spec(ui): `UserActionsConfigSchema` adopts `group` / `hideFields` / `rowColor` — the three toolbar affordances `ListView` honours but no spec-valid document can declare (ruled A on objectui#5435)

[os-sam]

Filed by the domain:spec @ objectui seat (objectui#5734) as the cross-seat transfer of a ruled card. packages/spec is this lane's sole owner, so the spec leg lands here; the downstream objectui leg is objectui#5435, now pm:blocked on this card.

Filed unassigned. Not claimed.

The ruling (binding — not re-opened here)

Maintainer, 2026-08-22, decision-inbox digest, recorded on objectui#5435. The full inbox (46 cards) was presented with per-card four-axis recommendations and accepted as a batch, verbatim:

「接受所有」

Ruled: Option A — the spec adopts the three keys. UserActionsConfigSchema gains group, hideFields and rowColor, so the three toolbar affordances ListView already honours become authorable in a spec-valid document and the runtime fold's output passes the save gate (declared = enforced closes).

Option B (retiring three live product capabilities) and Option C (permanent double-spelling) were not taken. The triage execution note routes this as a clause ② contract card at contract-review tier, with objectui's fold/renderer tests aligning on the pin afterwards.

Why the spec leg exists

packages/core/src/utils/normalize-list-view.ts in objectui folds legacy bare show* flags into the canonical userActions block via SHOW_FLAG_TO_USER_ACTION. Four of the seven targets land on keys the spec declares; three do not:

showGroup: 'group', showHideFields: 'hideFields', showColor: 'rowColor',

packages/plugin-list/src/ListView.tsx (toolbarFlags) reads all three regardless. So a stored legacy view carrying showGroup: false comes out of the fold as userActions: { group: false } — which ListViewSchema rejects by name. Anything that normalizes then validates hits a refusal on a key the runtime itself just wrote.

Re-measured at this repo's head (not the card's 17.0.0 reading)

origin/main 52a41b7. packages/spec/src/ui/view.zod.ts:853 — UserActionsConfigSchema is a strictObject (which is why the refusal is unrecognized_keys), declaring exactly eight keys:

sort · search · filter · refresh · rowHeight · addRecordForm · editInline · buttons

group, hideFields, rowColor are absent. The premise holds at head, not merely at the 17.0.0 the card measured.

Reproduce (from objectui#5435, control included — the control is what makes the three refusals mean "this key" rather than "this schema refuses everything"):

node --input-type=module -e "
import { ListViewSchema, UserActionsConfigSchema } from '@objectstack/spec/ui';
const uk = r => (r.error?.issues ?? []).filter(i => i.code === 'unrecognized_keys').flatMap(i => i.keys ?? []);
for (const k of ['group','hideFields','rowColor']) {
 const r = ListViewSchema.safeParse({ name:'my_view', label:'My View', columns:[{field:'name'}], userActions:{ [k]: true } });
 console.log(k, r.success, uk(r), (r.error?.issues??[]).length);
}
console.log('control sort', ListViewSchema.safeParse({ name:'my_view', label:'My View', columns:[{field:'name'}], userActions:{ sort:true } }).success);
"

⚠️ Named premise the implementer must confront — two of the three key names are already taken, with different shapes

This is not a re-adjudication of A; it is a measurement A's implementation will hit on its first stroke. Both spellings already exist in packages/spec/src/ui carrying non-boolean shapes:

key	existing declaration	shape	objectui's fold produces
hideFields	component.zod.ts:853 — "Field names to omit from the body"	z.array(z.string())	boolean (ua?.hideFields === true)
rowColor	component.zod.ts:2132 — "Row color rules" (plus RowColorConfigSchema, view.test.ts:1937)	z.unknown() / config object	boolean (ua?.rowColor === true)

So adopting them verbatim as booleans under userActions creates same-name / different-shape pairs across the spec — precisely the hazard object-strictness-batch20.test.ts:410 exists to catch, in its own words: "the same key NAME, disjoint vocabulary … which is exactly why an author who learned one writes it on the other."

Instruction, per the ruling-with-premise discipline: implement A as ruled. If the collision forces a shape or naming change (e.g. the three land under a different spelling, or hideFields takes the array shape rather than the boolean the fold emits), stop and report the fork on this card — ⛔ do not silently pick a spelling, and ⛔ do not fall back to option B or C, both of which were explicitly not taken.

Pins that move when the three keys land

1. packages/spec/src/data/object-strictness-batch20.test.ts:410-417 — its comment enumerates the exact eight-key vocabulary and goes false on adoption. The assertion itself ("nothing overlaps" with the object block's create/import/edit/delete/exportCsv) survives, but must be re-checked, not assumed.
2. packages/spec/src/ui/view.test.ts:2491+ — UserActionsConfigSchema default-value test enumerates all eight keys; the three new ones need declared defaults and pins. Note the existing defaults split true (sort/search/filter/refresh/rowHeight) from false (addRecordForm/editInline); objectui's reads imply group defaults true (ua?.group !== false) while hideFields/rowColor default false (=== true). That asymmetry is load-bearing and should be pinned, not normalised away.
3. packages/spec/src/ui/page.zod.ts:368 consumes UserActionsConfigSchema — check the widening does not change page-level strictness readings.

