diff --git a/‎.changeset/19332-g1b-field-action-form-rows.md‎
Lines changed: 22 additions & 0 deletions b/‎.changeset/19332-g1b-field-action-form-rows.md‎
Lines changed: 22 additions & 0 deletions
diff --git a/‎packages/lint/src/validate-predicate-path-refs.test.ts‎
Lines changed: 16 additions & 2 deletions b/‎packages/lint/src/validate-predicate-path-refs.test.ts‎
Lines changed: 16 additions & 2 deletions
diff --git a/‎packages/platform-objects/src/apps/translations/en.metadata-forms.generated.ts‎
Lines changed: 76 additions & 0 deletions b/‎packages/platform-objects/src/apps/translations/en.metadata-forms.generated.ts‎
Lines changed: 76 additions & 0 deletions
@@ -0,0 +1,22 @@
+---
+"@objectstack/spec": minor
+"@objectstack/platform-objects": patch
+---
+
+Clause-②: no
+
+Sixteen live structured metadata keys are authorable in the metadata form: eleven on the field form — `accept`, `currencyConfig`, `dependsOn`, `lookupColumns`, `lookupFilters`, `readonlyWhen`, `relatedListColumns`, `requiredPermissions`, `requiredWhen`, `storage`, `visibleWhen` — and five on the action form — `bodyExtra`, `description`, `errorMessage`, `patch`, `requiredPermissions`. Each was **declared** by its schema, graded `live` by the liveness ledger, and offered by **no** form in `METADATA_FORM_REGISTRY`, so an author's only door was the Source tab. Each now has exactly one row, whose control copies a row a registered form already carries for the same node shape:
+
+- `visibleWhen`, `readonlyWhen`, `requiredWhen` — `type: 'code'`, `language: 'expression'`, the object designer's per-field rows for the same three keys.
+- `lookupFilters` — `widget: 'json'`, the object designer's per-field row for the same key; no inline operator list, because `notIn` is not a spellable option value.
+- `lookupColumns`, `dependsOn` — `widget: 'json'`, **never** `string-tags`: each is an array of a union (a field name, or an object entry), and the tag widget is a chip input for strings only, which cannot show or edit a stored object entry.
+- `accept`, `relatedListColumns`, and both `requiredPermissions` — `widget: 'string-tags'`, the app form's `requiredPermissions` row: a chip input over a plain `string[]`.
+- `currencyConfig`, `storage` — a `composite` with declared sub-rows (`currencyMode` as a `dynamic` / `fixed` select, `defaultCurrency`; `notNull`), the shape of the object form's `access` row.
+- `patch`, `bodyExtra` — `widget: 'json'` over a string-keyed record.
+- `description` — `widget: 'textarea'`, the page form's `description` row, over the same `I18nLabel` node; `errorMessage` — a plain row, the twin of `successMessage`.
+
+Each type-specific row is gated to the types its runtime reader serves: the media types for `accept`, `currency` for `currencyConfig`, `lookup` / `master_detail` for the picker and related-list rows, those two plus the four option types for `dependsOn`, `operation: 'update'` for `patch` (the parse refuses it anywhere else), and `type: 'api'` for `bodyExtra`. The help text states what the runtime does with each value, including what absence resolves to. The four field-name lists (`relatedListColumns`, `lookupColumns`, `lookupFilters[].field`, `dependsOn`) are free text: no authoring door judges their names today — not the schema parse, not the publish door and not `os validate` — so the help text claims no such refusal.
+
+⛔ **No schema accept set moves and no export changes.** `METADATA_FORM_REGISTRY` is declared as an opaque `Readonly<Record<string, FormView>>`, so row contents were never part of the declared surface. What changes is the **form payload** `getMetaTypes()` serves and the translation keys `os i18n extract` walks — hence the regenerated `platform-objects` metadata-form bundles, whose 38 new leaves are authored in `zh-CN`, `ja-JP` and `es-ES` rather than left as extractor fills.
+
+⛔ **The gate that would notice a missing row is NOT landed here.** The reconciliation gate's top-level `zodOnly` direction stays unwired; this change lands offers only.
@@ -596,7 +596,16 @@ describe('#7010 corpus — shipped METADATA_FORM_REGISTRY', () => {
     // refuses one, so the form offers the control only where it draws. The same
     // card REMOVED the joined-block `chart` repeater column, which carried no
     // predicate, so it leaves this census untouched.
-    expect(predicates, 'the shipped metadata forms carry no predicates at all').toBe(73);
+    // It is 81 today, an ADDITION of EIGHT: #19332 (flight G1b) gave sixteen
+    // live structured field and action keys a form row each, and eight of those
+    // rows carry a meaningfulness gate — the key is read only for some field
+    // types or action shapes. Measured, not inferred: the shipped corpus was
+    // differenced against the merge base `789b2ae54` by
+    // `<form>::<field>::<source>`, 73 → 81, eight added and NONE removed —
+    // `field :: accept | currencyConfig | dependsOn | lookupColumns |
+    // lookupFilters | relatedListColumns`, plus `action :: patch` and
+    // `action :: bodyExtra`. The other eight rows carry no predicate.
