This in ObjectTypeValidator is wrong:
1) It only iterates over the keys in 'value' so if value is missing any required fields that isn't detected.
2) It's not really appropriate to reject keys that are not part of the definition. The management code is meant to be forgiving in such cases.
For now I think I'll just focus on #1. It's debatable whether being forgiving is really ideal in general, and since this particular bit of unforgivingness has been around since at least 2012 I think I'll leave it alone.