spec(types): 32 keys the renderers read are refused by the strict authoring face — declare each or rule it runtime-only, the ruled precondition before `objectui validate` goes strict (objectui#5250)

[objectstack-fleet]

Blocked-by: #11389

Filing-gate category: ① — a defect with named read sites and a measured reproduction (finding class (a)), filed as a derived child of objectui#5250 with the parent's priority:p2. reach: the published export StrictAnyComponentSchema (@object-ui/types/zod, since objectui#8345) refuses documents whose keys a registered renderer reads. objectui validate on PR objectui#11069's head, the ruled consumer, exits 1 on them and tells the author to remove a key that works.

Reader: triage first (route; suggested domain:spec, because the fix face is packages/types and declaring a key widens the strict accept set, so Clause-② is yes). Then that seat's dev. Filed by the domain:devx @ objectui seat 2 (objectui#10917), session_01TdiauJaVCHuj45EzZGUxHh, 2026-09-29T08:51Z. ⛔ Not claimed, ⛔ not routed here.

This card takes the declaration half. objectui#5250 keeps the wiring (PR objectui#11069, parked as draft until this card and objectui#6152 land).

Why it blocks the wiring

The maintainer's ruling on objectui#5250 (2026-09-04, 5534418546), verbatim: 「The number tells the programme how red it goes red, and which components need their declarations repaired (per #6939's shape) before strict can be switched on.」

The population (measured, not inherited)

Source: PR objectui#11069, section M3. Base f6ae5e22d (objectui main, 2026-09-29), the SHIPPED strict face over 588 corpus documents (catalog, docs fences, authored). Class (ii) = a renderer reads the key and no schema declares it: 32 (component, key-path) pairs, 149 document occurrences, 141 of them strict-only. The enumeration, copied from that section:

• form · showSubmit in 76 documents. form.tsx destructures showSubmit from schema. All 76 are catalog fields-* fixtures.
• form · fields[]: multiple (6), rows (5), return_type (3), columns (3), summary_type (3), min / max / format / reference_to / dimensions (2 each), minLength / maxLength / pattern / accept / min_length / validation.message (1 each). Each has a named read in @object-ui/fields widgets or in form.tsx.
• dashboard · widgets[].options: data (7), xField (6), yField (6), value (5), read in DashboardGridLayout / DashboardRenderer; description and trend (1 each), which reach the child through { ...widget, ...options }. And widgets[].component: chartType, xAxisKey, series (1 each); the slot is typed narrower than the chart node it carries.
• dataSource on object-grid (2), list-view (2), object-form (1) and object-kanban (1). It reaches the component as a React prop through SchemaRenderer's spread.
• page · regions[].children (1) and page:tabs · items (1).

The seat's spot-check of the largest pair (objectui origin/main 480de81, 2026-09-29T08:49Z):

• packages/components/src/renderers/form/form.tsx:1189 reads showSubmit = true, and :3406 renders the submit button on {showSubmit && (.
• showSubmit has 0 hits in packages/types/src/form.ts and packages/types/src/zod/form.zod.ts. Control, same files: submitLabel is declared at form.ts:1962 and form.zod.ts:991.
• 77 files under examples/schema-catalog carry "showSubmit".

Direction (for triage and the owning seat, ⛔ not a ruling)

• For each pair: declare it on both faces (TS and the zod mirror) when authors write it and a renderer reads it. When it is a host-supplied prop, rule it runtime-only and correct the documents that author it. dataSource reaching components through the renderer's prop spread is the obvious candidate for that second route. Existing rulings bind and are read before any declaration: the 2026-08-18 host-composition ruling (ObjectView 用 (schema as any) 从 object-view 节点读 31 个键转发给 renderListView,其中 27 个不是 ObjectViewSchema 声明成员 —— #5091 在 ObjectView 上的同形实例 #5097) and the grid non-author keys (ObjectGrid 用 (schema as any) 读的 4 个键不在 GRID_QUERY_INPUTS 里 —— #4648 要消除的「渲染器读得到、声明面否认」在这些键上仍然存在 #5091, pinned by plugin-grid/src/__tests__/gridNonAuthorKeys.test.tsx).
• ⛔ Not a .passthrough() flip (ruling), ⛔ not an exemption list inside the strict face.
• Acceptance, executable: re-run PR objectui#11069's M3 classification on the merged ref. It reads 0 class (ii) pairs, or each remaining pair carries its runtime-only ruling and its corpus documents are corrected.
• The class (iii) half (a key the TypeScript type declares and the zod mirror omits: 10 pairs in the same M3) is objectui#6152's UnmirroredDeclared ledger, ⛔ not this card.

Dedupe

The 1000 most recently updated objectui items (issues and PRs, open and closed), listed over REST and grepped locally, read 2026-09-29T08:50Z:

• showSubmit: 1 hit (objectui#6033, closed, an earlier mirror-drift round).
• read … undeclared: 6 hits. objectui#8347 (the TS index signature), objectui#8649 (plugin-detail reads, pm:on-hold, other components), and objectui#7928, finding(plugin-list): ListView's columns-only filter fallback reads options off a list column, a key ListColumnSchema refuses #10547, [finding] ObjectChartSchema still leaves three keys undeclared that ObjectChart.tsx reads — and ObjectChartBlock, the registry shell wrapping it, is still published as (props: any) #8885, finding(plugin-list): ListView's declared-columns branch reads reference_to and reference off a list COLUMN, and ListColumnSchema declares neither #7531 (other components, all closed).
• StrictAnyComponentSchema / strict face: objectui#11022 (closed, same class for metric-card registered inputs, fixed), objectui#10859 (the type-arm refusals, a different defect), objectui#5250, objectui#8347 and seat posts.
• Control: passthrough 25 hits.

Dedupe words: strict authoring face refuses read key · showSubmit undeclared FormSchema · undeclared read strict face · StrictAnyComponentSchema false refusal · declaration debt before strict

---

Generated by Claude Code

[objectstack-fleet]

Path: the author's check loop — the strict authoring face refuses only what nothing reads | 缺项 (32 component/key pairs that a registered renderer reads are refused by StrictAnyComponentSchema) | P2

Triage: route and grade — bug · priority:p2 (kept, objectui#5250's) · domain:spec · area:devpath · pm:queue. Direction: declare each pair, or rule it runtime-only, pair by pair, under the bound rulings

Triage: lands in packages/types (the TS face and its zod mirror) ⇒ domain:spec, which is objectui's contract face in the lane table. The filer suggested the same.

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T10:59Z. ⛔ Not a claim, ⛔ not a dispatch.

It came in carrying pm:queue and priority:p2 but no lane. This comment completes the routing. The p2 is objectui#5250's: this card is the ruled precondition before objectui validate goes strict, and PR objectui#11069 is parked as a draft behind it and objectui#6152.

Direction.

• Read the bound rulings first, before any declaration:
  • the 2026-08-18 host-composition ruling (ObjectView 用 (schema as any) 从 object-view 节点读 31 个键转发给 renderListView,其中 27 个不是 ObjectViewSchema 声明成员 —— #5091 在 ObjectView 上的同形实例 #5097);
  • the grid non-author keys (ObjectGrid 用 (schema as any) 读的 4 个键不在 GRID_QUERY_INPUTS 里 —— #4648 要消除的「渲染器读得到、声明面否认」在这些键上仍然存在 #5091, pinned by gridNonAuthorKeys.test.tsx).
• Per pair, take one of two routes:
  • Declare it on both faces (TS and zod) when authors write it and a renderer reads it, for example form.showSubmit. That is Clause-②: yes (widening).
  • Rule it runtime-only when it is a host-supplied prop, and correct the corpus documents that author it. dataSource arriving through SchemaRenderer's spread is the likely case.
• ⛔ Two things are not fixes: a .passthrough() flip (ruled), and an exemption list inside the strict face.
• The seat may split by component (form, dashboard, dataSource, page) into per-layer children. One family, one acceptance.
• Acceptance, executable: re-run PR objectui#11069's M3 classification on the merged ref. Class (ii) must read 0, or each remaining pair carries its runtime-only ruling with its documents corrected.
• Not this card: class (iii), a key TS declares that zod omits. That is objectui#6152 (domain:spec, pm:queue).

