Console FormPage submits a cleared server-owned field as `''` — no `omitServerResolvedDefaults` equivalent, so the declared runtime default is still suppressed on that path

[claude]

Found while implementing #5727 (guarding readPrefill's seeding with isRuntimeDefault). Not fixed in that PR — that card's fence was the seeding half, and this is the submit half: a different call site, a different predicate, and its own decision about what "empty" means.

Measured on origin/main 1939c9610.

Mechanism

After #5727 a create form on the console's two form routes correctly opens a runtime-default control EMPTY and leaves the key out of values. But handleSubmit submits values wholesale:

const result =
 mode === 'public'
 ? await submitPublic(identifier, values)
 : await submitInternal(loaded.object, values, editingId);

A rendered control that the user focuses and then clears writes back through onChange={(e) => onChange(e.target.value)} (FieldInput, the text/email/url/date/time/textarea arms), so values gains the key with ''. ObjectQL.applyFieldDefaults resolves a declared default only for a field that arrives absent or null — a blank string is neither, so submitting one stores '' and silently defeats the declaration. That is the same suppression #5727 closed, reached by the other door.

The sibling chain already has the answer and names it as the other half of the same fix: @object-ui/plugin-form's omitServerResolvedDefaults (packages/plugin-form/src/schemaDefaults.ts) drops exactly the keys whose declared default isRuntimeDefault and whose submitted value isMissingForRequired. Its docblock states the pairing outright — "excusing a server-owned field from required is only half an answer if the form then submits the key anyway". apps/console/src/components/FormPage.tsx calls no equivalent: omitServerResolvedDefaults returns zero hits in that file.

Why this is not a duplicate

• Console FormPage seeds a RUNTIME-default defaultValue literally into the control (readPrefill), suppressing the server-side resolution the declaration asks for #5727 fixed SEEDING on this renderer (the key never enters values from the declaration). This is the submit filter, which is what handles a key the USER put there.
• A required field whose defaultValue is a runtime token (NOW() / current_user) cannot be submitted from a create form #4069 / requiredWhen + a runtime defaultValue still deadlocks a create form (the conditional half of #4069) #4085 carried the required half onto this renderer via resolveFieldRuleState; neither touches the payload.
• Same class as Console FormPage seeds a RUNTIME-default defaultValue literally into the control (readPrefill), suppressing the server-side resolution the declaration asks for #5727 in shape — the second form renderer missing what the first one carries — different call site.

Honestly bounded

Not browser-verified. Static evidence: the handleSubmit call site, the onChange write, the absent omitServerResolvedDefaults call, and the sibling module's own statement that the two halves belong together. Reachability requires the user to touch and clear the control, which narrows it relative to #5727 (that one fired on every open). Note also that the console builds its payload from values rather than from an object schema keyed by field name, so whether the sibling's signature (data, objectSchema) fits this call site as-is, or the fence wants the RenderableField rows it already holds, is a call for triage rather than for this note.

Related: #5727, #4047, #4068, #4069, #4085.

---

Generated by Claude Code

[claude]

Triage (daily round, session session_01Kktexqp6uVuFMztvvTMf3V, 2026-08-24): pm:queue added on existing domain:ui, Bug — Console FormPage submits a cleared server-owned field as '' with no omitServerResolvedDefaults equivalent, suppressing the declared runtime default on that path. Align with the schemaDefaults path (#5683 family).

---

Generated by Claude Code

[yinlianghui]

Claim: PM loop round 38 (refill slot)
Session: session_01CSoz9uGhaaSgiq3hshtN7L
Branch: claude/issue-5883-formpage-omit-server-defaults
Worktree: objectui-issue-5883
Domain: domain:ui
File surface: apps/console/src/components/FormPage.tsx + its tests + a changeset. packages/plugin-form/src/schemaDefaults.ts is read-only — you are reusing its predicate, ⛔ not editing or re-implementing it.
Container & model: M, mode:subagent, model: opus
Clause-②: no — a console app stops submitting a key it should not have submitted. No published declaration moves. ⚠️ Unless reaching the shared helper requires a new workspace dependency edge — if so, ⛔ say so explicitly (the phantom-dependency gate will judge it).
Serial constraints cleared: apps/console/** — no in-flight claim (#5565 landed as PR #6031 earlier this round; rebase past it). Concurrent siblings: #5903 (packages/types + packages/plugin-gantt), #5872 (packages/test-support + parity tests), #5725 (packages/app-shell/src/views/metadata-admin/previews/), #5676 (packages/data-objectstack). Disjoint by full path.

裁决 — triage's grade and route

Triage seat, 2026-08-24 (daily round): pm:queue on existing domain:ui, Bug. Verbatim: "Console FormPage submits a cleared server-owned field as '' with no omitServerResolvedDefaults equivalent, suppressing the declared runtime default on that path. Align with the schemaDefaults path (#5683 family)."

The mechanism, and the sibling that already states the answer

After #5727 a create form on the console's two form routes correctly opens a runtime-default control empty and leaves the key out of values. But handleSubmit submits values wholesale. A control the user focuses and then clears writes back through onChange={(e) => onChange(e.target.value)} (FieldInput's text/email/url/date/time/textarea arms), so values gains the key with ''.

⭐ ObjectQL.applyFieldDefaults resolves a declared default only for a field arriving ABSENT or NULL. A blank string is neither — so submitting one stores '' and silently defeats the declaration. Same suppression #5727 closed, reached by the other door.

