Merge remote-tracking branch 'origin/main' into claude/project-thread-gaqa04

Author: claude

.changeset/25955-group-section-true-only.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/plugin-form': patch
+---
+
+fix(plugin-form): a `{ group }` form section no longer warns that it "also declares `collapsible`, `collapsed`" when its author wrote neither
+
+Clause-②: no
+Metadata-protocol: none
+
+`@objectstack/spec` gives a form section's `collapsible` and `collapsed` a default of `false`, so every parsed section carries both, and it refuses them beside `group` only when they are `true`. The console's form renderer reported any value at all, so every `{ group }` section of a parsed form logged the group-owned-key warning once per page and told the author to move keys they never wrote to the object's `fieldGroups`. The renderer now reads those two keys the way the spec does: `true` beside `group` is still reported (a programmatic caller that skips the spec's parse), while `false` or absent is not. `name`, `label`, `description` and `visibleWhen` are still reported on any value.
+
+What to do: nothing. If you moved `collapsible` / `collapsed` off a `{ group }` section because of this warning, no metadata change was needed.

.changeset/25970-compare-to-all-time.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/plugin-dashboard': patch
+---
+
+fix(plugin-dashboard): a `compareTo` KPI tile shows its number when the reader picks All time, instead of the executor's "compareTo needs a dated window to shift" error
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** A dataset-bound widget with `compareTo` always sent `compareTo` to the dataset executor, but lowered a `timeDimensions` window only when its resolved filter held a closed `{ $gte, $lte }` date pair. Picking **All time** on the dashboard's date-range filter removes that pair, so the executor refused the query and the tile showed a 400 error where its number belonged. The same tile without `compareTo` showed its number.
+- **Now.** When the resolved filter carries no date condition at all on the compared field (on any field when `compareTo.dimension` is omitted), the widget asks for no comparison: the query is the one a widget without `compareTo` sends, and the tile shows its number with no comparison badge.
+- **Unchanged: an author-written window that is not closed stays an error.** A one-bound window (`{ $gte: '{current_year_start}' }`, a YTD tile), an exclusive bound or a single day is still sent with `compareTo`, and the executor still refuses it and names the fix. The executor and the spec define a comparison only against a two-bound window. Two dated fields with no `compareTo.dimension` stay the executor's ambiguity error.

.changeset/25992-objectview-helpers-split.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+refactor(app-shell): the Console `ObjectView`'s module-level helpers move into sibling modules
+
+Clause-②: no
+Metadata-protocol: none
+
+Module-level helpers, types and constants of `views/ObjectView.tsx` (the record links the list publishes, the saved-view tab, override and column helpers, and the small toolbar and filter helpers) move verbatim into `objectViewRecordLinks.ts`, `objectViewTabs.ts` and `objectViewHelpers.ts` beside it. No logic, name or rendered output changes. `ObjectView.tsx` keeps the component and re-exports every name it exported before, and the package entry is unchanged.
+
+What to do: nothing.

.changeset/26046-released-file-keeps-record-rule.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/service-storage': patch
+---
+
+fix(storage)!: a file its record lets go keeps that record's read rule
+
+ADR-0104 D3 promises one file, one owning record and one access rule. That rule now holds after the owning record lets the file go: until a writer who may read that record claims the file again, or the platform collects it, the file is read by that record's rule. The download door and the record-write claim path ask the same verdict, so both follow it. A file no record has owned is read as before, within its organization. The uploader still reads their own file.
+
+`sys_file` gains two nullable fields, `released_ref_object` and `released_ref_id`, naming the record that last owned the file. The platform writes them when a record lets a file go and clears them when a record claims it. Existing rows hold NULL and are read as before.
+
+Clause-②: no (narrowing) — a file read that a record's rule refuses is now refused after the record lets the file go. Nothing that was refused becomes accepted.
+
+Metadata-protocol: none (a file read rule and two platform-managed bookkeeping fields; nothing a metadata author writes changes)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata author's surface moves: no spec key or authorable spelling is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. The platform object `sys_file` gains two nullable bookkeeping fields that only the platform writes; schema sync adds the columns and existing rows read NULL, which is the shape every row had before. What changes is which callers a file read admits after the file's owning record lets it go. The remedy is reading the file as a reader of that record, never a rewrite of a package source or a stored row. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** for a reader the owning record's rule refuses, shipped as `patch` because the metadata protocol does not move.
+
+- **Before.** The owning record's rule did not hold for the file once the record let it go.
+- **Now.** It is read by the rule of the record that let it go, until it is claimed again or collected.
+- **Fix.** Read or claim such a file as a reader of that record.

.changeset/26094-built-in-permission-set-labels.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+The built-in permission sets' names are shown in Chinese, Japanese and Spanish
+
+Clause-②: no
+Metadata-protocol: none
+
+Setup → Permission Sets showed the platform's own permission sets with English names (*Administrator — Full Access*, *Member — Standard Access* …) under zh-CN, ja-JP and es-ES, next to each app's translated sets and next to their own translated descriptions. Each built-in set's label is now translated through the permission-set group of the translation bundle (`permissions.NAME.label`), beside its description, so a row reads in one language. For example, under zh-CN *Administrator — Full Access* reads 「管理员 — 完全访问」 and *Viewer — Read-Only* reads 「查看者 — 只读」.
+
+No set's grants, name, English label or description changed. This changes only the text shown for each set, not its permissions.

docs/adr/0104-field-runtime-value-shape-contract.md

@@ -1459,9 +1459,11 @@ exists in the acting organization. One file had two access rules.
 - **One judgement, two callers.** The door's verdict is one function, and the
   claim path calls it under the write's caller context; neither restates it.
   It admits the uploader; a reader of the record that owns the file, through
-  its object's `fileAccessDelegate` where one is declared; a member of the
-  organization for a file no record owns; a reader of any parent for an
-  attachments-scope file; anyone for a `public_read` file.
+  its object's `fileAccessDelegate` where one is declared; for a file a record
+  let go, a reader of that record, until the file is claimed again or
+  collected (#26046); a member of the organization for a file no record has
+  owned; a reader of any parent for an attachments-scope file; anyone for a
+  `public_read` file.
 - **The quiet answer.** At the write door, a file the writer may not read is
   answered as one the organization-scoped lookup cannot see: the id is kept
   as written, nothing is claimed or copied, and constraint verdicts do not run

packages/plugins/plugin-security/src/objects/permission-set-descriptions.test.ts

@@ -2,11 +2,12 @@
 
 import { describe, it, expect } from 'vitest';
 import { PermissionSetSchema } from '@objectstack/spec/security';
+import { translateMetadataDocument } from '@objectstack/spec/system';
 import { defaultPermissionSets } from './default-permission-sets.js';
 import { SecurityTranslations } from '../translations/index.js';
 
 /**
- * Every built-in permission set says who holds it.
+ * Every built-in permission set says who holds it, in every shipped locale.
  *
  * Setup → Permission Sets lists the platform's own sets beside every app's,
  * with each set's `description`. Five of them showed none and the no-bypass
@@ -15,18 +16,25 @@ import { SecurityTranslations } from '../translations/index.js';
  * member set. This pins the business fact that every set in
  * `defaultPermissionSets` carries ONE plain sentence of at most 160
  * characters, and that every translated locale of this plugin's bundle
- * carries that sentence for it. It is deliberately not a copy of the wording,
+ * carries that sentence and the set's label for it, so no row of the list
+ * reads half English. It is deliberately not a copy of the wording,
  * which `default-permission-sets.ts` and `../translations/permission-sets.ts`
  * own.
  *
  * A sentence: non-empty, no line break, at most 160 characters, ends with one
  * full stop (`.`, or `。` in Chinese and Japanese) and holds no other sentence
  * break. Engineering terms stay in the code comments beside each set, so the
  * copy names no permission-set id and no code span.
+ *
+ * A label: a short noun phrase (at most 80 characters, no line break, no
+ * closing full stop) split by ` — ` exactly as often as the English label, so
+ * a translation keeps the "who — what access" shape the list reads by.
  */
 type AnyRec = Record<string, any>;
 
 const MAX_LENGTH = 160;
+const MAX_LABEL_LENGTH = 80;
+const LABEL_SPLIT = ' — ';
 const TRANSLATED_LOCALES = Object.keys(SecurityTranslations).filter((l) => l !== 'en');
 const SET_NAMES = defaultPermissionSets.map((ps) => ps.name);
 
@@ -45,6 +53,21 @@ function expectOneSentence(text: unknown, where: string): void {
   for (const name of SET_NAMES) expect(value, `${where}: names ${name}`).not.toContain(name);
 }
 
+function expectLabel(text: unknown, english: string, where: string): void {
+  expect(typeof text, `${where}: label missing`).toBe('string');
+  const value = String(text);
+  expect(value, `${where}: padded`).toBe(value.trim());
+  expect(value.length, `${where}: empty`).toBeGreaterThan(0);
+  expect([...value].length, `${where}: over ${MAX_LABEL_LENGTH} characters`).toBeLessThanOrEqual(MAX_LABEL_LENGTH);
+  expect(value, `${where}: line break`).not.toMatch(/[\r\n]/);
+  expect(value, `${where}: ends with a full stop`).not.toMatch(/[.。]$/);
+  expect(value, `${where}: code span`).not.toMatch(/`/);
+  for (const name of SET_NAMES) expect(value, `${where}: names ${name}`).not.toContain(name);
+  expect(value.split(LABEL_SPLIT).length, `${where}: not in the English label's shape`).toBe(
+    english.split(LABEL_SPLIT).length,
+  );
+}
+
 describe('built-in permission set descriptions', () => {
   it('ships the nine built-in sets', () => {
     expect(SET_NAMES).toEqual([
@@ -91,8 +114,32 @@ describe('built-in permission set descriptions', () => {
         const entry = group[name] as AnyRec | undefined;
         expectOneSentence(entry?.description, `${locale} ${name}`);
         expect(entry?.description, `${locale} ${name}: an English copy, not a translation`).not.toBe(set.description);
-        // Descriptions only: the labels are not translated here.
-        expect(entry && 'label' in entry, `${locale} ${name}: carries a label`).toBe(false);
+      },
+    );
+
+    it.each(defaultPermissionSets.map((ps) => [ps.name, ps] as const))(
+      '%s carries a translated label',
+      (name, set) => {
+        const entry = group[name] as AnyRec | undefined;
+        expectLabel(entry?.label, String(set.label), `${locale} ${name}`);
+        expect(entry?.label, `${locale} ${name}: an English copy, not a translation`).not.toBe(set.label);
+      },
+    );
+
+    it('gives no two sets the same label', () => {
+      const labels = SET_NAMES.map((name) => (group[name] as AnyRec | undefined)?.label);
+      expect(new Set(labels).size).toBe(labels.length);
+    });
+
+    // The overlay `GET /meta/permission` applies at the REST boundary, read
+    // through the bundle this plugin loads: the served set's label and
+    // description are this locale's, nothing else of the set changes.
+    it.each(defaultPermissionSets.map((ps) => [ps.name, ps] as const))(
+      '%s is served in this locale',
+      (name, set) => {
+        const served = translateMetadataDocument('permission', set, SecurityTranslations, { locale });
+        const entry = group[name] as AnyRec;
+        expect(served).toEqual({ ...set, label: entry.label, description: entry.description });
       },
     );
   });