@@ -0,0 +1,11 @@
+---
+'@object-ui/plugin-dashboard': patch
+---
+
+The metric cards no longer write authored keys they do not read onto the page (objectui#4425). Rendered through `SchemaRenderer`, which is how every dashboard draws its KPI tiles (`plugin-dashboard:metric` and `plugin-dashboard:metric-card` nodes), `MetricWidget` and `MetricCard` now spread onto their card element only what `toDomProps` from `@object-ui/core` passes: `id`, `className`, `role`, `tabIndex`, the `aria-*` and `data-*` families and the rest of that whitelist. They used to strip seven named non-DOM props and spread everything else, so `name`, and any key an author wrote that the card does not read (a `colorVariant` or a `label` on a `metric-card`, an extra key in a `metric` widget's `options`), landed on the element as an attribute, with objects written as `[object Object]`.
+
+**Behaviour change.** On a dashboard node, an HTML attribute outside that whitelist no longer reaches the card either: an authored `name` or `style` on either node, or a `title` on a `metric` node (a card reads `title` as its heading), is now dropped. An authored `label` on a `metric-card` is no longer a `label="…"` attribute. It is still not the card's heading, which is `title`.
+
+Rendering the components directly as React components is unchanged: `<MetricWidget …>` and `<MetricCard …>` still forward every `HTMLAttributes` key their props interfaces declare.
+
+**Clause-②: no.** No exported type, prop, registration input or export changes. The helper that tells the two paths apart is internal and is not exported from the package entry.
@@ -73,7 +73,9 @@ who supplies it:
    on the element a widget renders — the field's `id`, the `aria-describedby` the form
    control minted, and so on. `toDomProps` is this group's runtime executor, bound to
    the declaration in both directions by compile-time assertions, so a key cannot be
-   declared here and silently never delivered.
+   declared here and silently never delivered. Every other registered widget is held
+   to the same rule with the SDUI contract's own key set — the plugin-widget contract
+   is stated once, in [What Reaches the DOM](/docs/guide/plugin-development#what-reaches-the-dom).
 4. **The ARIA attribute family**, intersected in whole from React's `AriaAttributes`.
    This group is the bulk of the member count, which is why the count is not a useful
    thing to quote.
 
@@ -176,6 +176,66 @@ export type { BoardSchema, BoardProps, BoardColumn, BoardItem } from './types';
 
 Now any schema with `"type": "board"` will resolve to your component.
 
+## What Reaches the DOM
+
+`SchemaRenderer` hands a registered component far more than the keys it
+declares: the node itself as `schema`, every other key the author wrote on the
+node, the contents of its `props` bag, the runtime props it injects (`bind`,
+`events`, the camelCase `ariaLabel` the author wrote, the data-source adapter)
+and whatever its own host passed. React writes unknown lowercase props straight
+onto an element and stringifies objects, so a component that ends in a bare
+`{...props}` spread onto an element puts all of it on the page —
+`schema="[object Object]"`, `datasource="[object Object]"`, a `name` on a `div`,
+and every authored key the widget never declared. Nothing warns: React stays
+silent for lowercase names.
+
+**The contract for a registered widget's host element** (objectui#4425,
+phase-2 ruling, comment 5270759246): it receives only what `toDomProps` from `@object-ui/core`
+passes — the SDUI contract's declared DOM keys (`id`, `className`, `role`,
+`tabIndex` and the rest of `SDUI_DOM_PASS_THROUGH_KEYS`) and the open `aria-*`
+and `data-*` families. Everything else the renderer hands a widget is either
+**consumed** — read by name and turned into behaviour — or dropped. It is a
+whitelist rather than a list of keys to strip, because the set of keys an author
+may write is unbounded and a strip list can only name the ones that exist today.
+
+```tsx
+import type { HTMLAttributes, ReactNode } from 'react';
+import { toDomProps, type SduiDomPassThroughKey } from '@object-ui/core';
+
+// The DOM pass-through this widget declares is exactly what the whitelist
+// forwards — named from the whitelist's own key type, so the two cannot drift.
+interface BoardFrameProps extends Pick<HTMLAttributes<HTMLDivElement>, SduiDomPassThroughKey> {
+  children?: ReactNode;
+}
+
+export function BoardFrame({ className, children, ...props }: BoardFrameProps) {
+  return (
+    // Spread FIRST, so the attributes the widget computes stay authoritative.
+    <div {...toDomProps(props)} className={className}>
+      {children}
+    </div>
+  );
+}
+```
+
+A widget that really means to forward something beyond that set **declares**
+it on its props type and forwards it **by name** — the way `style` reaches the
+layout containers. Never reopen the spread to get it. A component that is both
+registered and exported for direct React use may keep a wider declared
+`HTMLAttributes` pass-through on its direct door, as `@object-ui/plugin-dashboard`'s
+metric cards do; what the renderer hands it still goes through the whitelist.
+
+Field widgets follow the same rule with their own declared set: `@object-ui/fields`
+exports a `toDomProps` that adds the form-control keys `name` and `disabled`
+(see [Field Widget Props](/docs/fields/widget-props)).
+
+**The gate.** `packages/app-shell/src/__tests__/widget-dom-leak-sweep.test.tsx`
+renders every registered widget of the packages it covers through the real
+`SchemaRenderer`, with planted canary keys from every family above, and fails
+on any attribute HTML does not define. A known leak is a ledger row in that
+file naming the issue that owns its fix, and the ledger is a two-way ratchet: a
+new leak fails the gate, and so does a fixed one until its row is deleted.
+
 ## Implementing a Custom Field Widget
 
