@praxisui/dynamic-form 10.0.0-rc.4 → 10.0.0-rc.40

package/docs/dynamic-form-authoring-document-semantics.md

@@ -4,7 +4,7 @@ doc_type: "adr"
 component: "praxis-dynamic-form"
 status: "accepted"
 owner: "praxis-ui"
-last_updated: "2026-09-10"
+last_updated: "2026-10-23"
 ---
 
 # Dynamic Form Authoring Document Semantics
@@ -23,6 +23,63 @@ Ao aplicar um documento canônico:
 
 Payloads legados ou parciais recebidos por APIs de compatibilidade, como `applyConfigFromAdapter(...)`, permanecem com semântica `merge-compat`: campos não informados devem ser preservados até migração completa para o contrato canônico.
 
+## Rule conversion and recovery
+
+`config.formRules` owns the canonical rule expression and both effect branches.
+`formRulesState` is derived visual authoring state. Wizard inline JSON Logic must
+survive Apply, Save and reopen unchanged. Conditions outside the visual graph
+vocabulary remain intact inline and are diagnosed as `runtime-only`; a valid
+root-data reference (`var: ''`) is not an invalid field reference.
+
+A partial graph must never weaken an AND/OR expression by dropping children.
+Missing rule roots, rules without a serializable target, and missing, cyclic or
+unsupported explicit condition graph nodes block Apply/Save while
+retaining the draft and last accepted configuration. Repairing through the
+properties panel revalidates a supplied replacement. A nonserializable visual
+draft is repaired in the wizard or JSON; the effects panel and accepted-rule diagnostics are withheld until
+conversion succeeds, so it cannot present the last accepted rule as the current
+draft. Deleting the last rule removes both
+`formRules` and `formRulesState`, including after a validation failure.
+
+Editor validation that gates Apply/Save uses the injected `PraxisJsonLogicService`
+and the same host operator registry as runtime evaluation. A registered host
+operator can remain runtime-only in the visual builder and must still save and
+reopen. Unknown operators and invalid arity remain blocked.
+
+### Reviewing conditional presentation rules
+
+The rule wizard and list describe the condition, target labels, and every effect
+in both branches. Boolean condition choices use Yes/No (Sim/Não). Grouping and
+order remain visible for AND/OR; expressions outside the readable vocabulary
+retain an explicit advanced/JSON review path and their original expression.
+
+Indicators have separate scopes: the Visual Builder checks structure; the
+structured effects panel reports whether a property can be edited; form
+analysis validates the condition against the injected runtime registry and
+reports unavailable targets or unsupported properties. A successful sample-data
+preview proves only the selected branch for those data. None of these labels
+replaces target access policies or a governed business decision.
+
+Replacing JSON rules, clearing the list, and Reset refresh the same visual draft
+and effects panel. A valid stale `formRulesState` is rebuilt from canonical
+`formRules`; malformed explicit graphs remain repairable and block Apply/Save.
+Removing or emptying `formRules` in a JSON replacement clears residual visual
+state. Input echoes do not freeze subsequent edits or reset builder history.
+Each canonical form rule reopens as one `propertyRule` with its complete target
+list, both effect branches and authoring metadata. The bridge does not recreate
+legacy conditional-validator nodes or duplicate a rule per target.
+
+Presentation (`formRules`) and conditional actions (`formCommandRules`) retain
+separate channels and validation policies. Hidden or inaccessible targets are
+reported as unavailable; authoring does not grant access to those fields.
+
+Identified standalone forms with host-provided fields use the same persisted
+configuration initializer as schema-backed forms. Local-first restores saved
+rules and field customizations after reload; input-first, volatile configuration
+and transient layout persistence retain their existing policies. Standalone initialization does not
+request a server schema. New host inputs received while storage or hooks are
+pending remain authoritative when the form is built.
+
 ## Filter Form projection
 
 `praxis-filter-form` compartilha o mesmo documento canônico, parser e serializer,
@@ -161,7 +218,8 @@ that the resource schema could not be loaded.
 
 The wrapper also exposes the existing `configPersistenceStrategy` as **Fonte da configuração**.
 **Definida nesta página** selects `input-first`; **Preferências salvas** selects `local-first`.
-The runtime default remains `local-first`. When the goal is a page-owned layout, select `input-first`
+**Configuração temporária** selects `volatile`, which never reads, saves or clears independent child preferences.
+The runtime default remains `local-first`. For ordinary page layouts, select `input-first`
 so an older saved form preference does not replace the correctly persisted page sections on reload.
 Changing only the source preserves the authored page config even if the currently displayed effective
 layout came from older local preferences. This is an existing runtime input, not a new persistence
@@ -213,3 +271,11 @@ Conflicting preference regression: the external config hydration suite passed al
 and placeholder (log `/private/tmp/praxis-form-preference-conflict-tests.log`). This
 is an isolated storage-service test and serialized widget round-trip; actual
 backend persistence and visual editor interaction are validated separately.
+
+## Governed page child adapter
+
+For published page authorship, use [the native page adapter](governed-page-widget-adapter.md), not the
+common wrapper output directly. It preserves exact presence and only explicit editor deltas, locks
+bindings/context to the admitted seed, and derives volatile execution inputs from page/widget identity.
+Native `presentation` and `dossier` modes survive open/save/reopen; new visual flows still prefer
+`view` with a separate display preference. Filter Form keeps its three-mode runtime subset.

