@@ -0,0 +1,11 @@
+---
+'@object-ui/i18n': patch
+'@object-ui/app-shell': patch
+---
+
+fix(console): the create-workspace dialog explains the organization limit in the session language
+
+Clause-②: no
+Metadata-protocol: none
+
+- **The organization-limit refusal is localized.** When a deployment caps how many organizations one user may create (`OS_ORG_LIMIT`) and the user is past it, the server refuses with `403 YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS`. The create-workspace dialog showed the auth library's English sentence for it in every locale. It now shows `organization.errors.organizationLimitReached`, which says the cap counts only organizations the user created, never ones they were invited to, in all 11 console locales (`en`, `zh-Hans`, `zh-Hant`, `ja`, `ar`, `de`, `es`, `fr`, `ko`, `pt-BR`, `ru`). The message names no number: the refusal body and `/auth/config` do not carry the cap.
@@ -379,3 +379,36 @@ describe('prefills a first organization from the e-mail (objectstack-ai/cloud#35
     expect(screen.getByTestId('workspace-name-input')).toHaveValue('Acme');
   });
 });
+
+// objectstack#28124: past the per-user creation cap (`OS_ORG_LIMIT`) the server
+// refuses with 403 YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS, and the
+// dialog showed better-auth's English sentence in every locale. Rendered through
+// the real packs, zh and en.
+describe('the organization-limit refusal is shown in the session language (objectstack#28124)', () => {
+  const SERVER_SENTENCE = 'You have reached the maximum number of organizations';
+  const limitRefusal = () =>
+    Object.assign(new Error(SERVER_SENTENCE), {
+      code: 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS',
+      status: 403,
+    });
+
+  for (const lang of ['zh-Hans', 'en'] as const) {
+    it(`${lang}: the dialog shows the pack sentence, not the server's English, and does not retry`, async () => {
+      packLang = lang;
+      createOrganization.mockRejectedValue(limitRefusal());
+      render(<CreateWorkspaceDialog open onOpenChange={() => {}} />);
+      await settleAuthConfig();
+
+      fillAndSubmit();
+
+      const shown = await screen.findByTestId('workspace-create-error');
+      const expected = (builtInLocales[lang] as { organization: { errors: Record<string, string> } }).organization
+        .errors.organizationLimitReached;
+      expect(typeof expected).toBe('string');
+      expect(shown).toHaveTextContent(expected);
+      expect(shown).not.toHaveTextContent(SERVER_SENTENCE);
+      expect(createOrganization).toHaveBeenCalledTimes(1);
+      expect(provisionMock).not.toHaveBeenCalled();
+    });
+  }
+});
@@ -173,6 +173,53 @@ describe('#12977 — ORGANIZATION_CREATION_DISABLED (objectstack registered code
   });
 });
 
