feat(spec): declare cloud-connection:panel / marketplace:installed-list in ComponentPropsMap — undeclared keys refused (#11575)

[os-warren]

Fixes#11575

Two console-registered widget types on @objectstack/cloud-connection's published Setup pages — cloud-connection:panel and marketplace:installed-list — had no ComponentPropsMap row: the #8691/#8744 silent no-op class (any authored key in their properties bag rode through every validator in silence, because the #5068 gate's dispatch skips unmapped types).

What landed

• packages/spec/src/ui/component.zod.ts — one ComponentPropsMap row per type, via the existing emptyProps factory (strict, empty accept set). Key sets measured from the renderers' ACTUAL read points at the pinned .objectui-sha (190fbd01d0), never from the registrations' declared-input claims:
  • objectui packages/app-shell/src/console/cloud-connection/CloudConnectionPanel.tsx — the registration lambda renders the component bare and discards the schema node; the component function takes no parameters. Accepted key set: EMPTY.
  • objectui packages/app-shell/src/console/marketplace/InstalledListWidget.tsx — same shape: registration lambda discards the schema node, component takes no parameters. Accepted key set: EMPTY.
  • The registrations' declared inputs: [] happen to agree with the measurement here (unlike spec: record:reference_rail has no ComponentPropsMap row — an entry filter parses, typechecks, validates, ships, and silently does nothing #8691/spec: record:alert / record:quick_actions / record:history have no ComponentPropsMap row — same silent no-op mechanism #8691 closed for the rail #8744, where they diverged); the rows record the measurement, not the claim. Per the card, no keys were invented to fill a row — an empty strict row is the measured outcome.
• packages/cloud-connection/src/canonical-expression-envelopes.test.ts — the two exemptUnmappedTypes entries and the emptiness pins deleted, exactly as the gate's exact-set assert demands in the same PR; the exemption machinery stays for future unmapped types.
• Pins — spec-side (component.test.ts: rows defined, empty bag accepted, any key refused naming the surface) and lint-side dispatch pins (validate-component-props.test.ts, spec: cloud-connection:panel and marketplace:installed-list have no ComponentPropsMap row — two more instances of the #8691/#8744 silent no-op class #11575 suite).
• ADR-0087 — semantic migration entry ui-cloud-connection-widgets-unknown-keys-refused under protocol major 18 + regenerated registry; changeset @objectstack/spec: minor with BREAKING prose and the registered disposition marker (spec: record:alert / record:quick_actions / record:history have no ComponentPropsMap row — same silent no-op mechanism #8691 closed for the rail #8744 precedent).

Verification (all at merged head b60e520de, after git merge origin/main)

• pnpm --filter @objectstack/spec test — 420 files / 11225 tests passed; typecheck OK (test layer held at 55 files / 263 errors in the shrink-only debt ledger, unchanged).
• pnpm --filter @objectstack/lint test — 81 files / 2274 tests passed; typecheck OK.
• pnpm --filter @objectstack/cloud-connection test — 26 files / 281 tests passed (includes the edited envelope gate: door 3 now reads both bags; the exact-set assert holds with zero exemptions — which also proves the suite consumed the rebuilt spec dist, since against the old dist it reds).
• pnpm --filter @objectstack/spec check:generated — "All 14 generated artifacts are up to date" (only the migration registry needed regenerating; no new exports, so api-surface / docs / authorable-surface are unchanged — the map rows are BFS-unreachable from metadata roots by design, per the file's own header measurement).
• Gate families derived by node scripts/pm/dispatch-gates.mjs (no hand-built path list; the derivation's stderr named this repo and my HEAD, change set 7 paths vs merge base). All path-derived and convention-triggered families green, with two declared deviations:
  • check:dev-prereqs — red on "workspace is not built" (37/67 package dists absent in this fresh worktree): a build-state precondition, not a diff finding; every package my diff touches is built; CI builds fresh.
  • check:type-check-debt — NARROWED (declared): the re-measure population is the DEBT ledger in scripts/check-type-check-coverage.mjs; the only DEBT entry among my touched packages is @objectstack/cloud-connection, re-measured with the gate's own measurement (tsc --noEmit in the package): 13 errors = the recorded 13, and none of them are in the file this PR edits. spec and lint are typecheck-covered (not DEBT) and their full typechecks ran green. The full-farm re-measure is CI's.
• Ratchet families re-run at the merged head b60e520: check:type-check-coverage, check:query-options-erasure, check:engine-double-contract, check:where-matcher, check:cross-package-test-inputs — all green.

Reverse verification (ablation — both legs rebuilt, both proven on disk)

Fix committed first. RED leg: the two map rows deleted (anchored greps on the exact row text 1/1 to 0/0 = mutation proof on disk), spec rebuilt, scripts/ablation-dist-preflight.mjs proved the compiled row markers ABSENT from all 209 built files — then the three suites went red in exactly the new pins: spec 3 (the whole #11575 describe), lint 2 (the loud dispatch pins), cloud-connection 2 (the exact-set asserts). GREEN leg: restore from HEAD (greps 0/0 to 1/1, porcelain clean), rebuilt, preflight proved the markers PRESENT in dist/ui/index.js and .mjs, all three suites exit 0. Both leg scripts carried trap-based restores. Note: the lint suite's third pin (empty bag stays silent) is green in both states by design — its value is guarding the accept face, not the row's existence.

Clause-②: this PR changes accept behaviour on a published face (silently-accepted authored keys become validated refusals) — draft; the contract-review chain runs before enqueue.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 2 documentable anchor(s).

⛔ 1 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v17.mdx(via ComponentPropsMap (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 45 of 222 client-bound route-ledger rows — the other 177 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run: node scripts/docs-audit/affected-docs.mjs --bridge-coverage

Coarse fallback — 126 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 945ffbea814c07ec93e81a3444af1790d9692cc3 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3d5495d506abd3b4a096a8d76e2b28bbd3a5e81c — the merge of head b60e520deaa63de63ab1b0e17baa7cead349153d into base 945ffbea814c07ec93e81a3444af1790d9692cc3, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3d5495d506abd3b4a096a8d76e2b28bbd3a5e81c && git checkout 3d5495d506abd3b4a096a8d76e2b28bbd3a5e81c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 945ffbea814c07ec93e81a3444af1790d9692cc3 b60e520deaa63de63ab1b0e17baa7cead349153d && git checkout -B drift-repro 945ffbea814c07ec93e81a3444af1790d9692cc3 && git merge --no-ff b60e520deaa63de63ab1b0e17baa7cead349153d
node scripts/docs-audit/affected-docs.mjs --json 945ffbea814c07ec93e81a3444af1790d9692cc3

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 945ffbea814c07ec93e81a3444af1790d9692cc3 → pass the list as
args.docs, on the commit named under Which tree this was computed on.