package/docs/evidence/form-authoring-635-20261023/final-review.md

@@ -0,0 +1,46 @@
+---
+title: "PR 645 — final review and regression evidence"
+doc_type: "guide"
+component: "praxis-dynamic-form"
+status: "validated"
+owner: "praxis-ui"
+last_updated: "2026-10-23"
+---
+
+# Final review of PR 645
+
+Review started at PR head `9ad3c8221b1de2bdba6b62adec778c185553bcd5`, against main `51075de81704596606bb578ab681124df5ae8493`. The follow-up source is identified by the refreshed 32-file `source-hashes.json`; earlier screenshots and logs remain historical evidence at the original head, not new executions against the follow-up. The original shared checkout and its server were preserved.
+
+## Findings resolved before integration
+
+1. **Shared graph ownership.** A and B could reference G/L, but clearing A retained `parentId=A`; clearing/removing B then left invalid orphan conditions. The existing graph owner now transfers retained parent references when the old edge is removed. Removal follows both child and condition references, including nested property rules, while preserving external sharing, immutable history and undo/redo. Incoming draft references are remapped together with IDs. The original red lane had two failures; the final service/component lane passed 74 tests.
+2. **Angular input assignment and cold storage.** Angular assigns `config` before `ngOnChanges`, so comparing against that property missed already-normalized replacements. The previous host document now determines whether the input changed. Genuine standalone replacements, including empty documents, rebuild without resuming an obsolete persisted initializer. A cold adapter that returns the old saved value on every subscription reproduced the failure; the final test asserts one config read and the latest field metadata.
+3. **Equivalent host echoes.** A local-first form can have a saved effective document different from its opening host document. An equivalent echo must retain the effective document and both rule branches, dirty controls and pending initialization. The public input retains the same type; an accessor observes only the transient pre-assignment references around the existing single effective document. Internal writes use that backing document directly. Only a config echo is excluded from the ownership epoch; other owner/mode/resource fences remain. Tests cover settled and pending-hook echoes, manual lifecycle calls without assignment, and two host assignments before one change-detection pass, ending either in an echo or a genuine update. Echo and batched-echo red lanes each reproduced one failure before correction.
+
+Inventory classification: `suportado-parcialmente`, corrected at the existing Visual Builder graph and Dynamic Form runtime owners. No additional model, persistence adapter, endpoint, feature flag, exported type or parallel authoring document was introduced by the review fixes.
+
+## Final applicable gates
+
+| Gate | Final result |
+| --- | --- |
+| Visual Builder service, Rule Editor, Rule Definition and Field Condition Editor | 74 passed |
+| Form field metadata, first-config and external-config hydration | 74 passed |
+| Official `build-libs.js --prod --only praxis-dynamic-form` dependency closure, including VB, Form and Page Builder | Passed |
+| Library purity | Passed, 2320 files |
+| Published documentation assets | Passed, 5 packages |
+| Material select content model | Passed, zero debt |
+| Catalog | Passed, zero errors/warnings |
+| Authoring contract acceptance | Passed, 20/20 |
+| Final component-doc extraction versus tracked source, excluding generation timestamp | Equal |
+
+These are focal lane counts, not a combined unique-test total. The unchanged editor/converter/diagnostic and visual presentation evidence is recorded in `validation.md`. Tests use Chrome Headless and real Angular `componentRef.setInput`; mocked storage/hooks and schema reconciliation do not constitute live HTTP proof. The final review did not rerun the desktop/narrow live authoring journey or a database lane. It does not certify settled form/component identity switching, full-suite behavior, screen readers, concurrency or release publication.
+
+The catalog initially lacked an ignored generated ingestion artifact. Official workspace generation resolved that environmental failure without editing tracked registry data. Authoring acceptance initially lacked the backend sibling path in the isolated worktree; the final gate used only an immutable source snapshot of canonical config-starter main `deebc69187f2aebcb23ebe259a6913947fc10b27`, not the unrelated dirty backend checkout. No backend runtime or database was started for this source-contract check.
+
+The graph fix author was different from the runtime fix author. Root independently reviewed both final diffs; the graph author also independently reviewed the final runtime accessor, internal writes, batching and ownership fences. No blocking finding remained in the reviewed final source. Test/configuration strictness was not weakened.
+
+## Derived artifacts and skills
+
+The existing documentation already describes graph ownership, host authority and persistence; the review enforces those invariants. No new public semantics require a README, HTTP corpus, AI manifest or landing delta. Final metadata extraction confirms no derived catalog change. Landing PR 268 from the original implementation remains outside this merge.
+
+Visual Builder graph skill: `existente-adequada`, because its canonical graph-runtime guidance already requires shared ownership, graph integrity and undo proofs. Form schema/runtime skill: `atualizar-existente`, adding real Angular/cold adapter and effective-echo proofs in canonical skills PRs 838 and 839. Both were independently reviewed and integrated; final canonical merge is `3ca2d184ba803dac1e560697142475e5ee8336fa`. Validation used the repository's focal validator, Python preflight and both family audits. The optional quick validator lacked `yaml`; the official fallback passed. Official selective synchronization of this one skill passed: canonical, manifest and installed hashes match, and all 796 files outside the target remained unchanged. Five unrelated existing Praxis drifts were preserved. The raw selective receipt is `review-skill-sync-receipt.json`.