+describe('#28124 — YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS (the per-user creation cap)', () => {
+  // better-auth refuses a create past `organizationLimit` (`OS_ORG_LIMIT`) with
+  // 403 and this code, and the body is its bare `{ code, message }`: no limit
+  // in it, and none in `/auth/config` either. So the console explains the cap
+  // without a number, and no pack may carry one.
+  const CODE = 'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS';
+  const SERVER_SENTENCE = 'You have reached the maximum number of organizations';
+  const KEY = 'organization.errors.organizationLimitReached';
+  const packValue = (lang: string): unknown =>
+    KEY.split('.').reduce<unknown>(
+      (n, k) => (n as Record<string, unknown> | undefined)?.[k],
+      builtInLocales[lang as keyof typeof builtInLocales],
+    );
+  const tPack = (lang: string) => (key: string, options?: Record<string, unknown>): string => {
+    const hit = key
+      .split('.')
+      .reduce<unknown>(
+        (n, k) => (n as Record<string, unknown> | undefined)?.[k],
+        builtInLocales[lang as keyof typeof builtInLocales],
+      );
+    return typeof hit === 'string' ? hit : String(options?.defaultValue ?? key);
+  };
+
+  it('zh: the refusal renders the zh pack sentence, not better-auth\'s English', () => {
+    const shown = resolveOrgErrorMessage(withCode(CODE, SERVER_SENTENCE), tPack('zh-Hans'));
+    expect(shown).toBe(packValue('zh-Hans'));
+    expect(shown).not.toBe(SERVER_SENTENCE);
+    expect(shown).toMatch(/\p{Script=Han}/u);
+  });
+
+  it('en: the refusal renders the en pack sentence, which says invited organizations do not count', () => {
+    const shown = resolveOrgErrorMessage(withCode(CODE, SERVER_SENTENCE), tPack('en'));
+    expect(shown).toBe(packValue('en'));
+    expect(shown).not.toBe(SERVER_SENTENCE);
+  });
+
+  it('every pack defines the key, with its own sentence and no number in it', () => {
+    const en = packValue('en');
+    for (const lang of Object.keys(builtInLocales)) {
+      const value = packValue(lang);
+      expect(typeof value, `${lang} lacks ${KEY}`).toBe('string');
+      expect(value as string, `${lang} names a number the server never sent`).not.toMatch(/\p{Nd}/u);
+      if (lang !== 'en') expect(value, `${lang} still serves the English sentence`).not.toBe(en);
+    }
+  });
+});
+
 describe('#4474 — the mapping table itself', () => {
   it('every mapped code resolves to a key the zh pack actually defines', () => {
     // Guards the class of typo that only shows up as a raw i18n key on screen,
@@ -196,6 +243,7 @@ describe('#4474 — the mapping table itself', () => {
         'ORGANIZATION_SLUG_ALREADY_TAKEN',
         'USER_IS_ALREADY_INVITED_TO_THIS_ORGANIZATION',
         'YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION',
+        'YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS',
         'YOU_ARE_NOT_ALLOWED_TO_INVITE_USERS_TO_THIS_ORGANIZATION',
         'YOU_ARE_NOT_ALLOWED_TO_INVITE_USER_WITH_THIS_ROLE',
         'YOU_ARE_NOT_THE_RECIPIENT_OF_THE_INVITATION',
 
@@ -48,7 +48,8 @@
  * the slug collision that is the create dialog's other outcome; the
  * multi-org-disabled refusal `CreateWorkspaceDialog` already comments about; and
  * the expired link `AcceptInvitationPage` already has a hand-written fallback
- * for), and one objectstack registered code (ADR-0112) on the create path:
+ * for; the per-user creation cap, which a hosted deployment sets low enough
+ * that an ordinary user reaches it), and one objectstack registered code (ADR-0112) on the create path:
  * `ORGANIZATION_CREATION_DISABLED`, the server's refusal for the same
  * deployment posture `CreateWorkspaceDialog`'s own guard reads from
  * `/auth/config` (objectui#12977). The rest are teams, dynamic roles and org
@@ -111,6 +112,18 @@ export const ORG_ERROR_MESSAGE_KEYS: Record<string, OrgErrorEntry> = {
     key: 'organization.errors.notAllowedToCreate',
     defaultValue: 'You are not allowed to create a new organization',
   },
+  // The per-user creation cap (`OS_ORG_LIMIT`, better-auth's
+  // `organizationLimit`): only organizations the caller OWNS count, never ones
+  // they were invited into, and the sentence says so because that is the part
+  // a refused user cannot guess. It names no number on purpose: the refusal
+  // body is better-auth's bare `{ code, message }` and `/auth/config` does not
+  // publish the cap, so the console has no number to show, and a number baked
+  // into every pack would be wrong on every deployment that sets another one.
+  YOU_HAVE_REACHED_THE_MAXIMUM_NUMBER_OF_ORGANIZATIONS: {
+    key: 'organization.errors.organizationLimitReached',
+    defaultValue:
+      'You have reached the limit on organizations you can create. Organizations you were invited to do not count toward it.',
+  },
   // objectstack's registered code (ADR-0112) for a deployment whose tenancy
   // posture refuses organization creation for every caller — a deployment
   // setting, not a missing grant, so it reuses the sentence the dialog's own
 
