feat(types)!: retire the legacy ActionSchema onSuccess/onFailure callback pair and delete ActionCallback (objectui#7068) - #7832

Fixes #7068

Retires the THIRD meaning of onSuccess that @object-ui/types published: the legacy crud.ts ActionSchema's Phase-2 callback pair onSuccess / onFailure (each an ActionCallback object), its zod mirror, and the two docs pages that taught the shape — in one PR, because the docs fences compile against the type. Maintainer ruling option 1 (2026-09-05, verbatim 「其他同意」, record comment 5555360195). Clause-② yes: a published accept set narrows on both faces. Contract-review tier.

Premise, re-verified on 900f8d99 (branch base)

• packages/types/src/crud.ts:29 export interface ActionCallback; :163 / :167 onSuccess?: ActionCallback / onFailure?: ActionCallback on the legacy ActionSchema. zod/crud.zod.ts:33 ActionCallbackSchema, :98 / :99 the two keys, :187 the inferred alias. Barrels index.ts:892, zod/index.zod.ts:287. Parity ledger rows zod-mirror-parity.test.ts:597 / :760.
• Producer census: git grep -l ActionCallback over packages content skills hits exactly the five packages/types files; positive control SchemaNodeSchema hits 22 files, so the zero is a reading. The repo-wide onSuccess: { type: … } hits outside those are runner-side ActionDef tests (packages/core, packages/app-shell) — the SECOND meaning, { type: 'notify' } action defs, not ActionCallback producers.
• Runtime readers: none. ActionRunner.ts imports only RunnableActionType / UIActionSchema from @object-ui/types; its onFailure sits on its own ActionDef (the second meaning). Stop condition 2 does not fire.
• Docs: content/docs/core/enhanced-actions.mdx — three ts fences ("Ajax Actions", "Callbacks", "Complete Example"), all importing ActionSchema from @object-ui/types; content/docs/guide/schema-overview.md — the doc-snippet: fragment block under "Enhanced Actions", the "Key Features" bullet, the "Enhanced ActionSchema" checklist row. skills/**: the only onSuccess hit is a React prop on LoginForm (auth guide), not this shape — no card needed.
• Spec side, through the installed @objectstack/spec@17.2.0: ActionSchema.safeParse({ name, label, type: 'script', target, onSuccess: { type: 'toast', message: 'x' } }) is REFUSED — invalid_type at path onSuccess.navigate ("expected string, received undefined") plus unrecognized_keys at path onSuccess ("Unrecognized key(s) on this action's onSuccess block: type, message. …"). onFailure: { type: 'message', … } is REFUSED at the root — unrecognized_keys naming onFailure. onSuccess: { navigate: '/done', openIn: 'self' } is ACCEPTED with the block preserved. So an author who wrote the docs' shape already failed at publish; this PR moves the failure to the authoring site.

What moves

1. TS face crud.ts: ActionCallback DELETED; onSuccess?: never / onFailure?: never with the RETIRED docblocks (what it was, why it is gone, where the live meaning lives).
2. Zod face zod/crud.zod.ts: ActionCallbackSchema and ActionCallbackSchemaType DELETED; the two keys are retirementTombstone(...) named refusals — one guidance string each, feeding both the parse-time message and .describe(); the guidance names the spec's { navigate, openIn } block on UIActionSchema (objectui#5934) and successMessage / errorMessage.
3. Barrels: index.ts and zod/index.zod.ts drop the two names.
4. Ledger zod-mirror-parity.test.ts: the crud.zod.ts#ActionCallbackSchema rows leave MIRRORS and Declared (the pair had no entry in any drift ledger, so no other count moves); EXPECTED_MIRROR_PAIRS 159 → 158; the header's pair-population chain gains the 159 → 158 step.
5. component-docs-retired-handler-keys-7340.test.ts: its name-shaped census of on*?: never members reads the two new tombstones — total 26 → 28, crud.ts 1 → 3, onFailure enters the "no shipped interface declares it callable" net (onSuccess stays ambiguous because UIActionSchema.onSuccess is live). Recorded as a ruled move with the reason, the way that pin asks.
6. phase2-schemas.test.ts: the only in-repo producer fixture no longer authors the callback shape (it authors successMessage / errorMessage); the refusal lives in the new pin.
7. New pin action-callback-retired-7068.test.ts (34 tests): both keys refused at path with the exact guidance — direct, through DetailSchema.actions (path actions.0.onSuccess), through safeValidateSchema's union door; .describe() carries the same string; BASE CONTROL on both faces (BaseSchema alone accepts the same document — the tombstone shadows the passthrough / the index signature); controls (legacy action without the keys, successMessage / errorMessage, chain / redirect, a wrong-typed successMessage still refused, an undeclared key still passes through); absence of the deleted names (barrel object, crud.zod.ts module, crud.ts AST, barrel text); the ?: never census of the interface; the spec comparison pin (refuses the callback shape, refuses onFailure, accepts the navigation block); a content/docs corpus scan; and @ts-expect-error legs (fresh literal, indexed member type, widened value) that tsconfig.test.json enforces.
8. Docs: the three enhanced-actions.mdx fences author successMessage / errorMessage instead of the callbacks; the "Callbacks" section becomes a "Post-success behaviour" note with no fence — the legacy ActionSchema carries no spec-derived post-success block (measured: its post-action keys are reload / redirect), so the note points at the spec block on UIActionSchema and at chain. schema-overview.md: fragment line removed, feature bullet rewritten, the ✅ checklist row is now a retirement note, two prose mentions of "callbacks" corrected. scripts/check-doc-component-types.mjs: the per-file exemption message for enhanced-actions.mdx ("under onFailure") is removed — it went stale with the fence, and a stale exemption is exit 1 for that gate.
9. Changeset .changeset/action-callback-retired-7068.md: @object-ui/types: minor, opening "Breaking for authored metadata:".

Disposition of the standalone type, and the precedent

Deleted, not tombstoned. This package's precedent for a retired standalone pair is objectui#7664 / PR #7743, which deleted the DeclarativeKanban* trio from both faces and the barrels, removed the ledger rows, and pinned the absence (membersOf('DeclarativeKanbanSchema') throws). The key-level tombstones follow PR #7761 (TextSchema.value) and PR #7769 (TreeViewSchema.data). Four axes: no producer or reader (measured); one contract, no stub kept alive in the barrel; an import of a deleted name fails at the import line with TS2305 and an authored key fails at the site with TS2322 / a named zod refusal — both loud; immediate, no window.

Before / after, both faces, read from the built dist

• BEFORE (BASE build): ActionSchema.safeParse(callback shape).success = true, also through DetailSchema.actions and safeValidateSchema; ActionCallbackSchema exported; a strict tsc probe assigning onSuccess: { type: 'toast', … } / onFailure to ActionSchema and importing ActionCallback exits 0 (harness control on the same tsconfig: a wrong-typed label exits 2 with TS2322).
• AFTER (rebuilt dist): success = false with invalid_type / expected never at onSuccess and onFailure, the message beginning "RETIRED (objectui#7068) — …"; DetailSchema refuses at actions.0.onSuccess / actions.0.onFailure; the union door refuses; ActionCallbackSchema absent from the barrel; the same tsc probe exits 2 with exactly three errors — TS2305 "no exported member 'ActionCallback'", TS2322 at onSuccess, TS2322 at onFailure; the successMessage / errorMessage control and a legacy action without the keys still parse.

Ablation (Clause-② yes)

Subject resolved through source imports (the pin imports ../zod/crud.zod.js), so no dist leg is involved. With the implementation committed, the zod face alone was reverted to the pinned BASE commit by path (git checkout 900f8d99 -- packages/types/src/zod/crud.zod.ts), proven on disk (retirementTombstone( count 4 → 2, export const ActionCallbackSchema 0 → 1, "RETIRED (objectui#7068)" 2 → 0, blob changed), then the pin and the parity ledger were run under the verify lock: VERDICT command-exit 1, 20 failed / 34 passed — the 18 zod-half legs and the ActionCallbackSchema absence leg red, the ledger's population-closed test red, every control leg (neighbours, spec comparison, docs scan, TS half) green. Restored with git checkout HEAD -- ABSOLUTE-PATH under an EXIT/INT/TERM trap; git diff HEAD empty, git status clean, blob hash 6dd88e95 identical to HEAD's. Direction as predicted: turns red.

Gates (exit captured before any pipe; heavy runs under os-verify-lock.sh; final head be90f812 after merging origin/main)

• pnpm --filter @object-ui/types build — VERDICT command-exit 0, "dist completeness: 1 package(s) complete (124 emitted files verified)".
• pnpm exec vitest run --maxWorkers=2 packages/types/ — VERDICT command-exit 0, "Test Files 128 passed (128) / Tests 2298 passed (2298)"; rerun on be90f812 after the merge: same figures. The new pin alone: 34 passed.
• pnpm --filter @object-ui/types type-check — VERDICT command-exit 0 (script name type-check echoed; tsc --noEmit && tsc -p tsconfig.examples.json && tsc -p tsconfig.test.json, no error TS).
• Consumer type-checks against the rebuilt dist: @object-ui/core (VERDICT 0), @object-ui/plugin-form (VERDICT 0, 11 closure builds), @object-ui/app-shell (VERDICT 0, 28 closure builds). Every closure package's build is its tsc, so 34 consumer builds green is the consumer reading; no consumer authored the retired shape.
• pnpm --filter @object-ui/types lint — exit 0; 274 warnings, all pre-existing no-explicit-any (the three in touched files are lines present byte-identical at BASE).
• pnpm check:doc-snippets — ran for real in the worktree after building the gate's own --build-filter closure (34 tasks, 28 cached): VERDICT command-exit 0, "Semantic phase: 455 of 455 block(s) judged, 0 failed. Every covered documentation snippet compiles against the built types." Supplementary differential compile of the touched page's ts fences against the rebuilt dist: edited page 10 fences, 0 errors; BASE page 11 fences, exactly 6 errors, all TS2322 at the callback sites (fences 1, 7, 10 — two keys each) — the docs half is load-bearing.
• pnpm check:doc-types — exit 0 ("Every documented component type is registered"; 117 exempted after the stale message exemption left). pnpm check:doc-fences — exit 0. node scripts/check-doc-links.mjs — exit 0 ("Links are valid across 17 scan roots"). pnpm check:control-bytes — exit 0 (6360 files). pnpm check:spec-symbols — exit 0.
• Changeset gates — check-changeset-presence / -fixed / -no-major / -overwrite all exit 0, rerun after the merge.
• Governed-surface predicate (objectstack scripts/pm/check-governed-merges.mjs --test over all 12 paths): "0 of 12 path(s) hit the register … NOT governed".
• Declared to CI, not run locally: the full affected-package test matrix (turbo ls --affected lists nearly every workspace package because @object-ui/types is a root dependency); the consumer reading above covers their type surface.

Out of scope, noticed

None filed. The .changeset/5867-plaintext-fenced-ts-batch2.md mention of ActionCallback is a historical changeset and stays.

Related: objectui#5934 · PR #7065 · objectui#7664 / PR #7743 · PR #7761 · PR #7769 · objectui#7340 · objectui#4314. Placeholders in this body are spelled as words (the GitHub sanitizer strips angle-bracket shapes). Dev of the domain:spec @ objectui seat's dispatch, session session_01BAZFhALsQsGqxui8sNqM8s.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BAZFhALsQsGqxui8sNqM8s

Generated by Claude Code