docs: document business form defaults

.trellis/spec/frontend/components.md

@@ -200,6 +200,44 @@ When a module becomes real, replace the placeholder with a Server Component that
 data from the server boundary and pass only persisted, permission-filtered data into
 client components.
 
+### Business Form Defaults Contract
+
+Create forms for persisted business records must not prefill required domain fields with
+assumed values. Defaults like age `75`, gender `male`, care level `self-care`, status
+`active`, or "first available role" can turn into real PostgreSQL records when a user
+submits without noticing.
+
+Use explicit empty selection states for required business choices, then validate before
+calling the API:
+
+```typescript
+// Bad: saves fabricated domain decisions if the user only fills name/email.
+const emptyInput = {
+  gender: "male",
+  age: 75,
+  careLevel: "self-care",
+  status: "active",
+};
+
+// Good: the user must provide the domain values that will be persisted.
+const emptyInput = {
+  gender: "",
+  age: "",
+  careLevel: "",
+  status: "",
+};
+
+const genderOptions = [
+  { value: "", label: "Select gender", disabled: true },
+  ...realGenderOptions,
+];
+```
+
+Edit forms may preload values that already exist on the persisted record. Create,
+invite, approve, and assignment forms should require an explicit selection for role,
+organization, status, and other authorization or workflow fields unless the default is
+server-owned and documented as a product rule.
+
 ### Use Proper Elements
 
 ```typescript