Console FormPage seeds a RUNTIME-default `defaultValue` literally into the control (`readPrefill`), suppressing the server-side resolution the declaration asks for

[os-zhuang]

Found while implementing #5627 (wiring the section-level and object-level conditional
rules into apps/console/src/components/FormPage.tsx). Not fixed in that PR — it is a
different defect class (seeding, not conditional-rule evaluation), and that card's fence was
the four conditional-rule surfaces.

Measured on origin/main c7cd2b60b.

Mechanism

readPrefill in apps/console/src/components/FormPage.tsx seeds every declared default
unconditionally:

for (const f of fields) {
 if (f.defaultValue !== undefined) out[f.name] = f.defaultValue;
 ...
}

A defaultValue may be a literal, or an instruction the server resolves per insert —
the DEFAULT_VALUE_TOKENS family (NOW(), current_user) or a CEL Expression envelope.
@object-ui/core owns the classifier for exactly that distinction
(packages/core/src/validation/server-owned-value.ts, isRuntimeDefault), and its own
docstring names seeding as consumer #1:

seeding (#4047 / #4068) — such a default is not seeded, because putting the literal text
NOW() into a datetime input and submitting it suppresses the very resolution the
declaration asked for

@object-ui/plugin-form schemaDefaults.ts routes its seeding through that classifier
(return !isRuntimeDefault(v)). FormPage.tsx calls neither: isRuntimeDefault returns
zero hits in that file. So on the console's two form routes a field declared
defaultValue: 'NOW()' opens with the literal string NOW() in the input, and a submit
sends that string as the value — which is not "absent or null", so
ObjectQL.applyFieldDefaults never resolves the declared default.

Why this is not a duplicate

• Create dialog ignores a field's defaultValue — a required select with a default renders empty and forces a manual choice #4047 / fix(plugin-form): seed create forms from the object schema's declared defaults #4068 fixed the seeding rule on the plugin-form chain, and A required field whose defaultValue is a runtime token (NOW() / current_user) cannot be submitted from a create form #4069 / requiredWhen + a runtime defaultValue still deadlocks a create form (the conditional half of #4069) #4085 the
  required-ness half that hangs off the same classifier.
• Console FormPage still drops the other three conditional-rule surfaces after #5594: section-level visibleWhen/visibleOn, and the object-level field rules visibleWhen/readonlyWhen/requiredWhen #5627 (this renderer, in flight) wires the conditional rules and reuses
  resolveFieldRuleState, which brings the serverOwnedValue carve-out for required with
  it — so after that PR a server-owned control is correctly not marked required here. The
  SEEDING half is untouched and is what this issue records.
• Same class as DrawerForm's no-sections field builder drops visibleWhen / readonlyWhen / requiredWhen (and group) — ModalForm's identical builder carries them #4755 in shape (a second/third renderer missing what the first one carries),
  different key.

Searched open issues before filing (readPrefill, seeding, runtime default, NOW(),
console form, server-owned) — no open match.

Severity note, honestly bounded

User-reachable on the public /f/:slug route as well as the internal one. The visible harm
is a control pre-filled with the text NOW() and a record whose column stores that string
rather than a timestamp. Not browser-verified — this is static evidence (the call site,
the absent classifier, and the sibling chain's guard). A fix presumably means routing this
seed through isRuntimeDefault the way schemaDefaults.ts does, but whether the console's
hand-rolled prefill path should import that classifier or grow a shared helper is a call for
triage, not for this note.

Related: #5627, #4047, #4068, #4069, #4085.

[os-zhuang]

Triage (first touch): pm:queue + domain:ui.

Landing: apps/console/src/components/FormPage.tsx — readPrefill's unconditional seeding loop. The classifier that makes the fix cheap already exists at packages/core/src/validation/server-owned-value.ts, so this is a consumer-side read of an existing contract, not a contract change.

Graded pm:queue: named file, named classifier to call, no open question.

objectui three-stream split (maintainer 2026-08-21). Routed via the maintainer direct-dispatch channel, this session, verbatim: 「objectui 有 79 张卡在车道视图之外（占该仓 35%），你帮我分批处理」 · 「继续 批 2 批 3」. PM session session_0124Qg8rLvpXnQDwCmpKUmaJ. Not a Routine triage fire — the triage seat may re-grade.

---

Generated by Claude Code

[claude]

Claiming this card.

• Session id: 01EuPCi56cnGyykygi3z9w4m (dispatched by the domain:ui PM seat)
• Branch: claude/issue-5727-formpage-runtime-default-seed

All seats share the os-zhuang identity, so this comment — not the assignee field — is the claim. If you are another seat and hold an earlier claim on this card, stop me.