Acceptance criterion (one line, executable)

ListViewSchema.safeParse({name:'my_view',label:'My View',columns:[{field:'name'}],userActions:{group:false,hideFields:true,rowColor:true}}).success === true, with the object-block control (rejectOnObject({userActions:{sort:false}}) still naming VIEW) still red.

Downstream

• objectui#5435 — the fold/renderer test alignment. pm:blocked, Blocked-by: this card. ⚠️ It is blocked twice: on this change landing, and on objectui's spec pin bump, which objectui#5716 currently holds at 17.1.0.
• Related on the same key, different defects: objectui#5398 / test(lint): give the in-process cold-load case the same COLD_LOAD_TIMEOUT_MS its siblings carry (#5421) #5434 (the userActions view/object name collision), objectui#5240 / LocalManifestSource.read() 把「条目不存在」和「条目损坏」都答成 null，两个 HTTP 调用方因此只能回一句无因由的 500 #5426 (the plugin-grid half), objectui#4337 (the legacy list-view vocabulary the fold accepts has no declared type).

Notes for triage

• Type not pre-filled deliberately. The mechanical boundary test cuts both ways here: the remedy widens the accept set (⇒ Feature), while the defect being closed is a runtime emitting documents its own gate refuses (⇒ Bug; objectui#5435 is typed Bug). Triage owns the field — flagging the tension rather than guessing.
• Dedupe performed before filing by two independent methods (full domain:spec label inventory, 45 cards; since-windowed listing, 140 issues) because search_issues returned an uncontrolled zero in this session — see finding(platform): search_issues 可整会话静默归零(含控制词);REST /search 被容器代理按设计拒绝——正确退路是 REST 列表端点,不是 MCP list_issues 手扫 #11193, filed independently minutes earlier. No existing card covers this.

[os-steve]

Claim: PM loop round R2 wave 5
Session: session_01T9cDbY2NBiVJWYx3BpWfH2
Branch: claude/issue-11195-user-actions-three-keys
Worktree: objectstack-issue-11195
Domain: domain:spec
File surface: packages/spec/src/ui/view.zod.ts (UserActionsConfigSchema, :853) · packages/spec/src/ui/view.test.ts (:2491+ defaults pins) · packages/spec/src/data/object-strictness-batch20.test.ts (:410 vocabulary comment + overlap re-check) · packages/spec/src/ui/page.zod.ts strictness reading check · regenerated artifacts + changeset (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — clause-② explicit in the transferring ruling ("clause ② contract card at contract-review tier"): accept-set WIDENING (three new authorable keys). needs:contract-review hung card-side in the claim stroke.
Clause-②: yes
Serial constraints cleared: premise re-verified on current origin/main — UserActionsConfigSchema still strictObject at :853 with the three keys absent; the two name-collision sites (component.zod.ts hideFields array / rowColor config) are live, exactly the trap the card pre-names with its stop-and-report clause. Wave siblings #11152 (data/aggregation-conformance.ts) and #11210 (scripts/liveness/** + liveness/permission.json) — disjoint. Downstream objectui#5435 is Blocked-by: this card (their seat's to unlock). No stale branch.

---

Generated by Claude Code

[os-steve]

Claim-surface supplement (same round, session session_01T9cDbY2NBiVJWYx3BpWfH2, branch claude/issue-11195-user-actions-three-keys):

• packages/spec/src/data/object.zod.ts — comment-only bounded in-place fix: the wrong-layer guidance rationale (lines 1726-1731) enumerates the view userActions vocabulary the same way the batch20 test comment does, and went stale the same way on adoption. Same defect class as the card's pin 1, mechanical (the shape is the evidence), no gate family added. Named with evidence in PR spec(ui): UserActionsConfigSchema adopts group / hideFields / rowColor (ruled A on objectui#5435) #11458's body.
• Generated artifacts the regen discipline moved, for completeness: packages/spec/authorable-surface/ui.json, packages/spec/authorable-defaults/ui.json, content/docs/references/ui/view.mdx, plus .changeset/user-actions-three-keys.md — all within the claim's "regenerated artifacts + changeset" line.

No other files outside the claimed surface were touched. No guidance/alias entries were added for the three new keys (behavioural extension, out of scope) — filed as #11459, finding, Blocked-by this card.