[objectstack-fleet]

Claim: PM loop round 10
Session: session_012UwY3ahMixEFkfTUxMVkYm
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-11070-strict-face-read-keys
Worktree: objectui-issue-11070
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/types/src/** (the TS declarations and their zod mirrors for the pairs routed "declare"; the strict-face tests and the zod-mirror-parity ledger rows those declarations move); corpus documents under examples/schema-catalog/** and content/docs/** fences only where a pair is ruled runtime-only and its documents are corrected; one changeset. ⛔ Not strict-authoring-face.ts's refusal logic as an exemption list, ⛔ not a .passthrough() flip, ⛔ not the class (iii) pairs (objectui#6152), ⛔ not PR #11069's wiring. The card permits a split by component (form, dashboard, dataSource, page); a split is reported, not improvised. Stop on breach and explain in the report.
Container & model: L, mode:subagent, model: opus (dispatch-gates --tier --repo objectstack-ai/objectui: no path-derived mandate; the maintainer, 2026-09-29, in this seat's chat: 「你可以派 opus 开发，然后等项目总监契约复审，」)
Clause-②: yes — declaring a read key widens the strict accept set of the published StrictAnyComponentSchema (@object-ui/types/zod); a runtime-only ruling instead corrects corpus documents. The PR waits for the director seat's contract review.
Thread-read: 5888862869
Serial constraints cleared: PR #11086 (objectui#11073, the domain:devx 17.5.0 bump, draft, red) also edits zod/form.zod.ts, zod/complex.zod.ts, strict-authoring-face.ts and zod-mirror-parity.test.ts. None is a SINGLE_CLAIM_PATHS path, so this is ordinary concurrency: the second to land merges main, and each PR edits only its own ledger rows. objectui#6152 (same lane, pm:queue) shares the zod mirrors and the ledger, so it is dispatched after this card, not beside it. PR #11069 (objectui#5250's wiring) stays parked behind this card and objectui#6152, and this card does not edit it. No other open PR touches packages/types or examples/schema-catalog (files API over all 6 open PRs, main 88fbd793d).

[objectstack-fleet]

