test(rest): flip #7134's stored-row BOUNDARY pin — the lookup route now answers (#7467)

PR #7468 landed the stored-row fold with a 'BOUNDARY: STILL 403' case
annotated to be revisited the day publicPicker became declarable. This is
the revisit: the same real saveMetaItem persists a groups-authored form
whose field carries a spec-valid publicPicker, and the same real route
handler answers 200 with projected data. The picker-less 403 half stays
pinned in public-form-lookup-picker.test.ts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CnMk7vfrt2zW7xvwLS3JDf

Author: claude

packages/rest/src/public-form-routes.stored-row.test.ts

@@ -16,11 +16,12 @@
  *                                       refused the submit outright (#6920)
  *   - `GET  /forms/:slug/lookup/:field` answered 403 for every field (#3022)
  *
- * The first two clear on the stored-row path and are pinned below. ⚠️ The THIRD
- * does not, and not because the fold missed it: the route's `publicPicker`
- * opt-in is not a spec-declared key, so a form carrying one is refused 422 at
- * `saveMetaItem` and never becomes a row. That is measured, and pinned as a
- * boundary case rather than dropped — see the case for the reasoning.
+ * The first two clear on the stored-row path and are pinned below. The THIRD
+ * cleared later, in two steps: the fold reached its `sections` walk on this
+ * card, and #7467 made the route's `publicPicker` opt-in spec-declarable (it
+ * used to be refused 422 at `saveMetaItem`, so no stored row could carry one).
+ * What was pinned here as a `BOUNDARY: STILL 403` case is now the flipped
+ * pin below: a stored form carrying a picker gets a real lookup answer.
  *
  * ⛔ The fix is NOT `?? match.form?.groups` here. The #6926 guardrail stands: a
  * lenient consumer is where AI-authored metadata errors hide, and it leaves the
@@ -115,12 +116,11 @@ const DATA = { provider: 'object', object: 'lead' };
 /**
  * The section every case declares.
  *
- * ⚠️ It deliberately carries NO `publicPicker`, and cannot: measured on this
- * branch, `ViewMetadataSchema` refuses that key outright ("Unrecognized key(s)
- * on this view/page schema: `publicPicker`", ADR-0089 D3a), so a form declaring
- * one is a 422 at `saveMetaItem` and never becomes a stored row at all. See the
- * lookup-route case below for what that means for the third degradation #7134
- * listed.
+ * It carries NO `publicPicker`, which — since #7467 declared that key — is a
+ * choice rather than a necessity (when this file was written the schema
+ * refused the key outright, so no stored row could carry one). A picker-less
+ * field keeps the lookup route at 403, which the flipped case below contrasts
+ * against its own picker-carrying fixture.
  */
 const SECTION = {
     label: 'About you',
@@ -183,9 +183,11 @@ function routesOver(storedView: any) {
             return [];
         }),
         createData,
-        // The lookup route's search, once it gets past the 403.
-        queryData: vi.fn().mockResolvedValue({ records: [{ id: 'usr_1', name: 'Ada' }] }),
-        findData: vi.fn().mockResolvedValue({ records: [{ id: 'usr_1', name: 'Ada' }] }),
+        // The lookup route's search, once it gets past the 403. The route reads
+        // `result.data` (or `result.items`) — the flipped #7467 case below
+        // asserts the projected rows, so the stub answers in that shape.
+        queryData: vi.fn().mockResolvedValue({ data: [{ id: 'usr_1', name: 'Ada' }] }),
+        findData: vi.fn().mockResolvedValue({ data: [{ id: 'usr_1', name: 'Ada' }] }),
     };
     const rest = new RestServer(mockServer() as any, protocol, { api: { requireAuth: false } } as any);
     (rest as any).resolveExecCtx = async () => ({ userId: 'test-user' });
@@ -229,31 +231,42 @@ describe('#7134 a Studio-saved form authored with `groups` no longer degrades on
         expect(createData.mock.calls[0][0].data).toEqual({ company: 'Acme', owner: 'usr_1' });
     });
 
-    it('BOUNDARY: the lookup route is STILL 403 — for a different reason, which is not this card\'s', async () => {
-        // #7134 listed `GET /forms/:slug/lookup/:field` answering 403 for every
-        // field as the third degradation. On the stored-row path that half does
-        // NOT clear, and the honest reason is worth pinning rather than
-        // quietly dropping.
+    it('FLIPPED [#7467]: the lookup route answers — a stored form carrying a publicPicker gets real data', async () => {
+        // This case was born as `BOUNDARY: the lookup route is STILL 403 — for
+        // a different reason`: #7134 listed the lookup route's blanket 403 as
+        // the third degradation, the fold reached its `sections` walk (the two
+        // routes above are the same walk, and they changed), but the route's
+        // `publicPicker` opt-in was declared in NO schema — `ViewMetadataSchema`
+        // is strict, so a form carrying one was refused 422 by `saveMetaItem`
+        // and could never reach a row. The original assertion said so and was
+        // annotated to be revisited the day a spec-side home landed.
         //
-        // The route's opt-in is `publicPicker` on the field declaration. That
-        // key is not declared anywhere in `packages/spec` (grepped: zero hits),
-        // and `ViewMetadataSchema` is strict — so a form carrying one is
-        // refused 422 by `saveMetaItem` and can never reach a row. The lookup
-        // route therefore answers 403 on the stored-row path both before and
-        // after this change: before because the fold left it no `sections` to
-        // walk, after because there is no picker to find in them.
+        // #7467 landed it (maintainer ruling: declare — `FormFieldSchema.
+        // publicPicker`, mirroring exactly what this route reads), so this is
+        // the revisit: the SAME real write path now persists the picker, the
+        // SAME real route handler gets past the 403, and the third degradation
+        // clears end-to-end. `object` is declared on the picker because the
+        // route's field-def fallback reads only legacy spellings — #7486.
         //
-        // The fold DOES reach this route's section walk — the two routes above
-        // are the same walk, and they changed. What is missing is a spec-side
-        // home for `publicPicker`, which is a separate card (filed from this
-        // one; enforced-in-rest, undeclared-in-spec — the mirror of ADR-0049's
-        // usual direction). This assertion goes RED the day that lands, which
-        // is when someone should revisit it.
-        const { lookup } = routesOver(await persistedBody('lead.contact', studioForm('groups')));
+        // The picker-less half of the old pin is not lost: a stored form whose
+        // field declares no picker still answers 403, pinned in
+        // `public-form-lookup-picker.test.ts` (the opt-in stays an opt-in).
+        const withPicker = {
+            ...studioForm('groups'),
+            config: {
+                type: 'simple', data: DATA, sharing: SHARING,
+                groups: [{
+                    label: 'About you',
+                    fields: ['company', { field: 'owner', publicPicker: { displayFields: ['name'], object: 'sys_user' } }],
+                }],
+            },
+        };
+        const { lookup } = routesOver(await persistedBody('lead.contact', withPicker));
         const res = mockRes();
         await lookup.handler({ params: { slug: 'contact', field: 'owner' }, query: {} } as any, res);
-        expect(res.statusCode).toBe(403);
-        expect(res.body.code).toBe('LOOKUP_NOT_PUBLIC');
+        expect(res.statusCode).toBe(200);
+        expect(res.body.data).toEqual([{ id: 'usr_1', name: 'Ada' }]);
+        expect(res.body.displayFields).toEqual(['name']);
     });
 
     it('the stored row itself is the canonical spelling — nothing here reads `groups`', async () => {