@@ -3870,6 +3870,7 @@ const ar = {
       organizationExists: 'هذه المؤسسة موجودة بالفعل.',
       slugTaken: 'هذا المُعرِّف مستخدَم بالفعل.',
       notAllowedToCreate: 'لا يُسمح لك بإنشاء مؤسسة جديدة.',
+      organizationLimitReached: 'لقد بلغت الحد الأقصى لعدد المؤسسات التي يمكنك إنشاؤها. لا تُحتسب المؤسسات التي دُعيت إليها ضمن هذا الحد.',
       notTheRecipient: 'لست المستلم المقصود بهذه الدعوة.',
       invitationNotFound: 'لم تعد هذه الدعوة موجودة أو أنها منتهية الصلاحية.',
       unknown: 'حدث خطأ ما. يرجى المحاولة مرة أخرى.',
 
@@ -3589,6 +3589,7 @@ const de = {
       organizationExists: 'Diese Organisation existiert bereits.',
       slugTaken: 'Dieser URL-Slug ist bereits vergeben.',
       notAllowedToCreate: 'Sie dürfen keine neue Organisation erstellen.',
+      organizationLimitReached: 'Sie haben die maximale Anzahl an Organisationen erreicht, die Sie erstellen können. Organisationen, zu denen Sie eingeladen wurden, zählen nicht dazu.',
       notTheRecipient: 'Sie sind nicht der Empfänger dieser Einladung.',
       invitationNotFound: 'Diese Einladung existiert nicht mehr oder ist abgelaufen.',
       unknown: 'Etwas ist schiefgelaufen. Bitte versuchen Sie es erneut.',
 
@@ -4393,6 +4393,7 @@ const en = {
       organizationExists: 'Organization already exists',
       slugTaken: 'That URL slug is already taken',
       notAllowedToCreate: 'You are not allowed to create a new organization',
+      organizationLimitReached: 'You have reached the limit on organizations you can create. Organizations you were invited to do not count toward it.',
       notTheRecipient: 'You are not the recipient of the invitation',
       invitationNotFound: 'This invitation no longer exists or has expired',
       unknown: 'Something went wrong. Please try again.',
 
@@ -3660,6 +3660,7 @@ const es = {
       organizationExists: 'Esa organización ya existe.',
       slugTaken: 'Ese slug ya está en uso.',
       notAllowedToCreate: 'No tiene permiso para crear una organización nueva.',
+      organizationLimitReached: 'Ha alcanzado el número máximo de organizaciones que puede crear. Las organizaciones a las que se le ha invitado no cuentan para este límite.',
       notTheRecipient: 'No es el destinatario de esta invitación.',
       invitationNotFound: 'Esta invitación ya no existe o ha caducado.',
       unknown: 'Algo salió mal. Inténtelo de nuevo.',
 
@@ -3656,6 +3656,7 @@ const fr = {
       organizationExists: 'Cette organisation existe déjà.',
       slugTaken: 'Ce slug est déjà utilisé.',
       notAllowedToCreate: "Vous n'êtes pas autorisé à créer une nouvelle organisation.",
+      organizationLimitReached: "Vous avez atteint le nombre maximal d'organisations que vous pouvez créer. Les organisations auxquelles vous avez été invité ne sont pas comptées.",
       notTheRecipient: "Vous n'êtes pas le destinataire de cette invitation.",
       invitationNotFound: "Cette invitation n'existe plus ou a expiré.",
       unknown: 'Une erreur est survenue. Veuillez réessayer.',
 
@@ -3591,6 +3591,7 @@ const ja = {
       organizationExists: 'その組織はすでに存在します。',
       slugTaken: 'そのスラッグはすでに使用されています。',
       notAllowedToCreate: '新しい組織を作成する権限がありません。',
+      organizationLimitReached: '作成できる組織の数が上限に達しました。招待されて参加した組織は上限に含まれません。',
       notTheRecipient: 'この招待の宛先はあなたではありません。',
       invitationNotFound: 'この招待は存在しないか、有効期限が切れています。',
       unknown: '問題が発生しました。もう一度お試しください。',