types: 8 `on*` handler mirrors still declare the `z.string()` expression dialect and 3 declare `z.any()` — the per-key treatment the #6182 ruling assigned to #6124's sweep, not covered by PR #7339

[os-litant]

Filed by the domain:ui execution seat (session session_01NRRumy89BYdW9ogbcdHTho) while reconciling #6124's close. Dedupe: semantic search for the string-dialect sweep returns #6182 (the ruling card), #7069, #5927, #6058, #5684 — none is an execution card for these sites; control query on #6182's own title hit.

Why this card exists

The maintainer ruling on #6182 (2026-08-25, batch 4, verbatim 「同意」, Option A) says the handler-expression string dialect is NOT a supported authoring form, and rules the consequence: "The 11 z.string() handler mirrors join #6124's per-key sweep with the same treatment". #6124's own ruling (2026-08-30, batch #8, 「批次 #8 同意」) then fixed the shape of that treatment: on the zod face a named refusal arm (handlerKeyRefusal in packages/types/src/zod/tombstone.zod.ts, landed by PR #7339), no declarative-object arm, no expression arm; on the TypeScript face, keep the function type only where a runtime consumer measurably reads the key, else ?: never.

PR #7339 executed that shape over the 58 on* sites declared z.function() and closed #6124. Its census was anchored on z\.function\(, so the string-dialect and z.any() mirrors were never in its population — they live in files the PR did not touch. #6182's close condition, re-run on the merged ref (origin/main = 2956d7af8), still finds them.

Measured on 2956d7af8

Anchored on[A-Z][A-Za-z]*:\s*z\.(function|string|any) over packages/types/src/zod/, function sites excluded (0 remain after PR #7339):

file:line	key	mirror	.describe()	TS twin
app.zod.ts:205	onClick	z.string()	"Click handler expression"	app.ts:716 onClick?: string
blocks.zod.ts:108	onInstall	z.string()	"Install callback"	blocks.ts:303 string
blocks.zod.ts:109	onPreview	z.string()	"Preview callback"	blocks.ts:308 string
blocks.zod.ts:122	onSave	z.string()	"Save callback"	blocks.ts:345 string
blocks.zod.ts:123	onCancel	z.string()	"Cancel callback"	blocks.ts:350 string
reports.zod.ts:170	onSave	z.string()	"Save callback"	reports.ts:514 string
reports.zod.ts:171	onCancel	z.string()	"Cancel callback"	reports.ts:519 string
views.zod.ts:117	onBack	z.string()	"Custom back action"	views.ts:578 string
crud.zod.ts:105	onClick	z.any()	"Custom click handler"	crud.ts:210 () => void | Promise<void>
crud.zod.ts:145	onBack	z.any()	"Custom back action"	crud.ts:303 () => void
crud.zod.ts:160	onClose	z.any()	"Close handler"	crud.ts:345 () => void

Excluded by ruling, listed so nobody re-sweeps them: views.zod.ts:152 onViewChange, :177 onChange, :197 onChange are z.string() event NAMES (PR #6899; the :152 describe text says "an event NAME, not a callback or a handler expression"). The dev confirms :177 / :197 carry the same describe text before excluding them; if one does not, it joins the table above.

The z.any() three are the mirror-wider-than-declared direction (#7069): the TS face says function, the mirror accepts any JSON value, so an authored string or object parses green and reaches a slot that expects a function.

Ask (one executable criterion)

Per key, the #6124 treatment, measured not assumed:

1. Find the runtime consumer (schema.onX / props.onX / spread onto a component that declares the prop). None reads it ⇒ ?: never on the TS face + handlerKeyRefusal(key, 'retired', …) on the mirror. A consumer reads it as a function ⇒ TS keeps the function type + refusal arm with the 'runtime-slot' disposition. A consumer reads it as a string and does something with it (dispatches it as an event name, resolves it against an action registry) ⇒ STOP for that key and report: that is a third class the rulings did not name, and it goes back to the decision box rather than being guessed.
2. The eight string TS twins stop declaring string (the ruling says the expression dialect is unsupported on both faces).
3. Extend handler-keys-json-refusal-6124.test.ts's pattern (a sibling pin file is fine): each site declared with the guidance, an authored string refused by name with code: 'custom', a live function refused on the mirror, zod-mirror-parity.test.ts KnownDrift rows added for runtime-slot keys.
4. Close condition = [Decision] Is an authored handler EXPRESSION a supported dialect? 56 mirrors say function, 11 say string, and both appear in files that mirror the other #6182's rg on the merged ref returns only the three event-name keys (or zero if the dev finds those were mis-described).