 Field widgets follow the `FieldWidgetComponentProps` interface from `@object-ui/fields`.
 
@@ -36,29 +36,34 @@
  *   | plugin-charts    |       5 |               0 |                 0 |
  *   | plugin-calendar  |       3 |               0 |                 0 |
  *   | plugin-chatbot   |       3 |               0 |                 0 |
- *   | plugin-dashboard |       7 |               2 |             7 / 9 |
+ *   | plugin-dashboard |       7 |               0 |                 0 |
  *   | components       |     150 |              82 |          12 .. 15 |
  *
- * **84 of 168 targets leak.** The `components` row is objectui#5574 and is
- * covered in its own section below; the two `plugin-dashboard` rows are the
- * older tail. Both are in {@link LEAK_LEDGER}:
- * `plugin-dashboard:metric` and `plugin-dashboard:metric-card`, the open tail
- * objectui#4425 owns directly. Two migration steps have closed their rows since
- * the phase-1 measurement:
+ * **82 of 168 targets leak.** All of them are the `components` row, which is
+ * objectui#5574 and is covered in its own section below. The four packages
+ * objectui#4425 named now read zero. Three migration steps have closed their
+ * rows since the phase-1 measurement:
  *
  *   - `plugin-chatbot:chatbot` / `chatbot-enhanced` — 14 attributes each,
  *     objectui#4431 / PR #4485, which also lifted `toDomProps` to
  *     `@object-ui/core` so later cards consume one executor.
  *   - `plugin-dashboard:dashboard` (spelled `view:dashboard` until
  *     objectui#9533) — `DashboardRenderer`'s widget-grid container, 13
- *     attributes, objectui#4432 / this file's most recent edit.
+ *     attributes, objectui#4432.
+ *   - `plugin-dashboard:metric` / `metric-card` — the KPI cards' open tail, 7
+ *     and 9 attributes, objectui#4425 itself: the last two rows inside these
+ *     four packages. See "what is left of it" below.
  *
- * The three packages now reading 0 are NOT clean for the same reason, and the
+ * The four packages now reading 0 are NOT clean for the same reason, and the
  * difference is worth keeping straight: `plugin-charts` never spreads the node
  * onto its container at all; `plugin-calendar`'s components take a declared prop
  * list and drop what they do not name, so the node's keys never reach an
- * element; `plugin-chatbot` and `DashboardRenderer`'s grid reach zero by
- * FILTERING — they still spread, through `toDomProps`.
+ * element; `plugin-chatbot`, `DashboardRenderer`'s grid and the two KPI cards
+ * reach zero by FILTERING — they still spread, through `toDomProps`. The KPI
+ * cards filter on the renderer's door only: rendered directly as React
+ * components they keep their declared `HTMLAttributes` pass-through
+ * (objectui#4426), and this gate, which renders every target through
+ * `SchemaRenderer`, never sees that door.
  *
  * `calendar-view` was originally swept with the `events` canary WITHHELD, because
  * authoring it crashed the component outright (objectui#4433) — a worse failure
@@ -81,23 +86,24 @@
  *   - a **deny-list** (`plugin-dashboard/src/schemaHostProps.ts`, #4357/PR
  *     #4428): destructure seven measured non-DOM props out, spread the rest.
  *
- * The deny-list is correct for the seven props it enumerates — this sweep
- * confirms all seven are gone from `metric` and `metric-card`. What it cannot
- * close is the **open tail**, exactly as `toDomProps`' docblock predicted: an
- * authored key the component does not declare still reaches the DOM. That is not
- * a hypothetical here; it is ledger rows {@link LEAK_LEDGER} `metric` and
- * `metric-card`, where `zzcanary` / `reference_to` / an authored
- * `props: { colorVariant }` all land as attributes while every one of the seven
- * named keys is correctly stripped. A deny-list bounded by enumeration cannot be
+ * The deny-list was correct for the seven props it enumerates — this sweep
+ * confirmed all seven gone from `metric` and `metric-card`. What it could not
+ * close was the **open tail**, exactly as `toDomProps`' docblock predicted: an
+ * authored key the component does not declare still reached the DOM. That was
+ * not a hypothetical here; it was two {@link LEAK_LEDGER} rows, `metric` (7
+ * attributes) and `metric-card` (9), where `zzcanary` / `reference_to` / `name`
+ * / an authored `props: { colorVariant }` — and, on `metric-card`, an authored
+ * `label` — all landed as attributes while every one of the seven named keys
+ * was correctly stripped. A deny-list bounded by enumeration cannot be
  * finished; a whitelist bounded by declaration can. That contrast IS the
  * measurement phase 2 waited for, and the ruling went to the whitelist on it.
  *
- * So the divergence is no longer a standing state of the repo — it is a
- * migration in progress, and the two rows still below are the last of it inside
- * these four packages. `plugin-dashboard` is now MIXED by design: its
- * `DashboardRenderer` grid container filters through `toDomProps` (#4432) while
- * the two KPI components still run the deny-list, and the two surviving rows are
- * precisely that difference, measured.
+ * The divergence is now gone from these four packages. objectui#4425 moved the
+ * two KPI components' renderer door onto `toDomProps` and deleted both rows in
+ * the same change — the two-way expiry below, which turned this gate red on
+ * exactly those two targets (each measured `[]` against its row) until they
+ * went. The deny-list stays in `schemaHostProps.ts` as the direct React door's
+ * filter, which this gate does not render.
  *
  * ## objectui#5574 — the family this sweep could not see, and what it found
  *
@@ -440,7 +446,8 @@ const AUTHORED_EXTRAS = {
 
 /**
  * Authored `props: { … }`. `colorVariant` is objectui#4425's own measured
- * example — `metric-card` has no such prop, so it lands as `colorvariant`.
+ * example — `metric-card` has no such prop, so it landed as `colorvariant`
+ * until that card moved onto `toDomProps`.
  */
 const AUTHORED_PROPS = {
   colorVariant: 'success',
@@ -885,6 +892,10 @@ const TARGETS: Readonly<Record<string, readonly Target[]>> = {
   ],
   'plugin-dashboard': [
     { type: 'plugin-dashboard:metric', schemaExtras: { label: 'Revenue', value: 42 }, ready: '.rounded-lg.border' },
+    // `label` is deliberately NOT this card's heading (`MetricCardProps` spells
+    // it `title`): authored here it is one more open-tail key, and it once
+    // leaked as `label="Revenue"` (objectui#4425). Kept so the gate keeps
+    // proving it stops at the component.
     { type: 'plugin-dashboard:metric-card', schemaExtras: { label: 'Revenue', value: 42 }, ready: '.rounded-lg.border' },
     { type: 'plugin-dashboard:object-metric', schemaExtras: { objectName: 'accounts' }, ready: '.rounded-lg.border' },
     { type: 'plugin-dashboard:pivot', ready: '[data-testid="pivot-empty-state"]' },
@@ -1201,40 +1212,12 @@ const COMPONENTS_LEAK_GROUPS: readonly LedgerGroup[] = [
 ];
 
 const LEAK_LEDGER: Readonly<Record<string, LedgerEntry>> = {
-  /* ── plugin-dashboard: the OPEN TAIL a deny-list cannot close ───────────── */
-  //
-  // Read these two rows against what is NOT in them. Every one of the seven keys
-  // `schemaHostProps.ts` enumerates (#4357 / PR #4428) is absent — `schema`,
-  // `bind`, `events`, `props`, `ariaLabel`, `ariaDescribedBy`, `dataSource` are
-  // all correctly stripped, on both components, including the adapter. The
-  // deny-list does exactly what it claims.
-  //
-  // What remains is the half it cannot reach: keys the component does not
-  // declare and the list never names. That is `toDomProps`' argument, measured
-  // rather than predicted, and it is the reading objectui#4425 phase 2 is for.
-  'plugin-dashboard:metric': {
-    attributes: [
-      'name', 'reference_to', 'zzcanary', 'zzcanarycamel', 'zzcanarynum',
-      'zzcanaryobj', 'zzcanaryprop',
-    ],
-    reason:
-      'the seven deny-listed props are gone; the open tail of authored keys ' +
-      '`MetricWidget` does not declare still reaches the Card.',
-    issue: 'objectui#4425',
-  },
-  'plugin-dashboard:metric-card': {
-    attributes: [
-      'colorvariant', 'label', 'name', 'reference_to', 'zzcanary',
-      'zzcanarycamel', 'zzcanarynum', 'zzcanaryobj', 'zzcanaryprop',
-    ],
-    reason:
-      'the same open tail as `metric`, plus two keys that are the tail in ' +
-      'miniature: `colorvariant` is objectui#4425\'s own measured example, and ' +
-      '`label` leaks because `MetricCardProps` spells its heading `title` — so ' +
-      'authoring the key its sibling `MetricWidget` takes puts the heading on ' +
-      'the DOM as an attribute instead of rendering it.',
-    issue: 'objectui#4425',
-  },
+  // ⛔ No `plugin-dashboard` rows. The last two — `metric` and `metric-card`,
+  // the open tail `schemaHostProps.ts`' deny-list could not close — were
+  // deleted by objectui#4425 when both KPI components moved their renderer door
+  // onto `toDomProps`. Both targets are still swept above with the full canary
+  // set, so a regression there is a NEW leak on an unledgered target and fails
+  // on the empty-report branch below, naming every attribute.
 
   /* ── packages/components: 82 of 150 targets, in four measured shapes ───── */
   ...Object.fromEntries(
@@ -1817,8 +1800,8 @@ const DOCBLOCK_COUNTS = {
   commonestShapeAttributes: 14,
   /** Every target this sweep renders, all five packages. */
   allTargets: 168,
-  /** Every ledgered row, `plugin-dashboard`'s open tail included. */
-  allLedgered: 84,
+  /** Every ledgered row, all five packages. */
+  allLedgered: 82,
 } as const;
 
 type CountName = keyof typeof DOCBLOCK_COUNTS;
 
@@ -12,7 +12,7 @@ import { cn } from '@object-ui/components';
 import { useObjectTranslation, pickLocalized } from '@object-ui/i18n';
 import type { I18nLabel } from '@object-ui/types';
 import { ArrowDownIcon, ArrowUpIcon, MinusIcon, AlertCircle, Loader2 } from 'lucide-react';
-import type { SchemaHostProps } from './schemaHostProps';
+import { hostDomProps, type SchemaHostProps } from './schemaHostProps';
 
 /**
  * DOM PASS-THROUGH (objectui#4426) — see `MetricWidget.tsx`'s interface header
@@ -31,6 +31,12 @@ import type { SchemaHostProps } from './schemaHostProps';
  * whole. The repo's spelling for this carve-out is `ComboboxProps`
  * (`extends Omit<React.ButtonHTMLAttributes<HTMLButtonElement>, "value" | "onChange">`),
  * omitted there for the same reason: the component's own contract owns the name.
+ *
+ * This declaration is the DIRECT React door's. Rendered through
+ * `SchemaRenderer`, the card's element receives only what `toDomProps` passes
+ * (objectui#4425, phase 2) — see `hostDomProps` in `./schemaHostProps`. That is
+ * also why an authored `label` stops at the component: it is not this card's
+ * heading (`title` is) and not an attribute either.
  */
 export interface MetricCardProps extends Omit<React.HTMLAttributes<HTMLDivElement>, 'title'> {
   /**
@@ -68,8 +74,8 @@ export const MetricCard: React.FC<MetricCardProps & SchemaHostProps> = ({
   // Schema-shaped props `SchemaRenderer` injects, destructured out so the
   // spread below cannot write them to the DOM (objectui#4357). Named and
   // measured in `./schemaHostProps`; `schema` alone put a
-  // `schema="[object Object]"` attribute on every card. The rest spread
-  // survives — it is the component's genuine DOM/aria passthrough.
+  // `schema="[object Object]"` attribute on every card.
+  // READ now, as the door discriminator below (same binding as `MetricWidget`).
   schema: _schema,
   bind: _bind,
   events: _events,
@@ -79,13 +85,16 @@ export const MetricCard: React.FC<MetricCardProps & SchemaHostProps> = ({
   dataSource: _dataSource,
   ...domProps
 }) => {
+  // What the `Card` may carry (objectui#4425): the `toDomProps` whitelist on
+  // the renderer's door, the declared pass-through on the direct React door.
+  const hostProps = hostDomProps(_schema, domProps);
   // Resolve icon via lazy resolver — each icon ships as its own micro-chunk
   const IconComponent = icon ? getLazyIcon(icon) : null;
   // Label text follows the active UI language (not the tenant's number locale).
   const { language } = useObjectTranslation();
 
   return (
-    <Card className={cn("h-full", className)} {...domProps}>
+    <Card className={cn("h-full", className)} {...hostProps}>
       <CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
         <CardTitle className="text-sm font-medium">
           {pickLocalized(title, language)}