fix(components): route ui:sidebar-trigger's spread through the form-control DOM declaration - #8660

Part of #5632 — one slice, the ui:sidebar-trigger group. The parent burn-down stays OPEN; #5632 is not addressed in full here and remains open, exactly as PR #7564 left it.

The defect, and the second one hiding inside it

ComponentRegistry.register('sidebar-trigger', …) destructured className and spread the rest onto SidebarTrigger, which spreads its own rest onto the Button it renders. So every canary family became an attribute on a real button element. Fourteen of them — one more than the shape this target derives from — and the extra one is the interesting half:

1. the bare spread the group records.
2. schema was never taken off the bag. Every other registration in renderers/navigation/sidebar.tsx names it (({ schema, ...props })) because it renders a child list. This one renders none and named only className, so the node SchemaRenderer injects on every render rode the same spread and landed as schema="[object Object]".

That is a second mechanism, not a variant of the group's — which is why this target was ledgered on its own. One filter closes both, because a whitelist never has to enumerate what it drops; re-ledgering schema would have been the wrong repair, and the sweep gate now carries an inverted case that refuses it.

Why the FORM-CONTROL declaration and not the bare toDomProps

The host is a button element, where HTML defines name and disabled. The ledger row is the evidence: it recorded thirteen attributes plus schema and never name, because the shared judge counts an authored name as legitimate on this element. A bare toDomProps would therefore have un-named this control without moving a single number in the gate that grades the change — the exact failure packages/components/src/lib/form-control-dom-props.ts exists to prevent, one host over.

style is forwarded BY NAME (#4435), as every converged sibling in this package does: it reaches the DOM today and the whitelist does not carry it. Dropping it is the plausible wrong fix, and it is pinned (leg E below).

Measured, through the real SchemaRenderer path

Renders-real-markup established before any reading counted: the trigger renders a button element carrying the primitive's own data-sidebar="trigger" hook, a lucide panel-left glyph and the sr-only "Toggle Sidebar" label — asserted as markup, so an error boundary or an early bail cannot satisfy it. Dump written to a file, with a lit control asserted first (a deliberately leaky div must report leaks), because vitest swallows console output from a passing test.

The 14: ariadescribedby, arialabel, bind, colorvariant, datasource, events, props, reference_to, schema, zzcanary, zzcanarycamel, zzcanarynum, zzcanaryobj, zzcanaryprop — re-derived from LEAK_LEDGER ([...BARE_SPREAD_MINUS_NAME, 'schema'].sort()), not from the card's summary table, and confirmed by measurement.

The 8 legitimate, unchanged in both runs: aria-describedby, aria-label, class, data-obj-id, data-obj-type, data-sidebar, id, name. This is the half a leak gate reports in neither direction — PR #7564's lesson, asked again on this host rather than inherited from the SVG one. On a button element the answer is name, not stroke/fill.

Lesson 1 checked too: this host does not have ui:spinner's clobber shape. The renderer computes no class of its own; SidebarTrigger merges via cn("h-7 w-7", className), and className is destructured so the filtered bag can never become a second writer for it. Both halves are asserted.

Ledger

The row is DELETED, as the two-way exact-set assertion requires. ui:grid stays out. BARE_SPREAD_MINUS_NAME survives as the base for the two groups that still derive from it (action:menu, ui:form). The three meta-cases still hold, and the sweep gains a fourth inverted case (ui:sidebar-trigger is CLEAN — the schema row may not be re-absorbed).

⚠️ The docblock's hand-written counts had already drifted before this slice: it read 95 of 158 / 97 of 181 / 61 clean while the file's own arrays held 90 rows of 159 targets and 69 clean. Re-derived here by parsing those arrays; the class is filed as #8659 and is not addressed in this PR.

Pins added — examples/schema-catalog/test/sidebar-trigger-dom-leak-5632.test.tsx

Five cases, every one observed RED on purpose:

1. the judge is element-aware about name (the same bag reported differently on a button and on a div)
2. the full canary set reaches the renderer and none of it reaches the DOM
3. the legitimate attributes on this host are exactly these — the full set, which is what a "drops everything" filter fails
4. the trigger still toggles the sidebar, read off the data-state the sidebar itself carries
5. the declared pass-through channels still arrive, style included

Every case asserts real markup first, and document.cookie is cleared per case because SidebarProvider persists sidebar_state and reads it back on mount (#4234).

Red legs — mutate, prove on disk, run, restore, prove restored

Each leg re-run against the final commit. Restore is git checkout HEAD -- path under an EXIT/INT/TERM trap, proven by an empty git diff HEAD; every leg's mutated blob hash differed from the HEAD blob, so no leg is void. Classified from vitest's JSON reporter.

Both caricature directions go red on the pin, which is the point: B, C, D and E are invisible to the sweep gate. A filter that strips every attribute, one that strips the ARIA and the designer data-*, one that leaves an inert button, and one that swallows style all read as a perfect zero there. That is the same blind spot #7564 documented on the SVG host, in this host's vocabulary.

Verification

• pnpm exec vitest run packages/components/ packages/app-shell/ examples/schema-catalog/ scripts/__tests__/body-dialect-census.test.ts — Test Files 934 passed (934), Tests 10761 passed | 1 skipped (10762).
• Final targeted run on the shipped commit — Test Files 3 passed (3), Tests 222 passed (222).
• pnpm --filter @object-ui/components --filter @object-ui/app-shell --filter @object-ui/example-schema-catalog run type-check — all three Done, on a tree whose dependency closure was built first (an unbuilt tree would have been a precondition, not a result).
• pnpm exec eslint on the three changed source files — 0 errors, 11 pre-existing no-explicit-any warnings on the index signatures already in the file.
• node scripts/check-changeset-presence.mjs — 2 source file(s) of 2 released package(s) changed, and this change declares 1 changeset(s): .changeset/5632-sidebar-trigger-dom-passthrough.md. node scripts/check-changeset-no-major.mjs — No changeset declares a major bump.
• check:control-bytes, check:unreferenced-sources, check:phantom-deps, type-check:coverage, lint:coverage — all exit 0.
• check:sdui-registration-pins exits 2 with a stated PRECONDITION ("No console build to weigh"), which is NOT MEASURED locally rather than a failure — it needs apps/console built, and this diff adds, removes and renames no registration (11 sidebar-* registrations before and after). Declared to CI.

One repo pin this nearly broke, recorded because it is not obvious

scripts/__tests__/body-dialect-census.test.ts slices this file from register('sidebar-trigger' to EOF and asserts the slice contains neither schema.body nor schema.children — that is how it pins this as the one sidebar-* registration reading no child list. The first draft of the new comment quoted schema.body while explaining why the other registrations destructure schema, and reddened the pin on a prose match. Reworded, and the constraint is now written beside the code. It is also why this fix does not add a schema parameter: the filter drops the key without one.

🤖 Generated with Claude Code

https://claude.ai/code/session_01YBWFb5YgMU5dw8p2VKj16S

Generated by Claude Code