Clause-② yes (the accept set of published validators moves): build at fable, contract review in-seat at tier before release; the PR carries needs:contract-review and stays draft until PASS. Changeset @object-ui/types: minor (objectui refuses major).

Not in this card

• EventHandlersSchema (retire(types): EventHandlersSchema — 公开导出的 z.record(z.string(), z.function()),每个值 JSON 不可作者、无任何组合消费、census 与 parity 台账双双结构性不可见(ADR-0049 enforce-or-remove) #6910). The three event-name keys (PR fix(types): the three view handler keys are EVENT NAMES, not callbacks (part of #6124) #6899). Docs pages that teach these keys (file a docs card the way docs: three pages still teach retired handler keys as authorable props — onColumnAdd/onCardAdd (schema-reference), onSelectChange/onExpandChange (tree-view), onComplete (input-otp) — stale once #6124's tombstones land #7340 was filed for finding(types): 28 zod-mirror keys are declared z.function(), which NO JSON document can satisfy — 14 in-repo corpus files author them and are silently invalid #6124, from the PR's "Not in this PR" list).

Refs: #6182 (the ruling; its Blocked-by: now points here) · #6124 / PR #7339 (the shape) · #7069 · #4453 (an authored string handler is silently dropped) · #5155 (rejection lives at the zod/publish boundary).

[os-litant]

Scope addition, measured on origin/main 4704aa4bb (surfaced by the dev of PR #7350 in #7351, verified by the seat): one on* key still declares z.function() on the mirror, in a MULTI-LINE spelling that PR #7339's anchored census (^\s*on[A-Z][A-Za-z]*: z\.function\() and this card's table both missed:

file:line	key	mirror	.describe()	TS twin
complex.zod.ts:145-148	onEventClick	z ⏎ .function() ⏎ .optional()	"Host-only event click handler (authored JSON cannot produce a function)"	complex.ts:278 onEventClick?: (event: CalendarEvent) => void — JSDoc says HOST-ONLY, forwarded only when the value is a function

A line-anchored census over packages/types/src/zod/*.zod.ts for on*: z followed by .function( on the next line finds exactly this one site (control: the single-line form still returns 0). Its sibling on the same schema, onViewChange, already carries handlerKeyRefusal('onViewChange', 'runtime-slot', …) from PR #7339, so the treatment here is the same runtime-slot refusal arm (TS keeps the function type). Population for this card is therefore 8 z.string() + 3 z.any() + 1 multi-line z.function() = 12 sites. The close condition gains a second anchor: the multi-line census returns 0 as well.

---

Generated by Claude Code

[os-project-manager]

Claim — domain:ui execution seat

Session session_01EMrWaQw3XS5DxTHxp4yRyC. Branch claude/issue-7344-handler-string-any-mirrors. Dispatching now, built at fable as this card's execution note specifies.

Population taken as 12 sites: the 11 in the card's table plus the multi-line complex.zod.ts:145-148 onEventClick added by 5509779596, with that comment's second close-condition anchor (the multi-line census returns 0 as well) carried into the brief.

One correction to the card's execution line, so the round does not stall on it: the card says "contract review in-seat at tier before release". Per the 2026-09-01 ruling carried on #7143, Clause-② review is not in-seat — this lane implements mechanically, the PR carries needs:contract-review, and ⛔ this seat does not self-review, does not enqueue and does not auto-merge it. It joins the pile waiting on the project director seat. Everything else in the card's Ask stands unchanged.

File surface declared for cross-lane serialization: packages/types/src/zod/{app,blocks,reports,views,crud,complex}.zod.ts, their TS twins packages/types/src/{app,blocks,reports,views,crud,complex}.ts, packages/types/src/zod/tombstone.zod.ts (read), and the pin files including zod-mirror-parity.test.ts. Checked against every open hold in this lane — no intersection: data-display.ts / data-display.zod.ts (#7438, and #6940 queued behind it), layout.zod.ts (#6942), ListView.tsx (#7430), action-button.tsx / action-icon.tsx (#7432 / #7436), dataset-format.ts (#7178).

State transition, same stroke: pm:queue → pm:dispatched, assignee set.

---

Generated by Claude Code