@object-ui/i18n 17.2.0 → 17.5.0

package/CHANGELOG.md

@@ -1,5 +1,1803 @@
 # @object-ui/i18n
 
+## 17.5.0
+
+### Minor Changes
+
+- 0e67b53: `/accept-invitation/:invitationId` is one route, one component, one namespace — the console now renders the invitation page that actually shows you the invitation
+
+  Two components shipped for this single URL. The console routed its own thin page, which offered nothing but an Accept and a Decline button: it never told the user which organization they had been invited to, in what role, or when the link expires, and accepting left them in whatever organization they were already in. App-shell's page — exported as `DefaultAcceptInvitationPage`, routed by nobody — fetches the invitation, shows the organization, the role and the expiry date, and switches the user into that organization on accept. Console now routes that one. The thin page is deleted.
+
+  Behind them sat two i18n namespaces for one screen: `acceptInvitation.*` (12 keys) for the thin page and `organization.accept.*` (14) for the richer one, both freshly translated into ten languages by different slices of objectui#3546, neither wrong when read on its own. That is 26 keys of duplicated copy with no gate to tell the next author which of the two to edit — the failure mode this repo already has an uncollected precedent for. `acceptInvitation.*` is removed from all ten packs, and its absence is pinned negatively so it cannot drift back: the slice-three test now asserts that no pack defines any of the 12 retired keys (nor an emptied namespace root left by a partial revert), and that neither consuming package asks `t()` for one.
+
+  One behavior needed repairing before the swap was safe rather than after. `?redirect=` is a basename-stripped path by contract in this console — `LoginPage` re-prefixes it with the mount before navigating — and the thin page built it from the route param, correctly. App-shell's page built it from `window.location.pathname`, which already carries the mount, so a console served under a `<base href="/console/">` would have sent the user back to `/console/console/accept-invitation/…` after signing in. It now reads the router (`useLocation`), like every other producer of that parameter in this repo. Under the default `/` mount the two spellings are identical, which is why only a basename case can see the difference; that case is now a test.
+
+  Nothing published was removed: `DefaultAcceptInvitationPage` keeps its export and simply becomes the routed implementation. Downstream apps mounting it get the redirect fix and are otherwise untouched.
+
+- ae10a01: Console chrome reaches the bundle — the list switcher, the aggregate footer, the dialog a11y fallbacks and the whole Settings namespace screen stop being English on non-English consoles
+
+  Six strings on the two screens a user looks at most were hardcoded English literals rather than bundle lookups, so they stayed English on every non-English console with nothing an app could author to change them. They are not object, field, view or action labels — no key in `TranslationData` reaches them — while the console's own bundle already ships zh-CN, ja-JP, es-ES, de, fr, pt, ru, ko and ar and translates hundreds of neighbouring strings. Omissions from an otherwise complete bundle, not a missing capability.
+
+  **Two of the six needed no new keys at all, which is the more interesting half.** The list-view mode switcher named its nine visualizations from a private `VIEW_LABELS` table while `console.objectView.viewType*` — the same nine words — had been resolved through the bundle by the create-view picker for months; the switcher now reads those keys, so the picker's 「画廊」 and the switcher's 「画廊」 cannot drift apart in nine languages. The create/edit dialog's close button is the remainder of a fix that already landed: objectstack#5505 routed the `sr-only` close label through `common.close` for the two Shadcn-synced primitives, but `MobileDialogContent` is a hand-written wrapper outside that regeneration zone with its own close button, and it is exactly what `ModalForm` renders — so the dialog the report measured was the one place still announcing "Close" in English.
+
+  The aggregate footer is the one the original report singled out: the **number** was already locale-formatted and the **prefix** was a hardcoded `Avg: ` / `Sum: `. All eleven aggregation kinds now take their prefix from `grid.summary.*`, and the label/value join is its own key rather than a `': '` baked into the renderer — the separator is translatable content, so zh sets a fullwidth colon and fr the French space-before-colon. The numbers are untouched. The form dialog's `sr-only` description fallback joins the packs too; it is clipped, not visible, so the only way an app could displace it was to author a `description` and thereby put a visible subtitle on every dialog.
+
+  **The Settings namespace screen converts as one unit.** `SettingsView` routed zero framing copy through i18n — save/failure toasts, the env-lock and crypto refusals, the load-error card, the empty-route state, the navigation buttons, the unsaved-changes save bar — while its immediate sibling `SettingsHub`, in the same directory, resolved everything through `t('console.settingsHub.*')`. A zh-CN admin read correctly translated field labels sitting inside an English save bar, because `useSettingsLabel` translates a namespace's authored content but reaches none of the chrome around it. All of it now resolves through a `console.settingsView.*` namespace placed beside the hub's, including the crypto-refusal strings that objectui#4579 deliberately left in English rather than leave one translated string among a dozen literals.
+
+  The save-bar counter was an English plural rule executing in every locale (`change` plus an `s` when the count exceeds one). It is now a real i18next plural family — base key plus `_one` and `_other` in all ten packs — not the `(s)` spelling translated nine ways. The base key is the load-bearing part: i18next asks `Intl.PluralRules` for the one suffix a language needs and, finding no such slot, falls back to English, so without it Russian would read English at counts 2-20 and Arabic at 2-99. Russian and Arabic take the "noun: {count}" form their packs already use for this exact reason, and the counter is verified rendering in-language at 1, 2 and 5.
+
+  The Beta badge reuses the hub's existing key rather than minting a twin, and the refusal messages interpolate their subject through the bundle instead of concatenating a translated word onto an English prefix.
+
+- 66fb4fa: The console's language menu now asks the app which locales it actually ships, instead of always offering the same ten.
+
+  `LocaleSwitcher` built its items from a module-level `LANGUAGES` constant — exactly the ten codes `@object-ui/i18n` ships packs for — and never consulted the app, even though `GET /api/v1/i18n/locales` has been serving that list all along. It failed in both directions at once. An app shipping a locale outside those ten (`th`, a regional `pt-BR`) had no way to be selected from the console: the bundle could be complete and lint clean, and the menu simply had no entry for it. An app shipping only `en` and `zh` still listed all ten, so picking 日本語 handed the user the console's own chrome in Japanese with everything app-authored in the fallback language — a half-translated UI its author never opted into.
+
+  The menu is now the **intersection**: the app's own locale list ∩ what the renderer can actually resolve (built-in packs, `config.resources`, and — for an app that wires a dynamic `loadLanguage` loader, which is how the console gets its packs — the locales that loader can fetch). Both failure directions close in the same change: an app-shipped locale becomes offerable, and locales the app does not ship disappear. The endpoint is reached through a new `loadLocales` prop on `I18nProvider`, wired exactly like the existing `loadLanguage`: the app owns the transport, the provider owns what is done with the answer. An app that does not wire it keeps today's menu unchanged.
+
+  **The restore validation widened in lockstep, because otherwise this fix would have minted the next bug.** A restored language was validated against "the locales this provider can produce" — built-in packs plus `config.resources` — a bound that was correct only for as long as the menu offered exactly the built-in ten. The moment the menu grows to the app's real list, a locale the user can now pick is a locale that bound rejects, so a user-picked app locale would have been purged on the next page load. It now also accepts a locale a wired dynamic loader may be able to fetch, and the bound stays honest rather than absent: only well-formed BCP-47 tags qualify (`constructor`, `__proto__`, `en_US` are still rejected, as is any stored locale in an app with no loader), and the app's own locale list adjudicates the choice for real once it arrives — a locale the app has since dropped is reverted and purged rather than left locking the UI to a language with no translations.
+
+  Labels come from the built-in native names where they exist (`中文`, `日本語`, … are unchanged) and from `Intl.DisplayNames` for everything else, so an app locale is named in its own language rather than by its code. The endpoint's own `label` is deliberately not used for display: the server sets it to the code echoed back, which would have put `th` in the menu where `ไทย` belongs.
+
+  While the app's list is in flight the switcher renders nothing, following the sibling menus in the same folder — the ten never flash past on an app that only ships two. When there is no backend, the endpoint fails, or the app answers with nothing this renderer can produce, the built-in ten remain as the offline fallback, so the menu is never empty and never unusable.
+
+- 92250d6: One home for the number-display policy — and a percent stops meaning two different things between a list cell and a dashboard measure
+
+  `formatDisplayNumber`, `shouldGroupDisplayNumber` and `DisplayNumberFormatOptions` move from `@object-ui/i18n` into `@object-ui/core`. `@object-ui/i18n` re-exports all three under the same names, so every existing import path keeps working unchanged and both spellings resolve to the same function object; nothing published was removed.
+
+  The move is what fixes the bug. `@object-ui/core`'s `formatMeasure` needed exactly this policy and could not import it — `core` is the React-free engine and is a runtime dependency of React-free consumers (the `object-ui` VS Code extension, `@object-ui/data-objectstack`), while `i18n` depends on `i18next`/`react-i18next` and peer-depends on React. So `formatMeasure` carried a parallel `Intl` implementation, recorded at both ends as deliberate duplication, and the two drifted in the one place a hand-built string and `Intl` disagree. A German session read `1.234,5 %` from a list cell and `1.234,5%` from a dashboard measure showing the same number. The function is pure, so the boundary was never a property of the code — only of where the code sat; moving it down removes the obstacle instead of working around it. `core` imports nothing from `i18n`, so the new edge adds no cycle.
+
+  **Behaviour change — a measure's percent sign now follows the locale.** `formatMeasure` appended a literal `%` in every locale; it now renders the locale's own percent convention, the same one the list-cell `formatPercent` has used since the fix to its own machine-locale defect. Measured to change output in de, fr, es, ru, sv, cs, fi (a no-break space appears before the sign), tr (the sign moves to the FRONT: `%1.234,5`) and ar (its own percent sign plus U+061C). English, Japanese and Chinese are byte-identical — their convention is a bare trailing sign — which is why this was invisible in an English session.
+
+  **No numeral moves, in any locale, at any magnitude.** The obvious route to the locale's convention is `Intl`'s `style: 'percent'`, but that style expects a fraction, so a value already in percentage points would have to be divided by 100 for `Intl` to multiply it straight back — and that round trip is lossy. Measured, it moves 27,581 of 1,200,013 ordinary-magnitude en-US forms at rounding ties (`0.175` at two decimals becomes `0.17%` instead of `0.18%`), plus `MAX_SAFE_INTEGER` and everything from 1e23 up, where `100,000,000,000,000,000,000,000%` becomes `99,999,999,999,999,990,000,000%`. The percentage points are formatted directly instead, through a new `style: 'percentPoints'` on `DisplayNumberFormatOptions`; that route was measured to produce a byte-identical percent affix to `style: 'percent'` across all 171 locale tags tested while moving none of those 1,200,013 forms. Callers holding a fraction keep using `style: 'percent'`, whose behaviour is unchanged — naming the two cases apart is what stops the next caller from reaching for the lossy one.
+
+  `@object-ui/i18n`'s entry declaration is byte-identical, but the declaration it points at now lives in `@object-ui/core` and the package gains that dependency, so it takes the same minor bump rather than a patch.
+
+- ac853ce: i18n: retire the reader-less `common.search` key from all ten locale packs
+
+  `common.search` (`Search`, no ellipsis) had exactly one consumer: `LookupField`
+  built its dialog placeholder by concatenating the key with three ASCII full
+  stops. objectui#4375 / PR #4391 retired that concatenation — the placeholder is
+  the reused `table.search` pack value (`Search…`, one U+2026 glyph), which is what
+  brought it under objectui#3878's glyph pin. That left `common.search` with zero
+  readers repo-wide while it still existed in all ten packs.
+
+  Re-verified before deleting, repo-wide: no `t()` call site in any package or app,
+  no MDX or JSON reference, and the one dynamic template-literal reader of the
+  `common` namespace takes a two-member union parameter (`'openChat' |
+'closeChat'`) that cannot resolve to it. No user-visible string changes — this key never rendered.
+
+  The dormant copy in `@object-ui/fields`' no-provider fallback table
+  (`useFieldTranslation.ts`'s `FIELD_DEFAULTS`) goes with it. That table is a
+  module-local `Record<string, string>` read only when no `LocalizationProvider`
+  is mounted; it is not exported, so removing an entry no reader asks for changes
+  no rendered output and narrows no public type. Hence patch for that package,
+  while the pack change is a minor: deleting a key from `en` narrows the exported
+  `TranslationKeys` type (`typeof en`), so code indexing `TranslationKeys` at
+  `common.search` stops type-checking. Same grading, for the same reason, as
+  objectui#4145's `report.editor.*` retirement. No runtime consumer existed to
+  break.
+
+  Retiring a key from `common` was the ruled decision on objectui#4392 rather than
+  keeping it as vocabulary: nothing pins a dormant key's meaning, so its next
+  reader inherits an unreviewed contract, and a dormant key beside a live
+  `table.search` is where a second dialect gets started. The objectui#4328
+  dead-surface family has consistently chosen removal for zero-consumer surfaces.
+
+  The neighbouring `common.select` (minted one commit earlier by objectui#4386 /
+  PR #4397) is a different key and is untouched.
+
+  A negative pin (`packages/i18n/src/__tests__/common-search-retired-4392.test.ts`)
+  fails if the key returns to any pack, if any package reads or re-declares it, or
+  if a dynamic `common.*` reader grows a `search` member — every existing i18n gate
+  runs call site to key, and none of them can see a key with no call site.
+
+- fa51109: i18n: retire the orphaned `report.editor.*` namespace — 105 of its 106 keys, in all ten locale packs (~1050 translated strings)
+
+  The namespace labelled the hand-rolled report editor form. That form no longer
+  exists: `ReportConfigPanel`'s body is `ReportDefaultInspector`, a spec-driven
+  inspector whose labels come from the report spec's own metadata rather than from
+  a pack namespace. Until objectui#4137 the namespace had exactly one live reader,
+  and it was the objectui#4118 defect itself — the panel borrowing
+  `report.editor.title` (the label of the report's Title _field_) to name itself.
+  Moving that slot onto a purpose-built `report.editor.panelTitle` left the other
+  105 keys with no reader anywhere.
+
+  Re-verified before deleting, repo-wide and per key: no `t()` call site, no
+  dynamic `t()` template form, and no JSON or MDX reference reads any of the 105.
+  No user-visible string changes — these keys never rendered.
+
+  `report.editor.panelTitle` survives in all ten packs and is untouched; the
+  deletion sweeps around it. `report.editor` therefore remains a live namespace
+  holding exactly that one key.
+
+  This narrows the exported `TranslationKeys` type (`typeof en`), which is why it
+  is a minor rather than a patch: code indexing `TranslationKeys` at a retired key
+  stops type-checking. No runtime consumer existed to break.
+
+  A negative pin (`packages/i18n/src/__tests__/report-editor-retired-4145.test.ts`)
+  names all 105 retired keys and fails if any returns to any pack, since every
+  existing i18n gate runs call site to key and none of them can see a key with no
+  call site.
+
+- 78fa331: console: seed the UI language from the tenant's server-side locale
+
+  `GET /auth/me/localization` has always been fetched on every boot, but its
+  `locale` only ever fed currency/date formatting — the UI language was decided
+  entirely client-side, so a tenant configured `zh-CN` still handed every new
+  device an English console until each user switched by hand.
+
+  The tenant locale now sits in the language precedence chain, between the user's
+  own choice and the browser's:
+
+  1. the user's explicit choice (`objectui-locale`)
+  2. the tenant's server locale, cached at `objectui-locale-seed`
+  3. the browser language
+  4. `en`
+
+  The server value is cached in a slot of its own and is never written into the
+  explicit-choice slot, so it can never masquerade as a preference the user
+  expressed: only a manual switch promotes a language to an explicit choice. A
+  cached seed applies synchronously at bootstrap, and the in-app fetch refreshes
+  that cache from every successful answer, so a tenant that changes its locale
+  reaches choice-less devices on their next boot without an old seed pinning
+  them. On a device's true first visit the fetch is raced against a ~500ms
+  timeout alongside the console's existing pre-mount round-trips and fails open
+  to the browser language; a seed that arrives after the bound is cached for the
+  next boot rather than re-languaging a live session. A tenant locale this build
+  ships no pack for falls through to the next tier instead of half-rendering.
+
+  No platform additions: no new endpoint, no client read/write API, and
+  `sys_user_preference` is untouched.
+
+- 0082db8: The timeline's gantt bucket labels and its row-label default speak the session language
+
+  objectui#4513 routed every `Intl` call in the timeline renderer through `useDisplayLocale()`, so a Chinese session renders `2026年8月` on the month axis and `2026年8月11日` on item dates. Three sibling strings in the same renderer never went through `Intl` at all and stayed English on that same Chinese axis: the `week` header (`Week 1`), the `quarter` header (`Q3 2026`), and the gantt row-label column default (`Items`). The half-fixed state was the visible one — a Chinese date axis with English bucket labels beside it.
+
+  They are a translation concern rather than a locale-resolver one, and that distinction is the fix: a locale TAG formats a date, only a TRANSLATION spells a word. All three now resolve through the package's existing channel — `useTimelineTranslation` / `TIMELINE_DEFAULT_TRANSLATIONS`, the `createSafeTranslation` factory `ObjectTimeline` already uses for `timeline.bucket.*` — under three new keys carried by all ten locale packs: `timeline.scale.week`, `timeline.scale.quarter`, `timeline.gantt.rowLabel`.
+
+  The week number and the quarter/year ride the channel's own `{{hole}}` parameters rather than being concatenated, because the word order belongs to the translation: Chinese puts the year first (`2026年第3季度`), which no `Q${q} ${year}` template can produce at all. Only the row-label DEFAULT moved — an author who writes `rowLabel` still supplies their own string, and the `year` scale stays a bare `String(getFullYear())` with no vocabulary in it to translate.
+
+  English output is byte-identical to the retired literals: the `en` pack values are the same two templates the code used to interpolate by hand. `generateTimeScaleHeaders` is a pure exported function and cannot host a hook, so the translate fn is threaded in as an optional fifth parameter on the seam #4513 opened for `locale`, defaulting to the package's own defaults table — the same lookup the channel serves with no `I18nProvider` mounted. Existing three- and four-argument call sites are unaffected.
+
+  One consequence is worth stating because it looks like a bug and is not: dates and vocabulary resolve through different channels on purpose. `useDisplayLocale()` puts the tenant's regional default first (how this organization writes dates), while `t` follows the UI language (what this user reads). A tenant configured `en` whose user reads Chinese chrome therefore sees `Aug 2026` beside `第 1 周` — the same split `timeline.bucket.*` has always had.
+
+### Patch Changes
+
+- 932cbcd: An app you are not allowed to open now says so, instead of reporting that it may still be publishing
+
+  `GET /api/v1/meta/apps` is filtered per session server-side (`filterAppForUser`), so an app withheld by its `requiredPermissions` and an app that does not exist were byte-identical to the console: both simply absent from the list. With one fact and two conditions, `AppContent` rendered its only copy for an absent app — "This app is not available yet — it may still be publishing. Try again in a moment." — over a permanent authorization decision, under a Retry button that could never succeed.
+
+  That is not a cosmetic complaint. On a downstream acceptance round one role hit this screen while another opened the same app fine, and because the copy names a transient deployment state the finding was filed as a suspected platform defect and carried through two test batches before a clean-baseline investigation found the account was missing a permission-set binding. The gate had been working exactly as designed; the message is what sent everyone to the wrong place.
+
+  The maintainer ruling (2026-08-12) took the contract half first. objectstack#8013 made the BY-NAME route answer an explicit denial — `403` with the ADR-0112 catalog code `PERMISSION_DENIED` in the declared `{ success: false, error: { code, message } }` envelope — for an app that exists and whose `requiredPermissions` the session lacks, while the LIST route stays filtered exactly as before, with no `authorized: false` flag, so the enumeration surface is not widened past what a direct by-name probe already implies. Absence keeps answering `404 RESOURCE_NOT_FOUND`, and so do the two neighbouring refusals the same ruling deliberately left alone: an unpublished app (ADR-0045 §3 keeps it externally unobservable) and an app gated by an absent optional service (ADR-0057 D10 — nothing was denied to the caller).
