fix(spec): FormField constraint keys converge on the landed value shapes (int lengths >= 1, digit counts >= 0) (#12458)

* fix(spec): FormField constraint keys converge on the landed value shapes (#12174)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5LFCYBJ3q2s6yW6oMLxwy

* chore(spec): regenerate migration registry projection and docs (#12174)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5LFCYBJ3q2s6yW6oMLxwy

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: huangyiirene

.changeset/formfield-constraint-shape.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/spec': minor
+---
+
+`FormFieldSchema`'s constraint keys converge on the value shapes the object-field surface landed (#12174): `maxLength`/`minLength` tighten from bare `z.number()` to `z.number().int().min(1)` (the #11566/#11949 template — a character length is a positive integer, and `minLength: 0` is a vacuous always-true declaration refused loudly; "no minimum" is expressed by omitting the key), and `precision`/`scale` tighten to `z.number().int().min(0)` (the #8321 template — digit counts). `min`/`max` are unchanged: they are values, not counts, exactly as on the object-field surface.
+
+The row keys are live, measured in objectui: the spec bridge (`form-view.ts` mapField, objectui#5898) and plugin-form (`sectionFields.ts`) copy all six onto the runtime field, the console FormPage merges `override.maxLength ?? def.maxLength` onto the rendered input (objectui#5595), the fields package builds validation rules from `minLength`/`maxLength`/`min`/`max`, and `precision`/`scale` drive the number widgets — so `maxLength: 0` on a form row reached the DOM as an input that accepts nothing, and `GET /forms/:slug` serves the rows verbatim to anonymous renderers. What newly gets rejected: `0` (length pair only), negative and non-integer values on the four count-shaped keys. Unlike the object-field twins there is no type-conditional applicability gate: a form row references its object field by name and usually omits `type`, so the referenced field's type is invisible at parse time — value shape is checkable here, key placement stays the object field's own schema's job. Already-legal declarations round-trip byte-identically, and absence stays absence — no default materializes.
+
+<!-- adr-0087: registered ui-form-field-length-malformed-refused, ui-form-field-precision-scale-integer-refused -->

content/docs/references/ui/view.mdx

@@ -140,12 +140,12 @@ Column footer summary configuration
 | **options** | `{ label: string; value: string; color?: string; default?: boolean; … }[]` | optional | Options for select/multiselect/radio/checkboxes fields |
 | **reference** | `string` | optional | Target object name for lookup/master_detail fields |
 | **publicPicker** | `{ displayFields?: string[]; maxResults?: integer; filter?: object[]; object?: string }` | optional | Opt this field into the anonymous public-form lookup picker (GET /forms/:slug/lookup/:field). Without it the route answers 403 LOOKUP_NOT_PUBLIC and the field is stripped from the rendered public form. |
-| **maxLength** | `number` | optional | Maximum character length (for text/textarea/email/url/phone) |
-| **minLength** | `number` | optional | Minimum character length |
+| **maxLength** | `integer` | optional | Maximum character length (positive integer; for text/textarea/email/url/phone) |
+| **minLength** | `integer` | optional | Minimum character length (positive integer; `minLength: 0` is refused — express "no minimum" by omitting the key) |
 | **min** | `number` | optional | Minimum value (for number/currency/percent/slider) |
 | **max** | `number` | optional | Maximum value |
-| **precision** | `number` | optional | Total digits (for number/currency) |
-| **scale** | `number` | optional | Decimal places |
+| **precision** | `integer` | optional | Total digits (non-negative integer; for number/currency) |
+| **scale** | `integer` | optional | Decimal places (non-negative integer) |
 | **multiple** | `boolean` | optional | Allow multiple values (for select/lookup/file/image) |
 | **label** | `string \| Record<string, string>` | optional | Display label override |
 | **placeholder** | `string \| Record<string, string>` | optional | Placeholder text |
@@ -302,12 +302,12 @@ View filter rule
 | **options** | `{ label: string; value: string; color?: string; default?: boolean; … }[]` | optional | Options for select/multiselect/radio/checkboxes fields |
 | **reference** | `string` | optional | Target object name for lookup/master_detail fields |
 | **publicPicker** | `{ displayFields?: string[]; maxResults?: integer; filter?: object[]; object?: string }` | optional | Opt this field into the anonymous public-form lookup picker (GET /forms/:slug/lookup/:field). Without it the route answers 403 LOOKUP_NOT_PUBLIC and the field is stripped from the rendered public form. |
-| **maxLength** | `number` | optional | Maximum character length (for text/textarea/email/url/phone) |
-| **minLength** | `number` | optional | Minimum character length |
+| **maxLength** | `integer` | optional | Maximum character length (positive integer; for text/textarea/email/url/phone) |
+| **minLength** | `integer` | optional | Minimum character length (positive integer; `minLength: 0` is refused — express "no minimum" by omitting the key) |
 | **min** | `number` | optional | Minimum value (for number/currency/percent/slider) |
 | **max** | `number` | optional | Maximum value |
-| **precision** | `number` | optional | Total digits (for number/currency) |
-| **scale** | `number` | optional | Decimal places |
+| **precision** | `integer` | optional | Total digits (non-negative integer; for number/currency) |
+| **scale** | `integer` | optional | Decimal places (non-negative integer) |
 | **multiple** | `boolean` | optional | Allow multiple values (for select/lookup/file/image) |
 | **label** | `string \| Record<string, string>` | optional | Display label override |
 | **placeholder** | `string \| Record<string, string>` | optional | Placeholder text |

packages/spec/liveness/view.json

@@ -317,7 +317,7 @@
           "verifiedAt": "2026-08-11",
           "evidenceScope": "cross-repo",
           "evidence": "objectui: form renderers + spec-bridge form-view.ts:169 (audit L17); packages/rest/src/rest-server.ts registerPublicFormEndpoints (the three /forms/:slug routes walk sections: resolve strips undeclared lookup/master_detail/user fields, submit builds allowedFields from them, and GET /forms/:slug/lookup/:field reads each field entry's publicPicker block)",
-          "note": "This row carries the blanket verdict for the whole FormField subtree beneath it (undrilled inheritance). [#7467] adds `publicPicker` {displayFields,maxResults,filter,object} to that subtree — live, measured reader: the GET /forms/:slug/lookup/:field handler in packages/rest/src/rest-server.ts (displayFields projection + contains search, maxResults clamp to hard ceiling 50, filter rows composed ahead of the search predicate, object override for the referenced object). The key had been ENFORCED there but declared nowhere — ADR-0049's mirror direction (enforced, never declarable) — until the maintainer ruled declare (option 1). The route also reads picker.sort, which stays deliberately UNDECLARED (outside the ruling's four-key enumeration; follow-up finding filed from #7467); a form authoring it is a loud parse error, pinned in view-public-picker.test.ts."
+          "note": "This row carries the blanket verdict for the whole FormField subtree beneath it (undrilled inheritance). [#7467] adds `publicPicker` {displayFields,maxResults,filter,object} to that subtree — live, measured reader: the GET /forms/:slug/lookup/:field handler in packages/rest/src/rest-server.ts (displayFields projection + contains search, maxResults clamp to hard ceiling 50, filter rows composed ahead of the search predicate, object override for the referenced object). The key had been ENFORCED there but declared nowhere — ADR-0049's mirror direction (enforced, never declarable) — until the maintainer ruled declare (option 1). The route also reads picker.sort, which stays deliberately UNDECLARED (outside the ruling's four-key enumeration; follow-up finding filed from #7467); a form authoring it is a loud parse error, pinned in view-public-picker.test.ts. [#12174] drills the six FormField constraint keys out of the blanket verdict — maxLength/minLength/min/max/precision/scale are all LIVE, measured at objectui@f7c52e2 (2026-08-26): two independent spec-to-runtime routes copy all six onto the runtime field (packages/react/src/spec-bridge/bridges/form-view.ts mapField, objectui#5898; packages/plugin-form/src/sectionFields.ts normalizeSectionField), the console FormPage merges override.maxLength ?? def.maxLength onto the rendered input (apps/console/src/components/FormPage.tsx:548, objectui#5595), packages/fields buildValidationRules turns minLength/maxLength/min/max into react-hook-form rules, ObjectForm.tsx:691 derives the number input step from precision, and NumberField.tsx:21 reads scale; server-side, GET /forms/:slug (packages/rest/src/rest-server.ts) serves the rows verbatim to anonymous renderers (a conduit, no key-level read). On that measurement the four count-shaped keys tightened to the #11566/#11949/#8321 value shapes (lengths int>=1, precision/scale int>=0; min/max stay bare numbers — they are values, not counts)."
         },
         "groups": {
           "status": "live",

