chore(spec): regenerate docs/ledger artifacts; drill onSuccess liveness container; move the action.zod site-count pin 8→9

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fs18A2DdXLVN2h8PaaFBcP

Author: claude

content/docs/references/ui/action.mdx

@@ -96,6 +96,7 @@ const result = ActionSchema.parse(data);
 | **mode** | `Enum<'create' \| 'edit' \| 'delete' \| 'custom'>` | optional | Semantic mode of the action. |
 | **opensInNewTab** | `boolean` | optional | Open the action result in a new tab. The renderer pre-opens the tab synchronously on click (popup-blocker-safe) and navigates it to the handler's redirectUrl. |
 | **newTabUrl** | `string` | optional | Direct new-tab URL template (`{recordId}` placeholder). When set with opensInNewTab, the renderer navigates the pre-opened tab here immediately — no action POST. The endpoint must enforce auth itself. |
+| **onSuccess** | `{ navigate: string; openIn?: Enum<'self' \| 'newTab'> }` | optional | Post-success navigation for type:'api' and type:'script' actions (#9566/#9474). `navigate` is a route/URL template interpolating $`{param.*}`, $`{ctx.*}` and $`{result.*}` (the server response); `openIn` defaults 'self'. The handler-return convention (`{ redirectUrl }` without openIn) keeps its 17.0.0 new-tab behavior. |
 | **aria** | `{ ariaLabel?: string \| Record<string, string>; ariaDescribedBy?: string; role?: string }` | optional | ARIA accessibility attributes |
 | **_lock** | `Enum<'none' \| 'no-overlay' \| 'no-delete' \| 'full'>` | optional | Item-level lock — controls overlay & delete (ADR-0010). |
 | **_lockReason** | `string` | optional | Human-readable reason shown when a write is refused by _lock. |

docs/audits/2026-07-unknown-key-strictness-ledger.counts.md

@@ -21,7 +21,7 @@ regenerate.
 | Measure | Value |
 |---|---|
 | Triaged directories | 5 |
-| Object sites in them | 443 |
+| Object sites in them | 444 |
 | Still-open (strip) sites | 123 |
 | Files carrying at least one | 22 |
 
@@ -44,12 +44,12 @@ The `strict` column is the one the campaign schedules against; it counts both th
 
 | Dir | Sites | strict | passthrough | catchall | strip |
 |---|---|---|---|---|---|
-| `ui/` | 175 | 164 | 5 | 0 | 6 |
+| `ui/` | 176 | 165 | 5 | 0 | 6 |
 | `data/` | 156 | 74 | 1 | 0 | 81 |
 | `automation/` | 65 | 42 | 0 | 0 | 23 |
 | `security/` | 20 | 7 | 0 | 0 | 13 |
 | `studio/` | 27 | 27 | 0 | 0 | 0 |
-| **total** | **443** | **314** | **6** | **0** | **123** |
+| **total** | **444** | **315** | **6** | **0** | **123** |
 
 ## File-level triage — site counts
 
@@ -62,7 +62,7 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | File | Sites |
 |---|---|
 | `action-params.zod.ts` | 1 |
-| `action.zod.ts` | 8 |
+| `action.zod.ts` | 9 |
 | `app.zod.ts` | 18 |
 | `bulk-action.zod.ts` | 3 |
 | `chart.zod.ts` | 8 |
@@ -77,7 +77,7 @@ classify and is not listed (it becomes reportable the day it grows its first sit
 | `theme.zod.ts` | 6 |
 | `view.zod.ts` | 56 |
 | `widget.zod.ts` | 1 |
-| **total** | **175** |
+| **total** | **176** |
 
 ### `data/` — sites
 
@@ -156,15 +156,15 @@ over it is here.
 
 ### `ui/` — open
 
-**6 strip of 175**, in 4 file(s).
+**6 strip of 176**, in 4 file(s).
 
 | File | Strip | Sites |
 |---|---|---|
 | `action-params.zod.ts` | 1 | 1 |
 | `app.zod.ts` | 1 | 18 |
 | `view.zod.ts` | 3 | 56 |
 | `widget.zod.ts` | 1 | 1 |
-| **total** | **6** | **175** |
+| **total** | **6** | **176** |
 
 | Bucket | Sites |
 |---|---|

packages/spec/liveness/action.json

@@ -159,10 +159,20 @@
       "note": "Declarative new-tab control for STATIC type:'url' targets. ActionRunner.executeUrl reads action.openIn with priority over the legacy params.newTab/external-URL heuristic; action-button/icon/menu/group + basic/elements renderers forward it. Distinct from opensInNewTab/newTabUrl (async SSO pre-open)."
     },
     "onSuccess": {
-      "status": "planned",
-      "verifiedAt": "2026-08-18",
-      "evidenceScope": "cross-repo",
-      "note": "PLANNED, deliberately not `live` — the #9340 map / #9463 viewMode convention for a spec-first contract-split key. Declared by the #9566/#9474 maintainer ruling (2026-08-18, one navigation contract for both cards): `{ navigate, openIn: 'self'|'newTab' }` post-success navigation for type:'api'/'script' actions, with `${result.*}` (the server response) joining the navigate template's interpolation scope. No console consumer reads it yet: objectui's consoleServerAction.ts drives only the handler-return `{ redirectUrl }` convention (new-tab, objectui#2967/#2904), executeAPI returns {success,data} and never navigates, and interpolateTarget's scope has no `result` member — the SPA-navigation branch, executeAPI navigation handling and result-scope interpolation are the downstream objectui card(s) filed Blocked-by #9566/#9474 at this key's landing. Amend to `live` citing the consoleServerAction/executeAPI read and the interpolateTarget result member when that half lands — measured objectui per the #9566 issue audit at spec/console 17.0.0, 2026-08-18."
+      "children": {
+        "navigate": {
+          "status": "planned",
+          "verifiedAt": "2026-08-18",
+          "evidenceScope": "cross-repo",
+          "note": "PLANNED, deliberately not `live` — the #9340 map / #9463 viewMode convention for a spec-first contract-split key. Declared by the #9566/#9474 maintainer ruling (2026-08-18, one navigation contract for both cards): a post-success route/URL template for type:'api'/'script' actions whose interpolation scope gains `${result.*}` (the server response) beside `${param.*}`/`${ctx.*}`. No console consumer reads it yet: objectui's consoleServerAction.ts drives only the handler-return `{ redirectUrl }` convention (new-tab, objectui#2967/#2904), executeAPI returns {success,data} and never navigates, and interpolateTarget's scope has no `result` member — the SPA-navigation branch, executeAPI navigation handling and result-scope interpolation are the downstream objectui card(s) filed Blocked-by #9566/#9474 at this key's landing. Amend to `live` citing the consoleServerAction/executeAPI read and the interpolateTarget result member when that half lands — measured objectui per the #9566 issue audit at spec/console 17.0.0, 2026-08-18."
+        },
+        "openIn": {
+          "status": "planned",
+          "verifiedAt": "2026-08-18",
+          "evidenceScope": "cross-repo",
+          "note": "PLANNED with its sibling `navigate` (see that entry for the full cross-repo measurement). The closed enum 'self'|'newTab' with a MATERIALIZED .default('self') — parse output always carries the resolved member, so the future console branch reads it with no fallback of its own. The shipped handler-return surface `{ redirectUrl, openIn? }` keeps 17.0.0 semantics (absent openIn ⇒ new-tab); only this schema key defaults 'self'. Amend to `live` together with `navigate` when the objectui half (Blocked-by #9566/#9474) lands."
+        }
+      }
     },
     "aria": {
       "status": "live",

packages/spec/liveness/state-counts.md

@@ -30,7 +30,7 @@ for both corollaries.
 | `object` | 50 | 0 | 0 | 1 | 51 |
 | `field` | 88 | 0 | 0 | 2 | 90 |
 | `flow` | 34 | 0 | 6 | 0 | 40 |
-| `action` | 42 | 0 | 2 | 0 | 44 |
+| `action` | 42 | 0 | 2 | 2 | 46 |
 | `hook` | 18 | 0 | 2 | 0 | 20 |
 | `permission` | 38 | 0 | 4 | 0 | 42 |
 | `position` | 12 | 0 | 0 | 0 | 12 |
@@ -57,4 +57,4 @@ for both corollaries.
 | `api` | 25 | 0 | 0 | 2 | 27 |
 | `capability` | 12 | 0 | 0 | 0 | 12 |
 | `qa` | 4 | 0 | 5 | 0 | 9 |
-| **total** | **796** | **6** | **55** | **10** | **867** |
+| **total** | **796** | **6** | **55** | **12** | **869** |

packages/spec/scripts/strictness-ledger.test.ts

@@ -100,7 +100,10 @@ describe('site counting reads the AST, not the source text', () => {
     expect(countSites(at('kernel/metadata-protection.zod.ts'))).toBe(0);
     expect(countSites(at('shared/suggestions.zod.ts'))).toBe(0);
     // And the case that mattered, because this file IS triaged: 9 → 8.
-    expect(countSites(at('ui/action.zod.ts'))).toBe(8);
+    // (8 → 9 at #9566, which ADDED the `onSuccess` strictObject site — the
+    // count is incidental; what this case pins is that JSDoc examples are
+    // not counted.)
+    expect(countSites(at('ui/action.zod.ts'))).toBe(9);
   });
 
   it('counts a call the source wraps across lines (`z\\n  .object({`)', () => {