+
+  This is the console half. When a requested app is missing from the list and the existing post-publish readiness re-check still cannot find it, the console asks the by-name route which of the two it is, through a new `ObjectStackAdapter.probeAppAccess(name)`. On the measured code it renders a plain authorization message with a way back to the launcher; on anything else — an absent app, an unreachable server, a host that injected a DataSource without the probe — today's publishing copy renders byte for byte, retry button included.
+
+  Two properties of that seam are load-bearing rather than incidental. It branches on the ADR-0112 **code**, never the status (objectui#4408): the two answers under test are both errors one status apart, and a status-reading implementation passes the happy path while going blind exactly where the defect lives. And only `denied` moves the copy: this bug exists because the console asserted a state it had not measured, so a probe that fails, times out or cannot be issued must leave the screen alone rather than guess in the other direction.
+
+  `probeAppAccess` is deliberately separate from `getApp` rather than a flag on it: `getApp` degrades every failure to `null` — the very conflation being undone — and memoises in the adapter's metadata cache, where a verdict about the CALLER would outlive the session it described. New public API on the adapter (`probeAppAccess`, `isAppPermissionDeniedError`, `APP_PERMISSION_DENIED_CODE`, `AppAccessVerdict`), purely additive; nothing existing changed shape. Three new `empty.*` keys ship in all ten locale packs.
+
+- 734d186: The console's Applications page is localized — its own chrome only, never the
+  server's words (objectui#4307).
+
+  `AppManagementPage` was raw English end to end: headings, the search field, the
+  selection and bulk controls, the six per-row actions with their tooltip/ARIA
+  pairs, the status badges, and every toast. It was the last un-i18n'd system page,
+  and #4233 / PR #4300 had just given it four live mutations — so the gap became
+  user-visible on every non-English console at the moment operators started using
+  it. 45 keys land under `appManagement.*` in all ten packs, reached through
+  `useObjectTranslation` with the call site's `defaultValue` inline, which is the
+  convention the neighbouring system pages already follow.
+
+  The split that shapes this change is between the strings the PAGE authors and
+  the strings the SERVER authors. `PUT`/`DELETE /api/v1/meta/app/:name` is gated on
+  `manage_metadata` (ADR-0066 D1), so a refusal like `forbidden: manage_metadata
+required` is the server's diagnosis of one specific request; there is no fixed
+  catalogue of those sentences to key against. Each failure toast is therefore a
+  keyed template with a `{{reason}}` hole, and what fills the hole is passed
+  through byte for byte, untranslated. The one part that IS the page's own — what
+  it says when the server sent no message at all — is keyed as
+  `appManagement.toast.unknownError`.
+
+  Two smaller things follow from doing the conversion properly rather than
+  mechanically. The per-failure entry of a bulk toast and the separator between
+  entries are keys, not literals, because bracket style and list punctuation are
+  locale properties (the same rule, and the same past defect, as
+  `validation.formInvalidJoiner`). And the row's controls now name an app through
+  the resolver the visible heading two lines away already used, with `t` passed:
+  an app carrying objectui's keyed label form previously rendered `Select [object
+Object]` into its checkbox's ARIA label.
+
+- 3fc2971: A null-keyed group renders as an explicit bucket instead of silently vanishing from a chart (objectui#4466)
+
+  `buildChartSeries`' single-dimension branch passed rows through verbatim, so a row whose category VALUE is `null` reached recharts with a null category and drew no mark. The visible outcome was not an empty chart but a quietly wrong one: rows `[{user_id: null, event_count: 51}, {user_id: 'Dev Admin', event_count: 2}]` drew exactly ONE bar — the dominant group, 51 of 53 events, dropped while the y-axis scale still accommodated it, so the chart understated its own data and the axis proved the data had been there. With every group null it drew axes, gridlines and an axis title with zero marks and no empty state, which is the shipped first-boot state of the built-in System Overview board's "Events by User" (every seeded `sys_audit_log` row is written with `user_id = NULL`).
+
+  The mapping lives in the shared series layer, so dashboard widgets and standalone `ObjectChart` get one answer rather than a per-chart patch in the recharts wrapper. It resolves the two-answers disagreement the card names as well: an empty result set keeps the designed empty state, a non-empty result always draws bars — the null bucket included.
+
+  `@object-ui/core` gains `NULL_CATEGORY_LABEL` and `ChartSeriesOptions`; `buildChartSeries` and `findChartSeriesRow` each take an optional trailing `options`. Both additive — every existing call site compiles and behaves identically, and a result with no null category is still returned by array identity. The two helpers are a pair on purpose: the caller matches a clicked segment against rows that still carry the raw `null`, so `findChartSeriesRow` reads the bucket label back to that row and the newly-visible bar keeps its drill-through instead of resolving to `-1`.
+
+  The label goes through the i18n channel (`chart.nullCategory`, en `(None)` / zh `(未指定)`, all ten packs), passed down by the renderer: `@object-ui/core` is React-free and cannot read the locale bundle, so it takes the resolved string the same way `dimensionOptionTranslator` takes a resolver. Its English constant is the floor for a provider-less host, not the mechanism.
+
+  `hasNoCategoryKey` (framework#4033) is untouched and now documented against this: a row that does not carry the category key AT ALL is a different defect — a dimension grouped by but never projected — and keeps its explanatory placeholder. The bucket deliberately never ADDS the key to such a row, which is what keeps that guard's signal alive. Key absent → the placeholder; key present with a null value → the bucket.
+
+- f7c6430: The build-history panel tells an operator a 503 means "the commit store could not be reached — retry", instead of `commits HTTP 503`
+
+  `packages/app-shell/src/preview/commitHistory.ts` flattened every non-OK response to a bare status code (`commits HTTP {status}` for the read, `HTTP {status}` for the revert). Nothing was ever swallowed and no fictional "no history" was ever rendered — those fail-loud properties held, and still hold, which is why objectstack#5980's 503-ification (ADR-0110 D3) needed no follow-up here. What was lost is the meaning the backend already sends, on the one screen where it matters most: this is the rollback surface, read by an operator who is usually mid-incident. A 503 says the read/write did not happen and is worth retrying; a 404 says the store answered "no". They now read differently, and 404, 500 and 503 stay tellable apart.
+
+  Failures now throw a `CommitStoreError` carrying `status`, the ADR-0112 `code`, and a `retryable` flag, and the panel renders a sentence rather than a number. The revert half gets a deliberately different sentence: a write that could not reach the store may still have landed, and re-issuing it appends a _second_ revert commit to an append-only log, so the copy asks the operator to re-read the timeline before retrying rather than simply saying "try again".
+
+  Two details of the report this fixes were checked against the producer and came back different, and both are the reason the copy is authored client-side. The semantic code arrives at **`error.code`**, not `details.code` — `HttpDispatcher.errorFromThrown` parks it in `details` and `buildApiError`/`splitSemanticCode` lift it out and drop `details` (objectstack#3842) — so a consumer reading `details.code` would run a check that can only pass vacuously. And the envelope's own `message` for this class is _withheld_: `declaresServerFault` (objectstack#5811) is true for a 5xx carrying a string code, so the prose on the wire is the generic `Internal server error`. Rendering it would have been strictly worse than the bare status code it replaced. Classification therefore keys on the HTTP status first and treats the code as a second signal, which also means a 503 shed by a proxy with an HTML body still produces the retryable reading.
+
+  Adds `preview.history.loadFailedUnavailable` and `preview.history.revertUnavailable` to all ten locale packs.
+
+- 92876f0: Doc comments no longer cite `@objectstack/spec` symbols the pinned spec has retired
+
+  Eight exported declarations carried a doc comment claiming alignment with a
+  `@objectstack/spec` symbol that `17.0.0-rc.6` does not export — four locale
+  formatting shapes in `@object-ui/i18n` (`SpecPluralRule`, `SpecDateFormat`,
+  `SpecNumberFormat`, `SpecLocaleConfig`) and four activity-feed shapes in
+  `@object-ui/types` (`FieldChangeEntry`, `Mention`, `Reaction`,
+  `RecordSubscription`). A citation that points at nothing is worse than a stale
+  one: the next reader cannot tell whether the protocol retired the symbol,
+  renamed it, or never had it.
+
+  Measuring all eight against the published registry answered that question, and
+  the answer was not "these names never existed". Every one was a real export the
+  protocol retired on purpose, and every local key set was faithful to the schema
+  it named. The feed four left `@objectstack/spec/data` in the `16.0.0` major,
+  when the feed surface was replaced by the data API over `sys_comment` /
+  `sys_activity`. The i18n four left `@objectstack/spec/ui` in `17.0.0-rc.6`
+  itself — they were still present in `rc.5` — retired under ADR-0049
+  enforce-or-remove because no authorable shape carried them and nothing ever
+  parsed them.
+
+  Each comment now records that provenance, including the version the symbol left
+  and what (if anything) replaced it, so the shapes read as declarations these
+  packages own rather than as a view onto a protocol type. Type shapes, runtime
+  behaviour and exports are unchanged — the published `.d.ts` files differ only in
+  comment text, which is why this is graded `patch`.
+
+- 828549a: The gantt's conflict dialog shows the number of affected tasks again, not a literal `{2}`
+
+  `gantt.conflict.body` was resolved at the render site with a literal string replace on **single** braces — `t('gantt.conflict.body').replace('{count}', String(n))` — while all ten locale packs spell the placeholder the i18next way, `{{count}}`. `"…{{count}}…".replace("{count}", "2")` consumes the inner seven characters and leaves the outer pair behind, so every user on every loaded pack read "自动重新排程 **{2}** 个受影响的任务？". The dialog now interpolates through i18next (`t('gantt.conflict.body', { count })`), the idiom `gantt.delete.body` already used.
+
+  The two sibling keys three lines away in the same file, `gantt.autoScheduleDlg.body` and `.skipped`, were **not** broken — pack and call site both used single braces, and they rendered correctly. They are converted anyway, because that split is the whole mechanism: two write-confirmation dialogs in one component carried two different interpolation idioms, so `conflict.body` drifting to the i18next spelling in the packs (which is the correct spelling, and matches every other placeholder in the bundle) silently broke the render. Leaving the auto-schedule keys on the literal-replace idiom leaves the same trap armed for the next translator. All ten packs and the plugin's bundled English fallback table now agree on `{{count}}` for all three; only the braces moved, no translation was reworded.
+
+  `gantt.quickFilter.resultSummary` stays deliberately single-brace — its `ObjectGantt` call site really does resolve `{shown}`/`{total}` with a literal replace, and that convention is pinned by its own parity test. It is now the only key in the gantt namespace on that idiom, and the comments at both spellings say so.
+
+  Nothing caught this, and each gate was silent for its own reason: the cross-pack parity check compares en against each pack, and all eleven spellings agreed; the en-drift check compares a pack against its own history, and the packs were born matching. Both are **relative** comparisons, and the defect lived in the **absolute** relationship between a pack's spelling and the syntax the call site resolves. The existing render test asserted the dialog body contains `'1'` — which `{1}` satisfies. The new pin asserts the absolute form directly, under a real loaded pack, for every way a placeholder can survive to the screen.
+
+- e1ade8f: An illegal gantt dependency link now says why it was refused, instead of doing nothing
+
+  Dragging a dependency onto a target the gantt refuses — itself, a locked row, a group row, or one that would close a dependency cycle — produced no feedback of any kind: no toast, no dialog, no cursor change, no target outline, not even a console warning. The guard was right and completely invisible, so a user drawing a legitimate-looking dependency got a dead interaction and no way to learn the constraint. The rejection was silent in both places it could have shown: a refused bar never became the drop target, so it got no hover treatment at all, and the release handler only ran its body when a target _had_ been registered, so the drop itself was a no-op.
+
+  Both halves are now wired, and both read the **same** verdict. `canReceiveLink`'s four-branch boolean became `classifyLinkTarget`, which returns which branch refused (or `null`), with the boolean derived from it. The hover affordance and the drop toast are two consumers of that one classification, so the reason a user is shown cannot drift from the reason the link was actually refused — there is no second classifier to disagree. The branch names are the leaves of the new `gantt.link.rejected.*` keys, so a branch added later without a message surfaces as a missing key rather than as a plausible-but-wrong sentence.
+
+  During the drag, a refused bar under the pointer gets `cursor: not-allowed` and a destructive outline; on release it raises a toast naming the reason. Four messages, one per branch, in all ten packs. Both the cursor and the outline are driven from inline `style` rather than utility classes, matching the bar's existing read-only cursor three lines away and for the same reason recorded there: `cursor-not-allowed` and the ring alpha utilities are not emitted in the prebuilt components CSS, so a class would look correct in a DOM test and render nothing in a browser.
+
+  Deliberately unchanged: a host veto through `onBeforeDependencyCreate` stays silent. That rejection carries a reason only the host knows, and the gantt has none to show — surfacing it means exposing a rejection-reason output on the public component, which is a separate contract rather than a rider on this one. The four built-in reasons are the gantt's own policy and are the only ones it can explain.
+
+  One of the four, `group`, has no end-to-end path today: a `type: 'group'` row renders no bar, so the drag can never target it. The message is kept anyway — without it the branch would render a raw key on screen if it ever did fire — and the test pins the reachability fact, so it goes red the day group rows gain a bar. Filed as objectui#4209.
+
+- 3e19fe7: i18n copy: one ellipsis glyph across the ten packs, `usted` in the es draft-preview empty state, and a pt sentence that stops contracting `de` onto its own hole
+
+  Three locale-copy defects that no gate could see, because all three are _value_ defects on keys whose names, placeholders and key sets were already correct.
+
+  **One ellipsis (objectui#3878).** `en` ended 33 values with three ASCII full stops (`Loading...`, `Ask anything...`) and 110 with the typographic ellipsis `…`, and the nine translation packs had copied `en` value by value — so a user could read both glyphs on one screen: `common.loading` beside `dashboard.loading`, `console.ai.askAnything` beside its own panel's siblings. All ten packs now spell it `…` (U+2026), per the maintainer-authorized consistency pass registered on objectstack#6015. 312 pack values changed: 34 in `en` (the 33 trailing plus the one mid-sentence `collaboration.commentPlaceholder`) and 278 across the nine. Eleven inline `defaultValue` call sites were re-synchronised with the new `en` text, which `scripts/check-i18n-call-site-keys.mjs` requires byte-for-byte.
+
+  The convention is now pinned so the split cannot regrow: `packages/i18n/src/__tests__/ellipsis-glyph-3878.test.ts` fails, by key name, on any value in any of the ten packs that holds three ASCII full stops. It is deliberately wider than "a trailing `...` in `en`", because the census showed the narrow rule would have shipped with two holes in it — `collaboration.commentPlaceholder` puts the ellipsis mid-sentence, and `list.loading` had the packs wrong while `en` was already right, which no `en`-only rule can see.
+
+  Fifteen module-local **no-provider fallback** entries were moved with the packs, across `useCollaborationTranslation`, `useFieldTranslation`, `useDetailTranslation`, `ObjectGrid`, `KanbanImpl`, `data-table` and `ConnectionStatus`. Those maps exist to render when no `LocalizationProvider` is mounted, and each one's own docblock requires it to stay byte-identical to the `en` pack — a requirement objectui#3440 already enforces mechanically for the collaboration map. Leaving them behind would have made the provider-less path disagree with the provider path on ten keys.
+
+  **es `usted` (objectui#3875).** `preview.empty.notReadyDescription` said `Revisa la conversación` — the tú imperative — in a namespace that is otherwise 23:1 usted, and it renders _underneath the usted draft-preview banner at the same moment_, not before or after it. `Revisa` → `Revise`; nothing else in the sentence carries a register. The neighbouring `approvalsInbox` namespace is legitimately tú and was left alone.
+
+  **pt contraction (objectui#3877).** `ConcurrentUpdateDialog` splits `detail.concurrentUpdateDescription` on `{{field}}` and renders a bolded label in the gap, and pt left a bare `de` in front of that gap. When the multi-field conflict branch passes the record label (`este registro`), Portuguese users read `de este registro` — a contraction error every native speaker sees, and one that no spelling of the leaf value could fix (`deste registro` renders `de deste registro`). The pt sentence is rewritten so the hole is preceded by the verb `afeta` instead of any preposition, which closes the whole class rather than trading `de` for an `em` or `a` that contract just as hard. pt only; `en` is unchanged.
+
+  No behavior, no keys added or removed, no placeholder changed.
+
+- bb58d1d: i18n: the two search placeholders become pack values, and four values the packs served in English get translated
+
+  **objectui#4375** — `ListView` and `LookupField` built their search placeholder as
+  `t(key) + '...'`, so the ellipsis was a literal concatenated in code: it stayed ASCII
+  in all ten locales on screens where objectui#3878 had converged everything else on
+  U+2026, and no pack could opt out of it (sharpest in `ar`, where a left-to-right run
+  was appended to right-to-left text). Both now read `table.search`, which is already
+  the repo's search-input placeholder key — `data-table`, `RecordPickerDialog` and
+  `PeoplePicker` render it too — and is translated with the right ellipsis in all ten
+  packs. No new keys.
+
+  **objectui#4376** — `list.loading` served the English `Loading records…` in eight of
+  the nine translation packs (`zh` alone had translated it); `designer.undo` and
+  `designer.redo` were English in all nine; `appDesigner.snakeCaseHint` in `ko`, `pt`,
+  `ru` and `ar`. All translated, reusing each pack's own established vocabulary. A new
+  pin (`untranslated-identity-4376.test.ts`) fails on any value byte-identical to `en`
+  inside a non-Latin pack unless the key is on an explicit 22-entry allowlist.
+
+- 5cc847c: The console shows a standing impersonation banner, with an exit that fails loudly (#4467).
+
+  While `session.impersonatedBy` is present, `ConsoleShell` renders a banner naming BOTH
+  parties — the impersonated user, whose name every write is recorded under, and the
+  administrator who started it — plus a stop affordance. It derives from the session rather
+  than from client memory of the click, so it survives a full SPA reboot, a new tab and a
+  browser restart, and it cannot disagree with who the server thinks is acting. An ordinary
+  session renders `null` and its chrome is unchanged.
+
+  The exit calls `POST /auth/admin/stop-impersonating` over the same data lane and then
+  awaits a session refresh. The server restores the administrator from the `admin_session`
+  COOKIE, so a deployment that blocks cookies cannot exit this way — the banner says so and
+  stays up instead of appearing to succeed, which would leave the operator doing ordinary
+  work under someone else's identity.
+
+  Ten locale packs carry the banner's copy.
+
+- fa21254: Kanban: a drop that makes fields required now collects them instead of dead-ending
+
+  Dragging a card into a column whose value flips a field's `requiredWhen` predicate to TRUE used to PATCH the column value alone. The engine refused the whole update — correctly, that is what the predicate declares — and the board had no way to finish the move: the only path to closing a won deal was to abandon the board and open the record form. HotCRM's opportunity pipeline is the reported case (`win_reason` is required when `stage == "closed_won"`), but the dead end belonged to every board whose target column carries a conditional requirement.
+
+  The board now evaluates the target column's predicates BEFORE writing anything. If the move would make fields required while they are still empty, it opens a small dialog collecting exactly those fields, then submits the column value and everything collected as ONE PATCH — never two writes, which would leave the record in the refused state if the second one failed. A drop that triggers no predicate is untouched, down to the PATCH body.
+
+  The verdict comes from `@object-ui/core`'s `resolveFieldRuleState` — the same evaluator the record form, the wizard and the line-item grid already resolve `visibleWhen`/`readonlyWhen`/`requiredWhen` with, delegating to `@objectstack/formula`'s CEL engine. The board's prompt and the server's enforcement therefore reach the identical verdict rather than drifting through a second hand-rolled predicate evaluator. Emptiness is core's `isMissingForRequired`, the presence contract the form and the server share, so a `false` boolean and a `0` count as answers and are not re-asked.
