Skip to content

[finding] form-view.ts spec bridge also reads spec.defaultSort — the same dormant-read shape as #3901, on the sibling key #3901's scope explicitly excluded #3974

Description

@os-project-manager

Observation-class finding from the axis-③ liveness audit (ledger claims vs measured objectui readers). Nothing breaks today — filed so it is recorded rather than rediscovered, unassigned for triage. #3901 covers the spec.aria read at :193 and states under "Not in scope": "Other spec.* reads in this bridge; only aria was measured." This card is that measurement for the sibling key. Ledger verdict vs measured reader disagree — not prescribing which side is right (same delete-vs-document fork, and the same unmeasured non-validated-input precondition, as #3901).

Audited revisions (E24)

  • objectui origin/main @ 5bfaabde05c3876c9604a2aa47f4822f9e6de8b5
  • objectstack origin/main @ 4ac12ef4cfe4a1925fb7e950c56d7aff0bbc5381

Both read via git fetch + git archive of origin/main, not working trees.

The finding

packages/react/src/spec-bridge/bridges/form-view.ts:188:

  if (spec.defaultSort) node.defaultSort = spec.defaultSort;

(the local FormViewSpec mirror still declares it at :81, defaultSort?: any;)

objectstack's ledger row packages/spec/liveness/view.jsonprops.form.children.defaultSort (status: "dead", verifiedAt: "2026-07-30"):

"REMOVED 2026-07-30 (#3896 close-out sweep) — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from sources by the protocol-17 close-out conversion. … a related list sorts by its own list view's sort."

Same dormancy analysis as #3901: retiredKey() rejects at parse, so spec.defaultSort is always undefined for any validated FormView and the guard is unreachable — unless some path feeds the bridge a non-validated object (stored pre-17 documents, fixtures), which was not measured here either.

One difference from the aria sibling

Downstream is also empty as far as measured: no object-form renderer consumer of node.defaultSort was found (plugin-view/src/ObjectView.tsx:848 and plugin-grid/src/ObjectGrid.tsx:637 read defaultSort on the table/grid schema surface, not the form node; plugin-detail/src/RelatedList.tsx takes it as a component prop). So the bridge line copies a parse-rejected key onto a node key nothing reads — dormant at both ends.

Dedup

Suggested direction (non-binding)

Whatever disposition #3901 gets after its promotion gate ("measure the non-validated-input paths") almost certainly applies verbatim here; cheapest is to handle both lines in the same card/PR.

Suggested lane: same as #3901 (spec-bridge hygiene, objectui react package).

Provenance: cross-repo read-only audit, session https://claude.ai/code/session_018ffcE95NaMJcL9XJ9VDYgk

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions