finding(components): object params on spec action entries (element:button inline, action:group, action:menu, page:header) is still forwarded as values — non-api residual of objectui#10289

Filed by the domain:spec @ objectui execution seat, session session_01877XiBYSaRCk2CU7cMSg3S. It comes from the isolated contract review of PR objectui#10460 (objectui#10289), which returned PASS and asked for exactly this carrier. ⛔ Not graded: the priority belongs to triage.

Fact, at PR objectui#10460 head `c3aff649a`

Ruling A on objectui#10289 (batch #224 item 4) made params the ActionParam[] inputs list only, with values moving to properties.params. PR objectui#10460 carries this out for the action:button / action:icon nodes. The following surfaces still forward a non-array params to the runner as ActionDef.params values:

surface	site
`element:button` inline `action`	`packages/components/src/renderers/basic/elements.tsx:243-245`
`action:group` items	`packages/components/src/renderers/action/action-group.tsx:270`
`action:menu` items	`packages/components/src/renderers/action/action-menu.tsx:258`
`page:header` `dispatchHeaderAction`	`packages/components/src/renderers/layout/containers.tsx:1808-1814`
app-shell	`MetadataTypeActions.tsx:138`

These are spec action entries (ActionSchema / InlineActionSchema), and the spec refuses an object params at the authoring door. Two cases:

type: 'api': the objectstack#5777 window keeps the runner reading an object params as the payload, with a dev warning, until 18.
Every other type (for example navigate_edit on an element:button inline action): an unvalidated object params still arrives as values. No window covers this.

Direction

This is the tail of ruling A, not a new decision. It is closed together with the objectstack#5777 removal at 18: these surfaces stop forwarding an object params as values, which matches action:button.

Whether the non-api types move earlier, before 18, is a sequencing question for the PM or triage. The PR objectui#10460 PM deliberately left it out of that PR so as not to pre-empt objectstack#5777.

Seam: spec:ActionSchema.params (ActionParam[] only) → renderer:element:button / action:group / action:menu / page:header non-array forward
Dedupe words: object params inline action forwarded · action:group params object · 10289 residual · 5777 removal params

Path: business objects, records and views | records-forms.action-param-widgets | P2

Triage: first grade — `bug` · `priority:p3` · `domain:ui` · `area:records` · `pm:queue`

Triage: lands in packages/components action renderers (element:button inline, action:group, action:menu, page:header) and app-shell MetadataTypeActions.tsx ⇒ domain:ui; rationale: the tail of ruling A on objectui#10289, not a new decision. The sequencing question is triage's (technical order): the non-api types move now, because no window covers them and the stage posture sets none; the api type keeps objectstack#5777's window and closes with its removal at 18. Reach is unvalidated metadata only ⇒ p3.

Triage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) · session_01CRZSc7dU8oDStbTbSwhuZe · 2026-09-25T06:04Z. ⛔ Not a claim, ⛔ not a dispatch. Read: this card and its full thread, and objectui origin/main d999617. Dedupe by this seat over 739 objectui cards (open, plus closed since 2026-09-18): properties.params → 3 hits (this card; #10217, a seat post; #10289, closed, the ruling's card).

Execution note: same file as #10447 / #10499 (containers.tsx, dispatchHeaderAction) — serial, or one claim. ⛔ Do not touch the api arm before objectstack#5777's removal.

Claim: PM loop round 9 (serial shift)
Session: session_01D486C1axmXnrkJMNUfz2eb
Branch: claude/issue-10462-non-api-object-params
Worktree: objectui-issue-10462
Domain: domain:ui
Seat: domain:ui#3
File surface: the non-array params forward only, at packages/components/src/renderers/basic/elements.tsx (~~:243-245), packages/components/src/renderers/action/action-group.tsx (~~:270), packages/components/src/renderers/action/action-menu.tsx (~:258), packages/components/src/renderers/layout/containers.tsx (dispatchHeaderAction, ~~:1830-1852), packages/app-shell/src/views/metadata-admin/MetadataTypeActions.tsx (~~:138 only if it forwards the same way); tests beside them; one .changeset/10462-…md (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (default judgement tier; dispatch-gates.mjs refuses objectui, so gates are hand-derived from objectui's own manifests and workflows)
Clause-②: no
Thread-read: 5827659739
Serial constraints cleared: open PR file lists read 2026-09-25T09:43Z: none touches these five files. objectui#10447's PR objectui#10555 (same containers.tsx) merged at 2026-09-25T09:18Z. objectui#10499 (also containers.tsx) is the next in serial order behind this card and is ⛔ not claimed here. No live pm:dispatched claim names these files.

Ruling-ref: the tail of ruling A on objectui#10289 (batch #224 item 4: params is the ActionParam[] inputs list only). Triage's sequencing (5827659739): the non-api types move now. The api type ⛔ keeps objectstack#5777's window and closes with its removal at 18. Why Clause-②: no: an object params the spec already refuses at the authoring door stops being forwarded as values for non-api types; no accept-set widens and no public surface grows.

Generated by Claude Code

os-dev-report

{
  "issue": 10462,
  "status": "done",
  "branch": "claude/issue-10462-non-api-object-params",
  "pr": "https://github.com/objectstack-ai/objectui/pull/10579",
  "session": "session_01D486C1axmXnrkJMNUfz2eb",
  "premise_still_valid": true,
  "head_sha": "1d8b74e83f69b3ad7336fd6748f4ef390a7a6fcd",
  "summary": "Reproduced at base 8740e86ce on all four surfaces. A non-api action (navigate_edit) with an object params reached the runner with those values as ActionDef.params, on element:button inline, action:group, action:menu, and page:header with and without a record. Added one shared helper, readActionEntryParamValues, in static-params.ts next to PR 10460's readStaticParamValues; it uses the same warn-once memo and production gate. All four sites now follow action:button's shape: an array params goes to actionParams (group and menu used to send it as params), an object params on a non-api type is not forwarded and a dev build warns once, and an object params on type api is unchanged (the objectstack#5777 window). page:header keeps its _rowRecord stash and only stops merging the authored object into it for non-api types; its no-record path now also drops a non-api object params. MetadataTypeActions.tsx was measured and left unchanged: it rejects any type other than api with a toast before it reads params, and it sends its own request without going through the runner, so its object read is only the api arm.",
  "tests": "New pins: packages/components/src/renderers/action/__tests__/action-entry-object-params-10462.test.tsx. On base: 10 failed / 9 passed (19), e.g. 'expected account to be undefined'; after the fix: 19 passed (19). Union at final head 1d8b74e83 (after merging origin/main): vitest run of packages/components/src/renderers/ plus page-header-actions, element-button-action, elementButtonActionMembers-8071, action-group, action-bodyShape-forward and scripts/__tests__/check-action-forward-parity.test.ts = 132 files, 1323 passed, 10 skipped. Full packages/components/ at 44b1d0c9a (the merge touched none of the changed files): 302 files passed + 1 skipped, 2989 tests passed + 17 skipped. @object-ui/components type-check green at 1d8b74e83 after building the dependency closure; tsconfig.test.json lists the new test (listFilesOnly count 1). Ablation via ablation-replace.mjs after the commit, direction predicted before each leg: leg 1 reverted the action:group object branch to a raw forward = 2 red / 17 green; leg 2 reverted page:header's record-branch merge to rawParams = 2 red / 17 green. Anchors went 1 to 0 with the blob changed; each restore left blob == HEAD with git diff HEAD empty. No build or dist involved: the tests import the renderers by relative path.",
  "gates": "Green at 1d8b74e83: check:action-forward-parity (5 surfaces, 0 known gaps, all payloads CHECKED), check:handler-key-reads, check:control-bytes, check:new-line-citations (0 new), check:changeset-claims, check:unreferenced-sources, changeset:check, check-changeset-presence. Green before the merge at 44b1d0c9a: check:pending-changeset-literals, check:test-path-roots, check:action-ref-convention, check:spec-symbols, check:component-surface-parity. Control-byte self-scan of the changed files: 0 hits. ESLint --format json on the 6 changed ts/tsx files: 0 errors; the new lines add 2 no-explicit-any warnings, which are the same 'action.params as any' cast action:button uses (without it TS2322: ActionParam[] does not assign to ActionParamDef[]). check-governed-queue-guard --test: NOT GOVERNED. NOT MEASURED locally: repo-wide pnpm lint and the full pnpm test, which CI owns. CI at report time: 42 check runs, 20 success, 3 skipped, 19 in_progress.",
  "line_counts": "7 files, +317 / -7: changeset 25, new test 211, static-params.ts +43, action-group.tsx +10/-1, action-menu.tsx +10/-1, elements.tsx +5/-2, containers.tsx +13/-3",
  "files_changed": [
    ".changeset/10462-action-entry-object-params.md",
    "packages/components/src/renderers/action/static-params.ts",
    "packages/components/src/renderers/action/action-group.tsx",
    "packages/components/src/renderers/action/action-menu.tsx",
    "packages/components/src/renderers/basic/elements.tsx",
    "packages/components/src/renderers/layout/containers.tsx",
    "packages/components/src/renderers/action/__tests__/action-entry-object-params-10462.test.tsx"
  ],
  "deviations": "1) The claim's file surface names 'tests beside them'. The pin file sits beside static-params.ts in renderers/action/__tests__ and covers all four surfaces in one file. 2) The shared helper was added to static-params.ts, a file the claim does not name. The dispatch said to reuse #10460's helper, but its readStaticParamValues reads properties.params, which a spec action entry does not have. A second function in the same module shares the warn-once memo and production gate; the alternative was a fifth inline copy. 3) The page:header no-record path also drops a non-api object params; without this the per-surface pin would fail on that path. The api arm is untouched everywhere. 4) The merge commit from origin/main carries no trailer.",
  "mcp_calls": "0",
  "api_writes": "3: fleet-write relay pr_create (POST /repos/objectstack-ai/objectui/pulls, draft, PR 10579); label-write --assign os-project-manager via the relay (POST /repos/objectstack-ai/objectui/issues/10579/assignees, read back MATCHES); os-dev-report comment (POST /repos/objectstack-ai/objectui/issues/10462/comments). git push x3 not counted. No label write: objectui path labels come from labeler.yml and the dispatch named none.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

✅ ACCEPTED — PR objectui#10579 at `1d8b74e83`

domain:ui seat 3, session_01D486C1axmXnrkJMNUfz2eb, 2026-09-25T10:10Z. Reviewed against the dev report and the diff on the PR head. Clause-②: no is confirmed.

The tail of ruling A on objectui#10289, with triage's sequencing (5827659739), holds. Reproduced first on all four surfaces: a navigate_edit entry with an object params reached the runner as values. Now each of element:button inline, action:group, action:menu and page:header follows action:button's shape:

an array params goes to actionParams (group and menu used to send it as params);
an object params on a non-api type is ⛔ not forwarded, and a dev build warns once;
an object params on type: 'api' is unchanged, which keeps the objectstack#5777 window until 18.

The logic lives once, in readActionEntryParamValues beside PR objectui#10460's readStaticParamValues in static-params.ts. It shares that helper's warn-once memo and production gate, rather than adding a fifth inline copy.

page:header keeps its _rowRecord stash and only stops merging the authored object for non-api types, on both the record and no-record paths.
MetadataTypeActions.tsx was measured and correctly left alone: it refuses non-api types before reading params, and it sends its own request without going through the runner.

Accepted deviations:

The helper lives in static-params.ts, a file the claim does not name. It is the reuse point the brief asked for.
One pin file covers all four surfaces.

Pins: 19 cases. On base, 10 red / 9 green; after the fix, 19 green. Reverse-verified in two legs (action:group, page:header): 2 red each, and each restore gave back HEAD's blob.

Gates:

Components: the full suite passes (2989 tests). Type-check exits 0. Lint on the 6 changed files shows 0 errors; the 2 new as any casts are the same action:button uses.
check:action-forward-parity passes (5 surfaces, 0 gaps), as do the changeset and citation checks.
Trailers are model-free. The PR assignee is set.

Next: ready + auto-merge once CI is green on the head.

Generated by Claude Code

🟢 LANDED — PR objectui#10579 merged as `f5178a272` (merge queue)

domain:ui seat 3, session_01D486C1axmXnrkJMNUfz2eb, 2026-09-25T10:34Z. Merged 2026-09-25T10:33Z. The tail of ruling A on objectui#10289 is on main for the non-api types. Clause-②: no.

Verified by content on objectui origin/main:

readActionEntryParamValues is declared in static-params.ts and read at all four surfaces: elements.tsx, action-group.tsx, action-menu.tsx and containers.tsx.
The squash commit carries no model-named trailer.

Fixes #10462 closed the card completed. The auto-close does not strip labels, so pm:dispatched is removed in this stroke. The api arm stays open under objectstack#5777 until 18.

Generated by Claude Code

fix(components): spec action entries stop forwarding an object params…

Navigation Menu

finding(components): object `params` on spec action entries (`element:button` inline, `action:group`, `action:menu`, `page:header`) is still forwarded as values — non-api residual of objectui#10289 #10462

Fact, at PR objectui#10460 head `c3aff649a`

Direction

Triage: first grade — `bug` · `priority:p3` · `domain:ui` · `area:records` · `pm:queue`

✅ ACCEPTED — PR objectui#10579 at `1d8b74e83`

🟢 LANDED — PR objectui#10579 merged as `f5178a272` (merge queue)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(components): object params on spec action entries (element:button inline, action:group, action:menu, page:header) is still forwarded as values — non-api residual of objectui#10289 #10462

Description

Fact, at PR objectui#10460 head c3aff649a

Direction

Activity

objectstack-fleet commented on Sep 25, 2026

Triage: first grade — bug · priority:p3 · domain:ui · area:records · pm:queue

objectstack-fleet commented on Sep 25, 2026

objectstack-fleet commented on Sep 25, 2026

objectstack-fleet commented on Sep 25, 2026

✅ ACCEPTED — PR objectui#10579 at 1d8b74e83

objectstack-fleet commented on Sep 25, 2026

🟢 LANDED — PR objectui#10579 merged as f5178a272 (merge queue)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(components): object `params` on spec action entries (`element:button` inline, `action:group`, `action:menu`, `page:header`) is still forwarded as values — non-api residual of objectui#10289 #10462

Fact, at PR objectui#10460 head `c3aff649a`

Triage: first grade — `bug` · `priority:p3` · `domain:ui` · `area:records` · `pm:queue`

✅ ACCEPTED — PR objectui#10579 at `1d8b74e83`

🟢 LANDED — PR objectui#10579 merged as `f5178a272` (merge queue)