+
+  Every control in the dialog is `@object-ui/fields`' `FieldEditWidget`, the same widget the record form renders for that field type — a select edits as a select, a date as a date picker — so this adds no second set of field-rendering decisions.
+
+  Four kinds of field are deliberately NOT collected, and each falls through to the unchanged PATCH where the server's refusal (legible since objectstack#7525) speaks for itself: one that already has a value, one `visibleWhen` hides, one that is readonly, and one whose type has no edit widget at all. A dialog row with no control would be a worse dead end than the one being fixed.
+
+  Cancelling writes nothing and leaves the card in its original column; a combined PATCH that is still refused for some other reason surfaces the refusal and rolls back exactly as a plain rejected move does, rather than looping the dialog on an arbitrary server error.
+
+  `@object-ui/i18n` carries two new `kanban.*` strings for the dialog, translated across all ten packs. Its public type surface is unchanged — the `.d.ts` was measured identical before and after — hence the patch bump.
+
+- 33c32bf: List sort: the picker stops borrowing the filter whitelist, and a header click is no longer a one-way door out of the view's declared sort
+
+  `filterableFields` was applied to the single field set both toolbar builders read, so a whitelist authored for _filtering_ silently became the _sort_ whitelist too. A view could declare a two-level default sort — `plan_start_date` then `name` — and get a sort panel that offered neither field and rendered both of its rows blank: the declared sort worked on load and could then be neither reproduced nor modified, and there was no way to express "sortable but not offered as a filter condition" short of widening the filter builder as collateral. The whitelist now narrows the filter builder alone, which is the contract it was written for; the sort picker starts from every field the view can name and applies its own sortability rules.
+
+  Those rules are about what the sort can honestly reach, so a second one joins the existing relational exclusion: a `formula` field is withheld. It has no materialised column, so ordering by one is refused by the server outright (objectstack `UNMATERIALIZED_SORT_TYPES`) — and it matters here precisely because the base set widened, since a formula field previously reached the picker only if someone had whitelisted it. The exclusion is `formula` alone and deliberately not the spec's `COMPUTED_VALUE_TYPES`: `summary` and `autonumber` are computed too, each gets a real maintained column, and both order correctly. Either rule keeps its existing escape hatch — a field the current sort already uses stays listed, which for a formula field is the only way to remove the offending row.
+
+  One consequence worth naming: the hint explaining the relational omission used to be gated by the same whitelist. A view whitelisting only `status` showed a near-empty sort picker and no word about why; the withheld relational field now reaches the rule that withholds it, so the explanation appears with it.
+
+  The second half is the way back. One column-header click replaces the whole sort array, so a view shipping a multi-level default lost it for the rest of the session — the declared `sort` behaved as an initial value only, recoverable just by reloading the page. The sort panel gains a **Reset to view default** control that restores the declared array whole: multi-level, in declared order, not merely cleared. It reads the view's declared sort through the same resolver the initial render already uses, so there is one answer to "what did this view declare". It is disabled while the active sort already matches that default, and absent entirely for a view that declares no sort — there is no default to return to, and clearing the sort under that label would be a second, differently-named way to do what removing the rows already does. The header click's own semantics are unchanged: it still replaces the array, it just no longer does so irreversibly.
+
+- 6d641c9: Members & invitations tabs gate their affordances by org role instead of letting the server's 403 be the UI (#4475)
+
+  A user whose organization role is `member` opened the workspace members page and
+  was shown an enabled **Invite member** button plus a per-row **Member actions**
+  menu carrying **Remove member** — on every row, the workspace Owner's included.
+  Nothing was hidden or disabled; the action only failed after the user had
+  committed to it. The Settings tab of the same page already gated correctly; the
+  members and invitations tabs never got the same treatment.
+
+  The affordances are now narrowed to the roles that can actually use them, keyed
+  on the active member's role — the same source the role-change menu on this page
+  already reads. Which roles those are is **measured against the routes that
+  enforce them**, not assumed to be "owner":
+
+  | affordance        | route                             | permission              | roles                         |
+  | ----------------- | --------------------------------- | ----------------------- | ----------------------------- |
+  | Invite member     | `/organization/invite-member`     | `invitation:["create"]` | owner, admin, delegated_admin |
+  | Remove member     | `/organization/remove-member`     | `member:["delete"]`     | owner, admin                  |
+  | Cancel invitation | `/organization/cancel-invitation` | `invitation:["cancel"]` | owner, admin                  |
+
+  Three different gates, because `delegated_admin` holds `invitation:["create"]`
+  without `member:["delete"]` and deliberately without `cancel` — so it keeps the
+  invite button and the copy-link action while losing remove and cancel. A single
+  owner check could not express that.
+
+  An actor left with no row action at all gets no menu rather than a trigger that
+  opens onto nothing, and the members page explains the absence where the Invite
+  button used to sit, in the Settings tab's own voice. An unresolved role is
+  treated as the least privileged, so nothing privileged is offered to a viewer
+  whose membership could not be read.
+
+  Reading the pages is unaffected: the member list and the invitation ledger still
+  render in full. Whether `org_member` should be able to read the invitation
+  ledger at all is a separate, server-side question.
+
+- 45e1949: Numbers render in the user's locale, and a `Field.number` year is no longer `2,026`
+
+  Every numeric field the console rendered went through an `Intl.NumberFormat` built with the locale hardcoded to `en-US` and `useGrouping` never set. Two defects rode in that one construction: a `zh-CN` or `de-DE` console still grouped and pointed decimals the US way, and a four-digit **year** stored as `Field.number({ scale: 0 })` rendered as `2,026` — in every locale, with no field property able to turn it off. Apps had been converting year columns to `Field.text` to escape it, permanently trading numeric comparison, range filters and dataset dimension types for a display detail.
+
+  The construction had been copied into five places — the number cell renderer, the currency cell renderer, the `CurrencyField` widget, the compact `formatNumber` helper, and the dashboard `MetricWidget` — so fixing any one surface never changed the answer. They now share one formatter, `formatDisplayNumber` in `@object-ui/i18n`, which owns the locale and the grouping policy together, plus one locale resolver, `useDisplayLocale`.
+
+  `useDisplayLocale` composes the two locale channels this repo already had rather than adding a third: the tenant's regional default (`useLocalization().locale`, ADR-0053) when an org has configured one, otherwise the active UI language (`useObjectTranslation().language`) so grouping and decimal marks follow a language switch. That second step is what covers the case the report was measured in — a fresh database, where the tenant localization endpoint has no locale to give.
+
+  Grouping is now suppressed when a field declares `scale: 0` and carries no currency, which is what makes years, fiscal periods and other ordinals render plainly. This is an **interim default** with an accepted cost: a large scale-0 _count_ loses its separators too. It holds only until the spec gains an authorable presentation hint, which is being specified separately, contract-first; when that lands it overrides this heuristic.
+
+  Three surfaces deliberately keep their separators, because a zero-decimal display there does not come from a field declaration: the dashboard `MetricWidget` (its decimals are parsed from a numeral.js format pattern, and its own contract calls the separators load-bearing — "`1,930,000` not `1930000`"), the `element:number` aggregate renderer, and every currency path including amounts whose currency code could not be resolved. An **undeclared** `scale` also keeps grouping — absent means "decimals unknown", not "integer".
+
+  `formatCurrency`, `formatCompactCurrency` and `formatNumber` each take a new optional trailing `locale` argument. Existing calls are unaffected; omitting it now follows the runtime default rather than forcing US conventions.
+
+- 58bebf6: Organization & invitation console: translate the English holdouts a zh session was left reading (#4474)
+
+  Three families of string, one sweep over `console/organizations/`:
+
+  - **Role names** now come from the single shared `ORG_ROLE_LABELS` map at every
+    site. The role badges on the members and invitations pages were rendering the
+    raw server identifier (`owner`) under a CSS `capitalize` that made it look like
+    a label in English and left it untranslated everywhere else; the accept page
+    did the same in its role row and inside its otherwise-translated sentence. The
+    map's four `organization.roles.*` keys existed in no locale pack, so even the
+    dropdown that did consult it fell through to English — all ten packs now carry
+    them. An unrecognized role renders verbatim rather than blank.
+  - **Server-echoed errors** are mapped by better-auth's stable `code`, never by
+    matching its English text. `createAuthClient` was dropping that code for every
+    `organization.*` call while preserving it for sign-in/sign-up, so the console
+    had nothing to key on; all sixteen organization methods now go through the same
+    `toAuthError` helper. Messages are unchanged — the code simply stops being
+    thrown away. An unmapped code still shows the server's own sentence.
+  - **Icon-only `aria-label`s** (member actions, copy invitation link, cancel
+    invitation, and a fourth on the share-link copy button) are translated — for an
+    icon-only control this is the only name a screen reader gets.
+
+- 405e808: `pickLocalized` reads own properties only, and takes only string values, on every limb
+
+  The resolver read four of its six limbs — the exact tag, the base language, `default` and `en` — with a bare bracket access. Bare access walks the prototype chain, so a locale that happened to name an `Object.prototype` member resolved to that member and the function stringified it into the label: `pickLocalized({ en: 'Pricing' }, 'constructor')` returned `function Object() { [native code] }`, and the same held for `toString`, `valueOf`, `hasOwnProperty`, `isPrototypeOf`, `propertyIsEnumerable` and `toLocaleString`. Those same four limbs also skipped the `typeof === 'string'` filter the regional and last-resort limbs already applied, so a non-string value short-circuited the chain and rendered as `[object Object]`.
+
+  Both guards now apply uniformly. A guarded limb **misses** rather than aborting the resolution, so an unusable entry falls through to the next limb exactly as an absent one does — `pickLocalized({ en: 'Pricing' }, 'constructor')` is now `'Pricing'` (the `en` limb), and only a map with no usable entry at all resolves to `''`. An empty-string value is still a hit, because `''` is a label the author wrote.
+
+  No real language tag can observe this: no BCP-47 tag is an `Object.prototype` member, and the inline locale map is declared `z.record(<tag>, z.string())`, so every in-contract input resolves byte-identically to before. What it changes is agreement with the backend twin `resolveI18nLabel` (objectstack#6765), which shipped with exactly these two narrowings recorded as deliberate departures from this function because on a server the locale can arrive in an `Accept-Language` header. That recorded rule divergence is now zero; the only remaining difference is how each side spells a miss (`''` here for a text node, `undefined` there for a producer's fallback chain), which is pinned as an identity in the cross-resolver parity table.
+
+- c0f9a4b: Studio surfaces the runtime authoring gate's advisory findings instead of discarding them client-side
+
+  The framework's runtime authoring gate produces two kinds of verdict on a metadata write. Errors become a 422 and the author sees them. Advisories ride a **200** — the save succeeded, the row persisted, the version bumped — and until objectstack#7435 the server dropped them into a deduped `console.warn` behind a process-level set. That landing put them on the wire as an optional `advisories[]` on the save response, emitted only when non-empty, and objectui was still throwing them away one layer further out: `MetadataClient.save` parsed the body, returned it as an opaque `T`, and every call site awaited it for its side effect and discarded the value.
+
+  The measured case the fix is built on: a `nightly_purge` flow whose only defect is a `delete_record` node with `multi: true` and no filter yields `errors = 0 / advisories = 1`. The save returns 200, the flow goes live, and nothing anywhere tells the author it deletes every row. That matters most for exactly the authors Studio serves — a Studio tenant or an MCP/AI author has no `os lint` and no CLI config for `sys_metadata` overlay rows, so this gate is not the weakest of four doors, it is the only one.
+
+  `MetadataClient` now carries an `onSaveAdvisory` sink, invoked after a save whose response carried a non-empty `advisories[]`, and the console wires it in `useMetadataClient` — the one hook every app-shell write path takes its client from, so a single wiring covers `ResourceEditPage`, `StudioDesignSurface`, `EmbeddedItemEditor`, `DatasourceResourcePage`, `ObjectHooksPanel` and any future call site rather than a toast copied into twenty of them. The finding shape is re-exported from `@objectstack/spec` (`RuntimeAuthoringIssue`) rather than restated, so it cannot fork from the 422 `issues[]` it deliberately shares a declaration with.
+
+  The affordance is the warning tier and says "Saved" first. A successful save that reads as a failure is the specific defect this surface must not ship, so the toast acknowledges the write, lists `rule` + `message` + `hint` per finding with `where` as secondary context, and renders that text **verbatim** — `message` and `hint` are server prose composed by the gate's rules, not i18n keys. Only the frame around them is translated (`console.saveAdvisoryTitle`, ten packs). The sink is best-effort in both directions: a malformed finding is dropped rather than printed as blanks, and a throwing renderer cannot turn a save the server already committed into an error.
+
+  **What this does not surface yet, and why.** Studio's designer saves as a **draft** on every edit, and drafts are never gated — the framework returns at its D1 early-return (`if (args.state !== 'active') return null`) before running a single rule, so a draft save produces no findings at all rather than producing some that get withheld. The publish step that promotes a draft to active _does_ run the gate, but the publish route returns no `advisories` field until objectstack#7294 lands. So a draft-then-publish flow renders nothing today, at both of its doors, for two different reasons; the active-mode save door renders findings now. That gap is pinned as a test rather than left for a reader to rediscover.
+
+- d46f9b8: i18n: `createSafeTranslation`'s provider-less fallback now honours a call site's inline `defaultValue`
+
+  `fallbackT` looked its key up in the hook's hand-written `defaults` map and, on a miss, rendered the
+  **raw key** to the user — then ran every option, `defaultValue` included, through the interpolation
+  loop as if it were a `{{defaultValue}}` variable. So `t('perm.facet.none', { defaultValue: 'None' })`
+  showed `perm.facet.none` on a host with no `I18nProvider`, which is a supported scenario (standalone
+  embedding and tests are the whole reason this factory exists).
+
+  The lookup order is now `defaults[key]` -> a string `defaultValue` -> the key, matching i18next,
+  which serves the provider path: the defaults map is the pack value's stand-in here, so it keeps the
+  pack's winning position. `defaultValue` is also excluded from the interpolation loop as a reserved
+  name — it selects the string, it does not fill holes in one. Non-string `defaultValue` is ignored.
+  The provider path is untouched.
+
+  Measured over all 26 `createSafeTranslation` hooks in the repo: 27 keys reach a hook whose defaults
+  map lacks them, 21 of those carrying an inline `defaultValue` that used to be dropped (16 keys in
+  `plugin-detail` alone). Those 21 now render their English instead of a raw key on provider-less
+  hosts; the other 6 pass no inline default and still need a map or pack entry.
+
+- 2fea4d2: `detail.showEmptyRelated` renders Russian and Arabic again — the "+N empty" button no longer falls through to English at the counts it takes most often
+
+  This was the repo's only pre-existing i18next plural family, and all ten packs defined exactly two slots: `_one` and `_other`. i18next asks `Intl.PluralRules` for the one suffix a language needs for that number, and when the pack has no such slot it walks `fallbackLng` to `en`. Russian has four plural categories and Arabic six, so `ru` at counts 2-4 (`few`) and 5-20, 25-30, … (`many`), and `ar` at 0, 2, 3-10 and 11-99, resolved nothing locally and rendered the English string. The call site is the collapsed-empties button in the record detail's reference rail, whose count is the number of empty related lists — 2 to 4 are the most common values it ever takes, so a Russian user essentially always read English.
+
+  The fix is a base key (no suffix) beside the two existing slots, in all ten packs. The base key is always in i18next's lookup chain, so every category a pack did not enumerate resolves to it, in that pack's own language — and, unlike adding `_few`/`_many` to `ru` alone, it keeps the ten packs' key sets identical, which full key parity requires. Same shape objectui#3546 slice six established for `perm.facet.*`. Where the base key is genuinely reachable it carries a count-invariant phrasing: `ru` uses the «Существительное: {{count}}» form the pack already writes 22 times, `ar` the «{{count}} مفرد(جمع)» marker it uses throughout. For `en`/`de`/`zh`/`ja`/`ko` the base key cannot be reached at all (their categories are covered by the two existing slots) and repeats `_other` for parity; `fr`/`es`/`pt` reach it only from a million up, where the plural form is already correct. No English copy moves.
+
+  The provider-less path needed the same row for a different reason: `createSafeTranslation`'s fallback resolves `defaults[key]` literally and never appends a plural suffix, so the two suffixed rows in plugin-detail's defaults table were unreachable through it and that path answered with the raw key. It now carries the base key too.
+
+  Parity across packs turned out to be necessary and not sufficient — ten identical key sets were green throughout, because the defect is one level below key names: the slot the language needs is not in the set. So the invariant "a plural family must carry a base key" is now asserted over all ten packs in `all-locales-key-parity.test.ts`, where it is pack-intrinsic and fails at PR time without needing a call site to exist. It went red on all ten packs before this change and names the family that is missing its base.
+
+- 7f1cb33: List sort: the relational hint stops recommending a formula field, the one type the server refuses to sort by
+
+  The Sort panel withholds columns that link to another record and explains why, and the last sentence of that explanation named the remedy: _add a formula field holding it_. A formula field is exactly what the platform will not order by. The server keeps `UNMATERIALIZED_SORT_TYPES = new Set(['formula'])` and, since objectstack#6994, a sort naming one is a hard `400 INVALID_SORT` — before that it degraded silently, returning every row with `asc` and `desc` byte-identical. So an author who read the hint, followed it, and built a formula field arrived at a refusal; and since #4243 withheld formula fields from this very picker, at a field the panel does not offer either. Two doors, opposite advice, for one problem.
+
+  The remedy sentence now names a **stored, denormalised field — written when the source changes** — and rules the formula field out in as many words: it is virtual, no column is stored for it, and the server refuses to sort by one. That is deliberately the server's own vocabulary rather than a third phrasing of the same fact: objectstack#6924 and objectstack#6994 settled on one wording across the refusal doors so an author refused twice is not sent two different ways, and this is the UI door of that same set. The first half of the hint — why relation columns are withheld at all — is unchanged.
+
+  All ten locale packs move together, as `check:i18n-drift` requires of any `en` edit. The same sentence also lives in `plugin-list`'s provider-less fallback table, which is what renders when the component is used outside an `I18nProvider`; it is updated to match `en` byte for byte, because a pack-only reword would have left the retired advice on exactly the surface this fixes.
+
+- 2e3b0c0: fix(list): an `OBJECT_API_DISABLED` list request renders an honest cannot-work state instead of the empty state
+
+  A list pointed at an object whose `enable` block withholds the API rendered its ordinary
+  empty state, so _"this page cannot work, and never could"_ reached the user as _"you have no
+  records"_ (objectui#4408). The reported instance — `Setup › Advanced › Signing Keys`, whose
+  `sys_jwks` declares `enable.apiEnabled: false` — could not load for any persona and said so
+  to nobody. That is also why the upstream defect objectstack#7544 survived review for its
+  whole life: a merely unpopulated page invites nobody to click through.
+
+  The masking had two halves, in two packages, and neither package could see the other:
+
+  - **`@object-ui/data-objectstack`** (minor — see the grading note below) — `find()` degraded
+    **every** 404 into `{ data: [], total: 0 }` and memoised the resource, so the denial arrived
+    at the surface as a successful empty result, indistinguishable from a genuinely empty
+    object. The two `enable`-block denials are now let through instead: `OBJECT_API_DISABLED`
+    (404) and `OBJECT_API_METHOD_NOT_ALLOWED` (405). The memo skips them too — absorbing one
+    would have pinned the object to "empty" for the rest of the session.
+  - **`@object-ui/plugin-list`** — the load-error panel gained an `api-disabled` kind. The 405
+    half was never swallowed, so it already reached this panel, but classified as `network`:
+    _"check your connection and try again"_ for a condition no retry can change. It now says
+    the object is not exposed through the API, that this is a setting on the object rather than
+    a permission, and it offers **no Retry** button, because every retry re-fetches the
+    identical refusal.
+
+  Both denials are pure functions of the object's metadata — no user, no permission, no
+  context — so neither is transient or per-user, which is exactly the case where a silent empty
+  state is most misleading. Discrimination is on the ADR-0112 `code`, never the status: a
+  missing collection, a missing record and a disabled object are all 404.
+
+  **A genuinely empty object still renders the ordinary empty state**, and a backend without an
+  optional collection still degrades to empty — pinned in both directions, at the adapter, at
+  the view, and once end-to-end over a real adapter and a real `ListView`.
+
+  Also closes a code-propagation gap on the same path: `find()`'s raw `$expand`/`$search`
+  branch bypasses `@objectstack/client` and hand-rolled its own error, stamping only `status`.
+  It now carries the ADR-0112 envelope (`code` + `httpStatus`), so a denial arriving on the
+  branch a list takes whenever it expands a lookup or runs a search is no longer anonymous.
+
+  New strings: `list.loadErrorApiDisabledTitle` / `list.loadErrorApiDisabledMessage`, in the
+  `en` pack and mirrored in the list defaults map.
+
+  ## Grading note — why `@object-ui/data-objectstack` is **minor** and not patch
+
+  Two independent reasons, either of which is sufficient under this repo's precedent
+  (objectui#4403 / #4177, and #4485's grading of `@object-ui/core`'s `toDomProps` lift):
+
+  1. **The emitted `.d.ts` grows two NEW exports.** `isApiAccessDeniedError(error: unknown):
+boolean` and `API_ACCESS_DENIED_CODES` (the readonly tuple
+     `['OBJECT_API_DISABLED', 'OBJECT_API_METHOD_NOT_ALLOWED']`) are added to the package's
+     public surface. Additive surface growth is minor.
+  2. **Observable behaviour on a published API moves.** `ObjectStackDataSource.find()` now
+     **REJECTS** for the two `enable`-block denial codes where it previously **RESOLVED** with
+     `{ data: [], total: 0 }`. No signature changed and nothing was removed, but a caller that
+     relied on those two codes arriving as a successful empty result now receives a rejected
+     promise carrying `code` + `httpStatus`, and must handle it.
+
+  Deliberately unchanged, and still resolving to an empty result exactly as before: a bare 404
+  with no code, `OBJECT_NOT_FOUND` (still memoised) and `RECORD_NOT_FOUND`. The behaviour move
+  is scoped to the two denial codes named above and to nothing else.
+
+  Not major: this follows AGENTS.md's version-alignment rule — objectui's major tracks
+  `@objectstack`'s, so this repo's own breaking semantics are declared as minor with the change
+  described in the body, which is what this note is.
+
+- 31ab1ac: fix(print): `window.print()` produces a usable page, and the Print buttons say what they do
+
+  The list, report and dashboard Print controls were bare `window.print()` calls with no
+  print stylesheet, so the browser printed the whole console — sidebar, top bar, chat rail,
+  toasts — with the data table clipped to a single viewport. With no label to the contrary
+  they were being accepted against "export to PDF" requirements, which they have never been.
+
+  - `@object-ui/app-shell/styles.css` gains a shared `@media print` block: it hides the shell
+    chrome, prints the active content area full-width, releases the viewport-height flex chain
+    so long tables paginate instead of clipping, repeats table headers on every sheet, and
+    neutralises dark mode (which otherwise prints white-on-white). One sheet serves list,
+    report and dashboard.
+  - The list and report Print buttons carry a tooltip and accessible name stating that they
+    open the browser's own print dialog and are not a PDF export (new `common.printDialogHint`,
+    translated in all ten locale packs).
+  - The dashboard's `export_dashboard_pdf` action no longer toasts "Preparing PDF export…" —
+    it names the print dialog it actually opens (`dashboardActions.pdfPreparing` is replaced by
+    `dashboardActions.printDialogOpening`).
+
+  No control was removed and no headless detection was added. A real print/PDF primitive
+  remains out of scope (`objectstack-ai/objectstack#1301`, closed NOT_PLANNED).
+
+- 06915b0: fix(i18n): every date branch threads the active locale, so a `zh` session no longer renders half its dates in English
+
+  Date rendering had two locale channels and only one followed the user's
+  language, so the same row could read `逾期 6 天` in one column and `In 3 days`
+  in the next, with a datetime column showing `8/11/2026 12:00 am`
+  (objectui#4468).
+
+  The overdue phrase resolves through the translate fn (the active UI language),
+  while every `Intl` branch took its tag from the raw tenant locale
+  (`useLocalization().locale`) — which is `undefined` on any workspace that never
+  configured one, and `undefined` makes `Intl` use the _machine's_ locale.
+  `DateTimeCellRenderer` passed no tag at all.
+
+  Every date-formatting site in `@object-ui/fields` now resolves through the one
+  existing channel, `useDisplayLocale()` (tenant regional default → active UI
+  language → `en`): `DateCellRenderer` (relative past, relative future, near-today
+  and the beyond-±7-days absolute fallback), `DateTimeCellRenderer`, the read-only
+  `DateField` / `DateTimeField` / `FormulaField` faces, and the sub-grid's
+  temporal cells. English output is unchanged, and the already-localized overdue
+  wording is untouched.
+
+  No public signature changed. `@object-ui/i18n` carries a documentation
+  correction only: `useDisplayLocale`'s docstring claimed `DateCellRenderer`
+  already formatted from this channel, which was the very thing that was not true.
+
+- ff84b05: Stop the report config panel being titled "Title", and the view-settings colour section "Color"
+
+  Two call sites asked for a key whose value was written for a different slot, so the rendered copy was wrong (objectui#4118, surfaced by objectui#3810's census).
+
+  `ReportConfigPanel` used `report.editor.title` for both its heading and the accessible name of its `role="complementary"` landmark. That key is the label of the report's Title _field_ — `report.editor.titlePlaceholder` ('e.g. Pipeline by Quarter') sits directly under it in the pack. So the panel was headed "Title", and a screen reader announced a complementary region named "Title", which says nothing about what the region is. A new `report.editor.panelTitle` ('Edit report' — what the call site's own dead fallback said before objectui#3810 aligned it to the pack) now names the panel, in all ten locale packs.
+
+  `ViewSettingsPopover`'s colour section used `list.color`. On the wide toolbar `ListView` already uses both keys correctly for the two slots of this one feature: the compact `Paintbrush` button is `list.color` ('Color') and the panel it opens is headed `list.rowColor` ('Row Color'). This popover is that same panel on the collapsed/`compactToolbar` surface, so it now takes `list.rowColor` — an existing key, no pack change.
+
+  No `en` value of an existing key changed; `scripts/check-i18n-en-drift.mjs` reports 0 en values changed, 1 key added.
+
+- Updated dependencies [ee66e2e]
+- Updated dependencies [ee26e65]
+- Updated dependencies [5900ac5]
+- Updated dependencies [3fc2971]
+- Updated dependencies [aca27fa]
+- Updated dependencies [dde7283]
+- Updated dependencies [f279deb]
+- Updated dependencies [eb7f586]
+- Updated dependencies [e901131]
+- Updated dependencies [d9d3463]
+- Updated dependencies [613b167]
+- Updated dependencies [abb0f81]
+- Updated dependencies [38ab505]
+- Updated dependencies [7e4f0e5]
+- Updated dependencies [92250d6]
+- Updated dependencies [c1d939f]
+- Updated dependencies [49ae9f4]
+- Updated dependencies [2459a3e]
+- Updated dependencies [d6aa172]
+- Updated dependencies [fe52a04]
+- Updated dependencies [bb68488]
+- Updated dependencies [9461dd3]
+  - @object-ui/core@17.5.0
+
+## 17.4.0
+
+### Patch Changes
+
+- 7864f03: Backfill the auth family's 54 missing locale keys — `auth` 26 + `oauth` 16 + `acceptInvitation` 12 (objectui#3546, slice three)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 54 keys that a
+  `t()` call site asks for and that **no locale pack defined** — 54 distinct keys at
+  54 call sites across the console's six auth pages. All 54 carried an inline
+  `t(key, { defaultValue: 'English' })`, which is exactly the objectui#3517 class:
+  English rendered correctly, and **all ten languages were stuck on it** for
+  months. Nothing here rendered a raw key — slice one (PR #3583) held those sites.
+
+  What that meant on the page: a `zh` user reaching `/login` and switching to the
+  phone/SMS branch got "Email or phone number", "Get code", "Resend in {seconds}s"
+  and "Sign in with password instead" in English; the whole `/oauth/consent` screen
+  — including the four scope sentences describing what a third-party client is
+  about to be granted — was English-only; so was the `/accept-invitation` page and
+  the device-authorization dead end.
+
+  - **`packages/i18n/src/locales/en.ts`** gains the 54 keys. `oauth.consent.*` and
+    `acceptInvitation.*` are new top-level namespaces; the other 26 extend
+    `auth.login`, `auth.forgotPassword`, `auth.device` and `auth.verifyEmail`.
+    Every one of the 52 keys whose call site carries a **string** `defaultValue`
+    gets that exact string, byte for byte (52/52, script-compared), so the pack
+    path and the inline-default path cannot diverge. The two remaining keys —
+    `oauth.consent.title` / `oauth.consent.request` — have **template**
+    defaultValues, where byte identity is structurally impossible (JS `${…}` vs
+    i18next `{{…}}`); both take the interpolation contract the call site actually
+    declares in its options.
+  - **The nine other packs** get real translations, each evidenced against a
+    neighbour key in the same pack (fr's space before `?`/`:`, de's en dash, ru's
+    ё, ar's verb-first placement so an RTL sentence does not open on a Latin
+    client name, zh's full-width punctuation). The one string all ten packs share
+    is `phonePlaceholder` — the E.164 example number, treated like the
+    `name@example.com` the packs already keep untranslated.
+  - **`scripts/i18n-call-site-key-baseline.json`** loses exactly those 54 entries
+    (163 → 109). The file is a ratchet: an unfixed key missing from it fails the
+    build, and a fixed key still listed fails it too.
+  - **No component changed.** An AST sweep of all 122 call sites in these three
+    namespaces found zero dead `t(key) || 'English'` fallbacks (the construct
+    slice one had to delete from `ObjectView.tsx`, where i18next's key-as-value
+    return made `||` unreachable).
+
+  Two holes here are **not** i18next's and must survive translation intact:
+  `resendOtpCountdownText` carries `{seconds}` in single braces because
+  `packages/auth/src/LoginForm.tsx` and `ForgotPasswordForm.tsx` substitute it with
+  a literal `.replace()`, and `oauth.consent.request`'s `{{suffix}}` arrives
+  pre-formatted from the page. Both are pinned in
+  `packages/i18n/src/__tests__/auth-namespace-3546.test.tsx`, in both directions.
+
+- f5f8744: Backfill the `console` namespace's 41 missing locale keys plus the `console.ai.group.` template family (objectui#3546, slice four)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured **41 distinct
+  keys at 47 call sites** under `console.*` that a `t()` call site asks for and
+  that **no locale pack defined** — five of those keys have more than one site
+  (`console.ai.dock.maximize` has three), which is why the denominator is measured
+  and never counted by hand. All 47 carried an inline
+  `t(key, { defaultValue: 'English' })`, so this is the objectui#3517 class:
+  English rendered correctly, and **all ten languages were stuck on it**. Nothing
+  here rendered a raw key — slice one (PR #3583) held those sites.
+
+  What that meant on the page: a `zh` user opening `/ai` got "Waiting for
+  server…", "Still working…" and "Connection lost — reconnecting…" in the
+  connection banner, all ten "Designing your app…" progress hints in English, and
+  "Built" / "Not yet built" / "Published" / "Publish failed" on the plan card; the
+  ChatDock's whole chrome (title, resize handle, collapse, "Open full page") was
+  English including two `aria-label`s; the conversation sidebar's date headers read
+  "Today" / "Yesterday" / "Previous 7 days"; a mistyped URL produced an English
+  "Page not found"; and the `?` shortcuts dialog's AI group was English inside an
+  otherwise translated table. Two of these strings ("Not yet built", "TODAY") are
+  named in objectui#2458's mixed-language list.
+
+  - **`packages/i18n/src/locales/en.ts`** gains 46 keys: the 41 measured ones plus
+    the five members of the `console.ai.group.` family. `console.notFound` is a new
+    sub-namespace; the rest extend `console.shortcuts` and `console.ai` (with new
+    `console.ai.dock`, `console.ai.designingPlanHint` and `console.ai.group`
+    objects). Every one of the 41 measured keys takes its call site's inline
+    `defaultValue` **byte for byte** (46/47 sites, script-compared), so the pack
+    path and the inline-default path cannot diverge.
+
+    - The one site that cannot match is `ChatDock.tsx:563`, where a single key
+      (`console.ai.dock.open`) carries two different English strings: the
+      `aria-label` says `Open assistant` and the `title` says
+      `Open assistant (⌘⇧I)`. A key can hold one value, so `en` takes the
+      `aria-label` spelling — an accessible name must not carry a glyph run that
+      screen readers announce as symbols, and `⌘` is a mac-only glyph that a
+      _language_ pack cannot vary per platform. The tooltip therefore stops
+      advertising the shortcut; recorded on objectui#3810 (whose class this
+      divergence joins) rather than papered over.
+
+  - **`console.ai.group.` leaves the ratchet's `missingPrefixes` (4 → 3).** It is a
+    template key — `` t(`console.ai.group.${group.key}`) `` in
+    `ConversationsSidebar.tsx:277` — whose static head matched no `en` key, so every
+    expansion missed. Its value surface is the **closed** `ConversationGroupKey`
+    union, so the repair is an enumeration of all five members, not a wildcard; a
+    test reads the component's own union and label map and fails if a sixth bucket
+    is ever added without a key.
+
+  - **The nine other packs** get real translations, each evidenced against its own
+    `console` neighbours: `zh` full-width punctuation and the pack's single-em-dash
+    status-line style, `ja`/`ko` the pack's `AI ` spacing, `de` formal _Sie_ and
+    its `Wird …` progressive, `fr` straight apostrophes, `es` _usted_ (as the
+    `console.ai` neighbourhood already uses), `pt` the pack's `off-line` spelling,
+    `ru` ё orthography, `ar` verb-first phrasing that never opens an RTL sentence
+    with a Latin token. Where `en` repeats a string the packs already translate
+    (`Go back`, `Publish failed`, `Try again`, `Back to home`, `Assistant`,
+    `Today`, `Yesterday`), the existing neighbour's wording is reused rather than
+    re-invented.
+
+  - **`scripts/i18n-call-site-key-baseline.json`** shrinks by exactly 42 entries
+    (41 keys + 1 prefix family): 109 → 68 keys, 4 → 3 prefixes.
+
+  No component changed: an AST sweep of all 308 `console.*` call sites in the repo
+  found zero dead `t(key) || 'English'` fallbacks among this slice's keys.
+
+- 69becd2: `de` approvals inbox no longer shows two quote typographies on one screen
+
+  Three `approvalsInbox` values quoted the record title with ASCII straight quotes
+  on **both** sides while their own sibling `approvalsInbox.approveOneTitle` used
+  the correct German pair (U+201E low-9 opener, U+201C closer):
+
+  | key                             | before                  | after                   |
+  | ------------------------------- | ----------------------- | ----------------------- |
+  | `approvalsInbox.rejectOneTitle` | `"{{title}}" ablehnen?` | `„{{title}}“ ablehnen?` |
+  | `approvalsInbox.inlineApproved` | `"{{title}}" genehmigt` | `„{{title}}“ genehmigt` |
+  | `approvalsInbox.inlineRejected` | `"{{title}}" abgelehnt` | `„{{title}}“ abgelehnt` |
+
+  A German approver therefore met both typographies in a single screen and inside a
+  single operation pair — German quotes on the approve confirmation, typewriter
+  quotes on the reject confirmation and on both inline toasts. `„…“` is the pack's
+  own majority (50 paired spans) and DUDEN R11, so the three values were the
+  outlier. Keys and the `{{title}}` placeholder are unchanged; this is a
+  value-domain typography fix, and `en` (ASCII on both sides by design) is
+  untouched.
+
+  This is a **different defect shape** from objectui#3876, which paired a German
+  opener with an ASCII closer. Because these three were ASCII on both sides they
+  were self-consistent, so the pairing invariant objectui#3876 left behind could
+  not see them — it scans forward from each `„`, and there was no `„` in them to
+  scan from. The pack's straight-quote census being empty now lets that pin become
+  strictly stronger: `de-quote-pairing-3876.test.ts` asserted an explicit
+  three-key allowlist and now asserts that **no `de` value holds a U+0022 at all**,
+  which covers both defect shapes and needs no per-key maintenance as new values
+  land. The pack census moves from `„` 47 / `“` 47 / `”` 0 / `"` 6 to
+  `„` 50 / `“` 50 / `”` 0 / `"` 0.
+
+  None of the three i18n gates could have caught this: `all-locales-key-parity`
+  compares key sets and placeholder shapes, `check-i18n-call-site-keys.mjs` only
+  asks whether a key resolves, and `check-i18n-en-drift.mjs` fires on `en` value
+  changes — these values were wrong from the day they landed, so no drift event
+  ever existed. All three are value-blind by design, which is why the invariant
+  lives in a test.
+
+- 5e52495: German pack: the 20 values that closed the German opening quote with an ASCII straight quote now close it with `“`
+
+  `packages/i18n/src/locales/de.ts` opened a quoted span with the German low-9
+  quote `„` (U+201E) and closed it with the ASCII typewriter quote `"` (U+0022) in
+  20 keys, so a German user read `Registerkarte „Alle Datensätze" anzeigen` — a
+  mismatched pair. `search.resultsCount` showed it most plainly: the value ended
+  `„{{query}}""`, the mismatched closer immediately followed by the TS string
+  terminator.
+
+  This was never a pack convention. Measured on `main@2937bcf7d` before the fix,
+  the same file already spelled 23 spans the correct German way, `„…“` — the two
+  styles sat side by side, in sibling keys of the same namespace. Every mismatched
+  closer is now `“` (U+201C), which is what German orthography (DUDEN R11) and the
+  majority of the file already used. Affected surfaces: the four empty states
+  (object / page / dashboard / report not found), the search results header, the
+  lookup "create named" action, four `console.objectView` strings, the home
+  getting-started hint, the six `navigationSync` toasts, the local marketplace
+  install toast, and the preview not-ready title.
+
+  No other language pack and no `en` value changed — the counts are unchanged for
+  every other locale, and the mismatch was measured only in `de`.
+
+  ### Counted at landing, in two units
+
+  The card reported "20 values" and the triage re-scan reported "22 mismatched
+  pairs"; both are correct about different units, and the difference is now
+  recorded rather than left to the next reader. 20 keys carried a mismatch;
+  22 mismatch occurrences lived in them, because `navigationSync.renamedPage` and
+  `navigationSync.renamedDashboard` each quote two names in one sentence
+  ("Seite „alt“ in „neu“ umbenannt") and so contribute two each. Full-file counts
+  before → after: `„` 45 → 45, `“` 25 → 47, `”` 2 → 2, `"` 28 → 6.
+
+  ### The durable half, and why it is not the count equality the card proposed
+
+  Three i18n gates run over these packs and none can see a wrong quote:
+  `all-locales-key-parity` compares key sets and placeholder shapes,
+  `check-i18n-call-site-keys.mjs` only asks whether a key resolves, and
+  `check-i18n-en-drift.mjs` fires on `en` **value changes** — these values were
+  wrong from the day they landed, so no drift event ever existed. Without a
+  value-domain assertion the next backfill copies the mismatch from a neighbour
+  again, which is exactly how these 20 accumulated.
+
+  The card proposed asserting `count(„) === count(“)`. That is **false on the
+  correctly fixed file** (45 vs 47) and would have sent the next reader hunting a
+  bug that is not there: two values in this pack, `grid.import.savedMappingHint`
+  and `grid.import.savedMappingPreviewNote`, are still untranslated English prose
+  and quote in the English style `“…”`, so their two `“` are legitimate _openers_.
+  The invariant that is pinned instead is the pairing itself — for every `„`, the
+  first quote character that follows must be `“` — backed by the arithmetic
+  identity `count(“) === count(„) + count(”)`, which stays true if those two values
+  are later translated (47 === 47 + 0) and breaks the moment a mismatch returns.
+  Both carry a presence guard so a broken import cannot make them pass by scanning
+  nothing.
+
+- b750823: `preview.draftBar` speaks one second person in `es` — the draft-preview banner no
+  longer switches from tú to usted when a Spanish user publishes (#3844)
+
+  `DraftPreviewBar` renders two mutually exclusive sentences in the same strip of
+  the same banner: `message` while there are unpublished changes, `messageClean`
+  once there are none. In `es` the two disagreed on register — `message` was tú
+  (`estás viendo`, `publiques`) while `messageClean` (`ve`) and `sampleDataBody`
+  (`Está`, `su`, `Publíquela`) were usted. So a Spanish user who pressed Publish
+  watched the banner change person: same component, same position, same session.
+
+  This is a third defect class in the value-domain blind spot behind #3582 and
+  #3625, and no gate in the repo can see it. Both `es` values are correct
