` of its own. The box is capped at a readable measure (`max-width: 40rem` on `.app-form-box`, a block element with no auto margins), so it ends where the fields end and stays left-aligned under its section header rather than running the width of the content column (maintainer, 2026-09-04: "Hugging definitely"; centering is a sign-in-page idiom, wrong on a page whose trail, title and section headers sit on the left edge). A dense row gets no box of its own, because the panel its page already opened is one; a bar's box is the list header it sits in; a settings table is its own shape and takes none. ### The outcome contract - A mutation refused for any reason answers **422**, with the same form re-rendered in submission mode: every submitted value carried back (including checkbox and radio state), each field's error under its control, the form-level error in the slot every form renders (empty when unused, `role="alert"`), and `autofocus` on the first errored control. The 200 body and the 422 body of one form share the outer element, so either swaps into the same target. - A mutation that **navigates** (a create page landing on the record, a settings save returning to a page) answers **303** with `?flash=` carrying the toast key. A mutation that **stays** answers the region's re-render with an `HX-Trigger` success toast. An inline `alert-success` in the response body is retired; so is an `HX-Redirect` on a refusal (integration settings used both before this change). - Every mutation form carries `hx-disable="find button[type=submit]"` and the commit shows its `htmx-indicator` spinner while the request is in flight, so a double submit is impossible. - Every mutation form (every kind but `Search`, which navigates, and `Confirm`, which has nothing to validate) carries `novalidate`: the browser's own constraint validation never blocks a submission, so the server's refusal, rendered under the control, is the one refusal a person sees. Before this was added, a cleared required field's cleared submission never reached the server at all; the only feedback was the browser's transient, unstyleable bubble (maintainer, 2026-09-03: "I cleared a name, pressed Save, and saw nothing"). The constraint attributes (`required`, `maxlength`, `min`, `max`, `pattern`) stay on every control regardless, for assistive technology and `:invalid` styling; they are derived from the declaration and from nowhere else, so the browser's rule and the server's rule cannot differ. ### The commit and the way out The commit is `btn-primary`, natural width, never stretched to its column, first in the commit row, at the row's left; `btn-sm` in a dense row. A destructive commit renders `btn-danger` only inside the confirm modal (`shell.confirm`'s default); outside it the trigger that opens the modal is `btn-outline-danger` (§2 "Buttons"). A bar's button is `btn-outline-secondary`, always: a search is not a commit, so the list's own "New …" link stays the page's one filled control, and the landing surface's "Look up" takes the same weight as every other search rather than an exception of its own. The way out follows the commit as `btn-outline-secondary`, and exists exactly where there is somewhere to go: a create page's Cancel links to its list; a sub-record panel's Cancel collapses the panel; a confirm modal's Cancel dismisses it; a preview's Discard re-fetches the resting state; an always-open edit form carries **no** way out, because nothing is left by cancelling it. Solid `btn-secondary` is not in the palette anywhere. ### Labels, help, hints and errors Every control carries a ``; in a dense row with no room for one the label is visually hidden, never absent, and an `aria-label` never substitutes for it. A label sits above its control, except a checkbox's, which sits beside the box, after it, because that label names the state the box turns on, the way every surveyed system places it (the "Forms" note in §2 states the same rule for switches versus checkboxes). The help icon (§6) renders after the label as its sibling, always, never inside the `` element: a button inside a label toggles the labelled control on every click that opens the popover, which is not what a help click should do. A field's hint carries an id its control's `aria-describedby` names; its error, when the submission is refused, carries its own id, also named, with `aria-invalid="true"` on the control; the hint stays visible beside the error, because GOV.UK's own side of this split is: don't take away the instruction just because the person got it wrong. A dense field carries no hint at all: a line under one control in an `align-items-end` row lifts that field's label above its neighbours' and the row reads as broken (the maintainer's Extend tier screenshot, 2026-09-03); a dense field's explanation goes behind its help icon instead. Wrapper ids are `form--`, stable across a field's three modes. `autocomplete` is declared per field: a real token (`name`, `email`, `url`, `organization`) where one applies, `off` for keys, search boxes and one-time values; the form tag itself carries none, and a template never writes the attribute by hand. ### Selects A select whose value must be chosen opens with a first option that is disabled, selected, and reads "Choose a …" (`forms.ChooseOption`), so a form cannot submit a value the person never chose. An optional select opens with a first option "None" (`forms.NoneOption`), the deliberate empty choice that clears the column. A submitted value outside the option set is refused, never silently defaulted. ### One-sided fields A field with `Only: Create` renders on the create page only; a field with `Only: Edit` renders