+    expect(predicates, 'the shipped metadata forms carry no predicates at all').toBe(81);
 
     const findings = validatePredicatePathRefs(corrupted);
     expect(findings).toHaveLength(predicates);
@@ -687,7 +696,12 @@ describe('#7010 corpus — shipped METADATA_FORM_REGISTRY', () => {
     // quoted literal and is not rewritten.
     // It is 53 today: #20161's `report :: chart` gate is `data.type != 'joined'`,
     // a `!=` against a single-quoted literal.
-    expect(comparisons, 'no shipped predicate carries an `==`/`!=` literal comparison').toBe(53);
+    // It is 56 today: three of #19332 G1b's eight new predicates compare
+    // against a single-quoted literal (`field :: currencyConfig` on
+    // `data.type == 'currency'`, `action :: patch` on
+    // `data.operation == 'update'`, `action :: bodyExtra` on
+    // `data.type == 'api'`); the other five are `in`-list gates.
+    expect(comparisons, 'no shipped predicate carries an `==`/`!=` literal comparison').toBe(56);
 
     const rhsFindings = validatePredicatePathRefs(corrupted)
       .filter((f) => f.rule === PREDICATE_RHS_PATH_SHAPED);
 
@@ -464,6 +464,18 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Scale",
         helpText: "Number of decimal digits"
       },
+      currencyConfig: {
+        label: "Currency Config",
+        helpText: "Which currency this field is in. Unset: dynamic mode. The stored value is a bare number in either mode."
+      },
+      "currencyConfig.currencyMode": {
+        label: "Currency Mode",
+        helpText: "dynamic (the default): the field has no currency of its own, and amounts display in the tenant default currency (the localization.currency setting). fixed: the field has one currency, defaultCurrency."
+      },
+      "currencyConfig.defaultCurrency": {
+        label: "Default Currency",
+        helpText: "The one currency of a fixed-mode field, as a three-character ISO 4217 code (e.g. USD, EUR). Defaults to CNY. Not read in dynamic mode."
+      },
       step: {
         label: "Step",
         helpText: "Step increment for the slider (default 1). Renderer-only: the write path does not reject a value off the step grid."
@@ -472,6 +484,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Max Size",
         helpText: "Maximum permitted file size in BYTES (positive integer). Enforced server-side on write against the stored file size — a file with no recorded size cannot fail it."
       },
+      accept: {
+        label: "Accept",
+        helpText: "Permitted upload types, as MIME types, type/* wildcards or .ext suffixes (e.g. image/*, .pdf). Offered to the file picker and re-checked server-side on write against the stored file. Unset: any type."
+      },
       dimensions: {
         label: "Dimensions",
         helpText: "Vector dimensionality — an integer from 1 to 10000 (e.g. 1536 for OpenAI embeddings)."
@@ -538,10 +554,26 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Lookup Page Size",
         helpText: "Rows per page in the record-picker dialog — a positive integer; default 10."
       },
+      lookupColumns: {
+        label: "Lookup Columns",
+        helpText: "Columns of the record-picker table: field names of the referenced object, or {field, label, width, type} entries (e.g. [\"name\", {\"field\": \"status\", \"label\": \"Stage\"}]). Unset: derived from the referenced object."
+      },
+      lookupFilters: {
+        label: "Lookup Filters",
+        helpText: "Base filter on the picker's candidates, as {field, operator, value} rules on the referenced object — operator one of eq, ne, gt, lt, gte, lte, contains, in, notIn (e.g. [{\"field\": \"status\", \"operator\": \"eq\", \"value\": \"active\"}]). Applied to every picker surface, ANDed with any dependsOn filter."
+      },
+      dependsOn: {
+        label: "Depends On",
+        helpText: "Fields on the same record this field's choices depend on: the form holds this field until each is set, and re-evaluates it when one changes. A lookup filters its candidates by them — a name filters the same-named field of the referenced object, {field, param} names a different one. On an option field list the parent field names; the per-option rule lives in each option's visibleWhen."
+      },
       relatedListTitle: {
         label: "Related List Title",
         helpText: "Title for this relationship's related list on the parent's detail page."
       },
+      relatedListColumns: {
+        label: "Related List Columns",
+        helpText: "Columns of this relationship's related list on the parent's detail page, as field names of this (the child) object, e.g. name, status. Unset: derived from the child object. Names only — labels, cell types and formatting come from the child's field definitions."
+      },
       inlineTitle: {
         label: "Inline Title",
         helpText: "Title for the inline master-detail grid on the parent record."
@@ -586,6 +618,14 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "External Id",
         helpText: "Mark as external ID for upsert operations"
       },
+      storage: {
+        label: "Storage",
+        helpText: "Physical storage constraints (ADR-0113): the DDL the write contract deliberately does not imply. Unset: none requested."
+      },
+      "storage.notNull": {
+        label: "Not Null",
+        helpText: "Emit a database NOT NULL on the column. Unset, the column stays nullable even under required — the engine enforces required on write. Declaring it over existing null rows is a destructive migration gated by schema drift (backfill first). Refused beside requiredWhen."
