feat(spec): retire the element:filter element at element grain (#9220, ADR-0049)

[os-steve]

Fixes #9220

Verdict first (measurement-first card — recorded on the issue before any removal work)

DEAD at element grain. Full table in the measurement comment. Summary: at objectstack 2f65b1b42 and objectui 5ffcc14 (read-only sweep), no renderer or behavior reader of element:filter exists anywhere — objectui's only hits are a stale comment (renderers/basic/elements.tsx:18) and a PALETTE_EXCLUSIONS entry, i.e. Studio deliberately does NOT offer the element and records "no renderer" as the reason, answering the dispatch's palette question in the inverse direction. The 2026-06 page-liveness audit (docs/audits/2026-06-pageschema-property-liveness.md) had already recorded it rendering "Unknown component type". Cloud was not reachable from this session: the cloud half of the verdict relies on the card's recorded sweep (taken at objectui 372d9f9b4) and the triage 04:44Z re-verification, not on a fresh reading.

What this PR does (the #9198 / PR #9221 precedent, one grain wider)

• Tombstones, all six keys (object, fields, targetVariable, layout, showSearch, aria) on ElementFilterPropsSchema via retiredKey(), each carrying the element-grain prescription (delete the component; list surfaces own filtering via a view's userFilters / the list toolbar's filter builder; os migrate meta --from 17).
• The ComponentPropsMap row deliberately STAYS — the SDUI 组件 props 没有解析闸门:PageComponent.properties 是开放 record,ComponentPropsMap 的 29 个站点从不被 parse(#4001 批 17 的 no gate 判定) #5068 props gate dispatches on it; deleting the row would demote the type to an unregistered custom string the gate deliberately skips, turning a loud retirement back into a silent no-op. A node-level refusal is not expressible: PageComponentSchema.type is an open union (enum ∪ string), so a bare node still parses — inert, as it always was.
• Enum de-advertisement: element:filter removed from PageComponentType (page.zod.ts) — parse-neutral by the open-union argument above, but stops advertising the element in docs, TS vocabulary and palette derivations. Surface widening declared in the claim amendment.
• ADR-0087 registration: six retired-keys entry files (18.ui__ElementFilterProps__*), folded by gen:migration-registry; D2 conversion element-filter-removed (protocol 18, retiredFromLoadPath), wired into the step-18 chain appended after the feat(spec): retire inert targetVariable on element:text_input / element:record_picker (ADR-0049) #9221 entries (their block untouched).
• Pre-registered negative-control flip: the ADR-0049 enforce-or-remove: targetVariable on element:text_input / element:record_picker — a declarative hint with zero readers in any repo and no liveness-ledger entry #9198 conversion's fixture used element:filter.targetVariable as its untouched control; it now uses an open-union custom:legacy_input node — same load-bearing assertion (the strip dispatches on the component TYPE, not the key name), one hop further out.
• Test flips (component.test.ts): the former accept shapes are now refusal pins asserting the prescription substance (.toThrow(/…removed…element is retired…/s), the feat(spec): retire inert targetVariable on element:text_input / element:record_picker (ADR-0049) #9221 pattern); the bare migrated node parses clean and materializes nothing; a node-level-parse pin documents where the refusal does NOT live. Note: the dispatch's ADR-0112 code+status clause cannot apply to a zod parse surface (no error envelope exists there) — message-substance assertions per the feat(spec): retire inert targetVariable on element:text_input / element:record_picker (ADR-0049) #9221 precedent are the honest equivalent, and the prescription string is itself the contract here.
• Lint residue (packages/lint): the 'element:filter': { props: ['fields'] } COMPONENT_FIELD_SPECS entry is dropped — forced by the lint package's own component-field-specs-liveness gate (validate-page-field-bindings 的 element:record_picker 条目仍列着 #5775 已退役的 displayField / searchFields #6629), which turned red on the tombstones with the exact prescription to drop it. @objectstack/lint patch changeset included.
• Baselines/docs: authorable-surface/ui.json + authorable-defaults/ui.json ([RETIRED] rows), regenerated references (component.mdx, page.mdx), hand-authored content/docs/ui/pages.mdx listing, format-type.test.ts enum pin. spec-changes.json / upgrade guide are correctly untouched — they render released majors only (protocol 17), same as feat(spec): retire inert targetVariable on element:text_input / element:record_picker (ADR-0049) #9221. content/docs/releases/ untouched.
• Changesets: @objectstack/spec minor (post-17.0.0 launch-window convention, the feat(spec): retire inert targetVariable on element:text_input / element:record_picker (ADR-0049) #9221 precedent) with FROM → TO and the adr-0087 marker; @objectstack/lint patch.

Verification (all at final head bd4495c0d unless noted)

• pnpm --filter @objectstack/spec test: 407 files / 10848 tests passed at a75d602d6; git diff a75d602d6..bd4495c0d -- packages/spec is empty, so the result stands for this head byte-identically.
• pnpm --filter @objectstack/lint test: 2065 passed (was 2064 passed / 1 failed before the residue drop — that red run is the gate demanding the lint edit).
• Reverse verification (from the committed state): restoring the OLD element:filter negative control turned conversions.test.ts red exactly as predicted — the new conversion strips the control to properties: {}, failing the fixture-equality assertion — proving the flip was load-bearing; restored and green (164/164).
• turbo run build full workspace closure: 70/70. turbo run typecheck --filter='...@objectstack/spec' (spec + downstream consumers, prefix filter): 125/125 — the tombstones' never typing swept every authoring site clean.
• check:generated: all 13 artifacts up to date. Light union all PASS: merge-driver, spec-parsed-alias, type-source-resolution, objectui-changeset, quick-reference-counts, role-word, adr-0087-registration, changeset-no-major, cross-package-test-inputs, empty-changeset, dev-prereqs, docs-audit affected-docs, nul-bytes, query-options-erasure, engine-double-contract, where-matcher, type-check-coverage, variant-docs, empty-state, skill-examples. check:type-check-debt --re-measure: 33 entries, no surplus.

Cross-repo follow-ups (for the PM to file; objectui deliberately not edited)

• objectui: drop the now-stale PALETTE_EXCLUSIONS['element:filter'] entry (block-types.ts:156) when the spec pin moves (its block-config test derives coverage from PageComponentType), and fix the stale elements.tsx:18 comment that still names element:filter (its element:form half is ADR-0049 candidate: element:form declares a full form contract with no renderer registration found in objectstack/objectui #9249's question).

Out-of-scope finding filed unassigned: #9249 (element:form declares a full form contract; same no-renderer shape measured during this card's sweep — needs its own verdict measurement). #6590's element:filter half is mooted by this retirement; its element:form half stands.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/lint, @objectstack/spec, touching 16 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/ui/pages.mdx (via PageComponentType (symbol))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17.mdx (via ComponentPropsMap (symbol))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 8 changed file(s) yielded no anchor (packages/spec/authorable-defaults/ui.json, packages/spec/authorable-surface/ui.json, packages/spec/src/migrations/entries/retired-keys/18.ui__ElementFilterProps__aria.ts, …) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)

Coarse fallback — 113 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json origin/main → packageMentionDocs.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.