package/docs/evidence/form-authoring-635-20261023/independent-review-vb-form.md

@@ -0,0 +1,50 @@
+# Revisão independente — Form Authoring #635
+
+Revisor: `rules_audit`; atualizado em 2026-10-23T21:18:03+00:00.
+Checkout: `/Users/rodrigo/Dev/pessoal/praxis-plataform/.worktrees/form-p1-631-633`; branch `fix/form-authoring-635`; HEAD `51075de81704596606bb578ab681124df5ae8493` **mais alterações locais**. Os hashes abaixo identificam os bytes revisados, não um futuro commit.
+
+## Resultado e limites
+
+Sem bloqueantes nos recortes revisados abaixo. Esta nota é revisão de código e evidência; não declara browser final, validação integral, contagem de testes únicos nem autorização de merge.
+
+- **Autoria VB:** este agente implementou o trabalho em `praxis-visual-builder/src` e seus testes. A revisão independente desses trechos foi feita pelo coordenador `root`; a presente nota não substitui essa revisão por autorrevisão. A última rodada própria foi `88 SUCCESS` em sete includes (`/tmp/praxis-635-vb-final88.log`); as contagens intermediárias são execuções sobrepostas, não suítes somáveis.
+- **Revisão independente feita por este agente:** ConfigEditor, painel de propriedades, textos/i18n, documentação e o follow-up runtime de `initialValue`. Não escrevi esses trechos. Não reexecutei suas suítes nem os builds finais nesta revisão. A ponte Form/propertyRule e sua preservação de metadados também têm revisão própria de `audit_environment`; aqui apenas confrontei seu contrato com o consumidor VB.
+
+## Escopos confrontados
+
+- **ConfigEditor:** hidratação centralizada; `formRules` prevalece sobre projeção válida obsoleta; drafts inválidos continuam disponíveis e bloqueiam Apply/Save; JSON vazio e Reset não ressuscitam estado residual. O eco descartado é somente uma assinatura obsoleta conhecida; seleção de nó não substitui o documento. O teste de assinatura distingue `selected` de uma mudança real no valor da condição.
+- **Painel e pureza:** o painel de efeitos obsoleto fica oculto durante falha de conversão; a mensagem esclarece qual configuração foi preservada. O painel usa o `PraxisJsonLogicService` injetado para validar/simular; prévia de ramo, edição de propriedade e validade runtime têm escopos explícitos. A guarda não oculta nem une o canal separado de comandos. Sem autorização extra de acesso ou decisão de negócio pela UX.
+- **i18n/docs:** mensagem do draft presente uma vez em pt/en; documentação coerente com os canais separados, limitações da prévia, alvos indisponíveis e edição de JSON avançado. README descreve a assinatura aditiva `updateNode(..., conditionState?)`, atomicidade, histórico e preservação de draft. Nenhum novo manifest/modelo foi exigido para esse ajuste visual.
+- **Runtime, revisão adicional:** a atualização local autoritativa de `initialValue` agora atualiza o cache mesmo antes dos controles. O build posterior usa o snapshot mais recente; se os controles já existem, o mesmo ramo faz reset/patch sem emitir mudanças de valor e restaura pristine/untouched. A condição existente `usesInitialValueAsAuthoritativeSnapshot()` continua excluindo edit/view com `readUrl` ou `resourcePath`; não encontrei ampliação da autoridade local sobre dados remotos. Confrontei os quatro casos storage/afterInit × atualização/limpeza e suas asserções sem HTTP. A revisão principal do guard de `loadEntity` pertence a `audit_environment`/root.
+
+A atestação runtime existente registra `67/67` por seu executor (`standalone-runtime-final-attestation.json`); correspondência dos três hashes de fonte/testes com esta árvore: **True**. Isso não transforma essa execução em uma prova nova executada por este revisor.
+
