finding(react): the `properties` hoist enumerates a degenerate `properties` into indexed node keys — `properties: "text"` still reaches the element as 0…8

[os-sales]

Measured while implementing objectui#6752, outside its fence (that card is scoped to the props bag and is explicitly forbidden from changing hoist behaviour), so filed separately. Observation-class in the same sense objectui#6752 was: nothing is known to depend on it today.

The fact, measured on b76ca6764

objectui#6752 fixed the props half of "a degenerate value must not have its shape reinterpreted by an object spread". The properties half is still open, and the site is NOT the evaluation memo — it is the hoist.

Rendered through the real SchemaRenderer with a probe that records the React props the element receives:

{ type: "test:deg", properties: "not-a-bag" }
 -> React props named 0, 1, 2, 3, 4, 5, 6, 7, 8 (one per character)
{ type: "test:deg", properties: ["x", "y"] }
 -> React props named 0, 1

Why the existing guard does not stop it

The evaluation memo guards properties with a real-object test, and its comment used to explain that guard by saying the value FEEDS the hoist. That explanation does not survive measurement. Ablating the guard to bare truthiness and re-rendering the same nodes leaves the indexed keys COMPLETELY UNCHANGED, because the hoist does its own enumeration:

if (newSchema.properties) {
 const props = newSchema.properties;
 for (const [k, v] of Object.entries(props)) { ... newSchema[k] = v; }
}

Object.entries("not-a-bag") yields the character indices whatever the memo did. The only thing the memo guard moves is whether schema.properties still holds the value the author wrote. That measurement is what selected the arm on objectui#6752, and the shape is pinned there in packages/react/src/__tests__/SchemaRenderer.degeneratePropsBag.test.tsx (the leg named "the properties channel is untouched — this card changed one bag"), so it is recorded as known and accepted rather than overlooked.

Blast radius, honestly bounded

Same denominator as objectui#6752: the objectui#6708 census walked every JSON document, every json doc fence and every TypeScript object literal and found zero authored nodes with a degenerate config bag. Latent shape, not a live failure. What makes it worth recording is that the two halves of one hazard are now fixed on one side and open on the other, and the open side is the one the spec spelling uses.

Arms, if anyone takes it

• guard the hoist the way the memo is guarded, so a degenerate properties contributes no node keys;
• or decide the hoist may enumerate whatever it is handed, and say so where the hoist is written.

Not picked here — objectui#6752 scoped hoist behaviour out explicitly.

Related: objectui#6752 (the props half, fixed), objectui#5123 (the two-bag precedence ruling), objectui#6708 (the census).

[huangyiirene]

定级：pm:queue · domain:ui · priority:p2。

⛔ 这张卡证伪了我在 #6752 上写下的分诊前提 —— 更正在此

上一轮我给 #6752 定的派发范围是一个两分支的条件式：

先读 properties 那条更宽的守卫是为什么存在的 …… 若该理由是通道无关的 ⇒ props 少一条守卫就是遗漏，加宽即可；若该理由专属于 hoist ⇒ 非对称是有意的，改注释而不改代码。

本卡把那个"为什么"测了，而结果两个分支都不是：

Ablating the guard to bare truthiness and re-rendering the same nodes leaves the indexed keys COMPLETELY UNCHANGED, because the hoist does its own enumeration.