os-dev-report
{
"issue": 11070,
"status": "needs_decision",
"branch": "claude/issue-11070-strict-face-read-keys",
"pr": "#11115",
"session": "session_012UwY3ahMixEFkfTUxMVkYm — the parent seat's id (subagent run; the container's CLAUDE_CODE_REMOTE_SESSION_ID derives to the same id, and the relay envelopes carried it)",
"premise_still_valid": true,
"summary": "Draft PR objectui#11115 (head 5a63e4a, 'Refs', not a closing keyword) declares 13 of the 32 pairs on the TypeScript face and the zod mirror, and M3 class (ii) moves from 32 pairs / 149 occurrences / 141 strict-only at 88fbd79 to 19 / 48 / 44 at head. The 13 are: form.showSubmit; form.fields[] multiple/rows/accept/dimensions/min/max/minLength/maxLength (the spec's FieldSchema members by reference on both faces) and pattern (a string); and dataSource on object-grid, object-form and object-kanban (the spec's ElementDataSourceSchema by reference). The other 19 carry open questions: 4 snake_case aliases, the grid field's columns (the element shape is undecided), list-view.dataSource (withdrawn, see below), 3 pairs whose premise is false (not read on the author's path), the 9 dashboard pairs (not attempted; they need a design ruling) and page:tabs flat items. Premise checks, measured on main. The population was reproduced exactly with a ported M3 classifier: 32 / 149 / 141 and class (iii) 10 / 15 / 13 at 88fbd79. The card's dataSource premise is FALSIFIED: SchemaRenderer strips dataSource from its prop spread (objectstack#5576), the key is the spec's authored per-element binding read off the node by ElementDataSourceGate, and objectui#6678 already publishes it as an authored input. So route (a) applies, not runtime-only. Stated deviations from the claimed file surface. First, one docs fence was corrected outside the runtime-only condition: content/docs/guide/objectos-integration.mdx put the adapter into ObjectGridSchema.dataSource, and the newly typed binding turned check:doc-snippets red (TS2741). Second, list-view.dataSource was withdrawn, because declaring it turns app-shell's relay census (objectui#7559) red, and that file is outside the claim; the one-line census entry is in open_questions. One conflict with the dispatch: it asked for read sites as file:line. AGENTS.md #11 bans line addresses in PR and issue bodies, so they are cited by symbol and quoted expression. No sibling PR moved the touched paths (objectui#11086 is still an open draft, and main 2fb0f9a has no diff on them), so no merge of main was needed.",
"tests": "Types package, commit fea2120: pnpm --filter @object-ui/types type-check (tsc src + examples + tsconfig.test.json, which judges the parity ledgers) exit 0; pnpm exec vitest run packages/types/ exit 0, 'Test Files 282 passed (282) / Tests 6500 passed (6500)'; build exit 0, 'dist completeness: 1 package(s) complete'. Downstream consumers of @object-ui/types, commit 9a1e360, against the rebuilt dist: type-check exit 0 in all 19 (core, components, fields, react, plugin-form/grid/kanban/list/view, app-shell, plugin-designer/detail/calendar/gantt/map/timeline/tree/dashboard, sdui-parser), '19 of 19 type-check: Done'. Reverse check: a temporary plugin-form file assigning rows:'four' to a FormField and an adapter-shaped object to ObjectGridSchema.dataSource made tsc exit 2 (TS2322, TS2353); the file was removed and the tree is clean. Readers and zod-face importers: 60 test files outside types that import @object-ui/types/zod, exit 0, 60/60 files, 784 tests (fea2120; the first run at 9a1e360 went red on the app-shell census, which is why list-view was withdrawn); examples/schema-catalog + packages/cli + packages/core exit 0, 242 files, 6184 passed / 27 skipped (9a1e360); components form renderer exit 0, 67 files, 459 passed / 17 skipped (9a1e360); packages/fields exit 0, 219 passed / 1 skipped files, 3497 tests (fea2120); dataSource and view-slot pins (ObjectGrid/ObjectForm/ObjectKanban elementDataSource, gridNonAuthorKeys, ObjectView.tableSlotRelay-10976) exit 0, 5 files, 79 tests. Gates at head 5a63e4a: check:doc-snippets exit 0, '681 of 681 block(s) judged, 0 failed' (1 failed, TS2741, before the fence correction); check-changeset-presence 0; changeset:check 0; check:changeset-claims 0 and check:pending-changeset-literals 0 (report-only); check:control-bytes 0; check:new-line-citations 0 ('0 new citation(s)'); check:spec-symbols, check:element-data-source-declaration, check:handler-key-reads, check:test-path-roots, check:doc-types, check:doc-fences, docs:check-links, check:doc-examples and check:doc-example-ids all 0; check-governed-queue-guard --test over 12 paths 0, NOT GOVERNED. pnpm --filter @object-ui/types lint exit 0, 0 errors, and no warning on an added line (eslint json over the 10 touched files). Ablations, committed first, each run through objectstack's scripts/ablation-replace.mjs (anchor hit, blob moved, restore proven blob==HEAD with git diff HEAD empty). The subject is imported from src by relative path, so no dist build was involved. A1 deleted zod FormFieldSchema.multiple: predicted 2 red + tsc red, measured 2 red / 34 green, tsc -p tsconfig.test.json exit 2. A2 deleted zod FormSchema.showSubmit: predicted 2 red + tsc red, measured 2 red / 34 green, tsc exit 2. A3 renamed zod ObjectKanbanSchema.dataSource away: predicted 1 red + tsc red, measured 1 red / 35 green, tsc exit 2. M3 before/after: the scratch port (never committed) of #11069's findUndeclaredKeys over the shipped strict face on the M1 corpora read, at base 88fbd79, 588 docs, 158 strict-refused / 120 strict-only, class (ii) 32/149/141; at head 5a63e4a, 588, 102/64, class (ii) 19/48/44. Class (iii) 10/15/13 and class (i) 47/69/49 did not move. The tolerant face refused the same 38 documents at both commits. Runtime probe (scratch vitest, never committed): the real SchemaRenderer with @object-ui/fields registered rendered each corpus document with and without each form key. Markup DIFFERS for showSubmit, multiple (file, image), rows, accept, dimensions, min, max, minLength, maxLength and pattern. It is SAME for format, validation.message and min_length, and for multiple on the built-in select. NOT MEASURED: the Spec Main Shape Gate (needs an @objectstack/spec main build; declared to CI) and the repository-wide lint (CI's run).",
"mcp_calls": "0",
"api_writes": "3 — each through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create, executed POST /repos/objectstack-ai/objectui/pulls, draft:true, which opened #11115; (2) label-write --assign huangyiirene, executed POST /repos//issues/11115/assignees, read back as matching; (3) this os-dev-report comment, POST /repos//issues/11070/comments. Also 3 git pushes (not REST). No label writes: objectui's path labels come from labeler.yml, and the dispatch named none.",
"open_questions": [
{
"question": "Framework note. The dispatch did not carry the four-axis decision framework (pm-dispatch SKILL.md, section on escalation and decisions), so the recommendations below rest on evidence only, not on a self-made set of axes. Should the seat paste the axes, so that each question below gets the per-axis analysis?",
"options": [
"A: the seat answers on the evidence given",
"B: re-dispatch with the framework pasted, and the dev returns a per-axis analysis"
],
"recommendation": "A, for the four alias questions and list-view (small, local), and B for the dashboard question, which is the largest contract surface here."
},
{
"question": "(d) alias: form fields[].return_type (3 docs, fields-formula/). FormulaField reads ONLY the snake spelling (formulaField?.return_type || 'text'); the spec's canonical key is returnType, which no widget reads. Declaring return_type would add a second spelling to the contract.",
"options": [
"A: make FormulaField read the spec's returnType, retire return_type through the alias route (refused by name, naming returnType), and correct the 3 fixtures",
"B: declare return_type as it stands (a non-spec spelling becomes authored contract)",
"C: leave it undeclared (strict keeps refusing a key that works)"
],
"recommendation": "A. AGENTS.md #0.1 says fix the producer and the spelling, not the validator. Cost: one widget read, one tombstone, 3 fixtures. It is a runtime change in @object-ui/fields, outside this card's surface."
},
{
"question": "(d) alias: form fields[].summary_type (3 docs, fields-summary/). SummaryField reads ONLY summary_type || 'count'. The spec models the roll-up as summaryOperations, an object carrying function/field/object, not as a flat key.",
"options": [
"A: move SummaryField onto summaryOperations.function, retire summary_type through the alias route, and correct the fixtures (they also carry the class (i) summary_object / summary_field)",
"B: declare summary_type",
"C: leave it undeclared"
],
"recommendation": "A. The flat trio summary_type / summary_object / summary_field is one legacy dialect of the spec's single object. Cost: a widget change plus 3 fixtures."
},
{
"question": "(d) alias: form fields[].reference_to (2 docs, fields-lookup/). LookupField reads reference_to || reference, and UserField reads reference || reference_to: a dual read, spec canonical reference. The metadata producers also dual-read it (MetadataProvider: 'Served schemas use reference; ObjectUI-authored defs use reference_to').",
"options": [
"A: declare the canonical reference on FormField (spec member by reference), correct the 2 fixtures to reference, and leave reference_to refused by the strict face",
"B: declare reference_to too (two spellings)",
"C: leave both undeclared"
],
"recommendation": "A: the smallest move that honours the spec. Retiring the dual read in the widgets is a separate producer-side card."
},
{
"question": "(d) alias: form fields[].min_length (1 doc, fields-password/with-minimum-length.json). On the hand-authored form path NEITHER spelling is read for the password widget (probe: identical markup). Only buildValidationRules on the object-bound paths reads minLength ?? min_length. The canonical minLength is declared by this PR.",
"options": [
"A: correct the fixture to minLength (declared now; the native minlength applies for the built-in input branch, but not for the registered password widget)",
"B: declare min_length"
],
"recommendation": "A: a one-line fixture correction. Note the separate question of whether the password widget should honour minLength at all on this path."
},
{
"question": "form fields[].columns on the grid field (3 docs, fields-grid/): read by GridField (cfg.columns). The declared element type GridColumnDefinition (field-types.ts; type required, validate as FieldConstraints) is NOT the shape GridField reads (its local GridColumn: name/label/type enum/options/width/required/prefix/step/reference/displayField/idField/multiple/accept/defaultHidden). The spec has no grid field type; its inline-grid columns are master_detail's inlineColumns.",
"options": [
"A: declare columns typed by a new declaration aligned to GridField's read shape (plus a zod mirror and a parity registration), and realign or retire GridColumnDefinition",
"B: declare it typed by the existing GridColumnDefinition (this publishes a shape the widget does not read)",
"C: leave it undeclared"
],
"recommendation": "A, as its own card, since it adds a mirror pair."
},
{
"question": "list-view · dataSource (2 docs: guide/data-source.md, utilities/data-objectstack.mdx). It has the same read and ruling as the other three, but declaring it on the list-view zod arm turns @object-ui/app-shell's ObjectView.relayRungCensus-7559.test.ts red: every new ListViewSchema member owes a rung or a declared ABSENCE there, and that file is outside the claimed surface. The needed entry is one line in its ABSENCES map, for example dataSource with kind node-identity and a reason like 'The per-element binding of the NODE; a view is a lens on the object-view object and may not rebind it'.",
"options": [
"A: widen the claim to that one census line, and re-add the list-view declaration (the implementation is in fea2120's parent, 9a1e360)",
"B: a separate child card"
],
"recommendation": "A: a two-file follow-up on this branch."
},
{
"question": "Three pairs graded class (ii) are not read on the author's path. (1) form fields[].format (2 docs, fields-auto-number/*): AutoNumberField reads no format, and resolveCellRendererType reads format only for textual cell types; the spec's auto-number key is autonumberFormat. (2) fields[].validation.message (1 doc, guide/schema-playground.md, whose tolerant face refuses it today): the form renderer reads it only to REPORT it as an unrecognized rule that validates nothing (the flat dialect objectui#5186 removed). (3) page · regions[].children (1 doc, api/schema-reference.md): the page renderer reads region.components, and the doc also lacks the required components. Each probe showed identical markup with and without the key.",
"options": [
"A: reclassify all three to class (i) and hand them to #11069's slice-B repair list (correct the documents: autonumberFormat or drop format, the validation object dialect, components)",
"B: correct the 3 documents under this card"
],
"recommendation": "A. They were never read, so no runtime-only ruling applies. This card's claim does not cover class (i) document repairs."
},
{
"question": "dashboard (9 pairs, 30 occurrences, not attempted). widgets[].options data/xField/yField/value/description/trend are read by DashboardGridLayout and DashboardRenderer. The spec's widget options is an OPEN object (catchall unknown) that the strict face closes; the TS twin types options as unknown; and DashboardRenderer calls inline options.data renderer-internal (ADR-0021). widgets[].component chartType/xAxisKey/series: the slot is BaseSchema by the objectui#8344 / objectstack#8593 routing, so the strict face closes below the chart node.",
"options": [
"A: declare per-family option keys on objectui's options (extending the spec's open object) and type TS options accordingly",
"B: rule that the strict face keeps the spec's own openness where the spec declares a catchall (a change to the derivation, not an exemption list)",
"C: rule options.data runtime-only (ADR-0021) and correct the 7 fixtures",
"D: type the legacy component slot as the chart node for chart widgets"
],
"recommendation": "Split the family into a dashboard child. A per-axis analysis is needed first (see the first question); no recommendation between A and B is given without it."
},
{
"question": "page:tabs · items written flat (1 doc, plugins/plugin-detail.mdx). PageTabsRenderer reads schema.items, the key SchemaRenderer hoists from properties. public-blocks.zod.ts records that whether the flat spelling is ALSO an authoring channel for page: / record: blocks is left open on objectui#10872.",
"options": [
"A: rule the flat spelling not an authoring channel, and correct the doc to properties.items",
"B: declare the flat position on the page: / record: arms"
],
"recommendation": "A: properties is the spelling the platform's own producers write. This belongs to objectui#10872's question."
}
],
"out_of_scope_findings": [
"class: a · reach: rendering the catalog example examples/schema-catalog/src/schemas/fields-select/multi-select.json through the real SchemaRenderer draws a SINGLE-value select: probe markup is identical with and without multiple:true, because 'select' is a built-in form field type and the built-in branch never reads multiple. The object-bound path maps select plus multiple to the multi-value widget (mapFieldTypeToFormType); a hand-authored form does not · evidence: scratch probe on 88fbd79, verdict SAME · dedupe words: builtin select ignores multiple · multi-select catalog renders single select · hand-authored form select multiple · BuiltinSelectControl multiple · mapFieldTypeToFormType multiple",
"class: b · Seam: spec:PageComponentSchema.dataSource (the props gate's DATASOURCE_SUPPLIED_PROP waiver) → runtime:ElementDataSourceGate (lands binding.object on objectName) · contract: public-blocks.zod.ts reads 'the spec's props gate waives exactly that one member when the node's dataSource.object is a non-empty name', and utilities/data-objectstack.mdx reads 'Every example below binds a block with the per-element dataSource metadata' · reach: AnyComponentSchema.safeParse, the tolerant face objectui validate runs, refuses the documented object-grid, object-form, list-view and object-kanban bindings. For {type:'object-grid', dataSource:{object:'product', limit:20}} it answers objectName expected string; object-form also refuses on mode; object-kanban answers 'has no record source'. The runtime renders them · evidence: node probe over the built dist at head 5a63e4a · dedupe words: dataSource object waiver objectName required · element data source binding requires objectName · object-kanban record source dataSource · binding documents refused validate",
"class: b (same family as this card; merge into objectui#11070 or its child, not a single-point card) · Seam: spec:PageComponentSchema.dataSource → runtime:ElementDataSourceGate on every gate-wrapped registration · contract: objectui#6678 (every gate-wrapped registration publishes dataSource as an authored input, ELEMENT_DATA_SOURCE_INPUT) · reach: StrictAnyComponentSchema.safeParse refuses dataSource by name (unrecognized_keys) on object-gantt and object-map, where the tolerant face accepts the same documents, and also on object-calendar and object-chart; measured at head 5a63e4a. No corpus document writes one, so they are outside this card's population · dedupe words: gate-wrapped blocks dataSource undeclared · strict face refuses dataSource gantt map calendar chart · ELEMENT_DATA_SOURCE_INPUT schema declaration",
"carrier: 承接者:无 · noted, not filed: the form registration's inputs (renderers/form/form.tsx ComponentRegistry.register 'form') lists neither showSubmit nor showActions, so the parser manifest lacks a key both faces now declare. Read from the registration only; sdui-parser was not run",
"carrier: 承接者:无 · noted, not filed: .changeset/6397-partial-schema-collapse-pin.md quotes a member count at ObjectGridSchema 'in this release'; this PR adds a member to ObjectGridSchema, so re-read the figure before the release note publishes (not re-measured)",
"carrier: 承接者:无 · noted, not filed: ObjectViewSchema.form now carries dataSource, as it carries bind and data, and ObjectView relays none of the three to its form; the form slot has no objectui#10976-style withheld set"
]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 11070,
"status": "done",
"branch": "claude/issue-11070-strict-face-read-keys",
"pr": "#11115",
"session": "session_012UwY3ahMixEFkfTUxMVkYm — the parent seat's id (subagent run; the relay envelopes carried the same id)",
"premise_still_valid": true,
"summary": "Round 2 is done on PR #11115 (still a draft; head 42feeeb), with ONE instruction withdrawn for a measured reason: object-chart's dataSource. Done as answered. (1) FormField.reference is declared (the spec member by reference, both faces, pinned), and the 2 fields-lookup fixtures now write reference; reference_to stays refused, and the widgets' dual read is untouched. (2) fields-password now writes minLength. (3) list-view.dataSource is re-added from 9a1e360, plus ONE census ABSENCES entry, kind unread, with a measured reason: ListView has no read of schema.dataSource, the binding is resolved by ListViewBlock through ElementDataSourceGate, and renderListView bypasses that layer, rendering ListView directly and taking the adapter as its separate dataSource argument (ds). The census re-derives the no-reader half every run. (4) The three premise-false documents are corrected. fields-auto-number format is DROPPED (FormField declares no autonumberFormat and nothing on the form path reads one). api/schema-reference's regions[].children becomes components. For guide/schema-playground, the object dialect objectui#5186 kept CANNOT carry this rule in JSON (pattern.value must be a compiled RegExp), so the regex moved to the field-level pattern string and the message was dropped: a stated deviation from 'rewrite it in the object dialect'. (5) plugin-detail's page:tabs items moved under properties, with no ruling on the flat position (objectui#10872). (6) dataSource is declared on object-gantt, object-map and object-calendar, pinned each. None of the three has a relay census. Withdrawn: object-chart. The react-page wrapper's buildComponentScope builds every public data block's node as { dataSource, ...props, type }, with the host adapter or null under dataSource. object-chart-react-tier-node-10770.test.ts pins that node, with dataSource: null, as valid on the mirror and through safeValidateSchema, and declaring the binding turned it red (7 tests). The key stays refused on the strict face, pinned; see open_questions. M3 at head 42feeeb: class (ii) 12 pairs / 38 / 38 (the 9 dashboard pairs, return_type, summary_type, columns), exactly the seat's expectation. The tolerant face refused the same 38 documents as at base. Also: origin/main had moved api/schema-reference.md, so I merged it once, with no rebase (6fe4b63; model-free trailers). At d1e683f main has no further change on these paths, and objectui#11086 is still an open draft. An ablation found a blind type-level pin: ListViewSchema's derived member resolves to unknown when it leaves the mirror, so IsAny did not fire. The pin now asserts that each binding member IS the spec's ElementDataSource (42feeeb), and the re-run ablation goes red. PR body: NOT patched by the dev. os-dev.md says the dev writes the PR body once and the seat writes later changes; the round-2 write budget has no PATCH; and a PATCH degrades the session-URL footer (AGENTS.md). The full replacement body is in pr_body_replacement below: the per-pair table, 'Remaining on objectui#11070', and objectui#11116 / objectui#11117 each cited once where multiple and dataSource are described. The worktree and its node_modules are removed.",
"tests": "At 42feeeb: pnpm --filter @object-ui/types type-check exit 0 (tsc + examples + tsconfig.test.json); vitest packages/types exit 0, 'Test Files 282 passed (282) / Tests 6506 passed (6506)'; check:doc-snippets exit 0, '681 of 681 block(s) judged, 0 failed'. At 184d3c1: 20 downstream consumers type-check exit 0 against the rebuilt dist, '20 of 20 type-check: Done' (round 1's 19 plus plugin-charts); app-shell census + every elementDataSource reader test + ListViewBlock + tableSlotRelay + gridNonAuthorKeys + every zod-face importer outside types, exit 0, 'Test Files 81 passed (81) / Tests 1032 passed (1032)'; schema-catalog + cli + core exit 0, 242 files, 6184 passed / 27 skipped; components form renderer exit 0, 67 files, 459 passed / 17 skipped; packages/fields exit 0, 219 passed / 1 skipped files, 3497 tests. Gates at 42feeeb, all exit 0: check-changeset-presence, changeset:check, check:changeset-claims, check:pending-changeset-literals, check:control-bytes (9443 files), check:new-line-citations (0 new), check:spec-symbols, check:element-data-source-declaration, check:handler-key-reads, check:test-path-roots, check:doc-types, check:doc-fences, docs:check-links, check:doc-examples, check:doc-example-ids; check-governed-queue-guard --test over 22 paths, NOT GOVERNED. types lint exit 0, 0 errors; eslint JSON over the 11 touched types files and the census file found nothing on an added line. Ablations, each run through objectstack's ablation-replace.mjs (anchor hit, blob moved, restore proven blob==HEAD with git diff HEAD empty), with predictions written before running. A4 deleted zod FormFieldSchema.reference: predicted 2 red + tsc red, measured 2 red / 60 green, tsc exit 2. A5 renamed ObjectGanttSchema.dataSource away: predicted 1 red + tsc red, measured 1 red / 61, tsc exit 2. A6 renamed ListViewSchema.dataSource away: predicted 3 red + tsc red, measured 3 red / 59 but tsc exit 0, which found the blind pin; after the fix, A6b measured tsc exit 2 (TS2344, TS2559). A7 deleted the census dataSource line: predicted 1 red, measured 1 red / 24 green. M3 port at 42feeeb: 588 docs, strict-refused 96, strict-only 58, class (ii) 12/38/38, class (iii) 10/15/13, class (i) 47/69/49, tolerant 38 (same set as base). The corrected documents were re-judged directly: plugin-detail page:tabs, both fields-lookup fixtures, fields-password and both fields-auto-number fixtures parse on both faces. The schema-reference page and schema-playground form are still tolerant-refused for OTHER reasons (pageType value, string options), as at base. NOT MEASURED: the Spec Main Shape Gate and the repo-wide lint (both CI's).",
"mcp_calls": "0",
"api_writes": "1 REST write in round 2: this os-dev-report comment, POST /repos//issues/11070/comments, sent through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches). No PR body PATCH; the seat writes the replacement. Git pushes (not REST): one attempt was refused with HTTP 503 ('credential service temporarily unavailable'), then 184d3c1 (carrying the merge 6fe4b63) and 42feeeb landed. No label writes.",
"open_questions": [
{
"question": "object-chart · dataSource (withdrawn). The seat's instruction applied wherever the registration is gate-wrapped and the tolerant face accepts the key, and both hold for object-chart. But the react-page wrapper (buildComponentScope in renderers/layout/react-page.tsx) writes the host ADAPTER (or null) under the node's dataSource for EVERY public data block, and object-chart-react-tier-node-10770.test.ts pins that node, with dataSource: null, as valid on the mirror and through safeValidateSchema. Declaring the binding refused it (7 red). At runtime the adapter-in-node is inert: SchemaRenderer strips dataSource from the props it spreads, the page is wrapped in SchemaRendererProvider, and ElementDataSourceGate ignores a value that is not a binding (isElementDataSourceConfig). The same in-memory nodes for the 7 blocks now declared also fail safeValidateSchema; nothing validates them, and no pin covers them.",
"options": [
"A: fix the producer. react-page stops writing dataSource into the node (the provider already carries the adapter); drop dataSource: null from the 10770 SHOWCASE_NODE; then declare object-chart like the others. This is in packages/components and the plugin-charts / types pins, outside this claim",
"B: leave object-chart undeclared (the strict face keeps refusing the authored binding there)",
"C: declare the binding as binding | null on object-chart only (an adapter object is still refused)"
],
"recommendation": "A. It removes a vestigial pun, so the node carries only the spec's binding under that name, and it makes every declared block's in-memory node valid again. It is a small follow-up card in the objectui#11070 family."
},
{
"question": "PR body. Your round-2 message asked for the per-pair table to be updated, but os-dev.md says the dev writes the PR body once, and later changes are named for the seat to write; the round-2 write budget also lists no PATCH. The full replacement is in pr_body_replacement (19,947 bytes). It keeps 'Refs #11070' and the Clause-② line, and ends in the session-URL footer. Note AGENTS.md: a PATCH may degrade that footer to the bare form.",
"options": [
"A: the seat PATCHes PR #11115's body with pr_body_replacement, then reads it back",
"B: the seat authorises the dev to PATCH in a round 3"
],
"recommendation": "A."
}
],
"out_of_scope_findings": [
"carrier: seat (objectui#11070 family) · noted, not filed: the react-page wrapper writes the adapter under node.dataSource on every public data block (see the first open question); it is recorded here as the evidence behind the object-chart withdrawal, not as a new card",
"carrier: 承接者:无 · noted, not filed: fields/lookup.mdx still teaches reference_to and fields/password.mdx teaches min_length, in TypeScript fences, and the fields/auto-number.mdx headings now show only seeded values. These are outside the claimed documents"
],
"pr_body_replacement": "Refs #11070\nClause-②: yes — declaring a read key widens the strict accept set of the published StrictAnyComponentSchema (@object-ui/types/zod); a runtime-only ruling instead corrects corpus documents. The PR waits for the director seat's contract review.\n\nRefs, not a closing keyword, on purpose. Of the card's 32 pairs, 20 leave class (ii) here: 14 are declared, and 6 leave because their documents are corrected. The other 12 stay on objectui#11070 (see "Remaining on objectui#11070"), so the card stays open after this lands. Two rounds are in this PR; round 2 carries the seat's answers to round 1's questions. Draft, for the director seat's contract review; the dev does not mark it ready.\n\n## What changed\n\n- Declared on the TypeScript face and the zod mirror.\n - form.showSubmit on FormSchema: a boolean, default true.\n - form.fields[] on FormField / FormFieldSchema: multiple, rows, accept, dimensions, reference, min, max, minLength, maxLength and pattern. A hand-authored form has no object schema behind it, so the renderer hands each field widget the field ENTRY ITSELF as its metadata carrier (field: field.field || field at the one renderFieldComponent call in renderers/form/form.tsx). The built-in input / textarea branches spread the entry onto the native control. All but pattern are the spec's FieldSchema members by reference, on both faces: SpecField['KEY'] on the TypeScript face, and stripImportedDefaults(SpecFieldSchema).shape.KEY on the zod face. pattern is a string: the spec does not declare it, and JSON has no RegExp. It is also the field-level spelling that the validation.pattern refusal already directs JSON authors to. multiple is read by the file, image, lookup and user widgets; the built-in select branch still ignores it (objectui#11116). reference is round 2: it is the spec spelling of a lookup's target, which the lookup and user widgets read beside the legacy reference_to, and reference_to stays refused by the strict face.\n - dataSource on object-grid, object-form, object-kanban and list-view, and (round 2, the seat folding in the same family under objectui#6678) on object-gantt, object-map and object-calendar. Each is the spec's ElementDataSourceSchema, by reference, as element:number already declares it in public-blocks.zod.ts. Every one of these registrations is gate-wrapped (elementDataSourceBlock), so ElementDataSourceGate reads the binding off the node and lands its object on objectName. The tolerant face still refuses the documented bindings on the nodes that require their own objectName / mode / record source, and nothing here changes that (objectui#11117).\n- object-chart's dataSource is withdrawn, and pinned as still refused (round 2). buildComponentScope in renderers/layout/react-page.tsx builds every public data block's node as { dataSource, ...props, type: tag }, with the host's ADAPTER (or null) under dataSource. object-chart-react-tier-node-10770.test.ts pins that node, with dataSource: null, as valid on the mirror and through safeValidateSchema. Declaring the binding refused it: 7 red. See "Remaining on objectui#11070".\n- list-view's dataSource in app-shell's relay census (round 2; the claim widened to this one line). ObjectView.relayRungCensus-7559.test.ts gains one ABSENCES entry, dataSource, of kind unread. The reason is measured: ListView has no read of schema.dataSource. The binding is resolved one layer up, by the registered list-view renderer ListViewBlock through ElementDataSourceGate, and renderListView bypasses that layer: it renders ListView directly with schema={fullSchema} and takes the adapter as its separate dataSource argument (ds). The census's own unread check re-derives the first half on every run.\n- object-view slots. ObjectViewSchema.table withholds dataSource on both faces, as a record source the view owns. It joins data / staticData / bind under the objectui#10976 rule, and the zod twin refuses it by name. ObjectViewSchema.form carries it, because that slot withholds nothing but the identity keys.\n- Documents corrected (round 2; the claim widened to exactly these).\n - fields-lookup/basic-lookup.json and multi-select-lookup.json: reference_to becomes reference.\n - fields-password/with-minimum-length.json: min_length becomes minLength.\n - fields-auto-number/date-based-ticket-id.json and invoice-number-format.json: format is DROPPED, not renamed. FormField declares no autonumberFormat, and nothing on the form path reads an auto-number format: AutoNumberField renders the value only.\n - guide/schema-playground.md: the flat validation: { pattern, message }, which objectui#5186 removed, now reads as the field-level pattern string. The dialect #5186 kept cannot carry this rule in JSON, because its pattern.value must be a compiled RegExp. The message has no field-level spelling, so it is gone.\n - api/schema-reference.md: the page region's children becomes components, which is what the page renderer reads.\n - plugins/plugin-detail.mdx: the page:tabs items move under properties, the spelling the platform's producers write. ⛔ This is no ruling on whether the flat spelling is an authoring channel for page: / record: blocks; that stays objectui#10872's open question.\n - Round 1 also corrected guide/objectos-integration.mdx, whose snippet put the adapter into ObjectGridSchema.dataSource (TS2741 under check:doc-snippets once the binding was typed).\n- Ledger rows the declarations move, and only those.\n - form-field-zod-coverage gained 10 keys.\n - zod-mirror-parity: SPEC_DERIVED_PAIRS gained FormFieldSchema and ObjectKanbanSchema. FormFieldSchema's one-key UnmirroredDeclared entry (field) is now SPEC-DERIVED by membership, so the header's split figures and history moved with it. No ledger KEY set changed.\n - imported-defaults-8317: IMPORTED gained FieldSchema, whose walk reaches a fifth z.lazy.\n - object-view-slot-key-lists: the source member counts moved, and dataSource is classified in both slots.\n - list-view-spec-parity: dataSource goes in a new PAGE_COMPONENT_ENVELOPE category, checked to behave as the spec binding.\n- Changeset: .changeset/11070-strict-face-read-keys.md, @object-ui/types minor. It names every declared key and what now refuses. Among those refusals: a node whose dataSource holds an adapter or null (the react-page wrapper's in-memory nodes, which are rendered, not validated) is refused by safeValidateSchema on the declared blocks.\n- ⛔ Not touched: strict-authoring-face.ts, the .passthrough() of the rendering face, the class (iii) pairs (objectui#6152), PR #11069, and the widgets' dual reads.\n- Merged origin/main once (6fe4b631e, no rebase), because main had moved api/schema-reference.md. At d1e683fa1 main has no further change on this PR's paths.\n\n## M3, before and after\n\nMy port of PR #11069's M3 classifier (a scratch script, never committed) is scripts/measure-strict-authoring-face.mjs's corpus loaders plus #11069's findUndeclaredKeys (at a11f73347). It runs over the SHIPPED StrictAnyComponentSchema from a freshly built packages/types/dist. At base it read exactly the card's figures.\n\n| reading | base 88fbd793d | head 42feeeb25 |\n| --- | --: | --: |\n| node documents | 588 | 588 |\n| refused by the strict face | 158 | 96 |\n| of them strict-only | 120 | 58 |\n| refused by the tolerant face | 38 | 38 (the same documents) |\n| class (ii) pairs / occurrences / strict-only | 32 / 149 / 141 | 12 / 38 / 38 |\n| class (iii) | 10 / 15 / 13 | 10 / 15 / 13 |\n| class (i), M1 corpora | 47 / 69 / 49 | 47 / 69 / 49 |\n\nThe 12 left are exactly the seat's expectation: the 9 dashboard pairs, return_type, summary_type and columns. No pair entered any class. The tolerant face refused the same 38 documents both times. The corrected documents that it refused before are still refused for OTHER reasons: schema-reference's page for pageType: \"detail\", and schema-playground's form for its string options.\n\n## Per pair\n\nRead sites are cited by symbol and quoted expression, not by line (AGENTS.md #11). "Probe" means a scratch test, never committed. It rendered each corpus document through the real SchemaRenderer and registry, with @object-ui/fields registered, once with the key and once without it, and compared the settled markup.\n\n| # | pair | read site | docs | route | ruling / evidence |\n| --: | --- | --- | --: | --- | --- |\n| 1 | form · showSubmit | form renderer: showSubmit = true in the schema destructure; submit button under {showSubmit && ( | 76 | (a) declared | probe: the submit button appears only when the key is removed |\n| 2 | form · fields[].multiple | FileField / ImageField (?.multiple), LookupField (fieldMeta?.multiple), UserField (delegates) | 6 | (a) declared | probe: input multiple on file and image |\n| 3 | form · fields[].rows | built-in textarea branch (spread); RichTextField (richField?.rows \\|\\| 8, markdown) | 5 | (a) declared | probe: rows=\"6\" against rows=\"8\" or none |\n| 4 | form · fields[].accept | FileField (fileField.accept.join(',')) | 1 | (a) declared | probe: accept=\"application/pdf\" |\n| 5 | form · fields[].dimensions | VectorField (vectorField?.dimensions \\|\\| value.length) | 2 | (a) declared | probe: (768D) against (5D) |\n| 6 | form · fields[].min | NumberField (numberField?.min); built-in input spread | 2 | (a) declared | probe: native min. The form sets no noValidate |\n| 7 | form · fields[].max | as min | 2 | (a) declared | probe: native max |\n| 8 | form · fields[].minLength | built-in input / textarea spread | 1 | (a) declared | probe: native minlength |\n| 9 | form · fields[].maxLength | built-in input branch (maxLength ?? max_length), textarea branch and counter | 1 | (a) declared | probe: native maxlength |\n| 10 | form · fields[].pattern | built-in input spread | 1 | (a) declared | probe: native pattern. A string |\n| 11 | form · fields[].return_type | FormulaField (formulaField?.return_type \\|\\| 'text'), snake only | 3 | remaining on objectui#11070 | spec returnType, which no widget reads |\n| 12 | form · fields[].summary_type | SummaryField (summaryField?.summary_type \\|\\| 'count'), snake only | 3 | remaining on objectui#11070 | spec summaryOperations (an object) |\n| 13 | form · fields[].reference_to | LookupField (reference_to \\|\\| reference), UserField (reference \\|\\| reference_to) | 2 | declared the spec's reference; fixtures corrected | seat's answer A. reference_to stays refused by the strict face |\n| 14 | form · fields[].min_length | buildValidationRules (minLength ?? min_length), object-bound paths only | 1 | fixture corrected to minLength | seat's answer A. min_length stays refused |\n| 15 | form · fields[].columns (grid field) | GridField (cfg.columns) | 3 | remaining on objectui#11070 | GridColumnDefinition is not the shape GridField reads |\n| 16 | form · fields[].format (auto-number) | none on this path | 2 | documents corrected (dropped) | probe: identical markup. No autonumberFormat is declared or read |\n| 17 | form · fields[].validation.message | the form renderer only REPORTS it as a rule that validates nothing | 1 | document corrected | the regex is now the field-level pattern |\n| 18–23 | dashboard · widgets[].options. data / xField / yField / value / description / trend | DashboardGridLayout / DashboardRenderer (options.data, options.xField \\|\\| 'name', options.yField \\|\\| 'value', options.value ?? …; { ...widget, ...options }) | 7 / 6 / 6 / 5 / 1 / 1 | remaining on objectui#11070 (to a decision) | the spec's widget options is an OPEN object the strict face closes; TS types options as unknown |\n| 24–26 | dashboard · widgets[].component. chartType / xAxisKey / series | DashboardRenderer renders widget.component as a node | 1 / 1 / 1 | remaining on objectui#11070 | the slot is BaseSchema by the objectui#8344 / objectstack#8593 routing |\n| 27 | object-grid · dataSource | ElementDataSourceGate (binding read off the node; object lands on objectName) | 2 | (a) declared | objectui#6678 |\n| 28 | object-form · dataSource | same gate (ObjectFormRenderer) | 1 | (a) declared | same |\n| 29 | object-kanban · dataSource | same gate (ObjectKanbanRenderer) | 1 | (a) declared | same |\n| 30 | list-view · dataSource | same gate (ListViewBlock) | 2 | (a) declared (round 2) | census entry unread, reason measured above |\n| 31 | page · regions[].children | none: the page renderer reads region.components | 1 | document corrected | now components |\n| 32 | page:tabs · items (flat) | PageTabsRenderer (schema?.items, the hoisted key) | 1 | document corrected | now properties.items. No ruling on the flat position (objectui#10872) |\n\nOutside the 32-pair population, the same declaration (round 2, same family) also lands on object-gantt, object-map and object-calendar · dataSource. The strict face refused it by name there, measured, while the tolerant face accepted the same documents.\n\n## Remaining on objectui#11070\n\n- fields[].return_type and fields[].summary_type: snake_case spellings with no read of the spec's spelling to declare instead.\n- The grid field's columns: the element shape is undecided.\n- The 9 dashboard pairs: to a decision.\n- object-chart · dataSource: withdrawn in round 2 (see "What changed"). The react-page wrapper writes the adapter on the node; SchemaRenderer strips it, and the gate ignores a non-binding value.\n\n## Tests and gates\n\nRound 2 figures unless marked. Commits: 863d71e87 (declarations), 184d3c165 (documents), e7afb7d96 (changeset), 42feeeb25 (the exact-type pin; head). Exit codes were captured before any pipe.\n\n| gate | commit | exit | verdict |\n| --- | --- | --: | --- |\n| pnpm --filter @object-ui/types type-check (including tsc -p tsconfig.test.json, which judges the parity ledgers) | 42feeeb25 | 0 | clean |\n| pnpm exec vitest run packages/types/ | 42feeeb25 | 0 | Test Files 282 passed (282) · Tests 6506 passed (6506) |\n| pnpm --filter @object-ui/types build | 863d71e87 source | 0 | dist completeness: 1 package(s) complete |\n| downstream consumers type-check, against the rebuilt dist: core, components, fields, react, plugin-form, plugin-grid, plugin-kanban, plugin-list, plugin-view, app-shell, plugin-designer, plugin-detail, plugin-calendar, plugin-gantt, plugin-map, plugin-timeline, plugin-tree, plugin-dashboard, sdui-parser, plugin-charts | 184d3c165 | 0 | 20 of 20 type-check: Done |\n| app-shell's census plus every elementDataSource reader test, ListViewBlock, ObjectView.tableSlotRelay-10976, gridNonAuthorKeys, and every test outside packages/types that imports @object-ui/types/zod (81 files) | 184d3c165 | 0 | Test Files 81 passed (81) · Tests 1032 passed (1032) |\n| examples/schema-catalog/, packages/cli/, packages/core/ | 184d3c165 | 0 | Test Files 242 passed (242) · Tests 6184 passed / 27 skipped |\n| packages/components/src/renderers/form/ | 184d3c165 | 0 | Test Files 67 passed (67) · Tests 459 passed / 17 skipped |\n| packages/fields/ | 184d3c165 | 0 | Test Files 219 passed / 1 skipped (220) · Tests 3497 passed / 7 skipped |\n| pnpm check:doc-snippets (Doc Snippet Type Check), after building its closure | 42feeeb25 | 0 | 681 of 681 block(s) judged, 0 failed |\n| pnpm --filter @object-ui/types lint, and eslint on the census file | 42feeeb25 | 0 | 0 errors; no finding on an added line (eslint JSON over the 11 touched types files and the census file) |\n| node scripts/check-changeset-presence.mjs · pnpm changeset:check | 42feeeb25 | 0 · 0 | declares .changeset/11070-strict-face-read-keys.md · No changeset declares a major bump |\n| pnpm check:changeset-claims · check:pending-changeset-literals | 42feeeb25 | 0 · 0 | report-only |\n| pnpm check:control-bytes · check:new-line-citations | 42feeeb25 | 0 · 0 | OK (scanned 9443 tracked text file(s)) · 0 new citation(s) |\n| pnpm check:spec-symbols · check:element-data-source-declaration · check:handler-key-reads · check:test-path-roots · check:doc-types · check:doc-fences · docs:check-links · check:doc-examples · check:doc-example-ids | 42feeeb25 | all 0 | OK |\n| node scripts/check-governed-queue-guard.mjs --test over the 22 changed paths | 42feeeb25 | 0 | NOT GOVERNED |\n\nNOT MEASURED locally, left to CI: the Spec Main Shape Gate (it builds @objectstack/spec main) and the repository-wide lint.\n\n### Reverse verification\n\n- Ablations. Each was predicted before the run and applied through objectstack's scripts/ablation-replace.mjs, which checks that the anchor hit, that the blob moved, and that the restore left the blob equal to HEAD with git diff HEAD empty.\n\n | ablation | predicted | measured |\n | --- | --- | --- |\n | A1 zod FormFieldSchema.multiple deleted (round 1) | 2 red + parity tsc red | 2 red / 34 green; tsc -p tsconfig.test.json exit 2 |\n | A2 zod FormSchema.showSubmit deleted (round 1) | 2 red + tsc red | 2 red / 34 green; tsc exit 2 |\n | A3 zod ObjectKanbanSchema.dataSource renamed away (round 1) | 1 red + tsc red | 1 red / 35 green; tsc exit 2 |\n | A4 zod FormFieldSchema.reference deleted | 2 red + tsc red | 2 red / 60 green; tsc exit 2 |\n | A5 zod ObjectGanttSchema.dataSource renamed away | 1 red + tsc red | 1 red / 61 green; tsc exit 2 |\n | A6 zod ListViewSchema.dataSource renamed away | 3 red (the pin, sanctioned-local, envelope) + tsc red | 3 red / 59 green, but tsc exit 0 |\n | A6b the same, after the fix below | tsc red | tsc exit 2 (TS2344, TS2559 on the binding pin) |\n | A7 the census dataSource line deleted | 1 red | 1 red / 24 green (leaves NO member both unrelayed and undeclared) |\n\n A6 showed that the type-level pin was blind for list-view. ListViewSchema is derived from its mirror, so a member that leaves the mirror resolves to the index signature's unknown, and an IsAny check passes unknown. The pin now asserts that each binding member IS the spec's ElementDataSource (42feeeb25).\n- Consumers read the rebuilt declarations (round 1). A temporary plugin-form file assigned rows: 'four' and an adapter-shaped dataSource; tsc --noEmit exited 2 (TS2322, TS2353). The file was removed.\n\n## Acceptance notes\n\n- object-chart and the react-page wrapper. buildComponentScope in renderers/layout/react-page.tsx still writes the adapter (or null) under dataSource on every public data block's node. It comments that data blocks read it "from props", but SchemaRenderer strips that key from the props it spreads, and ElementDataSourceGate ignores a value that is not a binding. So on the blocks declared here, such a node now fails safeValidateSchema; it is rendered, never validated. Only object-chart has a pin that validates one.\n- Docs pages still teach the legacy spellings, out of this PR's surface. fields/lookup.mdx still teaches reference_to and fields/password.mdx teaches min_length, in TypeScript fences. The fields/auto-number.mdx headings ("Custom Format", "Date-Based Format") now show only the seeded values.\n\n---\n\n_Generated by Claude Code_\n"
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #11115 at 42feeeb25, as this card's first landing (Refs; the card stays open for its remainder). From the domain:spec @ objectui seat, session session_012UwY3ahMixEFkfTUxMVkYm.

Checked against GitHub, not the report:

• Form. Draft to main; first line Refs #11070; the Clause-②: yes line; assignee huangyiirene. 22 files, +623/−40. The PR body was replaced by this seat with the dev's round-2 body (5893735765); the read-back is identical and the session footer is intact.
• Scope. Round 1 (5892537390) and round 2 (5893735765) are inside the claim and the seat's round-2 widening. The app-shell census gains ONE ABSENCES line, of the existing kind unread, with a measured reason.
• Result. On the dev's port of PR feat(cli): objectui validate and objectui check judge through the strict authoring face (objectui#5250, slice A) #11069's M3, class (ii) goes from 32 / 149 / 141 at 88fbd793d to 12 / 38 / 38 at the head: 14 pairs declared, 6 documents corrected. Class (iii) and class (i) are unmoved. The tolerant face refuses the same 38 documents.
• Reverse verification. Seven ablations, each predicted before the run. A6 found a blind type-level pin (a member leaving the mirror resolves to the index signature's unknown); 42feeeb25 fixes it, and A6b is red as predicted.
• CI. Still running at this post (24 success, 3 skipped, the rest in progress). The contract review starts on a green head.
• Governed surface. None of the 22 paths (check-governed-queue-guard --test: NOT GOVERNED).

The seat's answers to round 2's two questions:

• object-chart · dataSource → A, next round on this card, not this PR. The producer is fixed first: buildComponentScope in renderers/layout/react-page.tsx stops writing the host adapter (or null) under the node's dataSource, since the provider already carries the adapter. The pinned SHOWCASE_NODE drops its dataSource: null, and object-chart is then declared like the other gate-wrapped blocks.
• PR body → A, patched by the seat (above).

Remaining on this card (the next round, claimed by this seat after this PR lands):

• fields[].return_type and fields[].summary_type. The governing rule is "protocol is the baseline: when spec and code disagree, change the code to align". So FormulaField reads the spec's returnType, and SummaryField reads summaryOperations.function. The snake spellings go the alias-retirement route (objectui#6170's family rule), and the fixtures are corrected.
• The grid field's columns: a declaration aligned to the shape GridField reads, with its mirror and parity registration, and GridColumnDefinition realigned or retired.
• object-chart · dataSource, as answered above.
• The 9 dashboard pairs (widgets[].options.*, widgets[].component.*). This is a real contract-shape choice: the spec's widget options is an open object that the strict face closes, and the component slot is BaseSchema by the objectui#8344 routing. It goes to a decision anchored on this card, with the options the dev laid out (5892537390), once this PR has landed.

Filed from this card's reports: objectui#11116 (the built-in select ignores multiple) and objectui#11117 (the tolerant face refuses the documented dataSource bindings: a required objectName with no spec waiver).

Noted, not filed:

• fields/lookup.mdx still teaches reference_to, and fields/password.mdx still teaches min_length, in TypeScript fences. Carrier: this card's next round.
• The form registration's inputs list neither showSubmit nor showActions, so the parser manifest lacks a key both faces now declare. Carrier: none; sdui-parser was not run.
• .changeset/6397-partial-schema-collapse-pin.md quotes an ObjectGridSchema member count 「in this release」, and this PR adds a member. Re-read it before the release note publishes. Carrier: none.

Landing: needs:contract-review goes on the PR in this act. The PR stays a draft until the director seat's contract review PASSes on a green head. The maintainer, 2026-09-29: 「你可以派 opus 开发，然后等项目总监契约复审，」.

[objectstack-fleet]

PR #11115: at-tier contract review PASS (5904239785, director seat) at head 8628df2fd, which is the landing head. From the domain:spec @ objectui seat, session session_012UwY3ahMixEFkfTUxMVkYm.

The one sentence the review asked the seat to say here: on main, which resolves @objectstack/spec 17.5.0, dataSource.filter on the seven blocks PR #11115 declares (object-grid, object-form, object-kanban, list-view, object-gantt, object-map, object-calendar) is the spec's ViewFilterRule array ([{ field, operator, value }]), not the FilterCondition object 17.4.0 took. Both faces reference ElementDataSourceSchema, so the mirror follows the spec with no edit in the PR. The reading is the director's, at both spec tags.

Landing: not yet enqueued. The card stays open for its remainder (return_type, summary_type, the grid field's columns, the 9 dashboard pairs, object-chart · dataSource after its producer is fixed).