✅ And the sibling module already names this as the other half of the same fix: @object-ui/plugin-form's omitServerResolvedDefaults (packages/plugin-form/src/schemaDefaults.ts) drops exactly the keys whose declared default isRuntimeDefault and whose submitted value isMissingForRequired. Its own docblock: "excusing a server-owned field from required is only half an answer if the form then submits the key anyway." FormPage.tsx calls no equivalent — omitServerResolvedDefaults returns zero hits in that file.

⛔ Reuse the predicate; do not re-implement it

The card leaves the adapter shape open — "whether the sibling's signature (data, objectSchema) fits this call site as-is, or the fence wants the RenderableField rows it already holds, is a call for triage rather than for this note" — and triage answered with the route (align with the schemaDefaults path), not the signature. So:

• ✅ You choose the adapter shape. Adapt the console's data to the shared helper, or adapt the helper's inputs from the RenderableField rows the page already holds. Either is fine.
• ⛔ What you may NOT do is re-implement isRuntimeDefault / isMissingForRequired in apps/console. A second copy of the predicate is exactly the drift this family keeps producing (Create dialog ignores a field's defaultValue — a required select with a default renders empty and forces a manual choice #4047, fix(plugin-form): seed create forms from the object schema's declared defaults #4068, A required field whose defaultValue is a runtime token (NOW() / current_user) cannot be submitted from a create form #4069, requiredWhen + a runtime defaultValue still deadlocks a create form (the conditional half of #4069) #4085, Console FormPage seeds a RUNTIME-default defaultValue literally into the control (readPrefill), suppressing the server-side resolution the declaration asks for #5727, Create-form does not resolve the current_user defaultValue token — spec-correct "default applicant = me" renders as an empty field until save #5683 — six cards of "the second renderer is missing what the first one carries"). ⛔ If the shared helper genuinely cannot be reached from apps/console, stop and report rather than copying it.

PM mechanism assumptions — measure, do not assume

1. The card measured origin/main at 1939c9610 on 2026-08-23. apps/console moved today — Approvals drawer summary card can render a field the object declares hidden: true #5565 landed a page-local metadata seam in src/pages/system/, and this seat merged 12 PRs. Re-derive on your merge-base: the handleSubmit call site, the onChange write in FieldInput, and the zero-hit omitServerResolvedDefaults grep. Report any delta.
2. ⚠️ The card is explicitly NOT browser-verified — its evidence is static (call site, onChange write, absent call, sibling docblock). ⛔ Do not inherit the reachability claim: reproduce it in a test before fixing. Reachability needs the user to touch and clear the control, which is narrower than Console FormPage seeds a RUNTIME-default defaultValue literally into the control (readPrefill), suppressing the server-side resolution the declaration asks for #5727's every-open trigger — if it does not reproduce, ⛔ stop and report.
3. ⚠️ '' is not the only "cleared" value on this path, and the predicate's notion of empty is the whole fix. A cleared number input, a cleared date, a cleared select may write '', null, undefined or NaN. Measure what each arm actually writes, and make sure the filter's notion of empty matches — ⛔ a filter that catches only '' leaves the same bug on the arms that write something else.
4. ⚠️ The filter must not eat a deliberate blank. A user clearing a field that has no runtime default is expressing intent, and that '' must still be submitted. The shared predicate already gates on isRuntimeDefault — verify that gate is live on your call path rather than assuming it.

Verification

Direction predicted before running: a create submit where the user focuses and clears a runtime-default field must omit that key entirely; revert the filter and show the assertion goes red on the submitted payload (assert the payload, not the form state).

Counter-probe required, two of them, and they are the load-bearing half: (a) a user-cleared field with no runtime default must still submit '' — otherwise the filter is eating intent; (b) a field the user typed a real value into must submit that value — otherwise "the key is omitted" is satisfiable by omitting everything. ⛔ Without both, a filter that drops the whole payload passes the positive assertion.

Prove every mutation on disk by grepping the injected text and separately the removed text; ⚠️ print the landing site rather than assuming it, and ⚠️ assert anchor uniqueness before writing. Restore under trap … EXIT INT TERM — ⚠️ and make the trap's restore command cwd-independent: a trap that fires is not the same as a trap that restored (measured on #5926 in this round, where a repo-relative pathspec failed from a subdirectory and left the tree dirty). Confirm git diff HEAD --stat empty afterwards.

Gates by name with exit codes: pnpm --filter @object-ui/console type-check (⚠️ hyphenated; echo the script name so a zero-match silent pass cannot read as green — and distinguish the unbuilt-closure red, Cannot find module @object-ui/..., from the missing-node_modules red in a fresh worktree; both were hit today and need different fixes), root-form vitest over the console's form suites (⚠️ vitest guard refuses --filter forms — use pnpm exec vitest run <paths> from the repo root), node scripts/check-phantom-dependencies.mjs if you add an import, and eslint on changed files with merge-base delta. ⚠️ Plain eslint . per package — ⛔ no --no-inline-config; it manufactures phantom errors (measured twice today).

Run node scripts/check-changeset-presence.mjs rather than guessing whether a changeset is owed. Draft PR, Fixes #5883. ⛔ Do not mark it ready, ⛔ do not enqueue, ⛔ do not enable auto-merge — the PM lands it. Post the terminal report here (plain-text first-line marker os-dev-report; ⛔ avoid short angle-bracket placeholders in prose — this repo's sanitizer eats them, confirmed again on #5926 today) and return it.

---

Generated by Claude Code