on the edit form only. **Nothing about the side renders**: a line such as "Available after creation" tells the person nothing they cannot already see from the field's simple absence on the other side (maintainer, 2026-09-03, on the first cut's reason lines: "We also don't need to add superfluous stuff like that"), and the declaration itself carries no justification string either; a recorded reason nobody reads is noise in the registry (maintainer, 2026-09-04). Why a field is one-sided is an ordinary Go comment beside its declaration, the way Django's `add_fieldsets` and Filament's `hiddenOn` declare the side and nothing else. A field may carry a `Notice`, one line under the control, only where the difference would surprise a person: a value that can be set at creation and never changed again, say. A field carries at most one visible line under its control: its `Hint`, or its `Notice`, never both. This is the mechanism behind form-conventions' "Create and edit forms agree or disclose their difference": the disclosure is structural (the field either renders or it does not), not printed. ### The copy rule Every hint, notice, help text and caption survives the deletion test: delete it, and ask whether the person loses a fact they could not infer from the label, the control, and the page; if they lose nothing, it does not exist (GOV.UK: "Do not use help text to explain the interface. If you have to do that, you've made your service too complicated"; Polaris: "What's the most you can take away before things fall apart?"). The default for a field is **no hint**. A hint, when one is needed, is one short line that never restates the label and never explains the interface's own state ("Available after creation"); a field carries at most one visible line under its control. Copy must not contain: `Available after`, `Once created`, `After you save`, `This field`, `This is the`, `Here you can`, `allows you to`, `is used to`, `you can`, `lets you`, `Please`, `simply`, `just`, `in order to`, `Note that`, `It's worth noting`, `Keep in mind`. The lint rule `filler-copy` fails on these, case-insensitively on word boundaries, in template text, in an attribute value, and in a Go string literal under `internal/server`, `internal/web` or an integration's `web` package (tests excluded). The registry's own invariants separately refuse a hint over 100 characters (the sources state the cap qualitatively, "a single short sentence"; this is the repo's own number) and a hint whose content words, once stopwords are dropped, are all already present in its label (a label "Email address" with hint "Enter your email address" is the canonical failure). **The counter-rule stands**, so the lint does not eat facts: a side effect, a data-preservation guarantee, a prerequisite, or a cost is a fact, not filler, and stays. `GrantDescription`'s help, "Kept with the grant's history.", is the sources' own example of a hint that passes: it states a data-preservation fact the label "Description" does not carry. When a hint is needed to explain what a control does at all, the finding is against the control, not the copy; that is a review question, not something a lint can catch. ### Registered forms `internal/server/forms_doc_test.go` checks this table against `forms.All()`, the way `internal/config/config_reference_test.go` checks `docs/environment-reference.md` against every Viper key: every registered form's name, kind and family must appear here, and a form the test finds here but the registry no longer carries fails as stale. | Form | Kind | Family | One-sided fields | |---|---|---|---| | `discourse.mapping.create` | Sub-record | Dense | | | `fedwiki.site.create` | Create | Stacked | | | `member.plan.move` | Preview | Stacked | | | `member.workspace.create` | Create | Stacked | | | `operator.enrollment.grant.extend` | Sub-record | Dense | | | `operator.enrollment.grant.issue` | Sub-record | Dense | | | `operator.entitlement-set` | Create[^edit] | Stacked | `is_active` (edit) | | `operator.entitlement-set.rules` | Batch | Rows | | | `operator.integration.settings` | Settings | Table | | | `operator.list.controls` | Search | Bar | | | `operator.lookup.search` | Search | Bar | | | `operator.org-type.default` | Preview | Stacked | | | `operator.plan-ladder` | Create[^edit] | Stacked | | | `operator.plan-ladder.tier.add` | Sub-record | Dense | | | `operator.plan-ladder.tier.remove.commit` | Preview | Stacked | | | `operator.plan-ladder.tier.reorder.commit` | Preview | Stacked | | | `operator.product` | Create[^edit] | Stacked | `description`, `features`, `is_active` (edit) | | `operator.product.price.add` | Sub-record | Dense | | | `shell.confirm` | Confirm | Stacked | | [^edit]: Declared `Create`, with an `EditPath` and `CommitEdit`: one declaration serves the record's create page (unbound mode) and its edit form (record-bound mode, rendered `Edit` on that side); design D5. `operator.product`'s Visibility field is the worked example for a boolean with two named states (§2 "Forms"): one `` labelled "Public", with help reading "A public product is sold in the catalog. A private product is only issued by an operator as a grant." Unticked is Private, and it is the default, because an unticked checkbox submits nothing and the handler reads the absence as the off state. `shell.confirm` is the one declaration with no static fields at all (§3 "Confirm modal"): `confirm-action-modal.js` rewrites its endpoint, its message and its commit's class from the trigger's own `data-action-*` attributes on every open, and appends the trigger's own hidden fields directly, since one dialog serves whichever mutation opened it.

`, an `