+Follow-up VB após a rodada de 86: a assinatura de eco normaliza somente dados de transporte (`selected`, `parentId`, `children` omitido/`[]` e ordem de chaves), preservando conteúdo e ordem semântica. Os dois novos casos cobrem o passo Condição montado no MatStepper ao ativar Visual, o eco atômico equivalente e a hidratação de mudança externa real. O coordenador revisou esse delta; a prova browser final permanece sob sua responsabilidade. `git diff --check` passou.
+
+Follow-up independente final do escopo dos diagnósticos: aprovados os guards em HTML que também ocultam o diagnóstico aceito e seu placeholder vazio enquanto `ruleConversionFailed` estiver ativo. O alerta de conversão, o editor visual e o canal separado de comandos continuam disponíveis; estado aceito, persistência e gates não mudam. As três novas asserções do teste montado cobrem ambos os estados ausentes no draft inválido e o retorno do diagnóstico após reparo. A frase atualizada em `dynamic-form-authoring-document-semantics.md` corresponde ao comportamento. O executor root registrou `69 SUCCESS` em `/tmp/praxis-635-editor-diagnostic-scope-final.log` e build Form de produção verde; conferi o resultado bruto do log, sem executar outra suíte. Sem novos bloqueantes nesta revisão.
+
+## Identidade das fontes
+
+SHA-256 agregado dos 12 arquivos revistos: `93fbacf7a416827699ef172877caeb82e1207c42dd8db8c180398a26158d0adb`.
+Snapshot agregado de 17 arquivos VB de código/testes modificados ou novos: `fe60920e81205607fe87096add54791f0ca9492d35862cdf2f8df15ea1f739e5`. Esse segundo conjunto é de autoria, cuja aprovação independente pertence ao root.
+Algoritmo: ordenar os paths relativos; concatenar para cada arquivo `path UTF-8`, NUL, bytes do arquivo, NUL; calcular SHA-256.
+
+<details>
+<summary>SHA-256 por fonte revista</summary>
+
+| Fonte relativa ao checkout acima | SHA-256 |
+| --- | --- |
+| `projects/praxis-dynamic-form/src/lib/config-editor/praxis-dynamic-form-config-editor.ts` | `472441a47e45788961bdb1debe5618dd3f035fa9f588d16395a6e2debf713eaa` |
+| `projects/praxis-dynamic-form/src/lib/config-editor/praxis-dynamic-form-config-editor.html` | `89ca1a449d24bacaa2ac051fa152623524f70d843bab2e834375014874dddd94` |
+| `projects/praxis-dynamic-form/src/lib/config-editor/praxis-dynamic-form-config-editor.spec.ts` | `e1f6418631923aed67479168f534e2a7193dffce3efe682e3adf5371d0b7888e` |
+| `projects/praxis-dynamic-form/src/lib/config-editor/rule-properties-panel.component.ts` | `42a0e7ed41ab822ed82e6dcb455671be0fc3546a4676bc09e4f2daffde71f241` |
+| `projects/praxis-dynamic-form/src/lib/config-editor/rule-properties-panel.component.spec.ts` | `7428843281cfdd408064677bc531437843cea23f0e19ab32d1c376b749b46987` |
+| `projects/praxis-dynamic-form/src/lib/praxis-dynamic-form.i18n.ts` | `2aadec19c29908e76faf3cb3a6620bc905f7088322f7cc3b92bed3069d82e011` |
+| `projects/praxis-dynamic-form/src/lib/praxis-dynamic-form.ts` | `76d419643fc77da32c30b8fba1c7d65e955552adb84f0576f7f8b4eb9c2a7c1e` |
+| `projects/praxis-dynamic-form/src/lib/praxis-dynamic-form.field-metadata-roundtrip.spec.ts` | `e8e967d0dccec403d2dff1c7691a5f609bf6d1c8bfd4f48a57139a3f9f78a403` |
+| `projects/praxis-dynamic-form/src/lib/praxis-dynamic-form.first-config-hydration.spec.ts` | `da5d24f06e2fb5c72acc74a65dde090a2d5a0c9e14621236e9c6d1eb1c4df706` |
+| `projects/praxis-dynamic-form/docs/dynamic-form-authoring-document-semantics.md` | `98235e6fae395e2f51a32ace72d9369d7b7f0e2097f689bf15b4f419bcb39d40` |
+| `projects/praxis-dynamic-form/src/lib/config-editor/praxis-dynamic-form-config-editor.json-api.md` | `3a2e2c2e78c6286dbd34396ee21e468244321fda7c2c4bc6112252990d81bc58` |
+| `projects/praxis-visual-builder/README.md` | `6250604032792b0f23f4b33d5a1596e51325b27911aba7f0268b801a571dbe6d` |
+
+</details>