+  translations of their `en` sentences — nothing is missing, nothing is stale, and
+  nothing holds English. The inconsistency is _internal to one pack, on one UI
+  surface_: `scripts/check-i18n-call-site-keys.mjs` only asks whether a key exists
+  in `en`, `all-locales-key-parity` compares key sets and placeholder shapes and
+  never reads values, and `scripts/check-i18n-en-drift.mjs` only fires when an `en`
+  value moves — these two `en` values never moved.
+
+  `message` is the value that changes, because usted is what the pack already says
+  everywhere around it: the `es` pack censuses 102 usted markers to 30 tú (tú being
+  the marked exception, concentrated in the auth, report-editor and organizations
+  neighbourhoods that #3546 slice two deliberately ruled informal); the other three
+  strings of this same object were already usted; and #3546 slice five gave the 19
+  new `preview.unpublishedBar.*` / `preview.history.*` keys usted on the strength
+  of `home.pendingDrafts.published` ("¡Publicado! Sus cambios están activos."). Two
+  smaller divergences inside the same sentence are closed with it, so the banner's
+  two halves stop disagreeing about wording as well as person:
+
+  - **`—` instead of `:`** in `messageClean`, matching `en`, where both sentences
+    open `Draft preview — `. That is the whole of `messageClean`'s diff.
+  - **`activo` instead of `en producción`** for "live". The pack spells this concept
+    `activo` in four neighbouring places including `publishCta` in this very object
+    ("Publicar para verlo activo"), and it reserves _producción_ for the actual
+    production environment (`environment.entitlement.planLockedBody`), so the
+    outlier was ambiguous as well as inconsistent.
+  - **`Vista previa del borrador`** as the shared opening, `del` being the form
+    `messageClean` already used.
+
+  No `en` value changes (the en-drift gate reports 0), no key is added or removed
+  (so `all-locales-key-parity` is untouched by construction), and the nine other
+  packs are not touched. The diff is two values in one file.
+
+  Re-voicing the whole `preview` namespace to tú was considered and rejected — a
+  much larger change that would collide with the adjacent `marketplace.*` (9:0
+  usted) and `console.ai.*`. `preview.empty.notReadyDescription` therefore stays tú
+  here, since #3844's ruling is this banner only; it is filed as #3875 rather than
+  waved through, because `PreviewDraftEmptyState` renders _underneath_
+  `DraftPreviewBar` and so those two show usted and tú on screen at the same time.
+  After this change the `preview` namespace is 23 usted to that 1 tú.
+
+  A gate that checks "one register per namespace" is deliberately **not** here:
+  recognising usted vs tú needs real morphology, and token matching demonstrably
+  cannot — in this pack the token `revisa` is usted in `console.ai.empty.build`
+  (es.ts:1365, "…y usted revisa y publica.") and tú in
+  `auth.forgotPassword.successTitle` (es.ts:1918, "Revisa tu correo electrónico"),
+  the same eight letters in opposite registers. The neighbourhood boundary such a
+  gate would police is human judgement anyway — #3546 slice two's "same rule,
+  different answer". A new `draftBar-es-register-3844.test.ts` pins the four `es`
+  values byte for byte instead, plus the `en` literals, so a future reword of
+  either `en` sentence fails in the same PR that reworded it.
+
+- ac2139c: `grid.import` saved-mapping copy is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
+
+  Five keys — `grid.import.savedMapping`, `chooseSavedMapping`, `manualMapping`,
+  `savedMappingHint` and `savedMappingPreviewNote` — were **byte-identical to `en`**
+  in seven of the nine non-`en` packs, 35 values in all. Only zh and ja had been
+  translated, and two of the five are multi-clause explanatory sentences rather
+  than placeholders or proper nouns, so this was not a deliberately untranslated
+  term: a German, French, Spanish, Portuguese, Russian, Korean or Arabic user
+  picking a saved mapping in the import wizard read English.
+
+  None of the three i18n gates could see it. `all-locales-key-parity` compares key
+  sets and placeholder shapes, so English passed perfectly; the call-site gate only
+  asks whether a key resolves; `check-i18n-en-drift.mjs` fires on an `en` **value
+  change** and these keys arrived in the packs already English, so no drift event
+  ever existed. objectui#3920 also proposed a general "no non-`en` value may be
+  byte-equal to `en`" gate; that is deliberately not part of this change, because
+  values like `auth.*.emailPlaceholder` (`name@example.com`),
+  `fields.image.counter` (`{{current}} / {{total}}`) and
+  `grid.import.templateFileName` are byte-equal across packs correctly, and
+  objectui#3880 records the other face of the family. The five keys are pinned by
+  name instead.
+
+  Each translation reuses vocabulary its own pack already ships rather than
+  inventing a second word for the same concept: `stepMapping` for "mapping"
+  (Zuordnung / Correspondance / Asignación / Mapeamento / Сопоставление / تعيين /
+  매핑), `legacyFallbackNotice` for "type coercion" (Typkonvertierung / conversion
+  de type / conversión de tipos / conversão de tipos / приведение типов / تحويل
+  الأنواع / 형 변환), `view.readonlyTooltip` for "read-only", and `validateHint`
+  for "on the server". `es` follows the usted ruling objectui#3844 measured for
+  this pack; `pt` is the pack's own pt-BR (mapeamento / salvo / no servidor);
+  `ru` keeps its ё; `fr` keeps the straight apostrophe and the space before colon
+  and semicolon; `ar` punctuates with U+060C and U+061B; `ko` uses the 은(는) /
+  이(가) spelling its `fields.file.exceedsMaxSize` already uses for a placeholder
+  whose particle cannot be resolved at authoring time.
+
+  The quote around `{{name}}` follows each pack's measured majority for wrapping a
+  placeholder — de `„…“` (38 spans against 3 ASCII), fr `« … »` with an ASCII
+  space (25 against 18), ru `«…»` (23 against 18), and ASCII `"…"` for ko (38:0),
+  pt (39:0), es (22:19) and ar (27:15). The card cited
+  `residue-namespaces-3546.test.tsx` as pinning "the rest ASCII", but that line
+  pins the `empty.*` family only and its own comment scopes the rule to "the
+  sibling value in the SAME pack"; `grid.import` has no other quoted span, so the
+  census one ring out decides.
+
+  Germanising the two `de` sentences also closes the 45/47 gap
+  `de-quote-pairing-3876.test.ts` documented: that pack's census moves from
+  `„` 45 / `“` 47 / `”` 2 to `„` 47 / `“` 47 / `”` 0, exactly as that file's header
+  predicted, and its `count(“) === count(„) + count(”)` identity still holds. The
+  three literal counts in it were updated and the two keys are now pinned by name
+  there, so `rdqKeys === []` cannot become an assertion that passes because nothing
+  is produced.
+
+  `en`, `zh` and `ja` are untouched, and `grid.import.transform` — the sixth key in
+  the same block, English in the same seven packs, and the third column header of
+  the very table this hint sits above — is deliberately left alone, filed as
+  objectui#3938 and pinned as still-English so the number cannot drift while that
+  issue waits its turn.
+
+- b14ab3a: `grid.import.transform` is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
+
+  The third column header of the import wizard's saved-mapping summary was
+  **byte-identical to `en`** — the literal string `Transform` — in seven of the
+  nine non-`en` packs. zh (`转换`) and ja (`変換`) had translated it, which is what
+  rules out the "deliberately untranslated term" reading; this is the sixth key of
+  the same six-line block objectui#3920 / PR #3936 fixed the other five of, and it
+  was left out of that card only to keep its 5-keys / 35-values census verifiable.
+
+  | pack | before      | after            | the pack's own anchor                                                                    |
+  | ---- | ----------- | ---------------- | ---------------------------------------------------------------------------------------- |
+  | ko   | `Transform` | `변환`           | `savedMappingHint` "이름 변경 + 변환 + 형 변환"                                          |
+  | de   | `Transform` | `Transformation` | `savedMappingHint` "Umbenennung + Transformationen + Typkonvertierung"                   |
+  | fr   | `Transform` | `Transformation` | `savedMappingHint` "le renommage + les transformations + la conversion de type"          |
+  | es   | `Transform` | `Transformación` | `savedMappingHint` "el cambio de nombre + las transformaciones + la conversión de tipos" |
+  | pt   | `Transform` | `Transformação`  | `savedMappingHint` "renomeação + transformações + conversão de tipos"                    |
+  | ru   | `Transform` | `Преобразование` | `savedMappingHint` "переименование + преобразования + приведение типов"                  |
+  | ar   | `Transform` | `التحويل`        | `savedMappingHint` "إعادة التسمية + التحويلات + تحويل الأنواع"                           |
+
+  Each value is the **singular of the word the pack already uses** for `en`'s
+  plural "transforms" in `grid.import.savedMappingHint` — the sentence
+  `SavedMappingSummary` renders directly above this header. That is the anchor
+  rather than `legacyFallbackNotice`'s term, because `en`'s own sentence lists
+  "transforms" and "type coercion" as two different server-side operations and
+  `legacyFallbackNotice` is about the second: reusing de "Typkonvertierung", ko
+  "형 변환" or ar "تحويل الأنواع" for this header would name the wrong operation.
+
+  Why it was worth a card of its own rather than waiting for a general gate: this
+  value is not a hidden string. It is the third `TableHead` of
+  `SavedMappingSummary`, sitting in one row with `csvColumn` and `mapsTo`, which
+  were always translated — so a German user read `Spalte` / `Zugeordnet zu` /
+  `Transform`, two languages in a single header row, directly under the German
+  hint PR #3936 had just landed. Before that PR the whole panel was English and
+  therefore at least self-consistent.
+
+  The three i18n gates are value-blind here exactly as they were for
+  objectui#3920: `all-locales-key-parity` compares key sets and placeholder shapes
+  (the key was present with no placeholder, so English passed perfectly), the
+  call-site gate only asks whether a key resolves, and `check-i18n-en-drift.mjs`
+  fires on an `en` **value change** — this value entered the seven packs already
+  English, so no drift event ever existed. `en`, zh and ja are untouched, and the
+  pin PR #3936 left in `gridImportSavedMapping-i18n-3920.test.ts` asserting these
+  seven were "still English" has been replaced by the translated pin it asked for.
+
+- 8c60819: The inbox popover now spells out what the bell badge is made of
+
+  The bell badge is `unread notification topics + pending approvals`, clamped to
+  "9+" above nine. As one number it is unexplainable: objectstack#7213 measured
+  Home's "pending approvals" card saying 8 while the bell said "9+", and read that
+  as the two counts disagreeing — they never did, the bell was simply carrying a
+  second addend the user could not see.
+
+  The popover already tabs the two streams and puts a count pill on each tab, so
+  the split was partly visible — but those pills clamp at "9+" too. A loaded
+  console therefore showed three "9+"s that reconcile to nothing, which is why
+  sectioning alone did not close this.
+
+  A breakdown line under the popover header now states the exact, unclamped
+  addends beside the exact total — `15 total · 12 notifications + 3 pending
+approvals`. The approvals half is the same `pendingApprovalsCount` the Home card
+  and the Approvals Inbox tab read, so the number a user reconciles against is
+  literally the one they see elsewhere.
+
+  The badge formula, the counting APIs and the "9+" clamp on the badge itself are
+  unchanged — this is a display fix. Three new keys
+  (`notifications.badgeTotal` / `badgeNotifications` / `badgeApprovals`) land in
+  all ten locale packs. They interpolate named placeholders (`{{total}}`,
+  `{{unread}}`, `{{approvals}}`) rather than i18next's `{{count}}`, which would
+  additionally drive plural-key resolution these packs carry no forms for.
+
+- e64a52e: 回填 `perm` + `home` 两命名空间 14 个缺失语言 key,十个语言包补齐(#3546 切片六)
+
+  `scripts/check-i18n-call-site-keys.mjs` 实测:14 个不重复 key / 14 个调用点(1:1),分布在权限集
+  记录的授权面摘要(`PermissionFacetLink`,ADR-0056 P1)与"一键发布全部草稿"的其余几条 toast
+  (`usePublishAllDrafts`:ADR-0038 L3 探针健康、示例数据健康、ADR-0066 ⑨ 能力引用巡检)。
+
+  这 14 处都带内联 `defaultValue`,所以英文一直正常渲染,**十种语言都翻不了** —— 修的是这一半。
+  英文字串一字未改:9 处静态 `defaultValue` 与 en 逐字节相同;另外 4 个计数标签(对象 / 字段规则 /
+  RLS 策略 / 标签页规则)的 `defaultValue` 是带英文单复数分支的模板串,改用 i18next 复数族
+  (`key` + `key_one`)后逐个计数渲染结果与模板串一致。
+
+  复数族刻意带**基础 key** 而不是只写 `_one`/`_other`:i18next 只按语言的 CLDR 类别取一个后缀,
+  取不到就沿 fallback 链落到 `en`。ru(few 2-4、many 5-20)与 ar(two、few 3-10、many 11-99)
+  恰好在用户最先遇到的计数上会因此显示英文;基础 key 让这些类别落回**本语言**。
+
+- 844d17f: Backfill the `marketplace` and `preview` namespaces' 37 missing locale keys plus the `marketplace.disclosure.runtime.` template-key family (objectui#3546, slice five)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 37 keys that a
+  `t()` call site asks for and that **no locale pack defined** — 37 distinct keys at
+  37 call sites across five console components — plus one `missing-prefix` family
+  whose static head matched no `en` key at all, so every expansion missed. All 37
+  carried an inline `t(key, { defaultValue: 'English' })`, which is exactly the
+  objectui#3517 class: English rendered correctly, and **all ten languages were
+  stuck on it** for months. Nothing here rendered a raw key — slice one (PR #3583)
+  held those sites.
+
+  What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the
+  marketplace's "Your organization" strip, its Install / Installing… / Installed
+  buttons and the version-update affordances were English; the whole ADR-0025 PD4
+  **pre-install permission disclosure** was English — "This package contains code",
+  the trust-tier badge, "Reviewed & approved" / "Not yet reviewed" / "Signed", the
+  four permission group labels (platform services, lifecycle hooks, network,
+  filesystem) and the consent checkbox the user ticks to accept them; the ADR-0045
+  unpublished-app banner and its publish toasts were English; and the entire
+  ADR-0067 build-history sheet — title, description, the per-commit labels, the
+  Revert button and both of its result toasts — was English.
+
+  `marketplace.disclosure.runtime.` is repaired as an **enumeration, not a
+  wildcard**: its value surface is the closed trust-tier enum
+  (`PluginRuntimeSchema` = `z.enum(['node', 'sandbox', 'worker'])`, ADR-0025 §3.6),
+  so all three members are backfilled and the family leaves the ratchet's
+  `missingPrefixes` (3 → 2). A test reads the component's own fallback map and
+  fails if a fourth tier is ever added without a key — the job the prefix entry
+  used to do.
+
+  Each `en` value is byte-identical to the inline `defaultValue` it replaces (36 of
+  36 literal sites; the 37th's `defaultValue` is a template literal whose
+  `${pkg.display_name}` becomes the `{{name}}` hole its call site already passes),
+  so no English string a user sees today changes. The nine translations follow each
+  pack's own neighbourhood — including two namespaces that legitimately take
+  **different** second persons in `zh` (`marketplace` 你, `preview` 您) — and reuse
+  an existing neighbour's translation wherever the `en` string already existed
+  verbatim, so one English string never renders as two different sentences in the
+  same language.
+
+  No component changed: an AST sweep of the whole `marketplace.*`/`preview.*`
+  call-site surface found the slice's own dead-`||`-fallback count to be zero.
+
+- 4dcd52a: `console.objectView.systemViewReadonly` and `console.objectView.expandToPage`
+  are translated in the eight packs that stored English for them, so a Japanese,
+  Korean, German, French, Spanish, Portuguese, Russian or Arabic session reads
+  the system-view hint and the expand affordance in its own language (#3582).
+
+  This is a different defect class from #3546's ledger, and no gate in the repo
+  could see it. There the key was _missing_ from a pack and `fallbackLng: 'en'`
+  rendered English; here the key was **present in all ten** and eight of them
+  stored English as the value. `all-locales-key-parity` compares key _sets_ and
+  placeholder _shape_ — identical before and after this change, and neither key
+  interpolates anything. `scripts/check-i18n-call-site-keys.mjs` and its baseline
+  ratchet ask whether a `t()` key exists in `en`; it did, so these two were never
+  in the 258.
+
+  `systemViewReadonly` carried the sharper half: the eight packs did not hold
+  `en`'s sentence, they held one `en` had already abandoned. `en` says the view
+  is read-only; the eight said `System view defined in code - duplicate to
+customize.` — pointing eight locales at a duplicate-to-customize path the
+  product no longer presents. They are translated against `en`'s **current**
+  read-only meaning, not against the stale English they replaced.
+
+  Each value is built from terminology the same pack already uses rather than
+  invented: `view.readonlyTooltip` supplies "system view" and
+  `console.objectView.cannotEditMetaView` (landed in #3583) supplies "defined in
+  code", so the new hint agrees with the copy beside it in every pack. For
+  `expandToPage`, `detail.openAsFullPage` is the identical English sentence one
+  namespace over and was already translated everywhere — `en` and `zh` hold their
+  two byte-identical to each other, so the eight now do too, and one locale
+  cannot end up with two different words for one action.
+
+  `en` and `zh` are unchanged, byte for byte. No key is added or removed —
+  the diff is 16 values in 8 files. A new
+  `objectView-value-language-3582.test.ts` pins the `en` literal (so the next
+  rewording of `en` fails loudly instead of silently orphaning nine
+  translations), asserts that no pack but `en` serves either English spelling,
+  and requires the zh/ja/ko/ru/ar values to contain characters of their own
+  script. The repo-wide "no ASCII English sentence in a non-Latin pack" gate that
+  #3582 also sketched is deliberately **not** here; it is a separate, lands-green
+  change.
+
+- 42ae5c6: The organization-management console is translatable. The 90 keys under
+  `organization.*` — the org layout and its tabs, the members list, the whole
+  invitation flow, organization settings including the leave and delete
+  confirmations, the accept-invitation page, and the workspace switcher — are now
+  defined in all ten locale packs, so a non-English session reads the org admin
+  surface in its own language instead of English (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site
+  asks for and no pack defines. `organization.*` was the largest namespace in that
+  tally at 90 keys across 93 call sites in seven components. Every one of them
+  carried an inline `t(key, { defaultValue: 'English' })`, which is why nothing
+  looked broken: English rendered correctly at each site and all ten languages
+  were pinned to it. That is the #3517 class, not the raw-key class slice one
+  (#3583) held — no organization site rendered an identifier, and none had a dead
+  `||` fallback to remove, which was measured before deciding not to touch the
+  components.
+
+  Adding a `defaultValue` is deliberately not the fix; it is the mechanism that
+  kept these invisible for months. The existing defaults stay where they are, and
+  each `en` value is byte-identical to the default at its call site so the two
+  paths cannot render different text.
+
+  `organization` is a new top-level namespace, sitting next to — and distinct
+  from — `organizations`: the singular one is the management surface, the plural
+  one the org picker. The ratchet in `scripts/i18n-call-site-key-baseline.json`
+  shrinks by exactly these 90 entries, from 253 to 163. The
+  `organization.invitations.status.*` template-key family is untouched and still
+  baselined: enumerating an invitation status set is a different repair from
+  backfilling literal keys.
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- f9faa7d: Backfill the last 17 missing locale keys and both remaining template-key families, emptying the call-site key ratchet (objectui#3546, slice seven — final)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) opened this backlog with
+  **258 keys and 4 template-key families** that a `t()` call site asks for and that
+  **no locale pack defined**. Seven slices later the last of it is paid: this change
+  takes the ratchet from 17 keys to **zero** and from 2 prefix families to **zero**,
+  and the gate now reports every one of the **2320** literal call-site keys
+  resolving against `en`.
+
+  The residue was the long tail — nine namespaces across `app-shell`,
+  `plugin-detail`, `plugin-dashboard`, `plugin-kanban` and `plugin-gantt`, none of
+  them big enough to have been its own slice. 17 distinct keys at **23** call sites
+  (five keys are used at more than one site) plus **3** call sites behind the two
+  families.
+
+  What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the "App not
+  available" empty state a user lands on when an app is still publishing, including
+  its whole explanation and its Retry button; the interface page's "source is not
+  available" message; the system navigation's **Administration** group header,
+  **Datasources** and **Documentation** entries; the "creating new organizations is
+  disabled on this instance" guard in the workspace dialog; the invitation list's
+  five status labels (All / Pending / Accepted / Rejected / Canceled) on both the
+  filter tabs and every invitation badge; the Gantt dependency-drag hint that names
+  which endpoint the drop will link (`start` / `end`); the record detail's Add,
+  "Record deleted", "No history yet" and the concurrent-update dialog's "this
+  record"; the kanban empty board's column count; the dashboard widget's screen
+  reader "Loading…"; and the page editor's "Edit in studio" tooltip and accessible
+  name. All of it rendered English, in every one of the ten languages.
+
+  Nothing here rendered a raw key — slice one (PR #3583) held those sites, and the
+  three keys the issue body named as unprotected (`detail.viewSource`,
+  `wizard.missingRequired`, `gantt.toolbar.refresh`) have resolved in `en` since.
+
+  Both families are repaired as **enumerations, not wildcards**, and the assertion
+  that used to live in the ratchet's `missingPrefixes` moves into a test that fails
+  if either union grows a member without a key:
+
+  - `gantt.linkEnd.` — the closed union `'start' | 'end'`, declared by GanttView's
+    own `linkDrag` state.
+  - `organization.invitations.status.` — `StatusFilter`
+    (`all | pending | accepted | rejected | canceled`), declared by InvitationsPage.
+
