Merge remote-tracking branch 'origin/main' into claude/project-thread-xn40qf

Author: claude

.changeset/25555-localization-input-organization-id.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/core': patch
+'@objectstack/mcp': patch
+'@objectstack/plugin-audit': patch
+'@objectstack/plugin-hono-server': patch
+---
+
+refactor(core)!: `resolveLocalizationContext` takes the organization as `organizationId`; the `tenantId` key is retired
+
+Clause-②: no (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (runtime-export-retired @objectstack/core#ResolveLocalizationInput.tenantId) the retired member is a key of a published runtime TypeScript input with no Zod schema, no spec declaration and no stored shape; the compiler reports it at every object-literal call that still spells it, and nothing exists for `objectstack migrate meta` to rewrite -->
+
+**BREAKING** for a TypeScript caller of `resolveLocalizationContext` from `@objectstack/core`. The key that names the organization to localize for is renamed. There is no alias and no deprecation window.
+
+`ResolveLocalizationInput.tenantId` always meant the **organization** id: the settings service stores and reads `localization` under the organization (ADR-0131 D8), and the direct `sys_setting` fallback reads that organization's rows. The name did not say so, and an environment id passed there type-checked. It matched no organization's settings, so every non-UTC organization silently resolved its timezone as `UTC`, and the date boundaries cut from it moved with it. The key is now `organizationId`, and the resolver reads no other spelling at run time.
+
+- FROM `ResolveLocalizationInput.tenantId` TO `ResolveLocalizationInput.organizationId`: pass the caller's organization id under the new key, `resolveLocalizationContext({ ql, settings, organizationId, userId })`. Never pass an environment id.
+
+**Who moves.** A caller that builds the input as an object literal with `tenantId` gets a compile error (excess property) and makes the one-key fix above. A caller that builds it some other way, such as spreading an object that holds `tenantId` or passing a variable typed wider than the input, does not get that error: its `tenantId` is ignored and the resolver localizes as for a caller with no organization, so grep for `tenantId` beside `resolveLocalizationContext`. In this repository the four callers (`@objectstack/core`'s request execution context, `@objectstack/mcp`, `@objectstack/plugin-audit` and `@objectstack/plugin-hono-server`) are migrated here and behave as before.
+
+**Not moved.** The settings service's own scope argument, `{ tenantId, userId }` on `get` / `getMany`, keeps its spelling. It is a separate surface with its own callers. The resolver passes the organization id there as before.

.changeset/25876-nav-group-child-count.md

@@ -0,0 +1,15 @@
+---
+'@object-ui/layout': patch
+---
+
+feat(layout): a collapsed sidebar navigation group shows how many entries it holds
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** A closed navigation group drew its label and a chevron and nothing else, so a closed group holding one entry looked exactly like one holding ten, and users did not open it to find what was inside.
+- **Now.** While a group is collapsed, `NavigationRenderer` draws a small count badge between its label and its chevron. The count is what opening the group would reveal: the entries that pass the same per-item guards the renderer applies (the `visible` expression, `requiredPermissions`, the `requiresObject` / `requiresService` capability gates, a `doc` entry's readability check, and an `action` entry only when the host wires `onAction`), counted through nested groups. Separators and the groups themselves are not entries. It is the same walk that decides whether a group renders at all (`hasVisibleNavigationItems`), so the count cannot disagree with the opened group.
+- **When it does not show.** An open group shows no count, because its entries are in view. A group that holds the current route is forced open, so it never shows one. In the icon rail the badge is hidden under the same classes as the group label.
+- **Accessibility.** The badge is `aria-hidden`: the disclosure's accessible name stays the group label, and the disclosure already announces collapsed or expanded.
+
+What to do: nothing. No navigation key or value changes, and no translation key is added.

.changeset/25894-no-drafts-request-without-grant.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the Console no longer sends two requests it knows will be refused, the drafts ledger for a member and the published body of a new draft
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Home's drafts row** read `GET /api/v1/meta/_drafts` for whoever opened Home. A member holding none of the capabilities the ledger admits (`studio.access`, `setup.access` or `manage_metadata`) got a 403, and the console logged it as a failed request on every visit. The row now reads the ledger only for a session that holds one of them, through the new `useCanReadPendingDrafts()`. An unreported capability set still reads it, and the server still enforces the gate.
+- **The pending-changes sheet** (Studio's Publish and Changes, and the draft-preview bar's Changes) read each draft's published body beside its draft. Under Publish, where every row opens expanded, that read was sent before the sheet knew which drafts are new, so a draft-only object such as one just saved from New object got `GET /api/v1/meta/object/NAME?package=PKG` → 404. A row now waits for its new-or-update classification, and a new draft is not asked for a published body. A row whose classification read failed is read both ways, as before.
+
+What to do: nothing. The pages render exactly as before.

.changeset/25909-position-description-column.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the Setup → Positions list shows each position's description
+
+Clause-②: no
+Metadata-protocol: none
+
+The position list in Setup declared only Name, Label, Holders and Permission sets, so a position's `description`, which `GET /meta/position` already serves, was never shown. The list now has a Description column right after Label, the same column the permission-set list next to it has. A position without a description shows the empty cell. The text is the served one, so a description the translation bundle's `positions` namespace translates shows translated, like the label.
+
+What to do: nothing.