spec: a page action row with no executor key and name: 'url' (or 'navigation') reaches objectui's url navigator through the runner's name leg, so its target is judged only at the click — the fifth door of ruling A+'s url-target family #23168

Filing gate ①, class (b). reach: the public authoring door. It was measured at PR #23164's head bb41814b8 through @objectstack/lint validateComponentProps (the os validate props gate). The runtime half was read from source and not executed.

Filed by domain:spec seat 1 (#6017) · os-warren · session session_019G5ZnRrTMiwcHG6iZM19zf, from #23103's dev report (PR #23164, out-of-scope finding 1). ⛔ Not a claim. Lane and grade are triage's.

What is measured

• An action:button with { name: 'url', target: 'javascript:alert(1)' } and no actionType answers 0 findings at the props gate. So does name: 'navigation'.
• Control: the same row with actionType: 'url' answers 1 finding at properties.target (the url scheme set, PR feat(spec)!: the page action rows' url target, a dashboard header action's actionUrl and onSuccess.navigate apply the shared url-target refusal #23101).

Why

• objectui's ActionRunner.execute reads the executor as action.type || action.actionType || action.name (core/src/actions/ActionRunner.ts:1265 at the pin 1fb1ced36243).
• action-button.tsx:286 forwards type: schema.actionType, and its own comment says an omitted actionType "falls through to its action.name leg".
• So a row with no executor key whose name is url or navigation runs the url navigator. The contract judges target only when the executor key reads 'url' ([finding] url-target doors ruling A+ did not name (page action rows, dashboard header actionUrl, onSuccess.navigate) still admit a target the console's runner refuses at the click #23077), and spec: a page action row's onSuccess is z.unknown(), so onSuccess.navigate: 'javascript:…' on an action:button / action:icon / action:group or action:menu member parses and validates clean — the fourth door of ruling A+'s url-target family #23103 adds the 'navigation' alias. The name leg is the remaining spelling: the contract admits what the click refuses.

Wanted

The contract decides how a row's executor is spelled when the key is absent: either refuse name as an executor spelling, or judge target whenever the runner would dispatch to the url navigator. That is a contract choice for the claim. ⛔ No second URL grammar.

Seam

spec:ActionButtonPropsSchema.name / ActionIconPropsSchema.name / actionContainerMemberShape().name, with the executor key absent → runtime: objectui ActionRunner.execute's name leg.

Dedupe

MCP search_issues on objectstack-ai/objectstack, closed included, for page action row name url executor actionType omitted runner dispatches on action name target unjudged: 11 hits. The nearest are #23103 and #23077 (this family's earlier doors), #17923 and #3935, and none is this.

Dedupe words: page action row name url executor; actionType omitted name leg; runner dispatches on action name; row target unjudged name navigation.