packages/spec/src/migrations/entries/semantic/18.ui-form-field-length-malformed-refused.ts

@@ -0,0 +1,42 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'ui-form-field-length-malformed-refused',
+  surface: 'form-view field row `maxLength` / `minLength` declarations '
+    + '(`FormFieldSchema`, the rows inside `FormView.sections[].fields[]`) — '
+    + '`0`, negative or non-integer values',
+  replacement: 'a positive-integer bound (>= 1), or no declaration at all ("no minimum" is '
+    + 'expressed by OMITTING `minLength`, never by `minLength: 0`). The row-level key is a '
+    + 'per-form override that can only NARROW what the referenced object field already '
+    + 'declares (the object field surface tightened first: #11566/#11949) — so a malformed '
+    + 'row value is deleted, and a bound that was actually wanted is re-declared as a '
+    + 'positive integer, or dropped in favour of the object field\'s own authoritative '
+    + 'declaration',
+  reason:
+    '#12174: the form-field row carried the pre-#11566 shape — bare `z.number()` — after '
+    + 'the object-field surface converged (`maxLength` #11566, `minLength` #11949, both '
+    + '`z.number().int().min(1)`). The row keys are LIVE, measured in objectui: the spec '
+    + 'bridge (`packages/react/src/spec-bridge/bridges/form-view.ts` mapField, '
+    + 'objectui#5898) and plugin-form (`sectionFields.ts` normalizeSectionField) both copy '
+    + 'them onto the runtime field, the console FormPage merges `override.maxLength ?? '
+    + 'def.maxLength` onto the rendered input (objectui#5595), and the fields package '
+    + 'builds react-hook-form validation rules from `minLength`/`maxLength` — so '
+    + '`maxLength: 0` on a form row reached the DOM as an input that accepts nothing, and '
+    + 'the public-form resolve route (`GET /forms/:slug`) serves the rows verbatim to '
+    + 'anonymous renderers. The schema now refuses the malformed values at parse '
+    + '(`z.number().int().min(1)`, ADR-0078 declared=enforced). Unlike the object-field '
+    + 'twins there is NO type-conditional gate: a form row references its object field by '
+    + 'name and usually omits `type`, so the referenced field\'s type is invisible at parse '
+    + 'time — value shape is checkable on this surface, key placement is the object '
+    + 'field\'s own schema\'s job.',
+  acceptanceCriteria:
+    'Every form-view field row declaring `maxLength` or `minLength` carries a positive '
+    + 'integer. Well-formed rows (a positive-integer bound) parse byte-identically to '
+    + 'before; rows declaring neither key are untouched, and absence stays absence — no '
+    + 'default materializes. A stored form view carrying a malformed row value is refused '
+    + 'on its next authoring-path save with a prescriptive per-key issue; the author '
+    + 'deletes the key (the object field\'s own declaration keeps governing the write '
+    + 'seam) or re-declares the intended positive integer.',
+};

packages/spec/src/migrations/entries/semantic/18.ui-form-field-precision-scale-integer-refused.ts

