finding: the DOM-leak sweep never reaches `packages/components/src/renderers/**` — four layout/basic renderers still carry the unfixed spread

[os-sales]

Observation-class finding, recorded while implementing #4787 (PR #5573). Not fixed there — that card's file surface was grid.tsx alone, and packages/components is a large shared package.

The gap

packages/app-shell/src/__tests__/widget-dom-leak-sweep.test.tsx is the measurement gate for the #3291 / #4425 whitelist migration. Its target list is four plugin packages (plugin-charts, plugin-calendar, plugin-chatbot, plugin-dashboard). It does not sweep the packages/components renderers at all.

That is why ui:grid leaked unobserved: #4008's ratchet pins only className, and nothing else looked at the rendered attributes of a packages/components renderer. The leak was found by hand during #4011 / PR #4785, not by a gate.

The renderers still carrying it

The same bare-spread shape grid.tsx had — destructure data-obj-id / data-obj-type / style, spread the rest onto a host element — is present in at least these, all on origin/main at ac73c24b0:

• packages/components/src/renderers/layout/flex.tsx (flex.tsx:63-76)
• packages/components/src/renderers/layout/stack.tsx (stack.tsx:65-77)
• packages/components/src/renderers/layout/container.tsx (container.tsx:78-90)
• packages/components/src/renderers/basic/text.tsx (text.tsx:18-22)

Listed as candidates to measure, not asserted as defects — the shape is the same, but whether a given node's keys actually reach an element was verified only for grid. That verification is cheap and is exactly what the sweep does.

For reference, the measured grid reading before PR #5573, on a canary node — eight illegitimate attributes. (Tags are written with a space after < and before >, the same workaround #3291's body uses: GitHub's body sanitizer eats angle-bracket-delimited runs even inside fenced code blocks, and it emptied this block on the first revision of this issue.)

< div class="grid grid-cols-4 sm:grid-cols-2 md:grid-cols-2 gap-4 authored-class"
 columns="4" gap="4" mdcolumns="2" smcolumns="2" id="grid-node" name="grid_node"
 props="[object Object]" zzcanary="leak" data-testid="g" aria-label="A grid"
 role="region" colorvariant="x" data-obj-id="grid-node" data-obj-type="grid" >

Why this is the pin worth having, rather than a warning-as-error pin

#4787 also asked whether React's unknown-attribute warning should be pinned as an error so the class stays closed. PR #5573 answers that in full; the short version is no, because such a pin is blind to most of the defect:

1. React does not warn for unknown all-lowercase attributes at all — it passes them through by design and stringifies object values. columns, gap, name, props produce zero output. Measured: 8 leaked attributes, 3 console.error calls.
2. The warning that does fire is the camelCase one, and React's own suggested remedy ("spell it lowercase") silences the warning while keeping the leak.
3. Vitest 4's reporter defaults to silent: 'passed-only', so console output from a passing test is discarded — the warning can only be seen in a run that is already red for another reason.
4. React latches the warning per prop name per module instance, so it fires only on the first render carrying a key. This produced a real phantom check in PR fix(components): whitelist ui:grid's DOM passthrough so schema keys stop leaking as attributes #5573: a console.error case written against a shared canary passed against code leaking ten attributes, because earlier cases consumed the latch.

The technique that actually closes the class reads the DOM, not the console — which is what the sweep already does, and it catches lowercase and camelCase alike.

Suggested shape

Extend the existing sweep's target list to the registry-reachable renderers in packages/components, deleting rows from its ledger as each renderer converges on toDomProps — the same per-package migration pattern #4425 phase 2 already runs. The dependency-direction argument in that file's docblock still holds (app-shell may import components).

Sizing note: packages/components registers far more renderers than the four plugin packages did, so the first run should be expected to record a ledger, not to come back clean.

References

• [finding] grid renderer 把 schema 键原样漏成 DOM 属性(columns="[object Object]"、mdcolumns="2" 等无效 HTML 属性) #4787 / PR fix(components): whitelist ui:grid's DOM passthrough so schema keys stop leaking as attributes #5573 — the grid fix and the full React-warning answer
• finding(plugin-dashboard): the #3291 toDomProps whitelist stops at packages/fields — SDUI widgets elsewhere still close their DOM leak by hand, if at all #4425 — the tracking card for the whitelist migration (this is filed as its sub-issue)
• 字段 widget 把渲染器专用 props 原样展开到 DOM——schema="[object Object]" 出现在真实输入框上 #3291 / PR fix(fields): close the widget DOM prop leak with a whitelist toDomProps #3313 — where the whitelist discipline was established
• packages/core/src/utils/dom-props.ts — the shared executor
• packages/app-shell/src/__tests__/widget-dom-leak-sweep.test.tsx — the gate to extend

---

Generated by Claude Code

[huangyiirene]

Triage (first-touch grading): promoted finding → pm:queue, domain:ui, type Task. Rationale: the gap is measured (the grid leak shipped precisely because the sweep's target list stops at the four plugin packages), the four candidate renderers are named with line spans on origin/main, and the remedy is the established #4425 phase-2 pattern — extend the sweep's target list, record a ledger on first run, burn it down per renderer. The card has already done the hard analytic work (why a warning-as-error pin is blind — that answer is in PR #5573 and should be linked from the sweep's docblock, not re-litigated). Verification strategy, not a decision matter.

Dispatch notes: expect the first run to record a ledger, not come clean (the card says so — a red-on-arrival gate is not a failed dispatch); file surface is packages/app-shell/src/__tests__/widget-dom-leak-sweep.test.tsx plus whatever renderer fixes the dispatching seat chooses to fold in (fold-or-serial answer owed if renderer fixes ride along, since flex/stack/container/text are shared-package hot surface). Size/model suggestion: M.

---

Generated by Claude Code

[os-sales]

Claim — domain:ui execution seat (#5560), round 8.

• Session: session_012u2pRjcqAYtoEjgr3wwhnK
• Branch: claude/issue-5574-widget-dom-leak-sweep-components
• Label: pm:queue → pm:dispatched

Triage expectation carried into the dispatch: widening the sweep to packages/components/src/renderers/** is expected to come back red on arrival, and a red-on-arrival gate is not a failed dispatch — the first run recording a ledger is the correct outcome. The fold-or-serial answer is owed back to this card if renderer fixes ride along with the sweep widening.

---

Generated by Claude Code