package/docs/evidence/form-authoring-635-20261023/validation.md

@@ -0,0 +1,76 @@
+---
+title: "Conditional form authoring — issue 635 validation"
+doc_type: "guide"
+component: "praxis-dynamic-form"
+status: "validated"
+owner: "praxis-ui"
+last_updated: "2026-10-23"
+---
+
+# Conditional form authoring — issue 635
+
+The subsequent [final PR review](final-review.md) records additional ownership and Angular input regressions found and corrected before integration, final source hashes and fresh focal/build gates. Browser screenshots below belong to the original PR head; they were not rerun during that final review.
+
+The change was implemented in an isolated checkout on main `51075de81704596606bb578ab681124df5ae8493`. Unrelated changes in the original checkout were preserved. Classification: cross-library public behavior, with an additive optional `conditionState` argument on the existing `RuleBuilderService.updateNode` API. No new rule model, endpoint, AI contract, workspace configuration, dependency or public-api export was introduced.
+
+## Canonical inventory and impact
+
+Existing canonical property effects, graph drafts, host operator registry, diagnostics and persistence already cover the requested behavior. Summaries/status scopes are `ja-suportado-so-ux`; replacement, graph transfer and standalone hydration were `suportado-parcialmente`. An atomic node plus complete owned condition-graph update was missing from the existing service operation: the optional existing RuleBuilderState argument supplies that operation without a parallel contract. Complete conditions derive from fresh graph fields; incomplete descendants must not become an unconditional or partial condition.
+
+Owners: Visual Builder for authoring/history and Dynamic Form for the canonical document, diagnostics and persistence. Direct consumers are the Form config editor, authoring diagnostics and the All Fields showcase. Form→builder now produces one propertyRule per rule, retaining every target, both branches, identity and authoring/semantic metadata. Existing legacy ingestion remains; new authoring does not generate legacy conditional-validator nodes.
+
+Presentation formRules and formCommandRules retain separate channels. Core access policy remains authoritative; formHidden/access filters were preserved. Source builds include a direct consumer and the official dependency closure. No backend schema, business rule or HTTP corpus changed.
+
+## Automated gates
+
+| Gate | Result |
+| --- | --- |
+| Visual Builder: field condition, wizard, rule editor/list, target selector, service and summary | 88 passed |
+| Form config editor, converters and diagnostics | 121 passed |
+| Final mounted ConfigEditor diagnostic-scope guard | 69 passed (overlaps the preceding lane) |
+| Standalone field metadata roundtrip, first/external config hydration | 67 passed |
+| Official production dependency closure through Dynamic Form and Page Builder consumer | Passed |
+| Final Visual Builder and Dynamic Form production builds | Passed |
+| Purity and changed-document frontmatter | Passed |
+
+These are focal unit/component lanes, not unique-test totals or a full release certification. The mounted Material stepper tests cover backward/forward navigation and linear blocking; real FieldConditionEditor debounce and canonical own echoes are exercised. Atomic graph tests cover incomplete descendants, cycles, shared nodes, removal, selection and undo. Host initialValue updates/clears during storage/hooks preserve the latest local authority without schema/entity HTTP. Existing remote-authority guards remain intact.
+
+Logs in this folder contain the raw focal outcomes with terminal control sequences and trailing display padding removed. Historical failures were diagnosed before rerun; no test configuration or TypeScript strictness was weakened. The full test suite and screen-reader/assistive-technology certification were not run.
+
+## Browser validation
+
+Chrome via visible UI on official UI4003/API8088, frozen task checkout. No DOM state injection, fetch, mocks or JSON were used to author the simple rule. The real library All Fields example was used: Toggle and URL were renamed to Ativo and Foto (URL) through the visible Metadata Editor. This is a local form example using real remote config persistence; it is not certification of the Quickstart Foto upload or its backend field-access policy.
+
+The analyst task used target selection, Visual condition Ativo = Sim, visible/required true and false branches, readable review and Save. The review and list describe all four effects. The runtime false branch hides Foto; the true branch exposes a required input with aria-required=true. Sample-data preview evaluates the two branches separately and explicitly states its limits.
+
+Verified scenarios include incomplete draft/disabled saving with stale accepted effects and diagnostics withheld, repaired draft, keyboard target/Boolean choices and Next/Anterior, JSON replacement and advanced runtime-only if condition, exact advanced Save/reload with both branches, and subsequent restoration of the simple rule. Merely selecting a rule and navigating leaves Sem alterações. Closing returns focus to Configurar formulário.
+
+Reset was confirmed through its visible dialog: it restores the opened document in the editor and this host also clears persisted keys. A read-only GET returned404 afterward. Reload consequently returned to the host example, as intended; the rule was then authored and saved again. Final persisted receipt returned200/version5 with one rule, toggle===true and both visible/required branches intact. This does not certify ETag conflict handling or concurrent saves.
+
+At390×844 the section selector, footer actions and effect controls fit; review content is readable by vertical scrolling. This is an agent simulation, not a human usability study: no human task-time or comprehension score is claimed. Multiple internal scroll areas remain a usability limit for small screens.
+
+## Independent review and derived guidance
+
+Each implementation area was reviewed by a different agent. Root reviewed Visual Builder, runtime and converter changes; the VB author independently reviewed root ConfigEditor, panel, docs/i18n and the latest initialValue fix; the runtime author independently reviewed VB metadata preservation and root selection signature. Review covered canonical authority, replacement, both branches, ownership/history, consumers, source/test evidence and docs.
+
+Owner documentation was updated. The Visual Builder README is synchronized by the official vendor helper in praxis-ui-landing-page PR268; vendor75/docs25/guides145/sitemap gates passed, with the existing Cron Mermaid warning. No AI manifest/catalog, exported model or HTTP semantic surface changed, so registry/corpus generation was unnecessary.
+
+Skills: atualizar-existente for five existing skills in canonical praxis-codex-skills PR836, including document roundtrip, Form authoring settings and Visual Builder rules/graph/JSON Logic. No new skill was introduced. Standalone runtime guidance was already adequate in the canonical schema/runtime skill. Canonical skills PR836 was integrated at e13f4b4d1a0ed1bc127f15105cefc5f2eeb9524f. Official selective sync validated5/5 affected skills and preserved all783 files outside scope and unrelated local drifts. Landing PR268 remains open for review, without deployment.
+
+## Final visual receipts
+
+The last PT retest confirmed Condition stayed selected after fresh Visual activation, saving was disabled, and both accepted diagnostics (including the empty placeholder) and stale effects were absent. Repair restored current diagnostics and effects. Immediate Boolean edit→Next and Anterior both worked. JSON formRules=[] with residual formRulesState produced zero rows and the empty diagnostic; replacing it with the complete document restored one editable rule. The test draft was discarded and focus returned to Configure form. No additional configuration was saved during this last retest.
+
+English was exercised using the official providePraxisI18nConfig provider on the same UI origin. New summaries/status/preview copy and Yes were localized. The temporary host file was restored exactly: app.config.ts SHA256 bdf1dbc425b4d9babfa76b78a2f913ce36095d3e500d74d344ea5dd8bb251718. Host business labels and some existing metadata/control labels remain Portuguese; a whole-platform translation audit is not claimed. The final display-only diagnostic guard was then retested in PT and the mounted component lane.
+
+![Complete review](desktop-review-accepted.png)
+
+![Incomplete condition blocks saving without stale diagnostics](desktop-incomplete-accepted.png)
+
+![Narrow effect editor](narrow-effects-final-main.png)
+
+![Narrow review, lower effects after scrolling](narrow-review-effects-final-main.png)
+
+![English summary](english-summary-final.png)
+
+![Advanced expression preserved](advanced-reopen-final-main.png)

package/docs/evidence/p1-authoring-20261022/validation.md

@@ -0,0 +1,134 @@
+# P1 form authoring — issues #631, #632 and #633
+
+Classification: public behavior change with cross-library consumers. Canonical owners are Dynamic Form (rules bridge, form client/context and hydration) and Metadata Editor (cascade authoring). No exported type, endpoint, workspace configuration or dependency change.
+
+## Scope and compatibility
+
+- Preserve wizard JSON Logic and both property branches through Apply/Save/reopen. Invalid graphs remain available for repair and cannot silently become unconditional rules.
+- Preserve non-identity cascade filter maps and extraction paths. Table rows own the current edit draft; suggestions fill missing mappings.
+- Give each mounted form its own mutable CRUD client and editor context. This is a breaking beta DI correction; ancestor GenericCrudService replacements must migrate to supported component inputs or component-level test overrides. Shared HTTP infrastructure remains inherited.
+- Make the Quickstart dependency demo a local relationship explorer. Selectors query real resources individually; fields are omitted from domain payloads. Its new document identities avoid inheriting old schema-backed connections.
+- Open field customization from the current canonical materialization, rather than stale selection/render snapshots.
+
+Existing contracts cover these behaviors: already supported but incorrectly materialized. No parallel contract or new authoring vocabulary was introduced.
+
+## Review and gate resolution
+
+The implementation was isolated on main 8da9401a8; unrelated dirty checkout changes and unrelated documentation hunks were excluded. Reviewers different from the authors inspected conversion/diagnostics, cascade editing, DI ownership, demo and both remaining gates.
+
+The old label test conflated a selected snapshot with the current materialization. Regression tests now preserve the Cargo expectation while giving the canonical document/presentation that label, and making selection/cache explicitly obsolete.
+
+The earlier host-test compilation failure involved a nullable assertion in an unrelated dirty test. That test is absent from this main baseline; the demo target is compiled and executed without importing the unrelated changes or altering TypeScript configuration.
+
+Additional review covered deleting the last invalid rule, repairing through the properties panel, diagnostics for conditions outside the graph subset and loading rules without formRulesState. Valid runtime-only conditions must remain intact; invalid conditions must remain blocked. JSON Logic var:'' is a valid root-data reference, not an invalid field path.
+
+## Validation
+
+All selected gates passed on the isolated source tree:
+
+| Gate | Result |
+| --- | --- |
+| Rule converters, configuration editor, diagnostics and isolation | 114 passed |
+| Dynamic Form main/config/editorial/presentation/manifest/hydration/protocol | 334 passed |
+| Cascade service and tab | 17 passed |
+| CRUD dialog host consumer | 50 passed |
+| Additional DI consumers: entity selection, schema recovery, layout tabs, presentation preset and widget editor | 77 passed |
+| Dependency demo host target | 1 passed |
+| Official build helper: Metadata Editor, Dynamic Form, CRUD + dependency closure | Passed |
+| Final Dynamic Form and CRUD builds after gate repairs | Passed |
+| Published documentation assets | Passed, 5 packages |
+| MatSelect content model and diff whitespace | Passed |
+
+The isolated dependency tree was installed using npm ci. No broad full-test-suite
+or release certification is claimed. Counts represent separate lanes, not a
+claim about unique test coverage.
+
+Exact focal spec includes and commands are reproducible from the changed spec
+paths; the main lane also includes first/external hydration, authoring protocol
+and the authoring manifest. Builds use development configuration. Artifact logs
+are retained in the workspace under artifacts/form-p1-fixes-20261022/clean-*.log.
+
+## Final local browser smoke
+
+The isolated checkout was served frozen on official UI4003, with its proxy
+explicitly directed to unavailable local API8088. This smoke exercised the local
+editor only and did not attempt option loading or domain submission.
+
+Through the visible JSON tab of dependency-fields-demo, a malformed condition
+(`{"===": []}`) produced an invalid-condition diagnostic and disabled Apply and
+Save. Correcting the document by removing rule/state through the same JSON tab
+re-enabled both buttons. Drafts were cancelled and tabs closed; nothing was
+saved to the host or remote configuration.
+
+![Invalid condition blocks Apply and Save](final-invalid-blocked.png)
+
+![Corrected document re-enables Apply and Save](final-recovered-enabled.png)
+
+The native confirmation for the visual Remove button could not be accepted by
+the browser-control adapter because its focus command timed out. That attempt
+was abandoned and its tab closed. Visual deletion via that button is not claimed
+as passed; the component regression covers deletion and reopen. The rule list
+also retained a stale row after JSON replacement while canonical diagnostics