@@ -0,0 +1,36 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'ui-form-field-precision-scale-integer-refused',
+  surface: 'form-view field row `precision` / `scale` declarations '
+    + '(`FormFieldSchema`, the rows inside `FormView.sections[].fields[]`) — '
+    + 'non-integer or negative values (`scale: 2.5`, `precision: -1`)',
+  replacement: 'a non-negative integer digit count, or no declaration at all. The row-level '
+    + 'key is a per-form override of the referenced object field\'s own declaration (that '
+    + 'surface tightened first: #8321) — a malformed row value is deleted, and a count '
+    + 'that was actually wanted is re-declared as a non-negative integer (`scale: 2.5` was '
+    + 'probably `2` or `3`)',
+  reason:
+    '#12174: the form-field row carried the pre-#8321 shape — bare `z.number()` — after '
+    + 'the object-field surface converged on `z.number().int().min(0)` for both digit '
+    + 'counts. The row keys are LIVE, measured in objectui: the spec bridge '
+    + '(`form-view.ts` mapField, objectui#5898) and plugin-form (`sectionFields.ts`) copy '
+    + 'them onto the runtime field, `ObjectForm` derives the number input\'s step from '
+    + '`precision`, and the `NumberField` widget reads `scale` — so a malformed count '
+    + 'flowed into rendering arithmetic (`Math.pow(10, -precision)`) with no defined '
+    + 'meaning. The schema now refuses non-integer and negative values for both keys at '
+    + 'parse time (ADR-0078 declared=enforced). Same no-type-gate rationale as the length '
+    + 'pair entry (`ui-form-field-length-malformed-refused`): the row usually omits '
+    + '`type`, so only value shape is checkable on this surface. '
+    + '⚠️ `CurrencyConfigSchema.precision` and the gantt `scale` enum are different '
+    + 'surfaces and are unchanged.',
+  acceptanceCriteria:
+    'Every form-view field row declaring `precision` or `scale` carries a non-negative '
+    + 'integer. Well-formed rows (`0`, `2`, any non-negative integer) parse '
+    + 'byte-identically to before; rows declaring neither key are untouched, and absence '
+    + 'stays absence. A stored form view carrying a malformed row value is refused on its '
+    + 'next authoring-path save with a prescriptive per-key issue; the author deletes the '
+    + 'key or re-declares the integer they meant.',
+};