+  Every `en` value is byte-identical to the English the call site rendered before,
+  so no string a user sees today changes: 16 keys match an inline
+  `t(key, { defaultValue: … })`; `dashboard.loading` matches `useSafeTranslate`'s
+  positional fallback `tt(key, 'Loading…')`; `gantt.linkEnd.*` match
+  `useGanttTranslation`'s per-key fallback map; and the five status labels match the
+  CSS-capitalised wire value each badge and tab showed. The nine translations follow
+  each pack's own neighbourhood and reuse an existing neighbour's row wherever the
+  `en` string already existed verbatim **and** that row is grammatical here — the
+  four invitation adjectives are deliberately not reused from the approvals family,
+  because those agree with each pack's word for "request" (`ru` masculine `Отклонён`)
+  while an invitation needs its own agreement (`ru` neuter `Отклонено`).
+
+  `scripts/i18n-call-site-key-baseline.json` is kept rather than deleted: empty is
+  its terminal, load-bearing state — against an empty baseline any NEW unresolved
+  call-site key is unexpected and fails the build.
+
+  No component changed.
+
+- 33526fd: `view.readonlyTooltip` — the tooltip on a view tab's read-only lock — is
+  retranslated in the eight packs (ja/ko/de/fr/es/pt/ru/ar) that still described
+  the retired "duplicate to customize" workflow, so a Japanese, Korean, German,
+  French, Spanish, Portuguese, Russian or Arabic session is told the view is
+  defined in code and read-only, which is what `en` says and what the product
+  does (#3625).
+
+  This is the same stale sentence #3582 fixed one namespace over, but it hid
+  behind a much better disguise. In #3582 the eight packs stored the **English**
+  string, so two cheap criteria could see it: "value equals `en`" and "a
+  non-Latin pack holds pure ASCII". Neither can see this key. Its eight values
+  were **idiomatic translations** — real Japanese, real Cyrillic, real Arabic —
+  of a sentence `en` itself had already abandoned. Nothing about their form was
+  wrong; only their meaning was. Key sets were complete, so
+  `all-locales-key-parity` was green; the key exists in `en`, so the call-site
+  guard and its ratchet were green; the values are distinct and in their own
+  scripts, so every heuristic #3582 sketched would have been green too. Eight
+  locales spent those releases pointing users at a path the product no longer
+  offers, with every gate reporting success.
+
+  Each value is translated against `en`'s **current** meaning and built from
+  words the same pack already uses — "read-only" from its own `view.readOnly` /
+  `view.readonlyAriaLabel`, "defined in code" from
+  `console.objectView.systemViewReadonly` / `cannotEditMetaView` — so the tooltip
+  agrees with the copy beside it instead of introducing a ninth way to say
+  read-only. Nothing is rewritten from the stale text.
+
+  `en` and `zh` are unchanged, byte for byte, and no key is added or removed —
+  the diff is eight values in eight files. A new
+  `viewReadonlyTooltip-semantics-3625.test.ts` tests **meaning** rather than
+  form, in both directions: no pack may name the duplicate/copy workflow in its
+  own language, and every pack must positively carry all three pieces of the
+  sentence ("system view", "defined in code", "read-only") so the negative check
+  cannot pass on a gutted string. It also pins the `en` literal, so the next
+  rewording of `en` fails in the PR that does the rewording rather than orphaning
+  nine translations for another release — which is the invariant this family of
+  defects has actually been missing.
+
+- 32413ec: Resolve `_views` translation keys by the bare view name only — the prefixed full name is no longer a second candidate
+
+  `useObjectLabel().viewLabel` / `viewDescription` / `viewEmptyState` build their key by stripping the object prefix off the runtime view id (`crm_opportunity.pipeline_kanban` → `objects.crm_opportunity._views.pipeline_kanban.<tail>`). Until now, if that bare key missed, the resolver **also** tried the prefixed full name — `objects.crm_opportunity._views.crm_opportunity.pipeline_kanban.<tail>` — so a bundle authored against the prefixed spelling resolved too.
+
+  **Behavior change:** it no longer does. A `_views` entry keyed by the prefixed full name is not read at all; the label falls back to the metadata default, exactly as it would if no translation had been written. Bundles keyed by the bare view name — the only spelling the extractor emits and `os lint` accepts — are unaffected.
+
+  This closes an asymmetry, not a feature. The server-side resolver reads the one bare key (objectstack#5165), so a prefixed-key bundle produced a **translated label in the Console and English everywhere else**: the REST boundary, mobile, plain HTTP and SDUI consumers do not run this second resolution pass. The half-success was harder to notice than a clean miss, and it fossilized a second de-facto spelling of a key the platform has now converged on: per the objectstack#5164 ruling (2026-08-06, option A), the canonical `_views` key is the runtime view identity's bare name, with the i18n extractor deriving it from the view composer (objectstack#6124) and `packages/lint` enforcing that single spelling (objectstack#6038). This is the third and last leg of that convergence.
+
+  The object-name axis is untouched: a bundle written against the short object name (`objects.opportunity._views.…`) still resolves when the runtime presents the namespaced name (`crm__opportunity`).
+
+  **If a label stopped translating after this upgrade,** its `_views` key is written with the object prefix. Drop the prefix — `_views.crm_opportunity.pipeline_kanban.label` becomes `_views.pipeline_kanban.label`. `os lint` names these for you: a prefixed key is reported as `translation-target-unknown`, because no view of the object declares it.
+
+## 17.3.0
+
+### Minor Changes
+
+- 0554e88: The console language choice now survives a reload. `I18nProvider` writes every language change to `localStorage` (`objectui-locale`, exported as `LOCALE_STORAGE_KEY`) and boots the next session in that language, so switching to 中文/日本語/… is no longer reverted to `en` by the next F5 or new tab (objectstack#5406).
+
+  Bootstrap precedence is **stored choice → browser language → `defaultLanguage`**: an explicit choice outranks browser detection, and a stored value the app no longer offers is ignored and purged rather than locking the UI to a locale with no translations. The restore lands in the instance's bootstrap language, so `<html lang>` — and therefore the `Accept-Language` header on the first wave of API calls — is already correct on the first render.
+
+  New public surface on `@object-ui/i18n`: `persistLanguage` (default `true`; set `false` for fixed-language previews/demos), `LOCALE_STORAGE_KEY`, and `readStoredLanguage()` for apps that bootstrap their own i18next instance.
+
+- 5af2852: The record detail page now shows a read-gated approval panel (#3461). A record in approval used to expose NOTHING about the running approval to anyone but the current pending approver — `useRecordApprovals` was consumed solely to inject the header Approve/Reject buttons, while the pending-approver list, decision progress, and the `sys_approval_action` timeline existed only in the Approval Center's drawer, a `setup`-app surface that business roles can't navigate to (and whose backing object is tenant-wide, so granting read there is over-broad). The submitter couldn't tell whom to nudge; the record's own audit history was no help either, since the engine mirrors business fields as `runAs:'system'` and decisions never enter record history. The new surface is an **Approvals tab** on the record page — a peer of Details/Related (same promotion Attachments got in objectstack#4358), emitted by `buildDefaultTabs` only when the record actually has requests, with a request-count badge and the label localizing through the tab strip's KNOWN_LABEL_DICT (审批). The tab wraps the new `record:approvals` node (`RecordApprovalsPanel`), visible to EVERY viewer who can read the record: current flow/step with the enriched flow-steps strip, server-computed decision progress (quorum tally, per-group 会签 ticks), the waiting-on chips with server-resolved names and group labels (never raw ids), one chronological action timeline merged across all of the record's requests (a multi-level flow opens one request per node), decision comments and attachments, and an inline remind button for the submitter (`viewer.is_submitter`, with an id-match fallback for older backends) that POSTs the existing `/approvals/requests/:id/remind`. The host threads its live `useRecordApprovals` read through the node so the tab and the header decision buttons never disagree; on authored pages the `record:approvals` renderer self-fetches, and an authored page that omits the node gets a bottom-of-page fallback append so the approval story is never lost to a custom layout. Copy reuses the Approval Center's `approvalsInbox.*` keys so the two surfaces can't drift; `useRecordApprovals` now exposes the full `requests` array plus `listApprovalActions` / `remindApprovalRequest`, and its `ApprovalRequestLite` carries the display enrichment (`process_label`, `step_label`, `flow_steps`, `viewer`, `round`) the single-read endpoint already sent.
+
+### Patch Changes
+
+- b71fc92: Localize the last untranslated console-chrome accessible names (objectstack#5430)
+
+  Four icon-only controls still carried hardcoded English accessible names, so
+  under a non-English session they were the only English left in the record
+  chrome — and because the controls have no visible label, that literal _is_ the
+  control to a screen reader and to the hover tooltip.
+
+  - `page:header`'s `role="toolbar"` — now `detail.pageHeaderActions` (its `⋯`
+    overflow trigger eight lines below was fixed in #5407; the toolbar was missed)
+  - `ReactionPicker`'s `role="listbox"` popup — now `detail.emojiPicker`
+  - `ReactionPicker`'s per-reaction chip, which built its name by concatenation
+    with English pluralization baked in (`reaction${count !== 1 ? 's' : ''}`) —
+    now `detail.reactionCount` / `detail.reactionCountOne`
+  - `NavigationOverlay`'s drawer close and split-panel close — now `common.close`
+    (the key the rest of the console already uses) and `common.closePanel`
+
+  The pluralized label follows this repo's **two-key** convention
+  (`detail.relatedRecords`/`relatedRecordOne`, `lookup.recordCount`/`recordCountOne`)
+  rather than an i18next `_one`/`_other` pair: zh/ja/ko have no separate singular
+  form, so those packs would legitimately omit the `_one` half and
+  `all-locales-key-parity` would read that as a lost key.
+
+  All five new keys are added to all ten locale packs.
+
+- 65516ba: Name `CommentThread`'s three emoji-only buttons, and follow the session language past the 7-day mark (objectui#3441)
+
+  Two leftovers from objectstack#5506 / objectui#3424, in the same component. It
+  is an exported, published component with no in-repo consumer, so both only ever
+  bite an external host.
+
+  **One — three controls with no authored accessible name.** Each comment's two
+  quick-reaction buttons (`'👍'` and `'❤️'`) and the reply banner's dismiss button
+  (`'✕'`) carried no `aria-label` and no `title`. The `+` reaction picker right
+  beside them has had one since #3424 (`collaboration.addThumbsUp`), which is what
+  makes these three an omission rather than a design choice.
+
+  `aria-label`, not the `title` the `+` uses: a `button`'s accessible name is
+  computed from its CONTENT (accname §2F) before the `title` tooltip is ever
+  consulted (§2I), so on a button whose only child is a glyph a `title` decorates
+  the mouse and leaves the name alone. What a screen reader read out was the
+  codepoint — "thumbs up", "red heart", in English whatever the session language,
+  and for U+2715 MULTIPLICATION X very often nothing at all.
+
+  Three new keys in all ten packs: `collaboration.reactThumbsUp`,
+  `collaboration.reactHeart`, `collaboration.cancelReply`.
+
+  `reactThumbsUp` is deliberately NOT a reuse of `addThumbsUp`, even though both
+  dispatch the same `onReaction(id, '👍')` today. `addThumbsUp` names the reaction
+  bar's picker entry point, whose copy follows the picker if it ever picks; and on
+  any comment that already has reactions the two controls are on screen together,
+  so one shared key would put two visibly different buttons under one name.
+  `cancelReply` rather than the generic `common.cancel` for the same reason — an
+  accessible name has to say what is being cancelled (only the reply target is
+  dropped; anything typed into the composer survives).
+
+  **Two — the >= 7 day timestamp ignored the session language.** `formatTimestamp`
+  ended in a bare `date.toLocaleDateString()`, i.e. the RUNTIME's locale, so a
+  `zh` session read "6 天前" for a six-day-old comment and `8/1/2026` for an
+  eight-day-old one.
+
+  The fix passes the session `language`, but not straight through — that is the
+  trap #3424 flagged and declined to walk into. `toLocaleDateString(tag)`
+  canonicalizes its argument and throws `RangeError` on anything not well-formed
+  per BCP 47, and the session language reaches the component verbatim: a host that
+  configures `defaultLanguage: 'en_US'` (the POSIX spelling — well-formed-looking,
+  and rejected) hands `Intl` a tag it refuses. That `RangeError` would land in
+  `formatTimestamp`'s outer `catch`, whose fallback is `return iso`, replacing the
+  date with a raw `2026-08-01T09:30:00.000Z` — worse than the un-localized date it
+  set out to fix.
+
+  So the absolute-date branch gets its own local `try`/`catch` that falls back to
+  the no-argument call. A malformed tag degrades to exactly the previous
+  behaviour (the runtime's own locale); the worst case of following the session
+  language is the status quo, never a regression. A well-formed but unknown tag
+  such as `xx-YY` does not throw at all — `Intl` resolves it to the default — so
+  only genuinely malformed tags reach the guard. No date library, and no month or
+  weekday copy in the locale packs: `Intl` already owns the per-locale ordering
+  and separators.
+
+  Tests assert the computed accessible name via `getByRole('button', { name })`
+  rather than the presence of an attribute, which is the distinction the fix turns
+  on, and pin that no button is left answering to a bare emoji. The malformed-tag
+  case is recorded honestly as green on both sides of this change — `origin/main`
+  never passed a tag anywhere, so it could not trip over a bad one; its
+  counterfactual is the naive fix, and dropping the inner `catch` is what turns it
+  red with the raw ISO string in the DOM.
+
+- 94c5b7c: Localize `@object-ui/collaboration` — `CommentThread` no longer hardcodes English (objectstack#5506)
+
+  `@object-ui/collaboration` depended only on `@object-ui/types` and carried every
+  user-visible string as an English literal, so a `zh` console rendered a Chinese
+  shell around an English comment thread: "3 comments", "Reply", "Resolve",
+  "just now", "Add a comment... (use @ to mention)".
+
+  The package now takes `@object-ui/i18n` as a dependency and exposes one
+  translation seam, `useCollaborationTranslation` /
+  `COLLAB_DEFAULT_TRANSLATIONS`, built on `createSafeTranslation` — the same
+  factory `data-table`, `form` and `filter-builder` use. Under an `I18nProvider`
+  it resolves the session locale; with no provider it resolves the English
+  defaults map, which is what keeps `CommentThread` usable standalone. There is
+  deliberately no `formatter`/label prop escape hatch: a host that wants
+  different copy overrides the locale keys, so one thread can never end up half
+  translated by the bundle and half by props.
+
+  The issue listed 13 sites. A site-by-site sweep of the file found **20** — the
+  seven the original sweep missed are `{n}h ago`, `{n}d ago`, `(edited)`, the
+  thread's own comment count, the `Oldest`/`Newest` sort options,
+  `Replying to {name}...`, and the composer's `Send` button. All 20 are keyed
+  here; leaving any behind would have shipped a thread that is 90% translated.
+
+  Two of them carry a second defect on top of being untranslated: the plural
+  **rule** was compiled into the component, not just the words.
+
+  - the header read `` `${n} comment${n !== 1 ? 's' : ''}` ``;
+  - the reaction chip tooltip read `` n === 1 ? '1 reaction' : `${n} reactions` ``.
+
+  Both produced correct _English_ — this is not the "1 items" bug objectui#3423
+  fixed on the tab badge — but the choice between the two forms was English
+  grammar hardwired into the render path. No locale could apply its own: ru needs
+  three forms and ja needs none, and neither could ever be expressed no matter
+  what the packs said.
+
+  Both now use the repo's **two-key** plural convention
+  (`collaboration.commentCount`/`commentCountOne`,
+  `collaboration.reactionCount`/`reactionCountOne`) rather than an i18next
+  `_one`/`_other` pair: zh/ja/ko have no separate singular form, so those packs
+  would legitimately omit the `_one` half and `all-locales-key-parity` reads a
+  legitimately-absent half as a lost key. Counts are interpolated as strings, so
+  i18next skips its own plural resolution and the two-key scheme stays in charge.
+
+  The reaction tooltip gets a **dedicated** key pair rather than reusing
+  `detail.reactionCount`: that one interpolates `{{emoji}}`, and at this call
+  site the emoji is the chip's visible label with nothing to hand the
+  placeholder — reuse would have left a literal `{{emoji}}` in the accessible
+  name under every locale.
+
+  Relative timestamps stayed word-level: the existing minute/hour/day buckets are
+  untouched and no date library was introduced. The `>= 7d` branch still uses the
+  runtime's own `toLocaleDateString()` — that is not a hardcoded English literal,
+  and pinning it to the session language has its own failure mode (an
+  unrecognised tag throws into the surrounding `catch`, which would render a raw
+  ISO string), so it is tracked separately.
+
+  `Save` / `Cancel` / `Edit` / `Delete` read from the shared `common` namespace
+  instead of being re-spelled under `collaboration` — they are the generic action
+  words, already translated in all ten packs, and a second spelling would only be
+  a second thing to keep in sync. The 21 genuinely new keys are added to all ten
+  locale packs with real translations.
+
+- ca0fa8f: Localize `PresenceAvatars` — the avatar stack's accessible name and tooltips follow the session language (objectui#3440)
+
+  objectui#3424 wired `@object-ui/collaboration` up to `@object-ui/i18n` but only
+  converted `CommentThread`. `PresenceAvatars` in the same package kept three
+  English literals, and it is not a dormant export — the console renders it in
+  two places: `app-shell/src/layout/AppHeader.tsx` (tenant presence beside the
+  lifecycle badge) and `app-shell/src/views/RecordDetailView.tsx` (who else is on
+  this record). A `zh` session got them in English.
+
+  The three sites:
+
+  - the group's `aria-label`, `` `${n} user${n !== 1 ? 's' : ''} present` ``;
+  - the overflow badge's tooltip, `` `${n} more user${n !== 1 ? 's' : ''}` ``;
+  - each avatar's tooltip, `` `${name} (${status})` ``.
+
+  The first one is the whole control as far as a screen reader is concerned: the
+  stack renders images and initials and nothing else, so there was no other
+  accessible name to fall back on.
+
+  As with the comment count in #3424, the first two carried a second defect on
+  top of being untranslated — the plural **rule** was compiled into the component.
+  Both produced correct _English_ (each has a real singular branch, so this is
+  not the "1 items" defect objectui#3423 fixed on the tab badge), but
+  `n !== 1 ? 's' : ''` is English grammar in a render path and no locale could
+  apply its own. Both now use the repo's **two-key** plural convention
+  (`collaboration.presentUserCount`/`presentUserCountOne`,
+  `collaboration.moreUserCount`/`moreUserCountOne`) rather than an i18next
+  `_one`/`_other` pair, with the count interpolated as a string so i18next skips
+  its own plural resolution. German is what witnesses the move: "1 anwesender
+  Benutzer" vs "2 anwesende Benutzer" inflects the adjective, which the deleted
+  ternary could not have produced for any pack.
+
+  The avatar tooltip becomes a single `collaboration.userStatusTitle` key
+  (`{{name}} ({{status}})`) so the parentheses and their spacing belong to the
+  translation — the CJK packs drop the space English puts before `(`, matching
+  their existing `edited: '(已编辑)'`.
+
+  Its `status` is a **display-layer** translation
+  (`collaboration.statusActive` / `statusIdle` / `statusAway`): the
+  `PresenceUser['status']` enum value stays raw data everywhere it is stored,
+  compared or passed around — including the `statusColors` lookup — and is
+  translated only at this render exit. A status outside the declared union
+  renders as itself, the raw string: presence users arrive from a host-supplied
+  `PresenceSource` transport, so an unmapped value is reachable at runtime
+  whatever the type says, and the fallback invents nothing rather than leaving an
+  empty bracket pair.
+
+  Eight new keys, added to all ten locale packs with real translations.
+
+- 3889ffb: Console chrome i18n gaps (objectstack#5407).
+
+  - A dependency-gated lookup now names its controlling field by its **label**
+    instead of its raw API name. The sentence was localized but the interpolated
+    name was not, so every locale — English included — read `Select crm_account
+first`. The form renderer passes a new `dependsOnLabels` widget prop (the
+    lookup-side counterpart of `emptyHint`, which it already resolves to labels
+    for the fixed-option widgets); a name the host does not cover still falls
+    back to itself.
+  - The page-header overflow trigger's `More actions` accessible name now reads
+    `detail.moreActions`, the same key `action:menu`'s own overflow trigger uses,
+    so the two cannot diverge per locale.
+  - The activity-feed reaction button's `Add reaction` accessible name is now a
+    bundle key (`detail.addReaction`, added to all ten packs).
+  - The "check the highlighted fields" toast joins field names with a per-locale
+    separator (`validation.formInvalidJoiner`) instead of a hardcoded `、`
+    (U+3001) — right for zh/ja by accident, wrong in English and every Latin
+    locale. Latin packs use `, `, CJK `、`, Arabic `، `.
+  - The Spanish `validation.required` / `validation.unique` templates gained
+    their own masculine head noun (`El campo {{field}} es obligatorio`) so the
+    adjective agrees for feminine field labels too — `Cuenta es obligatorio` was
+    ungrammatical.
+
+- 7e2406a: The group-tenancy write-target badge is now translated in all ten locales (objectui#3517)
+
+  `form.createTargetOrg` — the ADR-0105 badge `RecordFormPage` shows in create mode