⇒ 注释里那句 "because that value feeds the hoist" 作为对这条守卫起了什么作用的解释，是假的。memo 守卫唯一改变的是 schema.properties 还留不留作者写的那个值；它对索引键毫无影响。

⛔ 所以我那个二选一是不完备的：真实答案是第三种——理由本身写错了。⇒ 我预登记的条件式没有覆盖实际发生的情况，这一条记在这里，因为它正是"预登记不等于想周全了"的一个实例。

⭐ 但要说清楚：那个测量之所以发生，是因为 #6752 的范围要求先测再改，而实施者照做了并把结果单独立了卡。⇒ 机制起作用了，只是我给的分支不够多。

⛔ 派发范围

无条件的那一半（先做，不需要任何裁决）：修掉 evaluation memo 上那句已被证伪的注释。⛔ 无论下面两条臂选哪个，那句话都是错的，⛔ 不要把它留到臂选定之后。

需要选臂的那一半：

• (a) 照 memo 的方式守住 hoist，使退化的 properties 不贡献任何 node 键；
• (b) 裁定 hoist 可以枚举任何交给它的东西，并在 hoist 写明。

⚠️ 两臂都便宜、都可逆、都不在人工地板上（零已编写实例，无客户可感影响）⇒ ⛔ 我不送决策箱，由实施者按 #5123 两包优先级裁决的精神选，并把理由写在代码里。

为什么 p2 而不是更高

分母与 #6752 相同且是同一次普查（#6708 走遍每份 JSON 文档、每个 json fence、每个 TypeScript 对象字面量）：零个已编写节点带退化配置包。⇒ 潜在形状，非活故障。

⚠️ 但有一点比 #6752 更值得注意，卡自己点破了：这个还开着的一侧，正是 spec 拼法所使用的那一侧（properties 是规范拼法，props 是那个"被求值然后丢弃"的信封）。⇒ 一旦有人写出退化值，撞上的更可能是这一侧。

⭐ 另记一笔方法：本卡的 ablation 是反向用的——不是证明守卫有效，而是证明它无效（拿掉它，输出不变）。这比"加上它，输出变了"更难做，也更有说服力。

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 6760,
 "status": "done",
 "branch": "claude/issue-6760-degenerate-properties-hoist",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6784",
 "premise_still_valid": true,
 "summary": "The card's own fact held and was re-measured on the dispatched base c6732825d: the hoist's unconditional Object.entries walk put nine React props named 0..8 on a node written properties: 'not-a-bag', and 0/1 on properties: ['x','y']. Took ARM (a) - the hoist now asks the shared isConfigBag predicate (objectui#6761, no new spelling; configBag.ts and configBag.pin.test.ts are byte-identical at base, HEAD and worktree), with the reasoning written at the hoist: under objectui#5123 one key gets one answer whichever channel reads it, so arm (b) would have answered one authored mistake two ways with the reinterpreting half landing on `properties`, the SPEC spelling, while the quiet half landed on its `props` legacy alias; plus the guard's reason was MEASURED to be channel-independent, and a degenerate bag is exactly the mistake AI-authored metadata makes, so making it inert beats nine plausible-looking props with no warning. STALE DISPATCH INSTRUCTION, not a dead premise: the 'unconditional half' (delete the falsified 'because that value feeds the hoist' comment) had ALREADY landed before my base - PR #6763 committed 3fe64634b at 08:04:45Z and the triage comment was written at 08:28:38Z against the pre-merge text (git blame puts the replacement paragraph on that commit). So instead I kept that corrected paragraph TRUE under the new behaviour and fixed the two comments this change falsifies: the memo's 'non-objects reach the hoist exactly as they do today', and propsWithoutCanonicalKeys' explanation of its degenerate-properties carve-out by what the hoist does. objectui#6752's pin was RATCHETED, not weakened: its `properties` leg pinned that card's known-and-open asymmetry ('recorded, not fixed', nine indexed props) and now asserts none; everything it asserts about the `props` bag is untouched.",
 "tests": "All runs from the repo root, serialised through the container's shared heavy-verify lock; exit codes captured before any pipe. Union re-run on the FINAL commit 00042324c: (1) `pnpm exec vitest run packages/react/` -> VITEST_EXIT=0, 'Test Files 68 passed (68)', 'Tests 997 passed (997)'. (2) `pnpm --filter @object-ui/react type-check` (= `tsc --noEmit && tsc -p tsconfig.test.json`) -> TYPECHECK_EXIT=0, with the script name echoed (no zero-match silent pass). First attempt was a real TS2307 'cannot find module @object-ui/types' storm - dependency closure not built in a fresh worktree; `pnpm exec turbo run build --filter=@object-ui/react^... --concurrency=2` (BUILD_EXIT=0) fixed it, and `tsc -p tsconfig.test.json --listFiles` then showed 1 hit each for both pin files AND SchemaRenderer.tsx, so the clean run is a measurement of the edit, not a vacuous pass over an excluded set. (3) eslint on the 3 changed files -> ESLINT_EXIT=0, 0 errors, 16 warnings, all pre-existing no-explicit-any in SchemaRenderer.tsx (0 added lines carry a type-position `any`). (4) `node scripts/check-control-bytes.mjs` -> exit 0, 'OK (scanned 5648 tracked text file(s))'. (5) `node scripts/check-changeset-no-major.mjs` -> exit 0, 'No changeset declares a major bump'. (6) `node scripts/check-changeset-presence.mjs` -> exit 0, '3 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'. ABLATIONS - three legs, all on the COMMITTED fix (a622ad7eb), each with a trap-protected restore using absolute paths. NO REBUILD IS INVOLVED: the pins import ../SchemaRenderer by relative path and the root vitest alias table maps every @object-ui/* to src, so vitest reads the source tree and no dist/ can go stale. Each mutation was confirmed on disk by grep count of BOTH the removed and the injected text plus a git hash-object blob change (removed=0 / injected=1 / blob moved off d269cfa67 every leg), and each restore was proven by hash-object back to the HEAD blob d269cfa67 AND an empty `git diff HEAD` - never by an exit code. LEG 1 (FORWARD, hoist guard -> bare truthiness): 0..8 return for the string bag and 0/1 for the array bag, both pins red ('expected [0,1,2,3,4,5,...] to deeply equal []') - this card's guard is what removes them. LEG 2 (REVERSE, memo guard -> bare truthiness, hoist guard kept): predicted direction CHANGED versus the card's own base measurement, and I report what I observed, not the template. On b76ca6764 this leg moved nothing (that is how the memo's reason was falsified); on this branch the indexed keys come BACK and the `properties` a renderer reads becomes {0:'n',...} instead of 'not-a-bag', because the bare spread manufactures a real bag the hoist then enumerates legitimately. The two guards are in SERIES after this card, not redundant - recorded in the memo and in the new pin. LEG 3 (REVERSE, propsWithoutCanonicalKeys' isConfigBag -> bare truthiness): NOTHING moves, both pins green (VITEST_EXIT=0) - that objectui#5123 precedence site never fed the indexed keys, so this card must not be credited to it. WHAT DOES NOT MOVE under the fix itself, from a full before/after diff of the probe reading: a real object bag hoists byte-identically (including the type/id keys the hoist has always refused to copy, checked on a page:tabs node with properties.type 'line'); the authored `properties` value still reaches both channels unchanged; properties: 42 and properties: true are byte-identical because Object.entries was already empty for them.",
 "mcp_calls": "2 - issue_read(get) for the card, search_issues(one targeted call, control terms #6760/#6752/#6761/#6708 all returned so the channel was live) for the finding dedupe. Card comments, all list/read work, the finding filing and the PR creation went through the zero-quota channels: the public-repo embedded JSON payload and the container's repo-scoped REST (probe returned 200; /search/issues is blocked on this seat, which is why the dedupe used MCP).",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #6783: five readProps() copies in packages/components/src/renderers/basic/ (elements, data-list, text-input, record-picker, metadata-viewer) still object-spread a degenerate config bag on the third channel - the config bag a renderer reads - so the hazard is now closed on two of three channels for both spellings and open on the last; outside this card's packages/react/src/ fence, unassigned and unlabelled for PM triage"
 ]
}

---

Generated by Claude Code