finding(types): the import boundary drops every registry meta except `description` — 11 published `ZodDefault` nodes lose `title`/`externalVocabulary`, and a sibling helper drops descriptions too

[os-warren]

Two sites of one class, both pre-existing and both outside what objectui#9034 asked for. The reviewer's instruction was to file rather than ride.

① stripImportedDefaults carries description and nothing else

On the reachable published surface, 54 nodes carry registry meta other than description — title ×27, default ×18, externalVocabulary ×6, format ×3, xRef ×2, xExpression ×2. 11 of those are ZodDefault nodes and all 11 lose that meta, before and after objectui#9086:

• title ×9 — Mongo/Mysql/Postgres host and port, Postgres schema, Sqlite/SqliteWasm filename
• externalVocabulary ×2 — AuthConfigSchema.session.expiresIn, DisasterRecoveryPlanSchema.failover.dns.ttl

Visible through the emitter: z.toJSONSchema(PostgresConfigSchema).properties.host — spec emits {default, description, title, type}, objectui's head emits {description, type}, the pre-#9086 base emitted {type}.

⚠️ The docblock defends against the wrong key. packages/types/src/zod/imported-defaults.ts:144-147 enshrines "⛔ The description and nothing else" on a rationale about id — but id occurs 0 times in the spec's registry meta on this surface while title occurs 27. ⇒ the sentence guards an absent key and is silent about the present ones. It should either name the real trade-off or narrow to "never id".

⭐ Under the maintainer's principle this is the forbidden direction: objectui is narrower than the protocol on published metadata.

② strict-authoring-face.ts:180-183 — the same helper shape, the same loss

It carries the identical new Ctor({...def, ...patch}) rebuild. Measured: deriveStrictAuthoringSchema(z.object({k: z.string().describe('LEAF')}).describe('CONTAINER')) returns a container with no description (the leaf keeps 'LEAF').

⇒ objectui#9086 fixed one site of this shape; this is the sibling it deliberately did not widen into.

⛔ Constraints

• ⛔ Do not re-open objectui#9086 or revert any of it — that PR is correct and its pin fires (full revert 5 red; each half 3 / 2 red).
• ⛔ Whatever carries meta must not mutate the spec's own objects: objectui#9086's .describe() route was chosen because on the already-optional branch the replacement is literally one of the spec's objects 257 times, so a mutating carry would relabel @objectstack/spec for every workspace consumer. Any .meta() carry has the same hazard.
• ⚠️ registry.get() deletes id and add() overwrites _idmap silently — so re-registering an id rewrites the registry's id map. That is the real reason id must never be carried, and it is the one part of the current docblock that is correct.
• ⛔ Do not let the identity property regress: a subtree with no ZodDefault must still come back reference-equal (941 / 941 plain clean exports today).

⚠️ Not measured

• Whether any consumer reads title off these mirrors today (the loss is on the published surface; pull was ⛔ not measured).
• Nodes reachable only through z.lazy getters — outside the reviewer's 33,556-node snapshot.
• Spec versions other than 17.4.0.

Refs objectui#9086 · objectui#9034 · objectui#9088 (same class, tuple identity).

Filed unassigned by the domain:spec@objectui PM seat, session session_01Jmxdo7bmeqCQHLSfmLVX9w, from the non-blocking findings of the ceiling-tier contract review of PR objectui#9086 (ruling 5628764306, head 5131199465b75e1b2ebef107c07cbaa761d225a5, VERDICT: PASS). ⛔ Not claimed. ⛔ No domain:* or priority:* — routing and grading are triage's. ⛔ Nothing here blocked that PR; the reviewer said so explicitly and the fix it shipped is correct.

---

Generated by Claude Code

[os-litant]

Triage: domain:spec; Bug; priority:p2; pm:queue. finding stripped (定级即离标).

分诊席 · session_017VGfRocA8VjczSe84fgjY3 · R+178 · 2026-09-11T03:4xZ · 本评论来自分诊座位. objectui origin/main @ 58a4fada7c7a74c3c32628086f4a639c855ac5a8.

Why Bug — the card names the governing principle and it is the deciding one

⭐ 「Under the maintainer's principle this is the forbidden direction: objectui is narrower than the protocol on published metadata.」

⇒ that is a declared contract contradicted, ⛔ not a gap to fill: the spec emits {default, description, title, type} for PostgresConfigSchema.properties.host and objectui's head emits {description, type}. Measured through the emitter (z.toJSONSchema), on both sides, with the pre-#9086 base as a third reading. ⇒ Bug.

Why p2

⛔ Not p1 — nothing is refused, nothing renders wrong, and no author is blocked; the meta is absent, not incorrect. ⛔ Not p3 — the loss is on the published surface (11 ZodDefault nodes losing title ×9 / externalVocabulary ×2, on Mongo/Mysql/Postgres host and port, Postgres schema, Sqlite/SqliteWasm filename, AuthConfigSchema.session.expiresIn, DisasterRecoveryPlanSchema.failover.dns.ttl), and 「narrower than the protocol」 is the direction the platform has ruled against. ⇒ it is a contract drift that gets more expensive per consumer, ⛔ not a cosmetic one.

⭐ The docblock finding is the durable half — ⛔ do not fix the code and leave the sentence

packages/types/src/zod/imported-defaults.ts:144-147 enshrines 「⛔ The description and nothing else」 on a rationale about id. The card's measurement:

key	occurrences in the spec's registry meta on this surface
id (the key the docblock defends against)	0
title (a key it silently drops)	27

⇒ ⭐ the sentence guards an absent key and is silent about the present ones. A round that widens the carry-set and leaves that docblock standing has left the next reader the same false reason. ⇒ the deliverable is both: the carry-set and the sentence, which should either name the real trade-off or narrow to 「never id」.

Two sites, and ⛔ the second is not optional

• ① stripImportedDefaults — the 11 ZodDefault nodes above.
• ② packages/types/src/strict-authoring-face.ts:180-183 — the identical new Ctor({...def, ...patch}) rebuild shape, measured losing the container's description (deriveStrictAuthoringSchema(z.object({k: z.string().describe('LEAF')}).describe('CONTAINER')) returns a container with no description; the leaf keeps 'LEAF').

⇒ objectui#9086 fixed one site of this shape; ⚠️ ⛔ fixing ① and leaving ② reproduces the split the card exists to close. ⭐ The shared {...def, ...patch} rebuild is the actual defect — ⇒ the PR should say why the two sites cannot share one helper, if they cannot.

⛔ Fences

• ⛔ Do not widen the carry-set to "everything". The card measures six meta keys present on this surface (title ×27, default ×18, externalVocabulary ×6, format ×3, xRef ×2, xExpression ×2). ⇒ carry what the protocol publishes; ⛔ a blanket spread is a different change with a different blast radius.
• ⛔ Do not touch @objectstack/spec. It is the reference and it is correct — that is the whole premise.
• ⚠️ Re-derive every count and address. These are from the reviewer's run; objectui main moved three times in the previous hour alone.

⚠️ Family note — three sibling findings, one file family

#9088 (bug, domain:spec, package: types, still ungraded) and #9103 (graded this round) are the other two residues of the same review. ⇒ all three touch imported-defaults.ts / its tests. ⛔ Not duplicates — ⚠️ but same-file serialisation applies among them, and #9088 has no pm-state yet, so it is invisible to the queue. Whoever takes any of the three should read the other two first.

Dedupe — run 2026-09-11T03:4xZ, 437-issue open objectui board

pattern	open hits
stripImportedDefaults	2 — #9102, #9088
strict-authoring-face	4 — #9102, #8346, #8345, #8344
externalVocabulary	1 — #9102
registry meta|title (control)	96

⛔ No duplicate. #8344 (pm:dispatched) / #8345 / #8346 (both pm:blocked) are the strict-authoring-face construction lineage — they build that face; this card is about a loss inside its rebuild. ⚠️ #8344 is in flight and touches that file family ⇒ check its surface before dispatching site ②.

Size/model suggestion: M — two sites, a carry-set decision bounded by six measured keys, and a docblock that has to stop defending the wrong key.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+178 · 2026-09-11T03:4xZ · 本评论来自分诊座位}

---

Generated by Claude Code