feat(metadata-protocol): mark an erased authoring arm in the /meta/types derivation - #19399

Part of #19295

Clause-②: no

What this lands

GET /meta/types now annotates a served member whose AUTHORING arm the output derivation erased, so a consumer can tell an erased authoring type from a member that genuinely admits anything.

Every predicate slot the platform serves composes the expression-input family — a two-arm union whose string arm is a ZodPipe. The served derivation is zod's default io: 'output', which describes what comes OUT of the transform, so the arm's own input type is erased and the member is served with an empty first arm. On the wire that empty schema means "admits everything", so a metadata designer could not tell the husk from a member that really does accept any instance.

Each such husk arm now carries one vendor-prefixed keyword:

{ "x-objectstack-erased-authoring-input": { "version": 1, "type": "string" } }

• Declared once, in packages/metadata-protocol/src/erased-authoring-mark.ts, with the keyword, the shape version and the reader a consumer mirrors.
• Versioned inside the VALUE, not baked into the keyword name, so a consumer gates on a shape it understands rather than on mere presence.
• The consumer reads the mark, never the key name — nothing here asks objectui to match hook.condition / visibleWhen / the rest.

Clause-② — how it was measured

The claim comment told this seat to measure the declaration rather than carrying one, and the card's Acceptance sets the rule: a new declared key on the ADR-0089 envelope is yes; an annotation on the served projection only is measured.

The shape chosen is the annotation, and the diff is the measurement. Seven files, all in packages/metadata-protocol/src/, .changeset/ and scripts/engine-double-contract.pinned.json. packages/spec is not touched: no Zod object gained a key, no closed set gained a member, no published entry point's export listing grew, and no registry gained a row. packages/metadata-protocol/src/index.ts is deliberately unchanged — the mark travels on the WIRE, so objectui reads it from the payload and no new published export exists for it to import.

Why the envelope key was the wrong shape here, and not merely the more expensive one. A declared key on the envelope describes the OBJECT arm, while the thing that needs describing is the sibling arm the derivation erased. It would also have been carried by every consumer of that envelope everywhere it is embedded, including the persistence contract where nothing was erased at all. The annotation sits on the exact node whose meaning is ambiguous, and it is emitted by the projection that created the ambiguity.

The refused widening is untouched

The blanket io: 'input' repair stays refused and its pin stays armed. JSON Schema ignores an unrecognised keyword, so every served document accepts exactly what it accepted before — byte-different, semantically identical. adds no constraint — every marked arm still admits every instance asserts that structurally: read with its mark removed, every marked node is still the empty schema zod emitted.

Two pin baselines now derive through the emitter's OWN override, which is the treatment #17502 established for the unauthorable strip rather than a new one:

• protocol.meta-types-degenerate-derivation.test.ts — blast radius still reads exactly ['action'].
• protocol.meta-types-unauthorable-columns.test.ts — the served payload is again a derivation minus deletions and nothing else.

Reverse verification, both legs restored and proven against HEAD. Adding io: 'input' to the served derivation and re-running the degeneracy pin moves 24 types instead of one and reds it — the refusal is still armed, not laundered into a baseline. Mutation and restore went through scripts/ablation-replace.mjs, so the anchor count, the blob change and the post-restore git diff HEAD are on-disk evidence rather than an exit code.

The negative control

A mark that appeared on every empty schema would be exactly as uninformative as the husk it replaces, so both directions are pinned and the negative half is the load-bearing one.

Measured over the served surface: 78 marked arms across 8 types, and 187 empty-schema nodes left unmarked. Named instances are pinned rather than only counted — the ADR-0089 envelope's own ast (a z.unknown() sitting one level BELOW a marked arm, inside the very envelope that arm is a sibling of), field.defaultValue, and the open record values on tool.parameters.

action is the second control, from the other direction: it is the one type served from the io: 'input' retry, where a pipe derives from its input side, nothing is erased, and the predicate slot already publishes its real string arm. It carries zero marks, and the test also asserts the string arm is really there — so the absence reads as "nothing was erased", never as "the sweep missed it".

Reverse verification of the control. Making the emitter treat every husk as an erased pipe arm reds BOTH negative assertions — the ast pin and the action pin — so neither is vacuously true.

Premise re-derived on this tree, with two corrections

The card's measurement came from objectui's dev reports, seat-verified there. Re-derived here against origin/main, and it holds — with two things the card states differently:

1. The predicate slots compose EvaluatedExpressionInputSchema, not ExpressionInputSchema. The card names the latter. On this tree hook.condition, field.visibleWhen / readonlyWhen / requiredWhen and the flow edge.condition are all EvaluatedExpressionInputSchema since spec/automation: FlowEdgeSchema.condition still accepts an envelope the engine cannot evaluate (ast-only, whitespace-only source) — the evaluated-slot rule of #15430 has not reached the edge condition #15807 / spec: the evaluated-slot rule of #15430 reaches only the flow-node ledger — every other ExpressionInputSchema slot an engine evaluates (formula expression, validation / hook / sharing condition, visibleWhen…) still accepts an ast-only or blank-source envelope #15811; ExpressionInputSchema and its alias PredicateInputSchema remain the PERSISTENCE contract. It changes nothing structural — both are two-arm unions whose first arm is a ZodPipe over a string, both erase identically — but the mark is emitted by a structural predicate rather than by naming a schema, so it covers the whole family and a third sibling added later.
2. sharing_rule resolves no schema in the registry-only harness, so that member is covered by the structural sweep wherever it IS served rather than pinned by name.

One consequence worth naming because it is wider than the card's list: the same predicate also marks flow.nodes.items, which derives an empty schema today and whose erased authoring type is an object. That is the same defect one level up, and the mark now says so instead of serving an anonymous husk. Nothing else about that member moves.

Acceptance notes

• The documentation half of Acceptance item 3 is NOT in this PR, and the card stays open for it. content/docs/references/ is auto-generated from packages/spec TSDoc and may not be hand-edited; the hand-written content/docs/api/metadata-api.mdx does not document the /meta/types schema derivation at all. Both homes are outside this claim's declared file surface (packages/metadata-protocol/src/), so the seat routes that half rather than this lane taking it uncleared.
• What the mark enables: a consumer can now offer a condition builder for an erased predicate arm instead of vetoing every empty schema. It becomes installable by objectui when a release carries it, which is a separate step from this merge.
• Noted, not filed: flow.nodes.items serving an empty schema is a whole-member husk of the metadata-protocol: /meta/types serves an EMPTY JSON Schema for action — the output-mode derivation of its ZodPipe has no properties, and the hand-crafted fallback never fires #17501 class, one level below the type. It is now labelled by the mark; making it derive is a different change with a different blast radius. Carrier: no queued PR touches it today.

Verification

• pnpm --filter @objectstack/metadata-protocol test — 183 files, 2608 passed, 19 skipped, 0 failed.
• pnpm --filter @objectstack/metadata-protocol typecheck — clean.
• pnpm --filter '@objectstack/metadata-protocol^...' build — dependency closure green.
• Gate families derived with scripts/pm/dispatch-gates.mjs and reconciled with --ran: 68 derived, 65 run green, 3 NOT MEASURED (check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt — each exits 3 refusing its own prerequisite, a full pnpm build; CI's Build Core provides it).
• pnpm lint — the whole repo, eslint . --no-inline-config, exit 0 at 03809f097.

Generated by Claude Code