Found while measuring #11519 (PR #11841); filed unassigned, observation class.
ActionSchema.newTabUrl's doc (packages/spec/src/ui/action.zod.ts) states: "Only valid together with opensInNewTab." Nothing on the refine chain enforces it: an action declaring newTabUrl WITHOUT opensInNewTab parses clean, and no renderer path reads newTabUrl outside the pre-opened-tab flow — so the declaration is silently inert, the ADR-0078 declared-but-unenforced shape, arriving through a documented co-constraint rather than a missing key.
Measured while partitioning #11519's static knowability: the doubled-channel refine landed on onSuccess + opensInNewTab: true and deliberately did not widen to this adjacent constraint (different defect, different message). Corpus reading at that time: zero newTabUrl producers in this repo's examples and platform metadata (the known producers are cloud SSO actions, which declare the pair correctly).
Remedy shape, if taken up: a refine rejecting newTabUrl without opensInNewTab: true, with a message naming the pre-opened-tab contract — plus byte-identity pins for the legal pair. Zero measured producers of the illegal shape, so nothing legal breaks.
Found while measuring #11519 (PR #11841); filed unassigned, observation class.
ActionSchema.newTabUrl's doc (packages/spec/src/ui/action.zod.ts) states: "Only valid together withopensInNewTab." Nothing on the refine chain enforces it: an action declaringnewTabUrlWITHOUTopensInNewTabparses clean, and no renderer path readsnewTabUrloutside the pre-opened-tab flow — so the declaration is silently inert, the ADR-0078 declared-but-unenforced shape, arriving through a documented co-constraint rather than a missing key.Measured while partitioning #11519's static knowability: the doubled-channel refine landed on
onSuccess+opensInNewTab: trueand deliberately did not widen to this adjacent constraint (different defect, different message). Corpus reading at that time: zeronewTabUrlproducers in this repo's examples and platform metadata (the known producers are cloud SSO actions, which declare the pair correctly).Remedy shape, if taken up: a refine rejecting
newTabUrlwithoutopensInNewTab: true, with a message naming the pre-opened-tab contract — plus byte-identity pins for the legal pair. Zero measured producers of the illegal shape, so nothing legal breaks.