+were empty: the remaining UI coherence work belongs to #635. The screenshots
+record this limit rather than hiding it.
+
+ Tests are unit/component tests using ChromeHeadless, without a database. Dependency builds use the official build-libs helper and its dependency closure. No release workflow, deployment or domain mutation is performed.
+
+## Earlier visual audit evidence
+
+The analyst journeys were repeated in Chrome on the previous shared source snapshot, using official UI4003/API8088 and assigned remote Neon branches with runtime identities/TLS. Those screenshots are historical visual evidence, not proof of this isolated revision. Current revision validation is listed separately above.
+
+- #631: wizard Ativo=true/false controlled Foto visibility and required state; persisted expression and both effects survived reload.
+- #632: Cargo/Departamento non-identity mapping survived explicit Edit, Save, Apply and reload.
+- #633: RH, Base/Equipe/Membro and Ameaça/Missão/Incidente/Indenização chains completed with real filtered option requests; parent replacement/clear emptied descendants; no-result search and sibling-tab independence were checked.
+- CRUD native Add dialog loaded its command schema and was closed without submission.
+
+Limits retained: Foto originally arrived formHidden and required temporary exposure in the visible JSON editor. After reload the target catalog again omitted it, a remaining #635 issue. Structural dotted mapping proof does not certify backend acceptance of that filter. No narrow-screen, screen-reader, adverse-latency, remote ETag/concurrency or latest-release certification is claimed.
+
+Detailed original audit artifacts are retained in the workspace artifacts/form-p1-fixes-20261022 directory and linked from the issue discussions. No credentials/network headers are published.
+
+## Derived artifacts and skills
+
+README/JSON API owner documentation explains DI migration and the explorer; Metadata Editor README explains lossless cascade editing. No public-api, AI operation/path, manifest shape, HTTP corpus or landing-page contract changed, so no parallel derived contract was created. Authoring manifest tests and published documentation asset checks cover the existing surfaces.
+
+Canonical cascade and runtime DI skill updates were previously integrated through praxis-codex-skills#826 and #827 and selectively synchronized. Existing form roundtrip guidance remains adequate: formRulesState is derived, canonical rules are preserved, and runtime discovery does not own persisted semantics. The additional gate repairs enforce that existing guidance.
+
+## Final review before integration — 2026-10-23
+
+A new independent review of cad84dd00 found and corrected three cases before
+integration:
+
+- A missing or targetless rule root was silently dropped, so the new empty-rule
+  branch could delete the last accepted rules. Projection now rejects every
+  referenced invalid root, including a mixed valid/invalid graph. The editor
+  keeps the accepted document and invalid draft and blocks saving; an explicit
+  rootNodes=[] still supports intentional deletion.
+- Blocking diagnostics used a built-in-only JSON Logic instance and rejected a
+  valid host operator. Editor diagnostics and command validation now share the
+  injected runtime service. A real registered operator is tested through runtime
+  evaluation and editor Save/reopen; unknown operators and invalid arity fail.
+- Removing a cascade dependency retained its extraction override record. The
+  save path now removes both mapping and extraction override for removed
+  dependencies; save/reopen/re-add and last-dependency/default cases are covered.
+
+An additional consumer inventory found four test fixtures still providing the
+CRUD mock in the ancestor injector. They now use the documented component-level
+replacement. The entity-selection fixture also supplies the current HttpResponse
+read API while preserving request, error and cancellation assertions. The widget
+editor fixture does not mount Dynamic Form and was intentionally left unchanged.
+
+Before/after evidence: missing-root regressions failed before the fix; the host
+operator regression failed before registry propagation; the extra DI lane had
+19 failures before fixture updates and finished 77/77. Final focused rules lane
+114/114 and cascades 17/17 passed. The 334-test form lane, 50-test CRUD lane and demo lane were also rerun after
+the production repairs and passed. All three owner/consumer builds were rerun after production repairs.
+No database or remote release workflow was required for these review repairs.
+
+The earlier native-dialog/browser and #635 limitations remain unchanged. They
+are not presented as newly validated by these unit/component regressions.
+
+The two narrowly scoped guidance additions were independently reviewed and
+integrated through praxis-codex-skills#829 (merge fb0fb5c). Both affected skills
+were selectively synchronized and audited; the other 787 installed skill files
+remained byte-identical and seven unrelated drifts were preserved. No new skill
+or public contract was introduced.

