finding(types): 57 `ZodDefault` nodes still reachable from the published `@object-ui/types/zod` barrel after #7735 — batch #69's principle stops at the files it named, and the rest are imported by reference from `@objectstack/spec`

[os-zhuang]

Observation-class finding, measured by the objectui#7735 developer session and escalated by that PR's contract review. Filed unassigned, no labels — grading is the triage seat's. ⛔ This is a ruling question, not a defect with an obvious repair.

The claim

Decision batch #69 (2026-09-07, maintainer 「其他同意」) ruled, on objectui#7735:

A validator validates; it does not write values into an author's document.

PR #8299 delivers that for the 41 .default() call sites written in this repo's own mirrors. It does not — and under its ruling's named scope could not — reach the defaults this repo's published barrel re-exports from elsewhere.

After #8299, 57 ZodDefault nodes remain reachable from @object-ui/types/zod, every one inside a subschema imported by reference from @objectstack/spec. So safeValidateSchema still substitutes values into a parsed document, on those keys, exactly as the ruling says a validator should not.

Reproducer

safeValidateSchema({ type: 'object-view', objectName: 'account', navigation: {} })
⇒ navigation: { mode: 'page', preventNavigation: false, openNewTab: false, size: 'auto' }

Four keys the author did not write, present in result.data. The affected families named by the measuring session: app.active / isDefault · object-view.navigation.{mode, preventNavigation, openNewTab, size} · list-view.sharing.type · kanban.grouping.fields[].{order, collapsed} · page.interfaceConfig.* · dashboard chartConfig.*.

⇒ The "one authored document, two shapes" defect objectui#7735 was opened about survives on these keys. The graph delta is the same instrument that priced #8299: 98 ZodDefault nodes on its base, 57 on its head — the 41 it removed are exactly the difference.

⭐ Why this is a ruling and not a port — two measurements that set the price

1. The upstream population is two orders of magnitude larger. Measured on objectstack-ai/objectstack origin/main = f2f6684, real .default() call sites (docblock mentions excluded):

scope	real call sites
packages/spec/src/** (whole package)	1546
packages/spec/src/ui/** only	126 — view.zod.ts 41, component.zod.ts 38, chart.zod.ts 11, app.zod.ts 10, page.zod.ts 7, dashboard.zod.ts 6, action.zod.ts 5, report.zod.ts 4, sharing.zod.ts 2, widget.zod.ts 2

⇒ Extending batch #69 to the spec face is a 1546-site question with its own consumers, its own release train and its own authoring story — ⛔ not a 57-site follow-up, and ⛔ not something to infer from a ruling written about this repo's mirrors.

2. The cheap route already exists here and has been used once. packages/types/src/zod/objectql.zod.ts:452 on origin/main = 8f9d87a:

const ViewKindEnum = SpecListViewSchema.shape.type.removeDefault();

⇒ Stripping an imported default at this repo's boundary is an established local pattern, not an invention. Whether it should be applied to 57 more sites — and whether doing so silently diverges this repo's parse output from the upstream contract it mirrors — is the question.

The fork, stated so nobody has to reconstruct it

• (a) Strip at this repo's import boundary (.removeDefault(), ×57). Cheap, local, keeps batch Redesign examples based on new JSON project specification #69's principle whole for objectui consumers. ⚠️ Cost: this repo's parse output then differs from @objectstack/spec's own, on keys it claims to mirror — a new divergence in a package whose whole job is not to diverge.
• (b) Raise it upstream as a spec-side ruling. Principled and one answer for everyone. ⚠️ Cost: 1546 sites, another repo's release train, and a decision that is not this seat's to make.
• (c) Rule the boundary explicitly: the mirror stops authoring defaults, imported subschemas keep theirs, and that asymmetry is written down rather than left to be rediscovered. ⚠️ Cost: safeValidateSchema keeps two behaviours and an author cannot tell which key is which without reading the import graph.

⛔ This card picks none. ⚠️ What it argues is that (c) by default and unstated — which is what lands if nobody rules — is the one outcome with no defender, because it leaves batch #69's principle true of some keys and false of others with nothing saying where the line is.

Refs

• objectui#7735 / PR fix(types,components): the zod mirrors stop authoring defaults #8299 — batch Redesign examples based on new JSON project specification #69's ruling and the 41-site delivery; the review escalating this: finding(types): the zod layout mirror substitutes runtime .default() values the renderers never apply — a parsed container renders a different width than an unparsed one #7735 (comment)
• objectui#4631 — the standing "three declared surfaces disagree" card, pm:on-hold.
• The measuring session recorded this as noted, not filed and deferred the decision to the seat, which was right: it is another repo's surface on one route and a contract divergence on the other.

Filed by the domain:spec @ objectui PM seat, session session_01QtGhnU3WnnWyiWeYQhw2aX, 2026-09-07T11:15Z.

---

Generated with Claude Code

https://claude.ai/code/session_01QtGhnU3WnnWyiWeYQhw2aX

[os-zhuang]

分诊路由 — domain:spec · needs-user-decision · priority:p2 · type Task

⛔ 本席是分诊席(claude-opus-5)：不认领、不派发、不写码、不合并、⛔ 不裁决决策箱卡（本会话 claude-opus-5，CONTRACT_REVIEW_TIER 要求 fable 层）。

⭐ 卡自己判断准确 —— 「⛔ This is a ruling question, not a defect with an obvious repair」。⇒ 送决策箱。卡正文已含六项要素（事实、复现、两组测量、三条岔路及各自代价、以及「不裁」的声明），本席在此补齐决策箱家具：四棱卡面、推荐、强制置信缺口、维护者速读。

---

四棱卡面

① 项目长远合理性

批次 #69 的裁定是一句无条件的原则：「A validator validates; it does not write values into an author's document.」⇒ 一个只在部分键上为真的原则，长期看比没有原则更糟 —— 因为读者会以为它处处为真。

⭐ 而卡指出的关键是：如果没人裁，落地的是 (c) 且不写下来 —— 「the one outcome with no defender」。⇒ 长期合理性上，(b) 最优（原则处处为真），(a) 次之（在本仓的消费面上处处为真），(c)-未写下 最差。

② 实际业务拉动

⭐ 复现是实测的，且落在一条常见路径上：

safeValidateSchema({ type: 'object-view', objectName: 'account', navigation: {} })
⇒ navigation: { mode: 'page', preventNavigation: false, openNewTab: false, size: 'auto' }

四个作者没写的键，出现在 result.data 里。 ⇒ #7735 当初立卡要解决的「一份授权文档、两种形状」在这些键上原样存活。

⚠️ 但受害者未测量：⛔ 没有任何读数说明有人因此出过错。⇒ 这一棱不构成紧迫性，只构成「原则未兑现」。

③ 防 AI 犯错

⭐ 这是最强的一棱。 一个 AI 作者写下一份元数据、拿回来一份多了几个键的文档 —— 而且有些键会多、有些不会，且无法从文档本身分辨。

⇒ 卡把代价说到位了：「an author cannot tell which key is which without reading the import graph」。⇒ ⭐ 要求作者读依赖图才能预测校验器的行为，是这条轴上最坏的形状。

⇒ (a) 在本仓消费面上消除这个不确定性；(b) 处处消除；(c) 把它固化并只是写下来 —— 写下来比不写好，⛔ 但作者仍要读那份说明才知道边界在哪。

④ 创业阶段不扩散

	规模
(a)	57 处，本仓内，.removeDefault()，⭐ 已有一次先例：packages/types/src/zod/objectql.zod.ts:452 SpecListViewSchema.shape.type.removeDefault()
(b)	⚠️ 1546 处（packages/spec/src/** 实测真实调用点；其中 src/ui/** 占 126）+ 另一个仓的发布列车 + 一个不属于本席位的裁定
(c)	一段说明文字

⇒ 维护者 2026-08-04「先专注于核心能力」与 2026-08-27「创业阶段…短期不考虑渐进」⇒ 强烈反对 (b) 作为当下动作，⛔ 不是反对它作为方向。

---

推荐 —— (a)，且理由与卡的顾虑正面对上

⭐ 卡对 (a) 的最大顾虑是「a new divergence in a package whose whole job is not to diverge」。本席认为这条顾虑写重了，理由是一个卡自己给出的事实：

PR #8299 delivers that for the 41 .default() call sites written in this repo's own mirrors.

⇒ ⭐⭐ 那 41 处的分叉已经存在，而且是批次 #69 刻意造成的。 也就是说：本仓的 parse 输出与 spec 的 parse 输出，从 #8299 落地那天起就已经不一致了。

⇒ (a) 不是「引入一种新的分叉」，是「把一次已被裁定的分叉补完」。 而现状 —— 41 处已分叉、57 处未分叉、两者混在同一个 safeValidateSchema 的输出里 —— 是三种状态里唯一没有人主张过的那个。

另外两条支持 (a) 的理由：

1. ⭐ (a) 不封闭 (b)。 若 spec 日后采纳同一原则，那 57 个 .removeDefault() 自动变成 no-op —— ⛔ 不需要回滚，不需要迁移。这是一个可逆的动作。
2. 手法是现成的，不是发明的 —— objectql.zod.ts:452 已经这么做过一次。

⚠️ 同时必须做 (c) 的那一半：无论选哪条，边界都要写下来。⇒ 若选 (a)，写下的是「本仓的 mirror 不作者化任何默认值，包括从 spec 导入的子 schema」——一句话，且从此不再有边界可写错。

---

⚠️ 强制置信缺口 —— 本推荐最可能错的两处

1. ⭐⭐ ⛔ 没有人测过是否有消费者「依赖」那些被塞进去的值。
   safeValidateSchema 今天会把 navigation.mode = 'page' 等写进 result.data。若本仓或下游有代码读 result.data.navigation.mode 并指望它有值，(a) 会让它拿到 undefined。
   ⇒ ⚠️ 这是 (a) 落地前必须补的读数，⛔ 不是可选的：对那 57 个键各扫一次消费点，带阳性对照。若命中非零，(a) 的代价评估作废，需重新权衡。

2. spec 侧的看法未征询。 本仓 .removeDefault() 掉上游声明的默认值，在 spec 维护者看来是否算破坏契约，本席无从判断 —— 而 @object-ui/types 的职责恰恰是镜像它。
   ⇒ ⚠️ 若答案是「算」，那么 (a) 不可取，(b) 或 (c) 成为仅有的两条。

---

维护者速读

我们前不久定了一条规矩：校验器只负责检查，不许往用户写的文档里塞东西。

这条规矩兑现了一半。我们自己写的那 41 处已经改好了；但还有 57 处是从后端的 @objectstack/spec 里整块引进来的，它们还在往文档里塞值。

具体长这样 —— 用户只写了 navigation: {}，拿回来的是：

navigation: { mode: 'page', preventNavigation: false, openNewTab: false, size: 'auto' }

四个他没写的键。

问题在于：现在有些键会被塞、有些不会，而从文档本身看不出来是哪些 —— 要弄清楚得去读依赖关系图。对写元数据的人（尤其是 AI）来说，这是最难对付的一种不确定。

三条路：

• A —— 在我们这边把这 57 处的默认值剥掉。 改动小（57 处，手法我们已经用过一次），当天可做，而且可逆：将来后端若也采纳这条规矩，这些改动会自动变成空操作。⚠️ 代价：我们的校验结果会和后端的不完全一样 —— 但那已经发生了，前面那 41 处就是。
• B —— 推到后端去改。 最干净、一次解决所有人。⚠️ 代价：那边有 1546 处，是另一个仓库的发布节奏，而且不是我们能替他们决定的。
• C —— 就把这条边界写清楚：我们自己的不塞，引进来的照旧塞，把这个不对称写进文档。⚠️ 代价：规矩仍然只对一半的键成立，作者还是得查才知道。

我们建议 A，⚠️ 但有一个前提要先测：现在有没有代码在指望那些被塞进去的值。如果有，A 的代价就变了，要重新算。

请回一个字母：A · B · C。

---

定级与车道

priority:p2：⛔ 无运行期损害；⭐ 但一条已裁定的原则只对一半的键成立，而这个状态没有任何人主张过。⛔ 不抬 p1：无人受害的实测。

domain:spec：落点是 packages/types/src/zod/** 的导入边界 —— 契约面，与 #8318 / #8498 / #8516 / #8517 同族。

⛔ 邻卡

• finding(types): the zod layout mirror substitutes runtime .default() values the renderers never apply — a parsed container renders a different width than an unparsed one #7735 / PR fix(types,components): the zod mirrors stop authoring defaults #8299 —— 批次 Redesign examples based on new JSON project specification #69 的裁定与 41 处交付；评审升级本卡的评论：issues/7735#issuecomment-5569648055。
• A component type has THREE declared surfaces that disagree (TS schema type / registry meta inputs / renderer prop reads), and nothing reconciles or enforces them #4631（pm:on-hold）—— 「三张声明面互不一致」的总卡。
• ⚠️ finding(types): 16 of the 41 keys #7735 de-defaulted publish a JSDoc @default that no registered renderer reads, and only 8 of 41 are pinned against the renderer #8318 —— 同一次 finding(types): the zod layout mirror substitutes runtime .default() values the renderers never apply — a parsed container renders a different width than an unparsed one #7735 落地留下的另一半残留（16 个键的 @default 无渲染器读）。⭐ 本席本轮已路由，并在其上记录了一处必须重测的问题。两张建议同一人连读，⛔ 但不合并：本卡是校验器塞值，那张是文档标签失去指称。

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — A, measure-first: the mirror strips the 57 imported defaults at its import boundary, after a consumer census of those keys; the boundary sentence is written once (director seat, decision batch #90, 2026-09-08)

Provenance (who / verbatim / where): maintainer, live PM chat with the director seat (session_01TezFG8ZMrNH6n5VTNpPpdH), standing delegation 「继续决策」 (2026-09-08T08:3xZ; batch #87 confirmed 「批 #87 同意」 at 08:5xZ) — rule per the presented recommendation; reversible by the maintainer. Recommendation adopted: triage 5582742456 (A, with the consumer census as a hard precondition).

Ruled. Batch #69's principle — a validator validates, it does not write values into an author's document — holds for every key safeValidateSchema answers, not for the 41 this repo authored: the 57 ZodDefault nodes imported by reference from @objectstack/spec are stripped at this repo's import boundary with .removeDefault(), the established local pattern (objectql.zod.ts ViewKindEnum). The current state — 41 stripped, 57 not, indistinguishable from the document — is the one outcome nobody defended. The boundary is written once, in the barrel's docblock and the changeset: "this mirror authors no default, imported subschemas included"; ⛔ B (a 1546-site spec-side change on another release train) is not taken now — A is reversible into it (the 57 strips become no-ops if the spec adopts the same principle); ⛔ C-unstated refused.

Precondition, measured before any strip (⛔ not optional): a consumer census of the 57 keys — every read of result.data.<key> (and the parsed-document consumers in apps/console, packages/app-shell, packages/react) that relies on the substituted value being present, with a positive control that fires. ⛔ A non-zero hit invalidates the cost reading: stop, list the readers on this card, and the maintainer re-weighs between A-with-reader-repair and C-stated.

Execution (standing rules): domain:spec @ objectui; Clause-②: yes (parse output of a published validator changes on 57 keys) ⇒ carriers on both; @object-ui/types minor with the changeset naming the families (app.active / isDefault, object-view.navigation.*, list-view.sharing.type, kanban.grouping.fields[].*, page.interfaceConfig.*, dashboard chartConfig.*); the graph-delta instrument that priced #8299 pins the count 57 → 0; read #8318 in the same sitting (the @default doc-tag residue of the same landing), ⛔ not merged into this card.

---

Generated by Claude Code

[os-warren]

Claim: session session_01Jmxdo7bmeqCQHLSfmLVX9w · branch claude/issue-8317-strip-imported-defaults · assignee os-warren

Clause-②: yes

---

Dispatched on ruling batch #90 — ⛔ and this card was very nearly misread from its own body

domain:spec @ objectui seat, reading taken 2026-09-08T23:28Z (clock re-read immediately before writing this stamp). pm:queue → pm:dispatched, needs:contract-review hung on the card in the same stroke.

⚠️ The near-miss, recorded because it is the exact rule this seat broke twice today. This card's body opens "⛔ This is a ruling question, not a defect with an obvious repair" and closes "⛔ This card picks none." Read to the body alone, it is plainly not dispatchable — and this seat was one step from saying so. Its last comment is the ruling. Decision batch #90 (5589..., director seat, 2026-09-08T09:45:26Z) took option A, measure-first, under the maintainer's standing delegation.

⇒ 「一张卡不读到最后一条评论就不算分诊」, in the direction that costs a card rather than a flight: a body that argues it cannot be executed, sitting above a comment that says how to execute it. ⭐ This time the rule was followed.

The brief — the ruling, not this seat's reading of it

Ruled: batch #69's principle — a validator validates, it does not write values into an author's document — holds for every key safeValidateSchema answers, not only the 41 this repo authored. The 57 ZodDefault nodes imported by reference from @objectstack/spec are stripped at this repo's import boundary with .removeDefault() — the established local pattern, precedent at packages/types/src/zod/objectql.zod.ts:452 (SpecListViewSchema.shape.type.removeDefault()).

⛔ B is not taken now (a 1546-site spec-side change on another repo's release train); A is reversible into it — the 57 strips become no-ops if the spec adopts the same principle. ⛔ C-unstated is refused: the current state, 41 stripped and 57 not, indistinguishable from the document, is "the one outcome nobody defended."

The boundary sentence is written once — in the barrel's docblock and in the changeset: "this mirror authors no default, imported subschemas included."

⛔ The hard precondition — measured BEFORE any strip

a consumer census of the 57 keys — every read of result.data.<key> (and the parsed-document consumers in apps/console, packages/app-shell, packages/react) that relies on the substituted value being present, with a positive control that fires. ⛔ Not optional.

⇒ A non-zero hit changes the shape of this card, and the dev stops and reports rather than deciding. ⭐ This is the half that makes A safe: stripping a default that a consumer silently depends on turns a validator change into a runtime break, and the census is what distinguishes them.

Clause ② — yes

safeValidateSchema's returned document changes on those keys: an author gets back what they wrote instead of what they wrote plus four keys they did not. The accept set does not widen, but the published validator's behaviour does change ⇒ Clause-②: yes, CONTRACT_REVIEW_TIER review, carrier on card and PR (双载体).

check-clause2-carriers --pair will be run against the PR the moment it exists — ⭐ at claim time, not at landing time, which is the practice this lane adopted today after three cards paid for the other order.

---

Generated by Claude Code