+  to name the organization a new record will land in — was defined in **no** locale
+  pack, not even `en`. i18next therefore genuinely missed the key and rendered the
+  call site's inline `defaultValue`, so the badge read English `Creates in <org>` in
+  all ten languages: a Chinese console creating a record on an org-walled object
+  showed `Creates in 某某组织`.
+
+  `all-locales-key-parity.test.ts` could not see this. It asserts that every pack
+  defines every **`en`** key, so a key `en` itself lacks is outside the comparison —
+  ten packs missing it identically kept parity fully green.
+
+  ## What changed
+
+  - `createTargetOrg` is backfilled into `en` as `Creates in {{org}}`, which makes
+    the parity gate demand it from the other nine; each is translated to its pack's
+    existing `form`-section tone rather than copied or machine-filled.
+  - The inline `defaultValue` in `RecordFormPage.tsx` is deleted, finishing what
+    objectui#3469 started — that key was the file's last remaining exception, and
+    every `t()` on the page now passes bare. Declared = enforced: the packs are the
+    single source of this copy, and a missing key must surface (raw key + dev
+    missing-key warning) instead of being papered over at the call site.
+  - The two exception-pinning tests objectui#3516 left behind invert. `form.createTargetOrg`
+    joins the `BARE_KEYS` list (pinned present in all ten packs), and the render
+    assertion now checks the badge against the **pack** copy in both `en` and `zh` —
+    the deleted English default could not satisfy the Chinese assertion, so the
+    badge fails loudly if the packs ever stop driving it.
+
+- 4eeb932: The form renderer's last user-visible English literals now go through i18n (#3272). The fullscreen long-text editor (`mobile_fullscreen`) was an entire untranslated dialog — title, screen-reader description, `Cancel` / `Done` footer buttons, and the expand trigger's accessible name — rendering English inside an otherwise translated zh/ja/ar form; it now reads the new `form.fullscreen.*` keys, shipped in all ten locale packs.
+
+  **Behaviour change worth reading if you author forms:** `submitLabel` and `cancelLabel` no longer default to the literals `'Submit'` and `'Cancel'` in the renderer. They default to _unset_, and the action bar falls back at render time to `common.submit` / `common.cancel`, so a form that declares no button copy now follows the session language instead of being silently frozen to English. A label you DO declare still wins verbatim in every locale — including an English one under a zh session, and including an explicit empty string (the fallback uses `??`, so `submitLabel: ''` renders a blank button rather than being overwritten). The only forms whose rendered text changes are those that never declared the labels and are viewed in a non-English session — which is the bug. `FormSchema.submitLabel` / `cancelLabel` stay optional strings; no spec or type change.
+
+  Also removed the built-in `select` branch's second `|| 'Select an option'` fallback. The single call site already supplies `t('common.selectOption')`, so the literal was reachable only through an authored `placeholder: ''` — where it replaced the author's deliberate blank with an untranslated English word.
+
+- 5c856ec: `ObjectGantt`'s quick-filter bar is now localized instead of pinned to Chinese. The four `QuickFilterBar` labels (`all`, `clear`, `empty`, `resultSummary`) were hardcoded as Chinese string literals at the `ObjectGantt` call site, so the bar read 全部 / 清除筛选 / 无可选项 / 显示 N / M 项任务 under an `en`, `ja`, `es` or `ar` session while the rest of the gantt toolbar localized correctly — a conspicuous mismatch, and a violation of the English-only-codebase rule. `QuickFilterBar` itself was never at fault: it is presentational and already falls back to English, so the host was the only thing pinning the copy.
+
+  The four strings moved into a new `gantt.quickFilter` namespace, added to all ten built-in locale packs, and the call site now resolves them through the gantt package's existing `useGanttTranslation` — the same per-key hook every other gantt string already uses, so a host dictionary that lags on these keys still renders the bundled English default rather than a raw key. `gantt.quickFilter.resultSummary` deliberately keeps SINGLE-brace placeholders (`{shown}` / `{total}`): the call site substitutes them with a literal `.replace`, not i18next interpolation, matching `gantt.autoScheduleDlg.body` and the placeholder convention `all-locales-key-parity` already recognises. Anyone retranslating these packs must keep that spelling — a respell to `{{shown}}` would render the raw placeholder to the user.
+
+- 68b6a28: The list toolbar's "Filter" now saves. Saving a filter from the runtime toolbar PUT the FilterBuilder's whole group object (`{ id, logic, conditions }`) into the view's `filter`, where `@objectstack/spec`'s `ListViewSchema.filter` declares `ViewFilterRule[]` — so every save came back `422 invalid_metadata` and the filter was silently never persisted (objectstack#5159).
+
+  The producer now folds the builder's group to the spec's flat `{ field, operator, value }` rule list before persisting, sharing one transform with the Studio view inspector (which had the only copy). Operators normalize through the spec's own `normalizeFilterOperator`, so the four builder operators the Studio's local table had drifted behind — `startsWith`, `endsWith`, `isNull`, `isNotNull` — now persist correctly too. The builder's per-row `id` is no longer written: it is a React list key that the read path regenerates, so stored view bodies keep the declared vocabulary only.
+
+  A filter whose shape cannot be represented losslessly as a flat rule list — `OR` across several conditions, or nested condition groups — is now refused with a translated message instead of being quietly saved as `AND`, which would have returned a different set of records than the one on screen. Such a filter still applies to the current list; it just does not become part of the saved view.
+
+- 28b2e65: Localize the create / edit / view form title `ObjectView` builds itself
+  (objectui#3462)
+
+  The same family as #3426 / PR #3457 and #3459 / PR #3464, one call site further
+  in. `ObjectView.getFormTitle()` string-built its three verbs in TypeScript:
+
+      case 'create': return `Create ${objectLabel}`;
+      case 'edit':   return `Edit ${objectLabel}`;
+      case 'view':   return `View ${objectLabel}`;
+
+  so a Chinese session whose object is labelled 联系人 read a drawer headed
+  **"View 联系人"** — an English verb glued onto a localized label. All three
+  consumers are visible chrome: `renderDrawerForm`'s `DrawerTitle`,
+  `renderModalForm`'s `DialogTitle`, and the `title` prop handed to
+  `NavigationOverlay` in the `popover` branch (a host-supplied `title` displaces
+  the overlay's own `resolvedTitle` default, so it is what the user sees).
+
+  The bar to reach it is lower than #3459's split panel: `ObjectViewSchema.layout`
+  already defaults to `'drawer'`, and `navigation` is a declared authorable input
+  on the registered `object-view` block whose `mode` union carries `drawer`,
+  `modal` and `popover`. A row click under any of them sets `formMode: 'view'` and
+  opens the container. `app-shell`'s wrapper pinning `layout: 'page'` is one host
+  overriding a registered block, not proof the branch is dead.
+
+  ## What changed
+
+  The three verb branches resolve `form.createTitle` / `form.editTitle` /
+  `form.viewTitle`.
+
+  **No new key family was minted.** `form.createTitle` (`'Create {{object}}'`) and
+  `form.editTitle` (`'Edit {{object}}'`) already ship in all ten packs and are
+  already how `app-shell` heads the PAGE-mode record form
+  (`RecordFormPage.tsx`, `AppContent.tsx`). The drawer / modal / popover titles are
+  the same heading on a different surface, so they resolve the same keys — a
+  parallel per-plugin family would have guaranteed the two spellings drift, which
+  is what the sibling issues were about. Only the third verb had no sibling:
+  `form.viewTitle` is added to all ten packs, following each pack's existing
+  arrangement for its create/edit twins rather than a translated-verb-plus-label
+  concatenation (de puts the verb last, ja/zh use particles and no space).
+
+  `VIEW_DEFAULT_TRANSLATIONS` in `ObjectView.tsx` gains the three English entries,
+  which is what `createSafeTranslation` falls back to with no `I18nProvider`
+  mounted.
+
+  Two branches stay literal on purpose and are pinned by tests: `schema.form.title`
+  (the author wrote a title, so the author's title wins, in every locale) and the
+  `default` branch (bare object label, no verb to translate).
+
+  ## Visible English change
+
+  None. Every branch is byte-identical in English — `Create Contacts`,
+  `Edit Contacts`, `View Contacts` — with and without a provider, so e2e specs and
+  host tests that address this chrome by its English name keep addressing it. The
+  provider-less path has its own test file, kept separate because
+  `initReactI18next` registers its instance as a module global that outlives
+  `cleanup()`.
+
+  The toolbar's create BUTTON keeps resolving `console.objectView.new`
+  ("New" / 新建) and was deliberately not reused for the heading: a button verb and
+  a title are different contexts, and folding them together is how the next drift
+  of this shape would start.
+
+- 825bbe3: The option widgets' "this list cannot be filled" message now has one source, and
+  it is translated (objectui#3231).
+
+  FROM: `SelectField`, `MultiSelectField`, `RadioField` and `CheckboxesField` each
+  carried their own copy of the empty/gated state, each destructured the declared
+  `emptyHint` prop into `_emptyHint` and dropped it, and each rendered a hardcoded
+  English literal (`'No options available'`, `` `Select ${…} first` ``) even in a
+  Chinese or Japanese session. TO: one shared `OptionsEmptyState` — the host's
+  `emptyHint` when it supplied one, otherwise a translated fallback
+  (`fields.options.empty` / `fields.options.selectFirst`, added to all ten locale
+  packs).
+
+  `emptyHint` was declared, produced by the form renderer and transported, then
+  lost three times over — so no registered widget could ever render it. All three
+  breaks are fixed, because closing only the last one delivers nothing:
+
+  - `isOptionField` compared the raw resolved type against `'select'` /`'radio'` /
+    `'multiselect'` / `'checkboxes'`. Object-derived forms emit
+    `mapFieldTypeToFormType`'s prefixed ids (`field:select`), which matched none of
+    them, so for every option field coming from an object schema — the normal case
+    in the console — the whole cascade block was skipped and no hint was computed
+    at all. It now normalizes the `field:` prefix, the same normalization
+    `stripRegisteredFieldProps` already applied a few lines below.
+  - `stripRegisteredFieldProps` then removed the `emptyHint` key from what was
+    left. It is now forwarded to the four cascade option types, alongside
+    `dependentValues`. This stays an allow-list rather than a blanket
+    pass-through: every other registered widget spreads its leftover props onto a
+    DOM node, where an unknown `emptyHint` attribute is a React warning.
+  - the widgets themselves discarded it. Keeping it out of the `...props` spread
+    was correct; not using it afterwards was not.
+
+  User-visible effect: a dependency-gated option list now prompts with the
+  controlling field's **label** ("Select Country first") instead of its raw
+  metadata name, in the session's language; an unconfigured list says so in the
+  session's language too. The gate sentence is one i18n key shared by the renderer
+  and the widget fallback, so the two sides cannot word it differently.
+
+  Untouched: the built-in (unregistered) `select` branch of the form renderer,
+  which already consumed `emptyHint`. That is a separate live path.
+
+- 6195841: Localize the record-detail overlay heading that `ListView` and `ObjectGrid`
+  build themselves (objectui#3426)
+
+  #3423 gave `NavigationOverlay`'s `resolvedTitle` an i18n default
+  (`detail.recordDetail`), but two hosts never let that default run: they
+  string-built an English heading in TypeScript and passed it as the `title`
+  prop, so a zh/ja/de session got a fully localized drawer with one English
+  heading on it.
+
+  - `packages/plugin-list/src/ListView.tsx` — `` `${schema.label} Detail` ``
+  - `packages/plugin-grid/src/ObjectGrid.tsx` — the same template, plus a bare
+    `'Record Detail'` literal for the no-label case
+
+  Both are user-reachable, not dead defaults. `list-view` / `object-grid` are
+  public page blocks and `navigation` is an authorable key on their schema, so a
+  page that authors `navigation: { mode: 'drawer' }` opens exactly this overlay
+  on row click. (`app-shell`'s `ObjectView` does suppress it — it passes its own
+  `onRowClick`, which takes priority inside `useNavigationOverlay`, and renders
+  its own overlay — but that is one host overriding a public block, not proof the
+  branch is unreachable.)
+
+  ## What changed
+
+  Both call sites now key their heading instead of concatenating it:
+
+  - a new `detail.recordDetailWithLabel` (`'{{label}} Detail'`) carries the
+    object label through interpolation, so a pack whose qualifier trails the noun
+    (`de`) or that needs a possessive particle (`ja`/`zh`) can write its own
+    arrangement rather than inherit English word order;
+  - the no-label branch reuses `detail.recordDetail` — the very key the overlay
+    itself defaults to — so one heading on one control cannot drift into two
+    translations.
+
+  The new key is added to all ten locale packs and to each plugin's English
+  defaults map (`LIST_DEFAULT_TRANSLATIONS` / `GRID_DEFAULT_TRANSLATIONS`), which
+  is what `createSafeTranslation` falls back to with no `I18nProvider` mounted.
+
+  English output is byte-identical in every branch (`Contacts Detail` /
+  `Contacts Detail` / `Record Detail`), with and without a provider — pinned by a
+  provider-less test file per plugin, kept separate because `initReactI18next`
+  registers its instance as a module global that outlives `cleanup()`.
+
+- 5dd0127: Localize the record-overlay and tab-badge chrome that #5430's sweep left behind (objectstack#5506)
+
+  Four more console-chrome strings were still hardcoded English literals. Unlike
+  #5430's set they are not all accessible names — one is visible copy, and one was
+  a component **default** that only the console happened to override.
+
+  - `page:tabs`' count badge built its `aria-label` by template literal,
+    `` `${formatTabCount(count)} items` ``. The badge renders digits only, so that
+    label _is_ the badge to a screen reader — and the English plural was baked in
+    with no singular branch at all, so a related list with one row announced
+    "1 items". Now `common.itemCount` / `common.itemCountOne`.
+  - `NavigationOverlay`'s drag-resize handle (`role="separator"`, no visible label)
+    — now `common.resizeDrawer`.
+  - `NavigationOverlay`'s `expandLabel` **default**. Hosts may override it and the
+    console does, but the default is what every other host ships — and it feeds
+    both `aria-label` and `title` of an icon-only button. Now
+    `detail.openAsFullPage`, still overridable by the prop.
+  - `NavigationOverlay`'s `resolvedTitle` fallback, `'Record Detail'` — **visible**
+    overlay heading, not just an a11y name. Now `detail.recordDetail`.
+  - The sr-only `SheetDescription`/`DialogDescription` prose
+    `Record detail overlay for {title}.`, which existed in three copies
+    (drawer / modal / popover) — now one `detail.recordDetailOverlay` key with a
+    `{{title}}` placeholder.
+
+  The count badge follows this repo's **two-key** plural convention
+  (`detail.reactionCount`/`reactionCountOne`, `detail.relatedRecords`/`relatedRecordOne`)
+  rather than an i18next `_one`/`_other` pair: zh/ja/ko have no separate singular
+  form, so those packs would legitimately omit the `_one` half and
+  `all-locales-key-parity` would read that as a lost key. The formatted count
+  (`1.2k`, not `1200`) is interpolated so the accessible name and the visible
+  digits never disagree — and because i18next skips its own plural resolution when
+  `count` is a string, the two-key scheme stays in charge of the choice.
+
+  Both touched components moved from `useSafeTranslate` to `createSafeTranslation`,
+  which carries an options bag (two of the new keys interpolate) and an English
+  defaults map. That map is what keeps the provider-less path English, which
+  consumers outside this package depend on — `plugin-view`'s `ObjectView.test.tsx`
+  and `e2e/live/inline-edit-polish-2572.spec.ts` address this chrome by English
+  accessible name with no `I18nProvider` mounted.
+
+  All six new keys are added to all ten locale packs.
+
+- a415684: The console server-action wrapper's `opensInNewTab` choreography no longer
+  ships hard-coded bilingual Chinese/English copy (objectui#3321, AGENTS.md
+  Commandment #-1): the pre-opened SSO spinner tab (title + body) and the
+  popup-blocked toast (title, description, action label) are now localized
+  through new `console.serverAction.*` keys in `@object-ui/i18n`, added at full
+  parity across all ten locale packs.
+
+  `createConsoleServerActionHandler` gains an optional i18next-style `t` option
+  (`t(key, englishDefault)`) — the wrapper is a plain function, so the translate
+  function is injected from the two hook-context call sites
+  (`useConsoleActionRuntime`, `RecordDetailView`) via `useObjectTranslation`.
+  When omitted (tests / standalone), every string falls back to its English
+  default; no non-English copy remains in code. Locale strings are HTML-escaped
+  before being written into the spinner document.
+
+- a6ec93d: `createSafeTranslation`'s no-provider fallback interpolation now replaces **all**
+  occurrences of each placeholder, matching i18next semantics on the provider path.
+
+  The fallback used `value.replace('{{k}}', String(v))`, and `String.prototype.replace`
+  with a string needle substitutes only the _first_ match. A default string repeating a
+  placeholder — `'Selected {{count}} of {{count}} items'`, natural in many locales and
+  sometimes required by RTL / agglutinative word order — therefore leaked literal braces
+  to users on hosts with no `I18nProvider` mounted (standalone / embedded renderers),
+  while the same string interpolated correctly once a provider was present. A silent
+  semantic fork, in exactly the environments we observe least.
+
+  The replacement is `value.split(needle).join(String(v))` rather than `replaceAll`:
+  both `replace` and `replaceAll` interpret `$&`, `` $` ``, `$'` and `$$` in the
+  _replacement_ string, which i18next does not. Values here are runtime data (record
+  labels, search terms), so that second divergence was reachable today — a label
+  containing `$&` was mangled on the fallback path. split/join is literal on both sides
+  and needs no regex escaping of the placeholder name.
+
+  Key resolution (`defaults[key] || key`), the `String(v)` coercion, and the
+  leave-it-literal behaviour for a placeholder with no matching option are unchanged.
+  Fixes objectui#3418.
+
+- c7ed4c3: `TagsField` no longer ships a hardcoded Chinese input placeholder
+  (objectui#3342, AGENTS.md Commandment #-1). The placeholder now resolves
+  through the pinned chain: the author-declared `field.placeholder` wins
+  (previously ignored by this widget); otherwise the widget's own copy arrives
+  via `useFieldTranslation()` under the new `fields.tags.placeholder` key, added
+  at full parity across all locale packs (Chinese lives in the zh pack, not in
+  code); with no `I18nProvider` mounted the English default from FIELD_DEFAULTS
+  renders — never a raw key.
+- 2409e1d: `TextAreaField`'s character counter now announces itself in the session locale. The counter block — rendered only when the field declares `maxLength` — carried the accessible name `Character count: {n} of {max}` as an English literal, and the element is an `aria-live="polite"` region, so a zh/ja/ar session had that English sentence read out on every keystroke while sighted users saw only the language-independent `{n}/{max}` digits. Nothing was wrong on screen, which is why it survived: only screen reader users could perceive it (#3406).
+
+  Unlike #3404, no key existed to consume — none of the ten locale packs had any character-count string. `fields.textarea.characterCount` is new in all ten, interpolating `{{count}}` and `{{max}}` as one sentence rather than parts assembled in code, because `ja` and `ko` put the cap before the count ("of {{max}} characters, {{count}}"), an order no concatenation can produce. The English pack value and the `FIELD_DEFAULTS` fallback are byte-identical to the literal they replace, so an `en` session and a provider-less embed both render exactly what they did before.
+
+  Behaviour is unchanged: `aria-live="polite"` and the per-keystroke recompute are deliberately untouched here and tracked separately (#3408).
+
+- 789fe3e: `TextAreaField`'s character counter no longer re-announces itself on every keystroke. Measured on `main` in a zh session with `maxLength: 500`, typing a 52-character sentence one character at a time produced 52 distinct screen-reader announcements totalling 979 spoken characters — roughly 19x the text being written, each one cutting off the reader's echo of the letter just typed. The counter element was simultaneously the visible `{n}/{max}` digits, the carrier of the translated sentence and the `aria-live` region itself, so "re-render" and "announce" were the same event; the field also had no `aria-describedby`, so focusing it said nothing about the cap at all (#3408).
+
+  It is now the three-node shape the GOV.UK Design System character-count component uses: the visible digits are `aria-hidden` and purely decorative; the counter sentence (`fields.textarea.characterCount`, unchanged in all ten packs) has moved onto the textarea's `aria-describedby`, so focus reads "Character count: 12 of 500" once and then stays quiet; and a separate visually-hidden `aria-live="polite"` region carries a new near-limit warning, `fields.textarea.charactersRemaining` (new in all ten packs), which stays silent until the value is inside the last 10% or last 20 characters of the cap — whichever the typist reaches first — and updates only after typing pauses for a second. The same 52-keystroke probe now produces zero announcements; a run that types all the way onto a 500-character cap produces five. Any `aria-describedby` the host already supplied (the form renderer's description and error-message ids) is appended to, never replaced.
+
+  No metadata change: the counter still renders exactly when the field declares `maxLength` (or the legacy `max_length`), and a widget rendered with no `I18nProvider` still shows the same English sentences.
+
 ## 17.2.0
 