+      },
       readonly: {
         label: "Readonly",
         helpText: "Field is read-only in forms"
@@ -602,10 +642,26 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Sortable",
         helpText: "Allow sorting lists by this field"
       },
+      visibleWhen: {
+        label: "Visible When",
+        helpText: "CEL predicate over the record (e.g. record.type == 'invoice') — the form shows this field only while it is TRUE."
+      },
+      readonlyWhen: {
+        label: "Readonly When",
+        helpText: "CEL predicate over the record (e.g. record.status == 'paid') — the field is read-only while it is TRUE, enforced server-side: an update's change to a locked field is dropped and the stored value kept. Reads the record's own columns; objectstack validate refuses a read through a reference field."
+      },
+      requiredWhen: {
+        label: "Required When",
+        helpText: "CEL predicate over the record — the field is required while it is TRUE, enforced server-side as a transition gate: a write that leaves the value missing is refused when the record complied before it, so a row already missing the value keeps passing unrelated edits. For a rule every write must meet, use a validations script rule. Refused beside storage.notNull."
+      },
       maskingRule: {
         label: "Masking Rule",
         helpText: "Partial masking: preset ('phone', 'id_card', 'bank_account', 'email', 'name') or {\"keepHead\": n, \"keepTail\": m}. Masked for callers not holding this field's requiredPermissions"
       },
+      requiredPermissions: {
+        label: "Required Permissions",
+        helpText: "Capabilities (permission-set systemPermissions) a caller must hold — every one listed — to read or edit this field (ADR-0066 D3). Without them the value is masked on read (partially, when a maskingRule is set) and edits are denied. Empty or unset: no capability gate."
+      },
       internal: {
         label: "Internal",
         helpText: "Never return this field's value on the generic data path: the engine omits the key from find/findOne results and from the create and update response bodies, on the default projection and when a client names the field in ?select=. Storage, filtering and indexing are untouched."
@@ -1535,6 +1591,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Operation",
         helpText: "Declarative single-record field write: 'update' applies `patch`, merged under the collected `params`, to the current record AS THE CALLER — never system-elevated, so the caller's permissions, the object's hooks and its validations all fire as for a user edit."
       },
+      patch: {
+        label: "Patch",
+        helpText: "Static field values the update writes to the current record, e.g. {\"status\": \"done\"} — merged UNDER the values `params` collects, so a param of the same name wins. Written as the caller: the object's permissions, hooks and validations apply as for a user edit."
+      },
       undoable: {
         label: "Undoable",
         helpText: "Offer an Undo affordance after this update succeeds. The undo captures the prior value of every field the action writes — the merged bag, `patch` under the collected `params`. An action with no `operation` declares no write set, so there is nothing to capture."
@@ -1543,6 +1603,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Execution",
         helpText: "The bulk dispatch contract this action's body is written for: 'perRecord' sends one dispatch per selected row carrying that row's recordId; 'aggregate' sends ONE dispatch for the whole selection, with every id in params._selectedIds. Omitted, the action is dispatched per record."
       },
+      description: {
+        label: "Description",
+        helpText: "Explanatory line under the title of this action's param dialog. On an action that collects params, the confirm question goes here rather than in confirmText — one dialog, not two. Not ai.description, which is the text an AI agent reads."
+      },
       confirmText: {
         label: "Confirm Text",
         helpText: "Confirmation message (e.g., \"Are you sure?\")"
@@ -1551,6 +1615,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Success Message",
         helpText: "Success message after completion"
       },
+      errorMessage: {
+        label: "Error Message",
+        helpText: "Error message shown when the action fails, in place of the raw error."
+      },
       refreshAfter: {
         label: "Refresh After",
         helpText: "Refresh the list/page after action completes"
@@ -1587,6 +1655,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
         label: "Requires Feature",
         helpText: "Public auth feature flag gating this action. It is lowered into the `visible` predicate at parse time and stripped from the output, so no downstream consumer ever sees the key."
       },
+      requiredPermissions: {
+        label: "Required Permissions",
+        helpText: "Capabilities (permission-set systemPermissions) a caller must hold — every one listed — to invoke this action (ADR-0066 D4). The platform action route refuses anyone else with 403 (script, flow and modal actions, and the MCP/AI path), and the button is hidden from them. A type api action calls its endpoint directly, so that endpoint must re-check them."
+      },
       ai: {
         label: "Ai",
         helpText: "AI exposure (opt-in): set ai.exposed=true and write ai.description (≥40 chars) to make this callable by agents."
@@ -1602,6 +1674,10 @@ export const enMetadataForms: NonNullable<TranslationData['metadataForms']> = {
       bodyShape: {
         label: "Body Shape",
         helpText: "Request body structure (flat or nested)"
+      },
+      bodyExtra: {
+        label: "Body Extra",
+        helpText: "Static request-body fields for this api action, merged last so they override the collected params (e.g. {\"resend\": true}). Page-variable tokens (page.NAME in double braces) are resolved by the runtime. The payload goes here, never in params."
       }
     }
   },