package/docs/governed-page-widget-adapter.md

@@ -0,0 +1,58 @@
+# Dynamic Form em páginas governadas
+
+O adapter do owner mantém `definition.inputs.config` como a única fonte de configuração do filho.
+A página guarda autoria; o documento nativo é reconstruído a partir desses inputs. A projeção de
+execução é transitória e nunca deve ser gravada de volta no documento da página.
+
+O perfil inicial vem do contrato P0 `page-publication-p0` de `praxis-config-starter` (PR #506).
+Core valida estrutura, referências, limites e exige validators dos owners. Este adapter valida o
+perfil nativo local; não autoriza uma fonte, registra uma seed ou substitui a admissão no servidor.
+
+`decodeDynamicFormPageInputs` reconstrói `praxis.dynamic-form.editor` v1:
+config, bindings presentes (`mode`, `emptyState`, `presentationModeGlobal`) e contexto presente
+(`backConfig`, `presentation`, `schemaPrefs`). Schema prefs só existe se algum dos três inputs
+`notifyIfOutdated`, `snoozeMs`, `autoOpenSettingsOnOutdated` estiver presente. Ausência, `false`,
+zero, objeto vazio admitido e `null` são preservados. Null em objetos mesclados de config é negado;
+null dentro de arrays atômicos permanece autoria. `layoutScope` não cabe neste perfil.
+
+Os cinco modos nativos são `create`, `edit`, `view`, `presentation` e `dossier`. O editor visual
+continua preferindo os três modos de operação com `presentationModeGlobal` separado. Abrir um
+documento nativo dos demais modos não deve convertê-lo. Filter Form mantém somente seus três modos.
+
+`encodeDynamicFormPageInputs` é a projeção inversa sem defaults. Campos fora do perfil,
+blocos vazios sem representação nos inputs, identidade/storage e dados de execução recebem
+diagnóstico. O adapter não filtra silenciosamente autoria incompatível.
+
+`projectDynamicFormPageEditorChanges(authoredInputs, editorBaseline, editorValue)` aplica apenas
+deltas explícitos sobre a autoria original usando o reconciliador nativo do owner. Capture o
+baseline após a normalização/montagem do editor e preserve-o durante aquela sessão. Alterar
+bindings ou contexto do mesmo widget retorna `seed.replacement-required`; a página precisa
+substituir o widget com nova key e nova fonte admitida. A API de projeção altera somente o draft
+que o chamador recebe; ela não salva preferências nem persiste a página.
+
+`materializeDynamicFormPageRuntimeInputs(inputs, pageId, widgetKey)` usa o helper canônico Core para
+identidades `page:<pageId>:widget:<widgetKey>`, projeta `configPersistenceStrategy: 'volatile'`
+e desabilita customização/copiloto independentes no filho. Submit e dados continuam nos contratos
+de domínio existentes. Não existe input runtime `authoringDocument`.
+
+A estratégia `volatile` impede leitura, gravação e limpeza de preferências próprias e conexão
+persistida. O Form preserva identidade operacional para montar o formulário, mas as trilhas de
+config/bindings/contexto/schema preferences ficam sem I/O de storage.
+Defaults visuais/materializações transitórias permanecem internos ao runtime e ao editor.
+
+Limites: JSON lossless, 256 KiB UTF-8 e profundidade 64 pelo helper Core compartilhado; o documento
+integral da página também tem o mesmo orçamento. Não há host publicado, endpoint de publicação,
+fonte admitida, banco ou release novos neste incremento. A integração Page Builder/host governado
+é trabalho posterior; os wrappers comuns continuam atendendo os fluxos não governados existentes.
+
+`volatile` também exclui overlays pessoais de configuração global nos defaults/estado de autoria
+que o owner consome. A instância compartilhada `GlobalConfigService` pode ler sua chave global;
+isso não é prova de zero leitura na aplicação. Tenant, cache, locale e CSP continuam infraestrutura
+do host. O gate comprova ausência de I/O nas chaves do filho e ausência de influência da autoria
+pessoal sobre a configuração publicada. Em Table, `TableDefaultsProvider.getDefaults(id,
+{ includeGlobal: false })` preserva defaults nativos sem duplicá-los; mudanças globais e reset
+seguem a mesma política, inclusive o fallback de timezone usado em regras JSON Logic.
+
+Respostas e filas de preferências capturam a geração, a identidade e a estratégia do filho. Trocar identidade, documento ou estratégia (inclusive A → volatile → A), ou destruir a instância, invalida a continuação antiga antes do próximo I/O ou da materialização. Uma requisição já enviada não é cancelada retroativamente. Respostas tardias de erro também passam pelo mesmo fence.
+
+O fence segue a chave do recurso: conexão, inputs e schema preferences usam identidade do owner e geração do host; apresentação acrescenta a chave `form-pres:<id>:<mode>`. Hidratar mode/path das próprias preferências iniciais não troca o owner. Eventos de inputs do host invalidam a geração e iniciam uma resolução atual. Schema, config e escritas também capturam os bindings de runtime.

package/docs/hot-metadata-updates.md

@@ -95,6 +95,22 @@ Regra operacional:
 - se o loader da coluna for localizado, apenas ele e atualizado;
 - se o loader nao puder ser localizado, o runtime usa fallback seguro de rebuild do form.
 
+## Saved configuration after request schema removal
+
+When reconciling saved configuration with the current request schema, Core retains
+removed schema-backed fields for authored layout continuity, but marks them hidden,
+disabled and `submitPolicy: "omit"`. A required orphan with a null value therefore
+does not invalidate the group, and a value still returned by the read projection
+cannot reenter the request payload through `getRawValue()`.
+
+A field whose `source` is absent is schema-backed for this reconciliation. Explicit
+`source: "local"` fields preserve existing local/transient policies and may opt into
+submission with `submitPolicy: "include"`. Hidden fields still present in the request
+schema remain submit-eligible; do not turn all hidden controls into omitted fields.
+If the server publishes a retained field again, current server validation, visibility,
+enabled state and submit semantics replace the orphan state. No host payload strip,
+new flag or layout deletion is needed.
+
 ## Melhorias no DynamicFieldLoader
 
 O guard de rerender do loader passou a incluir no snapshot: