forms: a relation.field may cross models

versions/1.2.md

@@ -793,6 +793,10 @@ forms:
 
 Generates one form per `forms[]` entry. Controls are typed by looking each field up against the bound entity (string to a text input, integer / decimal to a number input, boolean to a checkbox, date to a date picker, and so on). Actions become buttons, coloured by name (approve to positive; reject / decline / delete / cancel to negative; save / submit to emphasised).
 
+A `relation.field` entry reads a field of a one-hop to-one relation, read-only — the related record is loaded for the form rather than typed into it. The relation MAY be **cross-model**: a document's form can show a field of the entity another module owns (an invoice's Send form showing the customer's address), which is the same one-hop path a [`notify`](#notifications) recipient takes.
+
+**Normative.** For a cross-model `relation.field`, the relation's `model:` MUST be declared in [`uses`](#reuse-dont-redefine--uses), and the referenced field is validated against the **owner's** model at generation time rather than against the local document. A conforming generator MUST report a field the owner model does not declare instead of dropping the control silently: a control bound to a value nothing ever provides is indistinguishable from a record that has no value.
+
 ### actions — custom buttons
 
 Developer-defined buttons that open a custom page — the escape hatch when a workflow or a generated screen is not enough: