spec: close memory driver's persistence sub-shapes against unknown keys (#4001 batch B) - #7985

…ged with batch B

Second turn of the os-regen relay. `#7985` (batch B — the memory driver's five
persistence sub-shapes) and `#7972` landed while this branch was in the queue, so
the shared counts artifact met two batches that each decremented it correctly and
independently.

That is the exact arithmetic #5107 built this artifact to prevent: the rows do
not overlap, git merges them without complaint, and the SUBTOTAL — which overlaps
nothing — merges clean and wrong. The artifact carries `merge=os-regen` so the
merge defers rather than splices, and the only correct resolution is to recompute
from the merged tree. Regenerated, never hand-edited:

    still-open (strip)          149 → 144   (batch B's five)
    files carrying at least one  26 → 25
    authorable — forced scope      9 → 4
    data/ strip                 107 → 102,  data/ strict 57 → 62
    total strict                283 → 288

Neither batch's own numbers moved; the combined ones did. `check:strictness-ledger`
agrees with the merged tree in both directions (25 open files / 144 strip sites,
no closed file still carrying a worklist row — batch B's `driver/memory.zod.ts`
row left with their side of the prose).

Merged tree verified: spec 382 files / 10109 tests, lint 71 / 1932,
check:generated 13/13.

Part of #4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NLJ8PWLdwLSyi84LHzrAx

…keys (objectstack-ai#4001 batch A) (objectstack-ai#8008)

* feat(spec): close the 31 SDUI component-props shapes against unknown keys (objectstack-ai#4001 batch A)

`ComponentPropsMap` — the declared shape of every `page:*`, `record:*`,
`element:*`, `nav:*` and `ai:*` node a page can carry — stripped unknown keys
in silence. All 31 object sites in `ui/component.zod.ts` are `strictObject` now,
including the two union arms (`RecordHighlightsField`'s object arm and
`record:related_list`'s sort entry) and every nested block, since strictness
does not recurse.

objectstack-ai#5068 already REPORTED these keys, by walking a strip-mode object and
reconstructing what the parse would have dropped. Now the parse rejects the key
itself — same rule id, same warning tier, and three things the reconstruction
could not give: curated per-surface prescriptions, a rejection that holds for
every caller rather than only inside the gate, and coverage of union arms.

Five renderer-honoured props are DECLARED rather than rejected, on the rule this
file has applied three times before (objectstack-ai#5611/objectstack-ai#5775/objectstack-ai#6276 — the delivered,
authorized shape is the contract): `page:header` `maxVisible`/`mobileMaxVisible`,
`page:tabs.alwaysShowStrip`, `record:details` `inlineEdit`/`showHeader`. Each is
read by objectui through `schema?.X ?? schema?.properties?.X` with its own
comment inviting authors. All optional with no schema default — the defaults are
the renderer's, and declaring them would turn an unset key into an authored one.

Curated tables, each backed by a producer measured in the wild rather than
guessed: a tab item's `key` → `value` (objectui's Studio designer publishes
`key`; the renderer reads `it.value`), a header's `description` → `subtitle`
(the rename its own ADR-0087 conversion performs — the one path that had no
diagnostic at all), a container's `body` → `children`, and a wrong-layer family
for keys that belong on the component NODE.

`@objectstack/lint` gains one piece of wiring: zod 4 collapses union-arm
failures into a single `invalid_union`, so a lone arm's `unrecognized_keys` is
unpacked back onto the unknown-key rule id — and deliberately is not when two
arms could both have been meant.

Deliberately unchanged: the carrier is still `z.record(z.string(), z.unknown())`
(direction B stays declined, unregistered `record:*` types are still skipped),
the storage path still parses no props (objectstack-ai#4463), and the gate is still warning
level.

Verified with direct build-artifact `.parse()` probes over the example corpus —
`objectstack validate` never parses through `PageSchema` (objectstack-ai#5000), so "the
examples validate clean" would have been no evidence. 244 registered props bags
across the three example apps' build artifacts, the same three from source, and
the three published platform pages: zero undeclared keys, zero new refusals. The
probe's negative control moved from 0/244 injections caught to 244/244.

Filed out of scope: objectstack-ai#7973 (objectui's Studio designer publishes three page
component inputs no renderer reads).

Part of objectstack-ai#4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NLJ8PWLdwLSyi84LHzrAx

* docs(ui): stop teaching `record:highlights.actions` — nothing has ever rendered it

Found by the objectstack-ai#3746-style corpus scan this batch owes: every `content/docs/**`
and `skills/**` code block carrying a registered component type was parsed and
its props judged against the now-closed `ComponentPropsMap`. One hit, in the
"Complete Example" of the pages guide — an `os:check` block, so it is an example
the docs gate compiles and an AI author copies.

`RecordHighlightsProps` has never declared `actions`, and objectui's
`record-highlights.tsx` reads `schema.fields` and nothing else. Under strip the
key was dropped in silence, which is precisely why a doc could teach it for this
long: the example parsed clean and rendered without the actions, and no layer
disagreed. With the shape closed it is a rejection, so the doc had to be right
before the batch could land.

The actions move to `record:quick_actions`, which is the component that renders
them (`actionNames`, per objectui's own designer config) and which the same page
already lists two sections up.

Scan after the fix: 392 mdx + 2299 markdown files, 8 registered-type props bags,
0 teaching a key these schemas reject. `check:skill-examples` — 209 prose
examples type-check.

Part of objectstack-ai#4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NLJ8PWLdwLSyi84LHzrAx

* chore(spec): regenerate authorable-surface after merging main — the os-regen driver's second half

`authorable-surface/ui.json` carries `merge=os-regen`, so a merge resolves it by
taking a side and leaving it REGEN-PENDING rather than by textually splicing two
generated files. That is the driver working as designed; the half that must
follow is the regeneration, and it is not optional here — measured on the merged
tree before pushing, `check:authorable-surface` fails:

    ❌ authorable-surface/ is out of date (1 key(s) not recorded).
         + ui/GlobalFilter:object

The missing key is main's own, from objectstack-ai#7892 (`GlobalFilterSchema` gains an optional
`object` for i18n label resolution). Nothing of this branch's is involved: the
regenerated diff is exactly that one line, and batch A's five declared keys were
already recorded.

Worth stating because the failure mode is quiet: `pnpm build` REWRITES this
artifact, so a `check:generated` run that happens to follow a build reports all
13 green against the file the build just fixed. Only `check:authorable-surface`
on its own, against the merged bytes, shows the drift — which is how this was
caught before the merge queue caught it.

Merged tree verified: spec 381 files / 10091 tests, lint 71 / 1932,
check:generated 13/13, check:strictness-ledger current (438 sites / 149 strip /
9 authorable — unmoved by the merge). The ledger counts and liveness counts were
regenerated too and came back byte-identical.

Part of objectstack-ai#4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NLJ8PWLdwLSyi84LHzrAx

* chore(spec): recompute the strictness ledger counts from the tree merged with batch B

Second turn of the os-regen relay. `objectstack-ai#7985` (batch B — the memory driver's five
persistence sub-shapes) and `objectstack-ai#7972` landed while this branch was in the queue, so
the shared counts artifact met two batches that each decremented it correctly and
independently.

That is the exact arithmetic objectstack-ai#5107 built this artifact to prevent: the rows do
not overlap, git merges them without complaint, and the SUBTOTAL — which overlaps
nothing — merges clean and wrong. The artifact carries `merge=os-regen` so the
merge defers rather than splices, and the only correct resolution is to recompute
from the merged tree. Regenerated, never hand-edited:

    still-open (strip)          149 → 144   (batch B's five)
    files carrying at least one  26 → 25
    authorable — forced scope      9 → 4
    data/ strip                 107 → 102,  data/ strict 57 → 62
    total strict                283 → 288

Neither batch's own numbers moved; the combined ones did. `check:strictness-ledger`
agrees with the merged tree in both directions (25 open files / 144 strip sites,
no closed file still carrying a worklist row — batch B's `driver/memory.zod.ts`
row left with their side of the prose).

Merged tree verified: spec 382 files / 10109 tests, lint 71 / 1932,
check:generated 13/13.

Part of objectstack-ai#4001

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012NLJ8PWLdwLSyi84LHzrAx

---------

Co-authored-by: Claude <noreply@anthropic.com>