---

Generated by Claude Code

[os-steve]

os-dev-report

{
 "issue": 11195,
 "status": "done",
 "branch": "claude/issue-11195-user-actions-three-keys",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11458",
 "premise_still_valid": true,
 "summary": "UserActionsConfigSchema (view.zod.ts:853) adopts group (default true), hideFields (default false), rowColor (default false) as booleans, exactly as objectui's fold emits them — Option A as ruled, no shape/naming fork triggered (the collisions are cross-surface toggle-vs-config pairs: component hideFields string[], view-level rowColor RowColorConfig; both untouched, documented on the describes and schema docblock). Defaults asymmetry copied from ListView.tsx reads (ua?.group !== false vs === true) and pinned by a dedicated test. Premise re-verified at head 5a916c4d4 before editing: strictObject, eight keys, three absent. Draft PR held for contract review (clause 2).",
 "tests": "All at head 51de14c509, clean tree, via os-verify-lock (exit codes captured pre-pipe, VERDICT lines read): spec build VERDICT command-exit 0; spec test VERDICT command-exit 0 (419 files / 11157 tests passed); spec typecheck VERDICT command-exit 0 (check:test-typecheck OK); check:generated — 1 of 14 stale (check:docs), regenerated with --fix, re-run exit 0; acceptance probe on built dist: safeParse({...userActions:{group:false,hideFields:true,rowColor:true}}).success === true observed, per-key probes accepted with zero unrecognized_keys, defaults parse gave group=true/hideFields=false/rowColor=false; controls: object-block userActions:{sort:false} red naming VIEW, and group/hideFields/rowColor each refused BY NAME on the object block. No ablation legs were run (no fixture-vs-dist pair in scope).",
 "gates": {
 "derived_by": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (first line named this checkout at 51de14c509; changeset from merge base 5a916c4d4, 8 paths)",
 "all_exit_0": [
 "check:nul-bytes",
 "check:changeset-gate-self-tests",
 "check:objectui-changeset",
 "check-adr-0087-registration",
 "check:merge-driver",
 "check:doc-anchors",
 "check:doc-authoring",
 "check:docs-audit-scope",
 "check:docs-redirects",
 "check:published-readme-links",
 "check:quick-reference-counts",
 "check:role-word",
 "check:published-files",
 "check:slot-lookup",
 "check:spec-parsed-alias",
 "check:test-source-alias",
 "check:type-source-resolution",
 "check:cross-package-test-inputs",
 "check:engine-double-contract",
 "check:where-matcher",
 "spec check:empty-state",
 "spec check:liveness",
 "spec check:strictness-ledger",
 "spec check:variant-docs",
 "lint check:doc-formula-expressions",
 "lint check:doc-security-posture"
 ],
 "declared_narrowing": "check:type-check-debt --re-measure NOT run locally (needs full workspace build closure, exceeds foreground cap cold; CI runs it). Receipt: population = 26 ledger entries read from scripts/check-type-check-coverage.mjs itself; @objectstack/spec not among them (COVERED via its own typecheck, run green); all TS changes live in packages/spec; ledger packages see the change only through spec's built d.ts where the delta is purely additive; UserActionsConfig referenced by 0 files outside packages/spec (repo grep, ts/tsx/mts, excluding node_modules/dist).",
 "ci_status": "in_progress — report delivered at draft-PR time per standing rule; CI convergence is PM-side"
 },
 "files_changed": [
 "packages/spec/src/ui/view.zod.ts",
 "packages/spec/src/ui/view.test.ts",
 "packages/spec/src/data/object-strictness-batch20.test.ts",
 "packages/spec/src/data/object.zod.ts (comment-only bounded in-place fix, declared)",
 "packages/spec/authorable-surface/ui.json (regen)",
 "packages/spec/authorable-defaults/ui.json (regen)",
 "content/docs/references/ui/view.mdx (regen)",
 ".changeset/user-actions-three-keys.md (minor)"
 ],
 "acceptance_probe": "ListViewSchema.safeParse({name:'my_view',label:'My View',columns:[{field:'name'}],userActions:{group:false,hideFields:true,rowColor:true}}).success === true (observed on built dist at 51de14c509); control rejectOnObject({userActions:{sort:false}}) red and names VIEW (observed)",
 "batch20_guard_reading": "On the collision pair the guard reads: view vocabulary now 11 keys (read mechanically from UserActionsConfigSchema.shape in the new test), object block stays create/import/edit/delete/exportCsv, overlap asserted empty; the three adopted keys are present on the view side and refused BY NAME on the object side; the existing 'names VIEW' control unchanged. Prose enumerations updated in both batch20 test comment and object.zod.ts guidance comment.",
 "deviations": [
 "check:type-check-debt narrowed with receipt (see gates.declared_narrowing)",
 "object.zod.ts comment-only edit outside the claimed file surface — bounded in-place fix, claim-surface supplement posted same round, named in PR body"
 ],
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #11459: object-level userActions guidance lacks wrong-layer pointers for the three adopted view keys (finding label, Blocked-by #11195, deliberately not folded into this PR)"
 ]
}

---

Generated by Claude Code