 ### Minor Changes
@@ -189,7 +1987,7 @@ plan` sentence users reported (cloud#959). Both spec builders now take a transla
 
 ### Patch Changes
 
-- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:* audit actors — objectstack#4365 / objectstack#4366
+- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:\* audit actors — objectstack#4365 / objectstack#4366
 
   - **Approvals inbox** (`ApprovalsInboxPage`): a reassign timeline entry now
     renders "from A to B" from the structured
@@ -901,6 +2699,7 @@ os_tianshun_ehr_position — use a unique value or the record id` — with the f
   is byte-identical, it just comes from the pack now.
 
   Adds two guards, both mutation-verified:
+
   - `en` ↔ `zh` full key parity, asserted in both directions. The other eight
     packs are still ~357 keys behind and are tracked separately (objectui#2872
     part a), so they are deliberately not asserted yet.
@@ -1835,6 +3634,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   wired by `RecentItemsProvider` + `useTrackRouteAsRecent` +
   `RecordDetailView`). Multi-device by construction: open a record on
   laptop, see it in `⌘K → Recently viewed` on phone.
+
   - Group renders only when input is empty (no competition with search).
   - Limited to the 5 most recent record-type entries.
   - New i18n key `console.commandPalette.recentRecords` (en + zh seeded;
@@ -1844,6 +3644,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 
   When `useRecordSearch` is mid-flight (debounced fetch across objects
   hasn't returned yet), the palette now surfaces a subtle visual:
+
   - A small pulsing primary-coloured dot next to the **Records** group
     heading, so the user sees that more results may still appear.
   - A `Searching…` placeholder inside the empty state when the user has
@@ -1857,6 +3658,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   - Stage chevron (`record:path`): bump completed-stage contrast (emerald-800 text on emerald-500/15, was 700 on /10) and future-stage text from `foreground/70` to `foreground/85` for legibility.
   - i18n: add `notifications.emptyUnread`, `notifications.filterUnread`, `notifications.filterAll` (en + zh) so the InboxPopover Unread/All sub-filter renders in the active locale.
 - 5425608: CRM UX polish pass — calmer enterprise look across detail + kanban.
+
   - **plugin-kanban**: column headers now use a 2px muted accent stripe with
     neutral foreground titles + a quiet grey count pill instead of full
     rainbow gradient + colored title + colored count. Pipeline boards
@@ -1888,6 +3690,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -1911,6 +3714,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 ### Minor Changes
 
 - 49b1760: Polish the ConcurrentUpdateDialog and add i18n.
+
   - Internationalise all dialog strings (title, body, button labels, "your edit" / "current value" headings, audit-trail line) through `useDetailTranslation`. Locale strings added to `@object-ui/i18n` for English and Chinese.
   - Replace the plain dialog header with an amber warning badge + `AlertTriangle` icon to communicate that this is a conflict, not a routine confirmation.
   - Visually differentiate the two value blocks: amber tint for the user's pending edit, sky tint for the server's current value. Both wrap long values cleanly.
@@ -1976,6 +3780,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   default detail view. They were missing cross-cutting affordances and
   shipped with English-only tab labels and heavy bordered section cards
   even when the host locale was Chinese. Track 1 closes the visible gap:
+
   - **app-shell `RecordDetailView`**: the `assignedPage` branch now wears
     the same chrome as the default branch — lifecycle managed-by badge
     and presence avatars in the top-right, `MetadataPanel` debug panel,
@@ -2031,6 +3836,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   The matrix/summary "Group by" (rows) and "Columns axis" (cols) sections now
   share the same searchable popup picker as the columns section, with a
   commit-on-select single-pick mode wired through `FieldPickerDialog`.
+
   - Per-row field buttons display the human-readable field label and open a
     dialog scoped to swap that single field (already-used fields filtered out)
   - "Add grouping" trigger uses the same dialog
@@ -2040,6 +3846,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   - Bigger row spacing (h-7 / text-xs) — the old `text-[10px]` was unreadable
 
   `FieldPickerDialog` gains:
+
   - `commitOnSelect`: hides the Confirm/Cancel footer; clicking a row commits
     - closes immediately (intended for `singleSelect` flows)
   - `trigger`: custom trigger element override (used by the per-row field button)
@@ -2068,6 +3875,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   in the spec.
 
   New exports from `@object-ui/plugin-report`:
+
   - `JoinedBlocksEditor` — standalone component for embedding the
     block editor anywhere.
   - `validateJoinedBlocks` — pure helper returning translated
@@ -2099,6 +3907,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   The report configuration panel is now safe to open on any spec-shape `Report` and only exposes fields that are actually persisted by `@objectstack/spec`.
 
   `@object-ui/plugin-report`:
+
   - Add a bidirectional `SpecFilterAdapter` so `ReportConfigPanel` can edit
     spec `FilterCondition` filters (`{field: value}`, `{field: {$op: value}}`,
     top-level `$and`/`$or`). Complex / nested filters fall back to a
@@ -2120,12 +3929,14 @@ actionName, spec)`: overlays translated `title` / `description` /
   - 18 new unit tests cover the filter adapter round-trip.
 
   `@object-ui/components`:
+
   - `FilterBuilder` now guards against malformed external `value` props.
     Previously a spec-shape filter (`{is_active: true}`) would crash the
     component on first render; the builder now falls back to an empty
     AND group whenever `value` is not a valid `FilterGroup`.
 
   `@object-ui/i18n`:
+
   - Add `report.editor.*` strings to `en` and `zh`.
 
 - 8442c05: Improve report editor panel usability based on real-user browser testing:
@@ -2205,6 +4016,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   no visible effect — the user/session were nulled but the UI stayed authenticated.
 
   Changes:
+
   - **`@object-ui/auth`** — added `isAuthEnabled: boolean` to `AuthContextValue`
     (`true` only when real auth is in use, `false` for guest/preview modes).
   - **`@object-ui/app-shell`** — `AppHeader` and `AppSidebar` now hide the "Log out"
@@ -2222,6 +4034,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 - fd15918: Comprehensive i18n refactor + CI test fix.
 
   **i18n (`@object-ui/i18n`)**
+
   - Added ~130 new keys under 12 new top-level namespaces: `layout`, `search`,
     `empty`, `renderer`, `actionDialog`, `rowAction`, `navigationSync`,
     `objectActions`, `objectViewActions`, `dashboardActions`, `recordDetail`,
@@ -2233,6 +4046,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 
   **App shell (`@object-ui/app-shell`)** — replaced hardcoded English in 14
   files with `useObjectTranslation`:
+
   - Layout: `AppSidebar`, `ActivityFeed` (locale-aware relative time),
     `MetadataInspector`.
   - Views: `SearchResultsPage`, `ActionParamDialog`, `RecordFormPage`,
@@ -2244,12 +4058,14 @@ actionName, spec)`: overlays translated `title` / `description` /
     `useObjectActions` (delete confirm + success / failure toasts).
 
   **Plugin grid (`@object-ui/plugin-grid`)**
+
   - `ObjectGrid` record-detail panel now translates Empty / Yes / No / System
     via the existing `useGridTranslation` safe-fallback wrapper.
   - `RowActionMenu` adopts a local safe-fallback i18n wrapper for
     `Open menu` / `Edit` / `Delete`, preserving standalone-usage guarantees.
 
   **CLI test fix (`@object-ui/cli`)**
+
   - `cli-bin.test.ts` auto-builds the package on first run when `dist/cli.js`
     is missing, instead of throwing. This unbreaks `pnpm test:coverage` in CI
     (root vitest run does not honor turbo's `^build` deps) and removes the