@@ -36,11 +36,11 @@ This is the grid face of the disclosure the detail page closed in objectui#8440.
 
   Columns without the flag copy, show, export and edit exactly as before.
 - **`@object-ui/plugin-grid`: `ObjectGrid` sets the flag** at its column emit seam, from
-  `isMaskedFieldType()` (objectui#8686). It reads the column's type and the
-  object-declared type as a narrow-only union, the same shape as the detail page's
-  `isMaskedDetailFieldType`. So a view that authors `type: 'text'` over a `secret` field
-  keeps the refusal, and a view that authors `type: 'password'` masks a field the object
-  declares as text. Once the object schema has loaded, the same rule leaves every masked
+  `isMaskedFieldType()` (objectui#8686). It reads the column's type and, once the object
+  schema has loaded, the object-declared type as a narrow-only union, the same shape as
+  the detail page's `isMaskedDetailFieldType`. So a view that authors `type: 'password'`
+  masks a field the object declares as text from first paint, and a view that authors
+  `type: 'text'` over a `secret` field keeps the refusal once the schema has loaded. Once the object schema has loaded, the same rule leaves every masked
   field of the grid's object out of the grid's client export (CSV and JSON, used when the
   data source has no server export) and draws a masked field through its cell on the
   mobile card. Once the object schema has loaded, it also refuses a masked field as a
@@ -59,8 +59,9 @@ This is the grid face of the disclosure the detail page closed in objectui#8440.
   which folded objectui#10658).
 - On the host-fetched path (rows handed down as `data`, as `ListView` and `ObjectView`
   do), the grid's guards and the cell's own mask depend on the object schema, which the
-  grid fetches after first paint. Until it settles, an untyped view column over a
-  `password` / `secret` field draws and hands out the raw value (objectui#10706).
+  grid fetches after first paint. Until it arrives, and for good if that read fails (the
+  grid swallows the failure and keeps its heuristic column types), an untyped view column
+  over a `password` / `secret` field draws and hands out the raw value (objectui#10706).
 - The server-streamed export (`exportDownload`) sends the masked columns as before and
   relies on the server's masking.
 - The client JSON export writes an expanded lookup record whole, so a credential field
 
@@ -161,16 +161,16 @@ producer's `cell` renderer, and the table draws a column with no `cell` as its v
 You rarely set the flag by hand: `object-grid` sets it for every column whose field
 type is drawn as a mask (`password`, `secret`, or a type registered with the mask),
 from `isMaskedFieldType()` in `@object-ui/fields`. It reads both the view's column
-`type` and the object's field type, so a view that shows a `secret` field as `text`
-keeps the flag. Once the object schema has loaded, the same rule leaves every masked
+`type` and, once the object schema has loaded, the object's field type, so a view that
+shows a `secret` field as `text` keeps the flag once that schema has loaded. Once the object schema has loaded, the same rule leaves every masked
 field of the grid's object out of `object-grid`'s own client export (CSV and JSON),
 draws those fields through their `cell` on its mobile card, and refuses them as
 grouping keys (the entry is ignored with a console warning). What `object-grid` does
 not cover: on the host-fetched path (rows handed down as `data`, as `ListView` and
 `ObjectView` do), the grid's guards and the cell's own mask depend on the object
-schema, which the grid fetches after first paint, so until it settles an untyped
-view column over a `password` / `secret` field draws and hands out the raw value
-(objectui#10706). The server-streamed export (`exportDownload`) sends the masked
+schema, which the grid fetches after first paint, so until it arrives, and for good
+if that read fails, an untyped view column over a `password` / `secret` field draws
+and hands out the raw value (objectui#10706). The server-streamed export (`exportDownload`) sends the masked
 columns as before and relies on the server's masking, and the client JSON export
 writes an expanded lookup record whole, so a credential field of the related object
 is not pruned. Other producers of
 
@@ -396,8 +396,10 @@ Not covered:
   which folded objectui#10658).
 - On the host-fetched path (rows handed down as `data`, as `ListView` and `ObjectView`
   do), the grid's guards and the cell's own mask depend on the object schema, which
-  the grid fetches after first paint. Until it settles, an untyped view column over a
-  `password` / `secret` field draws and hands out the raw value (objectui#10706).
+  the grid fetches after first paint. Until it arrives, and for good if that read fails
+  (the grid swallows the failure and keeps its heuristic column types), an untyped view
+  column over a `password` / `secret` field draws and hands out the raw value
+  (objectui#10706).
 - The server-streamed export (`exportDownload`) sends the masked columns as before
   and relies on the server's masking.
 - The client JSON export writes an expanded lookup record whole, so a credential
 
@@ -25,7 +25,8 @@ import { isMaskedFieldType } from '@object-ui/fields';
  * ⚠️ Every one of those paths asks with the object-declared type, which the grid
  * reads from the object schema it fetches after first paint. On the host-fetched
  * path (rows handed down as `data`) an untyped view column is therefore
- * unmasked until that schema settles (objectui#10706).
+ * unmasked until that schema arrives, and for good if the read fails
+ * (objectui#10706).
  *
  * The rule itself is NOT restated here — it is `isMaskedFieldType()` from
  * `@object-ui/fields`, the one authority for "is this field type's cell drawn
 
@@ -724,19 +724,20 @@ export interface TableColumn {
    * ⭐ The producer decides, and the rule is not restated here: `ObjectGrid`
    * stamps this flag from `isMaskedFieldType()` in `@object-ui/fields`
    * (objectui#8686), the one authority for "is this field type's cell drawn as
-   * a mask", reading the view-authored type and the object-declared type as a
-   * narrow-only UNION — a view authoring `type: 'text'` over a `secret`
-   * column keeps the flag. Once the grid's object schema has loaded, the same
+   * a mask", reading the view-authored type and, once the grid's object schema
+   * has loaded, the object-declared type as a narrow-only UNION — a view
+   * authoring `type: 'text'` over a `secret` column keeps the flag once that
+   * schema has loaded. Once the grid's object schema has loaded, the same
    * rule also leaves every masked field of the grid's object out of the grid's
    * own client export, draws those fields through `cell` on its mobile card,
    * and refuses them as grouping keys. `@object-ui/components` cannot import
    * `@object-ui/fields`, so the table obeys the flag instead of asking the
    * question itself. Not covered there: on the host-fetched path (rows handed
    * down as `data`, as `ListView` and `ObjectView` do), the grid's guards and
    * the cell's own mask depend on the object schema, which the grid fetches
-   * after first paint, so until it settles an untyped view column over a
-   * `password` / `secret` field draws and hands out the raw value
-   * (objectui#10706); the server-streamed export (`exportDownload`) sends the masked columns as
+   * after first paint, so until it arrives, and for good if that read fails,
+   * an untyped view column over a `password` / `secret` field draws and hands
+   * out the raw value (objectui#10706); the server-streamed export (`exportDownload`) sends the masked columns as
    * before and relies on the server's masking; the client JSON export, and
    * this table's CSV export of a lookup column, write an expanded lookup
    * record whole, so a credential field of the related object is not pruned;