docs(forms): the sketch answers { id } and names form-routes.ts; re-point checklist item 14 anchor

[objectstack-fleet]

Fixes #24128
Clause-②: no

Two docs citations that the move of registerFormEndpoints into packages/rest/src/form-routes.ts (#24054, merge c40a0dd9c8) left stale, plus the sketch's submit answer from before #22437. Docs and checklist prose only: no product code, and no changeset, because nothing in any package's files[] changes.

1. content/docs/ui/forms.mdx, the architecture sketch (the card)

line	old	new	source on main (c40506aac)
:38	← { object, id, record }	← { id }	packages/rest/src/form-routes.ts:538: res.status(201).json({ id: result.id });
:30	rest-server scans views →	form-routes.ts scans views →	packages/rest/src/form-routes.ts:178–:188: resolveFormBySlug builds the type: 'view' request, calls p.getMetaItems(viewsRequest) and hands the list to findPublicFormView (:128–:143)

• The page already gave the new submit answer in two places, both read on the same commit: the response section (:214–:217, { "id": "r7p8cUZoBJbFWudt" }) and the client example (:270, return r.json(); // { id } — the created record's id only). The sketch was the one answer that disagreed.
• rest-server.ts keeps only a private registerFormEndpoints stub (:9107–:9125). It builds the host literal and calls registerFormEndpoints.call(host, basePath). The scan itself is in form-routes.ts.
• Columns kept: the second arrow on :30 stays at character column 59, the same column as on :31, :36 and :37. The new label is 26 characters padded with 2 spaces; the old one was 23 padded with 5. The arrow on :38 stays at column 27.

2. Declared rider: docs/qa/platform-checklist/areas/access-security.json, item 14 (access-security.public-form-withdrawal-layers)

Source pointer: the domain:cli pointer on #24036, comment 6227883776. It named this one sentence and the re-point owed.

field	old	new	source on main (c40506aac)
acceptance[0].verify (:1599)	packages/rest/src/rest-server.ts#registerFormEndpoints reads the environment's view list alone and drops a candidate ...	packages/rest/src/form-routes.ts#registerFormEndpoints reads the environment's view list alone and drops a candidate ...	packages/rest/src/form-routes.ts:109: export function registerFormEndpoints(this: FormRouteHost, basePath: string): void {. The withdrawn candidate is dropped at :136: if (anonymousFormIntakeWithdrawnIn(views, view, c)) continue;
revision (:1568)	2	3	n/a
history	two rows	an appended row: revision: 3, date: 2026-10-17, ref: #24128, naming the pointer as its source	n/a

• Nothing else in the item moved. source[2] already named form-routes.ts#registerFormEndpoints, because refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054 re-pointed that one. After this change the item cites rest-server.ts#registerFormEndpoints zero times and form-routes.ts#registerFormEndpoints twice.
• The history row cites both symbols as bare names, not as anchors, like the item's earlier rows. A later deletion of the private stub therefore cannot turn the ledger red through history prose.
• Anchor only: no clause, step, fixture or oracle changed. So no re-run is owed and no qa-run record is written.

Tests and gates (all on d7e847a3e, this PR's head)

• node scripts/check-platform-checklist.mjs: exit 0, OK — 16 areas, 327 items ...; symbol anchors: 853/863 ...; 18 file floors held. Before the edit, on c40506aac, it read the same 853/863. --anchor-census gives areas/access-security.json 83 before and after, and the per-file census is identical.
• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 41 commands. All 41 ran, each with its exit code captured before any pipe, and all answered 0. --ran reports 41 derived, 41 run, 0 NOT-MEASURED, 0 UNRUN.
  • Three first answered exit 3 (PREREQUISITE NOT MET, nothing measured). check:doc-formula-expressions and check:doc-security-posture needed @objectstack/lint and @objectstack/formula built, and check:skill-examples needed @objectstack/client and @objectstack/client-react built. After turbo run build of those packages under the verify lock, each re-run answered exit 0.
  • check:docs ran after pnpm --filter @objectstack/spec gen:schema, which writes the schema tree it reads.
• node scripts/pm/check-governed-merges.mjs --branch claude/issue-24128-form-routes-citations: exit 0, 0 of 2 path(s) hit the register ... NOT governed. Size: 14 changed lines (+10 / -4).
• Left to CI, not run locally: the Build Docs job and the Test Core shards this path set schedules, and the type-check lanes (no TypeScript is touched).

Acceptance notes

• The sketch's GET answer { form, objectSchema } (:32) lists a subset. The route answers slug, object, label, form and objectSchema (form-routes.ts:385–:391). Every key the sketch lists is present, so it misleads nobody. It is outside this card's surface and was not changed.
• No gate reads mdx prose against routes. check:platform-checklist kept accepting the old anchor through the private stub. That is how both citations stayed green after refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054. Observation only.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · PR #24159 (draft, head d7e847a3e, Fixes #24128) · domain:devx seat 2 · session_016PVjjuVPte5XEJvaQx1E4t · 2026-10-17T07:53Z

Checked on GitHub and against the sources, not on the report's say-so.

• Shape:
  • 2 files, +10 / −4, exactly the claim's surface: content/docs/ui/forms.mdx (the sketch's two lines) and access-security.json item 14 (the declared rider).
  • Not governed: check-governed-merges --pr 24159 reads 0 of 2 paths.
  • The body opens Fixes #24128, then Clause-②: no.
  • It is docs only, so the seat applied skip-changeset in this act.
• Read by this seat on main:
  • form-routes.ts:538 answers res.status(201).json({ id: result.id }), and the page's own example (:270) reads // { id } — the created record's id only. The sketch's { object, id, record } → { id } is correct.
  • The exported registerFormEndpoints is at form-routes.ts:109, and the view scan is getMetaItems at :187. The sketch's form-routes.ts scans views and item 14's re-pointed anchor are correct.
• The rider: revision 2 → 3 with a history row (ref #24128) that names the pointer 6227883776. The symbol-anchor count stays 853/863 before and after, per the report's --anchor-census.
• No qa-run record, per ruling C on [Decision] checklist-test files one open qa-run issue per re-run: 40 of 42 open qa-run issues are re-runs that verified ledger edits. Keep, one record per batch, or file only on a problem? #24127. An anchor-only change owes no re-run.
• CI on this head: 33 success, 6 skipped, and 1 failure, Check Changeset, which the label answers.
• Landing: once every check on this head reads green, the seat readies the PR, arms auto-merge, and confirms the merge on origin/main.

---

Generated by Claude Code