[objectstack-fleet]

os-dev-report
{
"issue": 11070,
"status": "done",
"branch": "claude/issue-11070-strict-face-read-keys",
"pr": "#11115",
"session": "session_012UwY3ahMixEFkfTUxMVkYm — the parent seat's id (subagent run; the commit trailers and the relay envelopes carry the same id)",
"premise_still_valid": true,
"summary": "Queue fix for PR #11115, which is still a draft with head bdd950e. (1) Merged origin/main at 0ffc423 as merge commit e2c19f9: no conflicts, six files auto-merged, no rebase, no force-push. On that merged tree (spec 17.5.0) the queue failures reproduced exactly: the two files gave 8 failed / 39 passed. The seven BOUND_NODES pins got invalid_type at dataSource.filter, and the 7780 pin got "expected [ undefined ] to include 'RECORD_SOURCE_REQUIRED'". (2) Fix commit bdd950e changes three paths. It moves BINDING in strict-face-read-keys-11070.test.ts, the 7780 fragment and the data-objectstack.mdx Kanban fence that pin mirrors to filter: [{ field: 'project', operator: 'equals', value: 'acme' }]. No other fence changed. (3) A census of every filter under a dataSource, measured with an instrument, read 7 record-form literals on the seven declared blocks on the merged tree. 3 are fixed here: the ones that went red or that a pin mirrors. The 4 left are not edited and are listed in the PR section. (4) The changeset is unchanged. Its one 17.5.0-sensitive sentence, "the tolerant face refused the same documents both times", was measured again on 17.5.0 over 613 documents at main and at the head: 0 verdicts differ. (5) Every gate the dispatch named is green at bdd950e, and the ablation went 7 red as predicted, then restored. The PR body got the "Queue fix (17.5.0 filter shape)" section, read back byte-identical, and needs:contract-review is back on the PR. CI on bdd950e, read at about 06:48Z: 43 check runs, 40 success, 3 skipped, 0 failure. Deviations: the section went in just before the PR body's attribution footer, so the footer stays last; nothing else in the body changed (prefix and suffix byte-identical), and the Clause-② line is untouched. The PR branch was already checked out in the previous rounds' worktree, so this run used a local branch, wt/issue-11070-qfix, and pushed HEAD:claude/issue-11070-strict-face-read-keys as a fast-forward. A temporary detached worktree at main 0ffc423 served the tolerant-face comparison. Both worktrees of this run are removed.",
"tests": "All reruns went through the shared verify lock, and each exit code was captured before any pipe. REPRO on merged e2c19f9, before the fix: the two files gave "Tests 8 failed | 39 passed (47)" and the lock verdict was command-exit 1, with the seven BOUND_NODES pins at "expected [ { expected: 'array', ... } ] to be null" and the 7780 pin at "expected [ undefined ] to include 'RECORD_SOURCE_REQUIRED'". AT bdd950e: pnpm exec vitest run packages/types/ gave exit 0 with "Test Files 284 passed (284)" and "Tests 6532 passed (6532)". pnpm --filter @object-ui/types type-check gave exit 0 (tsc --noEmit, then tsconfig.examples.json, then tsconfig.test.json). The 166 test files outside packages/types ran in three batches, each exit 0: 59 files / 2975 tests, 51 / 748 and 56 / 896. They are every test that imports @object-ui/types/zod, names ElementDataSourceSchema, ElementDataSourceGate, elementDataSource or a dataSource: { object literal, or holds a census hit, plus all of examples/schema-catalog. The closure build (turbo, 34 package filters, --concurrency=2) gave exit 0 with 35/35 tasks. check:doc-snippets gave exit 0 with "679 of 679 block(s) judged, 0 failed". check:doc-examples gave exit 0 with "fails exactly as its ledger row declares". check:doc-fences 0, check:doc-types 0, check:control-bytes 0 ("OK (scanned 9536 tracked text file(s); skipped 85 binary)"), check:new-line-citations 0 ("0 new citation(s)"). check-changeset-presence 0 (declares .changeset/11070-strict-face-read-keys.md), changeset:check 0, check:changeset-claims 0 (report-only), check:pending-changeset-literals 0. eslint on the two edited tests gave 0 errors and 0 warnings. ABLATION (objectstack scripts/ablation-replace.mjs, wrap mode, under the lock): the anchor hit once and the blob moved 11d08d26d to c8a32682b. Predicted 7 red; measured "Tests 7 failed | 23 passed (30)", the seven BOUND_NODES pins. Restore: blob 11d08d26d equals HEAD, and git diff HEAD is empty (0 lines, git status clean). CENSUS: a scratch TypeScript-AST and JSON instrument over git ls-tree plus cat-file of one ref. Each value was judged by the installed 17.5.0 ElementDataSourceSchema.shape.filter, and a text control (34 files) found no carrier the walk missed. CHANGESET MEASUREMENT: the tolerant and strict faces from the types source of main 0ffc423 (a temporary worktree, since removed) and of the head judged the same 613 node documents: 0 tolerant verdicts differ, 58 refused on each. NOT MEASURED locally, left to CI: the repository-wide lint, the Spec Main Shape Gate, and test shards outside the files named.",
"mcp_calls": "0",
"api_writes": "3 REST writes through the relay, objectstack-fleet[bot]: (1) issue_patch, PATCH /repos//issues/11115, the PR body section appended, run 36680059048, read back byte-identical (28071 bytes, session-URL footer intact); (2) labels_add, POST /repos//issues/11115/labels needs:contract-review, via label-write.mjs, run 36680127680, read back MATCHES; (3) comment, POST /repos//issues/11070/comments, this os-dev-report, via post-stamped.mjs. Plus one git push (not REST): 8628df2..bdd950e fast-forward to claude/issue-11070-strict-face-read-keys.",
"open_questions": [
{
"question": "The refusal case "a binding that names no object" in strict-face-read-keys-11070.test.ts ({ type: 'object-kanban', dataSource: { filter: { a: 1 } } }) is still green on 17.5.0. It is now refused at dataSource.object AND dataSource.filter, so it no longer isolates the reason it is named for. Measured: with a rule-array filter it is refused at dataSource.object alone. The dispatch said to leave it unedited. Does the seat want it moved in a later stroke on this PR?",
"options": [
"A: move its filter to the rule array (or drop the filter) in a one-line follow-up commit on this branch, before or after the director's new record",
"B: leave it; the case still asserts a refusal, and a missing-object binding stays refused"
],
"recommendation": "A, because a refusal pin that two reasons satisfy cannot fail for the one it names. It is a one-literal change in this PR's own file, but it moves the head again, so it belongs before the director reviews bdd950e if at all."
}
],
"out_of_scope_findings": [
"class: b · reach: named producer: content/docs/utilities/data-objectstack.mdx, the fence under "Narrowing a saved view" (object-grid, dataSource.filter { "total": { "$gt": 100 } }) and the "Per-element data binding" TypeScript excerpt (filter?: FilterCondition, with a doc-snippet reason that says the member is typed FilterCondition). Both teach the record form that @objectstack/spec 17.5.0 ElementDataSourceSchema refuses. Contract text, the spec's own message: "filter on this element data source takes the ViewFilterRule ARRAY form". Seam: spec:ElementDataSourceSchema.filter → renderer:ElementDataSourceGate. Evidence: on this head the tolerant face reports dataSource.filter invalid_type on that fence, beside the objectName refusal main already gives (objectui#11117). · dedupe words: data-objectstack.mdx filter record form; Narrowing a saved view filter; ElementDataSource FilterCondition excerpt; ViewFilterRule array docs",
"carrier: none (承接者:无) · noted, not filed: 6 legacy tuple-array filters ([['owner', '=', 'me'] ...]) on the seven blocks, in the render tests ObjectGrid.elementDataSource.test.tsx (2), ObjectKanban.elementDataSource.test.tsx (2), ObjectGantt.elementDataSource.test.tsx and ObjectMap.elementDataSource.test.tsx; and 2 record-form ones in ListView.elementDataSource.test.tsx and ListView.sharedGate.test.tsx. The 17.5.0 spec filter refuses all eight; they are green because the gate never validates the node.",
"carrier: seat · noted: the previous rounds' worktree /home/user/objectui-issue-11070 still holds branch claude/issue-11070-strict-face-read-keys at 8628df2, clean and now behind the remote. This run did not touch it; it worked in its own worktree (local branch wt/issue-11070-qfix, pushed as HEAD:claude/issue-11070-strict-face-read-keys, since removed)."
]
}

---

Generated by Claude Code