packages/spec/src/migrations/registry.ts

@@ -6687,6 +6687,76 @@ const step18: MigrationStep = {
         + 'and behaviour that seems to need one is a renderer capability request against '
         + 'objectui, not a metadata key.',
     },
+    {
+      id: 'ui-form-field-length-malformed-refused',
+      surface: 'form-view field row `maxLength` / `minLength` declarations '
+        + '(`FormFieldSchema`, the rows inside `FormView.sections[].fields[]`) — '
+        + '`0`, negative or non-integer values',
+      replacement: 'a positive-integer bound (>= 1), or no declaration at all ("no minimum" is '
+        + 'expressed by OMITTING `minLength`, never by `minLength: 0`). The row-level key is a '
+        + 'per-form override that can only NARROW what the referenced object field already '
+        + 'declares (the object field surface tightened first: #11566/#11949) — so a malformed '
+        + 'row value is deleted, and a bound that was actually wanted is re-declared as a '
+        + 'positive integer, or dropped in favour of the object field\'s own authoritative '
+        + 'declaration',
+      reason:
+        '#12174: the form-field row carried the pre-#11566 shape — bare `z.number()` — after '
+        + 'the object-field surface converged (`maxLength` #11566, `minLength` #11949, both '
+        + '`z.number().int().min(1)`). The row keys are LIVE, measured in objectui: the spec '
+        + 'bridge (`packages/react/src/spec-bridge/bridges/form-view.ts` mapField, '
+        + 'objectui#5898) and plugin-form (`sectionFields.ts` normalizeSectionField) both copy '
+        + 'them onto the runtime field, the console FormPage merges `override.maxLength ?? '
+        + 'def.maxLength` onto the rendered input (objectui#5595), and the fields package '
+        + 'builds react-hook-form validation rules from `minLength`/`maxLength` — so '
+        + '`maxLength: 0` on a form row reached the DOM as an input that accepts nothing, and '
+        + 'the public-form resolve route (`GET /forms/:slug`) serves the rows verbatim to '
+        + 'anonymous renderers. The schema now refuses the malformed values at parse '
+        + '(`z.number().int().min(1)`, ADR-0078 declared=enforced). Unlike the object-field '
+        + 'twins there is NO type-conditional gate: a form row references its object field by '
+        + 'name and usually omits `type`, so the referenced field\'s type is invisible at parse '
+        + 'time — value shape is checkable on this surface, key placement is the object '
+        + 'field\'s own schema\'s job.',
+      acceptanceCriteria:
+        'Every form-view field row declaring `maxLength` or `minLength` carries a positive '
+        + 'integer. Well-formed rows (a positive-integer bound) parse byte-identically to '
+        + 'before; rows declaring neither key are untouched, and absence stays absence — no '
+        + 'default materializes. A stored form view carrying a malformed row value is refused '
+        + 'on its next authoring-path save with a prescriptive per-key issue; the author '
+        + 'deletes the key (the object field\'s own declaration keeps governing the write '
+        + 'seam) or re-declares the intended positive integer.',
+    },
+    {
+      id: 'ui-form-field-precision-scale-integer-refused',
+      surface: 'form-view field row `precision` / `scale` declarations '
+        + '(`FormFieldSchema`, the rows inside `FormView.sections[].fields[]`) — '
+        + 'non-integer or negative values (`scale: 2.5`, `precision: -1`)',
+      replacement: 'a non-negative integer digit count, or no declaration at all. The row-level '
+        + 'key is a per-form override of the referenced object field\'s own declaration (that '
+        + 'surface tightened first: #8321) — a malformed row value is deleted, and a count '
+        + 'that was actually wanted is re-declared as a non-negative integer (`scale: 2.5` was '
+        + 'probably `2` or `3`)',
+      reason:
+        '#12174: the form-field row carried the pre-#8321 shape — bare `z.number()` — after '
+        + 'the object-field surface converged on `z.number().int().min(0)` for both digit '
+        + 'counts. The row keys are LIVE, measured in objectui: the spec bridge '
+        + '(`form-view.ts` mapField, objectui#5898) and plugin-form (`sectionFields.ts`) copy '
+        + 'them onto the runtime field, `ObjectForm` derives the number input\'s step from '
+        + '`precision`, and the `NumberField` widget reads `scale` — so a malformed count '
+        + 'flowed into rendering arithmetic (`Math.pow(10, -precision)`) with no defined '
+        + 'meaning. The schema now refuses non-integer and negative values for both keys at '
+        + 'parse time (ADR-0078 declared=enforced). Same no-type-gate rationale as the length '
+        + 'pair entry (`ui-form-field-length-malformed-refused`): the row usually omits '
+        + '`type`, so only value shape is checkable on this surface. '
+        + '⚠️ `CurrencyConfigSchema.precision` and the gantt `scale` enum are different '
+        + 'surfaces and are unchanged.',
+      acceptanceCriteria:
+        'Every form-view field row declaring `precision` or `scale` carries a non-negative '
+        + 'integer. Well-formed rows (`0`, `2`, any non-negative integer) parse '
+        + 'byte-identically to before; rows declaring neither key are untouched, and absence '
+        + 'stays absence. A stored form view carrying a malformed row value is refused on its '
+        + 'next authoring-path save with a prescriptive per-key issue; the author deletes the '
+        + 'key or re-declares the integer they meant.',
+    },
     {
       id: 'ui-record-blocks-unknown-keys-refused',
       surface: 'page `record:alert` / `record:quick_actions` / `record:history` / '