feat(types)!: mirror eight ObjectViewSchema keys (three by spec reference) and retire viewTabBar (objectui#7779) - #7922

Fixes #7779

What this PR does

ObjectViewSchema's TypeScript face declared ten keys its Zod mirror never did (the UnmirroredDeclared entry objectui#7279 re-derived), so a document authoring any of them passed the validator unexamined through BaseSchema's passthrough while the published type invited the author to write it. Under the maintainer's ruling B on the card (2026-09-06, verbatim 「第二批(4 项,契约形状族) 帮我处理，全部同意」; record 5556357004) — liveness first, then mirror-or-retire per key — nine of the ten are dispositioned here and the tenth (listViews) stays in the ledger on the ruling's own fallback clause, with its measurement.

Read on origin/main 6a9ee323 (the branch base). The seat's premise at fa7d66c4 re-verified on it: objectql.zod.ts:196, the ten declarations at objectql.ts:1804–:1922, ledger rows :702 / :864 / :1437 / :1604 / :1855 / :2866–:2867, all as stated; every reading below is bound to the ObjectViewSchema block, never to a name match (navigation and searchableFields also live on other interfaces in the same file).

Per key

Positive controls of the same schema.KEY query: objectName and layout (read); viewTabBar and the never-declared viewSwitcherPosition (not read). The pin derives this set off disk, so each zero is a reading.

Why allowCreateView / viewActions are sibling slots rather than restated literals: the renderer hands both to the switcher node unchanged, the sibling mirror already spells the identical shape (z.enum(['share', 'settings', 'duplicate', 'delete']) plus optional icon), and one object for one key is what stops the two from drifting. defaultViewType is deliberately the declaration's seven values, not the spec's nine-value view-kind enum: chart / tree are host-composition-only on this node (objectui#5321) and NamedListView.type spells the same seven.

Spec-side readings, through the installed pin

@objectstack/spec@17.2.0, ui entry, measured from this worktree — 117 exported object schemas walked; control keys objectName 9 hits, columns 15, navigation 5, listViews 1; each of the six local keys 0 hits:

• ListViewSchema.navigation and ObjectListViewSchema.navigation: optional object (NavigationConfigSchema: mode defaulting to page, view, preventNavigation, openNewTab, size, width; strict, an unknown key is refused). { view: 'summary_view' } parses with mode defaulted; a bare string is refused.
• searchableFields and filterableFields on both view faces: optional array of string; the spec's own description of filterableFields is "Legacy shorthand for userFilters.fields — bare field names enabled for end-user filtering. Prefer userFilters".
• ViewSchema.listViews: optional record whose VALUE is ObjectListViewSchema by identity — strict (catchall never), columns its only required key (a union), type a nine-value enum defaulting to grid.

listViews — measured, and left in the ledger on the ruling's stop clause

What the two value types admit, and what the readers accept:

• The renderer reads seven NamedListView members off a named view — label, type, columns, filter, sort, options, data (derived off disk and pinned). NamedListView declares about 52 members (objectql.ts:1957–:2134).
• The spec value (ObjectListViewSchema) accepts the schema-catalog example ({ label, columns }) but REFUSES: the README / mdx form { label: 'All Users' } (at columns); a type plus filter view with no columns (at columns); content/docs/api/schema-reference.md's ObjectQL tuple filter [["owner", "=", "..."]] (at filter.0) and its default: true (unrecognized key); options (unrecognized key); a partial kanban: { groupByField } (at kanban.columns).
• The writers disagree as well: the README and mdx author the local shape; schema-reference.md authors tuple filters; app-shell's ViewPreview.tsx:113 spreads a spec-shaped view body into listViews.

So mirroring the spec value by reference loses documented behaviour, and mirroring the local NamedListView key-for-key enforces about 45 members the renderer never reads — the "enforced dead key" ruling B refused for the six local keys. That is the ruling's stop condition for this key, and its own instruction is followed: the other spec-modelled keys are mirrored, listViews stays in the ledger with the measurement (pinned against the SPEC schema, so a spec relaxation or a renderer change re-takes it instead of remembering it). z.any() is not used anywhere. The value-type decision goes to the maintainer in the report's open questions with the four-axis analysis.

Ledger and pins

• zod-mirror-parity.test.ts: the ObjectViewSchema entry shrinks 10 → 1 (listViews); SPEC_DERIVED_PAIRS gains the pair by a real code reference (the objectui#6705 scanner now sees SpecListViewSchema.shape.* in the initializer), so the split re-derives the entry into the SPEC-DERIVED half; header figures move 14 / 96 → 14 / 87 and 1 / 2 + 13 / 94 → 2 / 3 + 12 / 84, each with its history sentence (the PR test(types): re-derive ObjectViewSchema's side of the #6058 split as LOCAL and pin the header counts (objectui#7279) #7776 / PR feat(types)!: retire the legacy ActionSchema onSuccess/onFailure callback pair and delete ActionCallback (objectui#7068) #7832 shape). The objectui#7279 pin reads them off the header and agrees.
• object-view-spec-parity.test.ts — a seventh file, not on the dispatch's list, moved by a gate: its TS_ONLY_BACKLOG "may shrink, never grow" pin held exactly these ten keys. It shrinks to listViews plus onNavigate; the audit figures move 11 / 13 → 20 / 22 with the arithmetic shown; the three spec-counterpart notes now read DONE.
• New pin object-view-unmirrored-keys-7779.test.ts (52 tests): reads derived off disk with controls; membership on the mirror's own .shape; identity against the spec slots and the sibling slots; per mirrored key, accepted-and-survives plus a wrong-typed refusal AT the key (12 refusal probes, direct and through the union door); the tombstone on both faces (message, code invalid_type, describe equals message, TS never at the type level plus @ts-expect-error); the listViews measurement against the spec; neighbour and passthrough controls; the two doc tables.
• Docs: the packages/plugin-view/README.md and content/docs/plugins/plugin-view.mdx import tables no longer teach viewTabBar as a node key — the only two pages that did; the diff moves zero fenced snippets.
• Changeset: @object-ui/types minor, "Breaking for authored metadata" opening, every key and its disposition named.

Gates — exit captured before any pipe, verdict lines quoted, heavy runs under the shared verify lock

Taken on e9f86194; the ratchet family re-run on the merged head 94e7ac47 (origin/main f5d2acc3 merged in; main moved nothing under packages/types since the base):

• pnpm --filter @object-ui/types build — VERDICT command-exit 0 (dist completeness: 124 emitted files verified)
• pnpm exec vitest run --maxWorkers=2 packages/types/ — Test Files 129 passed (129), Tests 2388 passed (2388), VERDICT command-exit 0; re-run at 94e7ac47: the same figures
• pnpm --filter @object-ui/types type-check (tsc --noEmit && tsc -p tsconfig.examples.json && tsc -p tsconfig.test.json) — VERDICT command-exit 0; tsc -p tsconfig.test.json --listFiles lists the new pin (1 hit); re-run at 94e7ac47: green in the same verdict
• consumer type-checks, DOWNSTREAM direction, against the rebuilt dist (their tsconfigs drop the root paths, so @object-ui/types resolves to dist/*.d.ts): pnpm --workspace-concurrency=2 --filter @object-ui/plugin-list --filter @object-ui/plugin-view --filter @object-ui/app-shell type-check after building each dependency closure — all three echo type-check$ tsc --noEmit && tsc -p tsconfig.test.json and Done, VERDICT command-exit 0
• reverse verification of the cross-package type change: a throwaway probe compiled standalone against the dist, authoring viewTabBar: { showAddButton: true } and defaultViewType: 'tree' — exactly two TS2322 at those two lines (not assignable to type 'undefined'; '"tree"' is not assignable to …'"kanban" | "grid" | …'), the eight-key literal beside them clean, --listFiles reading packages/types/dist/objectql.d.ts with 0 src reads; probe removed, tree clean
• pnpm --filter @object-ui/types lint — 0 errors (274 pre-existing no-explicit-any warnings, none in the touched regions)
• check-changeset-presence.mjs / -no-major / -fixed / -overwrite — all ✅; check-control-bytes.mjs ✅ (6396 tracked text files); pnpm check:spec-symbols ✅; check:doc-types ✅; check:doc-fences ✅; check:vi-mock-specifiers ✅; check:vi-mock-inherit ✅; check:shell-escape-residue ✅; check:unreferenced-sources ✅
• NOT MEASURED locally (a precondition, not a red): check:doc-snippets exits 2 PRECONDITION NOT MET (six unbuilt packages, none of them this PR's); check:readme-exports could not judge one plugin-gantt type (unbuilt dist) — the plugin-view README was among the 43 READMEs it judged. Both are CI's runs; this PR's doc diffs move zero fenced snippets.
• governed-surface predicate (objectstack scripts/pm/check-governed-merges.mjs --test, all 8 paths) — 0 of 8 path(s) hit the register → NOT governed
• ablation (Clause-② yes): objectql.zod.ts alone reverted to the base blob, trap-guarded with absolute paths — mutation proven on disk (tombstone line and spec-reference line each 1 → 0; blob 97b7a668 vs HEAD 44e31169); the three pins under it: Test Files 3 failed (3), Tests 37 failed | 100 passed (137) — 34 in the new pin, 2 in object-view-spec-parity (backlog, audit figures), 1 in the ledger (SPEC_DERIVED_PAIRS re-derivation); the controls green; tsc -p tsconfig.test.json exit 2 with the compile-time ledger naming exactly 'objectql.zod.ts#ObjectViewSchema'; restored via git checkout HEAD -- path, blob 44e31169 equals HEAD's, git diff HEAD empty, status clean

Sibling overlap

#7493's dev touches zod-mirror-parity.test.ts at the base.zod.ts#ComponentInputSchema rows and its own header figures; this PR touches only the objectql.zod.ts#ObjectViewSchema rows, the UnmirroredDeclared figures and SPEC_DERIVED_PAIRS. Textual overlap is possible on the header-figure lines; the union is both history sentences plus the re-derived totals, which the objectui#7279 pin checks. The merge queue rebuilds on main; origin/main is merged again when the sibling lands. Left DRAFT with needs:contract-review; no ready flip, no enqueue.

Noted for the seat, out of this card's scope: the NamedListView declaration itself carries about 45 members nothing reads off a named view — a liveness question of its own, not one of this card's ten keys.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BAZFhALsQsGqxui8sNqM8s

Generated by Claude Code