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 5727,
 "status": "done",
 "branch": "claude/issue-5727-formpage-runtime-default-seed",
 "pr": "https://github.com/objectstack-ai/objectui/pull/5885",
 "premise_still_valid": true,
 "summary": "Re-measured the card's static evidence on today's origin/main (1939c9610), not the c7cd2b60b it was taken at: readPrefill still seeded unconditionally and isRuntimeDefault still had zero hits in FormPage.tsx, so the premise holds. Guarded the seed with isRuntimeDefault imported from @object-ui/core per the PM's ruling (no new helper) - the same published classifier @object-ui/plugin-form's schemaDefaults.ts guards its seeding with, and the one this file already read once removed via isServerOwnedValue for the #5627 required carve-out. A runtime default now leaves the key ABSENT rather than seeded, because absent is precisely the case ObjectQL.applyFieldDefaults resolves. Two ruling consequences recorded in the PR rather than silently chosen: isRuntimeDefault and not schemaDefaults.ts's isSeedableDefault wrapper (the wrapper also rejects null, which would change this route's declared-null contract), and the skip is NOT create-gated (on edit a record naming the field already outranks the default, while a record leaving the column unset is exactly where the literal would still reach a control). No dependency change was needed: @object-ui/core is already declared by apps/console and already imported by this file, and check:phantom-deps is green.",
 "tests": "All legs ran on d62fb621d, this PR's head; the ablation restored the tree byte-identically (sha256 of the working file == sha256 of `git show HEAD:...`), so the union and the head are the same tree. TESTS: `pnpm exec vitest run apps/console/src/components/FormPage.test.ts` -> 'Test Files 1 passed (1)' / 'Tests 75 passed (75)'; `pnpm exec vitest run apps/console/` -> 'Test Files 72 passed (72)' / 'Tests 805 passed (805)'. TYPES: `pnpm --filter @object-ui/console type-check` exit 0 with the script name echoed ('> @object-ui/console@17.6.0 type-check' -> 'tsc --noEmit && tsc -b tsconfig.node.json --force'), after building the dependency closure (`pnpm --filter '@object-ui/console^...' build`, exit 0). REVERSE VERIFICATION (discriminating): ablated ONLY the guard back to the unconditional seed; the mutation was confirmed on disk by grep counts anchored on both the injected and the deleted text (injected 'ABLATED-5727' = 1, removed 'isRuntimeDefault(f.defaultValue)' = 0), never on an editor's exit code. NO REBUILD is involved or claimed - the test imports the subject as './FormPage', a relative source specifier, so nothing resolves through a package exports map to dist; the classifier it calls does come from dist and was built, unchanged, by the closure build above. The mutation script carried `trap '<git checkout ...>' EXIT INT TERM`. Ablated run: 'Tests 5 failed | 70 passed (75)' - the two DEFAULT_VALUE_TOKENS legs, the CEL envelope leg and both tolerated-spelling legs went red, which is the direction predicted before running. Restore proof: `git diff HEAD --name-only` empty, sha256 identical, re-run 'Test Files 1 passed (1)' / 'Tests 75 passed (75)'. NON-DISCRIMINATING LEGS, named: all ten control rows stay green under the ablation by design (they catch an over-broad guard, not this one); of those, the stored-record and prefill_ rows do not test the guard at all - they pin precedence, and the later rungs overwrite source 1 either way - and the declared-null row discriminates a different candidate implementation (isSeedableDefault), not this ablation. GATES (exit codes captured before any pipe; verdict lines are the gates' own): check-changeset-presence.mjs '2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'; check-changeset-no-major.mjs 'No changeset declares a `major` bump.'; check-control-bytes.mjs 'OK (scanned 4891 tracked text file(s); skipped 85 binary)' plus an explicit grep -naP self-scan of the three changed files (no hits); check-phantom-dependencies.mjs 'Every in-scope import is declared by the package that publishes it.'. RE-DERIVED from the paths actually touched rather than trusting the dispatch list, because the test's new @objectstack/spec/data import reaches past the four named: check-spec-symbol-derivation.mjs 'spec symbol derivation: 1300 files scanned against 4959 spec export names' and check-package-self-import.mjs 'No package names itself inside its own src/.', both exit 0. LINT, NARROWING DECLARED: ran the whole @object-ui/console turbo lint unit ('eslint .' from apps/console, the package's own script verbatim) rather than all 40 units - 171 files, 0 errors, 202 warnings, with the file count read from --format json and the population from eslint's own resolution of '.', not a hand-picked list; no warning falls on a line this PR adds. Soundness: eslint.config.js extends tseslint.configs.recommended, NOT recommendedTypeChecked, and sets no parserOptions.project/projectService, and the local eslint-rules/* are per-file AST rules with no filesystem reads, so no rule reads across file boundaries and this diff touches no config file - it cannot move any untouched file's verdict. ONE GATE DELIBERATELY NOT RUN, declared: check:eager-closure needs apps/console/dist/eager-closure.json from a vite build and without it reports a BROKEN GAUGE, not a verdict; it cannot move here and that is checkable rather than assumed - this PR only adds a named symbol to an already-existing import statement, so the bundled module's package-specifier set is byte-identical to origin/main's (diff of the sorted `from '...'` sets is empty). CI builds the console and runs it.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #5883: console FormPage submits a cleared server-owned field as '' - handleSubmit posts `values` wholesale and there is no omitServerResolvedDefaults equivalent, so a control the user focuses and clears still defeats the declared runtime default on that path (different call site and predicate from this card's seeding fence; duplicate-searched over all 220 open issues before filing)",
 "filed as #5884: observation (labelled `finding`, no pm:queue) - console FormPage does not RESOLVE the current_user seed the way schemaDefaults.ts has since #5683; after this PR the behaviour is correct (the server stamps the id) but the operator cannot see the attribution before submitting, and threading usePermissions() into a pure (fields, search, record) seam is a real cost, so it is filed as a triage call rather than a defect"
 ]
}

---

Generated by Claude Code