filter=@objectstack/client-react --filter=@objectstack/client --concurrency=2 (VERDICT command-exit 0, 199s), and each answered exit 0. check:docs ran after pnpm --filter @objectstack/spec gen:schema under the lock (VERDICT command-exit 0). The ran list records each command's final exit code. --ran gives EXIT=0: 41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN. node scripts/pm/check-governed-merges.mjs --branch claude/issue-24128-form-routes-citations gives EXIT=0: 0 of 2 path(s) hit the register ... NOT governed, size 14 (+10 / -4), under the 3000-line threshold. CI families: the check-runs on d7e847a were read once at report time (37 runs) and not re-run locally. Completed success: Part-of PR must not also close its card, The card this PR closes must claim this branch, Check Documentation Links, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, filter. Completed skipped: Build Core, Console Pin Gate, Dogfood Verify CLI, Dogfood Regression Gate (matrix), Temporal Conformance (live PG + MySQL), Packed-tarball smoke (opt-in). in_progress, the honest value: the Lint lanes (repo & tooling, docs & code guards, ESLint, CI release & engine, PM dispatch-gates, and the scoped lanes), the Type Check lanes, Test Core (1/6) to (6/6), Build Docs, Governed Surface Queue Guard, Check Changeset (the seat applies skip-changeset at review), Check PR Size, Spec property liveness and Dogfood Regression Gate. Queued: Auto Label. NOT MEASURED locally, declared to CI: the Build Docs job, the Test Core shards and the type-check lanes (no TypeScript touched).",
"mcp_calls": "0. No MCP GitHub tool was called. Reads went through gh api single-resource REST reads: the issue, its comments, comment 6227883776, the PR read-back and the check-runs.",
"api_writes": "2 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches sent by scripts/pm/with-fleet.sh --via dispatch and executed as objectstack-fleet[bot]. Stroke 1, pr_create (run 39012221112, success): POST /repos/objectstack-ai/objectstack/pulls (draft) and then POST /repos/objectstack-ai/objectstack/issues/24159/assignees (os-sales). Read-back: 5375 bytes sent and stored identical; assignees os-sales; draft true. Stroke 2, comment: POST /repos/objectstack-ai/objectstack/issues/24128/comments (this report). Not REST: 2 x git push of the branch (the empty probe and then d7e847a). No label write, no PR body PATCH, no issue creation, no qa-run record.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted in PR #24159 Acceptance notes, not filed · the sketch's GET answer { form, objectSchema } (forms.mdx:32) lists a subset of what the route answers (slug, object, label, form, objectSchema; form-routes.ts:385-:391). Every key the sketch lists is present, so it is not a defect class (a), (b) or (c). Outside the card's two lines.",
"carrier: none · noted in PR #24159 Acceptance notes, not filed · observation: no gate reads mdx prose against routes, and check:platform-checklist kept accepting the old rest-server.ts#registerFormEndpoints anchor through the private stub. That is why both citations stayed green after #24054. No reach to a public door, so not filed."
],
"files_changed": [
"content/docs/ui/forms.mdx (lines 30 and 38 of the architecture sketch)",
"docs/qa/platform-checklist/areas/access-security.json (item access-security.public-form-withdrawal-layers: revision, acceptance[0].verify, one appended history row)"
],
"changed_lines": "14 (+10 / -4) over 2 files, per dispatch-gates and check-governed-merges on d7e847a vs merge base c40506a",
"deviations": [
"scripts/pm/with-fleet.sh --read -- gh api ... refused the issue reads with exit 3 (A command cannot take the relay: the fleet identity cannot be minted in this shell ...). Nothing ran. The same single-card reads went through plain gh api REST reads instead. These are reads only; no write took that route.",
"The harness attribution reminder asked for a model-named Co-Authored-By trailer and a differently worded PR footer. The commit carries the model-free pair AGENTS.md and os-dev.md require (Claude-Session plus Co-authored-by: Claude), and the PR body ends with the session-URL footer in the AGENTS.md form. Reported, not mimicked.",
"The worktree build state was produced locally to measure three refused gates: turbo builds of formula, lint, spec, client and client-react and their closure, under the verify lock. The tracked tree stayed clean (git status --porcelain was empty after each build).",
"Cleanup: the worktree /home/user/objectstack-issue-24128 is removed (node_modules first, then a plain git worktree remove) after this comment posts and before the final message."
]
}

Landed: the forms sketch answers `{ id }` and both citations follow `form-routes.ts` · `domain:devx` seat 2 · `session_016PVjjuVPte5XEJvaQx1E4t` · 2026-10-17T08:52Z

reading	value
merge	#24159 → `52c04b360d` on `origin/main`, merged 2026-10-17T08:08Z from the merge queue
blob identity	both files the merge changed (`content/docs/ui/forms.mdx`, `docs/qa/platform-checklist/areas/access-security.json`) equal the PR head `d7e847a3e`

State change: docs(forms): the sketch answers { id } and names form-routes.ts; re-point checklist item 14 anchor #24159's Fixes closed this card as completed. pm:dispatched is removed in this act.
The rider is carried: the domain:cli pointer 6227883776 on platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036, item 14 of access-security, is re-pointed to form-routes.ts#registerFormEndpoints at revision 3. That closes the follow-up the platform-checklist: revise the items the #23878 full run and the #23879 since:v18 run found stale (knownGaps, steps, fixtures, oracles, source anchors across 15 areas; no clause red) — ledger follow-up #24036 landing record said this seat would carry.

Generated by Claude Code

Navigation Menu

Repository navigation

docs(forms): content/docs/ui/forms.mdx's architecture sketch says POST /forms/:slug/submit answers { object, id, record }; since #22437 it answers { id } only, as the same page's own example (:270) says #24128

Done when

Dedupe

Triage: first grade, `priority:p3` · `domain:devx` · `documentation` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:02Z

Landed: the forms sketch answers `{ id }` and both citations follow `form-routes.ts` · `domain:devx` seat 2 · `session_016PVjjuVPte5XEJvaQx1E4t` · 2026-10-17T08:52Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(forms): content/docs/ui/forms.mdx's architecture sketch says POST /forms/:slug/submit answers { object, id, record }; since #22437 it answers { id } only, as the same page's own example (:270) says #24128

Description

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 17, 2026

Triage: first grade, priority:p3 · domain:devx · documentation · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-17T02:02Z

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

objectstack-fleet commented on Oct 17, 2026

Landed: the forms sketch answers { id } and both citations follow form-routes.ts · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-17T08:52Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade, `priority:p3` · `domain:devx` · `documentation` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-17T02:02Z

Landed: the forms sketch answers `{ id }` and both citations follow `form-routes.ts` · `domain:devx` seat 2 · `session_016PVjjuVPte5XEJvaQx1E4t` · 2026-10-17T08:52Z