Merge remote-tracking branch 'origin/main' into claude/project-thread-0i0ziw

# Conflicts:
#	ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx

Author: claude

.changeset/25922-studio-i18n-studio-previews.md

@@ -0,0 +1,10 @@
+---
+'@object-ui/i18n': patch
+---
+
+feat(i18n): the rest of the Studio strings and the metadata preview panes move into the `studio` namespace
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Fifth slice of the move ruled on objectstack#25922** (6431032267, Q2 = A; kept by 6431234244). Every remaining `engine.studio.*` key except `engine.studio.inspector.*`, and the preview panes' `engine.*Preview.*` and `engine.previewShell.*` keys (the doc, book, flow, page-block and translation previews stay for a later slice), 596 keys in both `en` and `zh`, now live in `@object-ui/i18n/namespaces/studio` instead of `@object-ui/app-shell`'s private table, text unchanged. Studio reads the same strings; a Chinese viewer sees these labels in English for the moment the `zh` catalogue takes to load, as with the earlier slices. No export changes.

.changeset/26080-readme-contributing-links.md

@@ -0,0 +1,42 @@
+---
+'@object-ui/auth': patch
+'@object-ui/collaboration': patch
+'@object-ui/components': patch
+'@object-ui/console': patch
+'@object-ui/core': patch
+'@object-ui/create-plugin': patch
+'@object-ui/data-objectstack': patch
+'@object-ui/fields': patch
+'@object-ui/i18n': patch
+'@object-ui/layout': patch
+'@object-ui/mobile': patch
+'@object-ui/permissions': patch
+'@object-ui/plugin-ai': patch
+'@object-ui/plugin-calendar': patch
+'@object-ui/plugin-charts': patch
+'@object-ui/plugin-chatbot': patch
+'@object-ui/plugin-dashboard': patch
+'@object-ui/plugin-designer': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/plugin-editor': patch
+'@object-ui/plugin-form': patch
+'@object-ui/plugin-gantt': patch
+'@object-ui/plugin-grid': patch
+'@object-ui/plugin-kanban': patch
+'@object-ui/plugin-list': patch
+'@object-ui/plugin-map': patch
+'@object-ui/plugin-markdown': patch
+'@object-ui/plugin-report': patch
+'@object-ui/plugin-timeline': patch
+'@object-ui/plugin-view': patch
+'@object-ui/providers': patch
+'@object-ui/react': patch
+'@object-ui/types': patch
+---
+
+docs: the README's Contributing Guide and Roadmap links point at the ObjectStack repository (objectstack#26080)
+
+Every package README linked its "Contributing Guide" and "Roadmap" to `CONTRIBUTING.md` and `ROADMAP.md` in the archived `objectstack-ai/objectui` repository. Those documents now live at the root of `objectstack-ai/objectstack`, which is where the links point; the `@object-ui/console` README's roadmap links move there too. No code, export or behaviour changes.
+
+Clause-②: no
+Metadata-protocol: none

.changeset/26596-security-cache-invalidation.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): the security plugin's metadata-derived caches now invalidate on a runtime metadata publish
+
+Clause-②: no
+Metadata-protocol: none
+
+The security plugin keeps the per-object inputs it derives from metadata for reuse across requests. Those caches are now dropped whenever metadata changes at runtime, so the next request is judged by the published declaration without a restart (#26596, #26698):
+
+- **The signal.** The plugin listens to the protocol's post-persistence `onMetadataMutation` notification, which every metadata authoring door emits (save, per-item and package publish, revert, rollback, delete) after the engine registry holds the new definition, and which a cluster peer replays after converging its own registry. Drafts are ignored. It also listens to the `metadata:reloaded` announcement that an artifact reload fires.
+- **What it replaces.** The previous subscription probed an optional `watch` member on the metadata service, which `MetadataManager` does not implement, and the runtime authoring path does not announce to the metadata service's watchers in any case.
+- **Composition note.** A protocol service that offers no `onMetadataMutation` is reported once at `warn` when the plugin starts.

.changeset/26668-approval-served-route.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/spec': patch
+'@objectstack/plugin-approvals': patch
+'@object-ui/app-shell': patch
+'@object-ui/console': patch
+---
+
+feat(spec,plugin-approvals,app-shell): the approvals get serves a request's own route, and both approval step lines draw it
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+The single request read (`GET /api/v1/approvals/requests/:id`) served one step list, `flow_steps`: the flow's trunk, walked from its start by taking the `approve` edge, else the `true` edge, else the first edge. A request a decision routed off the trunk was not on it. A contract routed from the manager to the finance-only rung was served the manager, the joint legal + finance rung, the executive and the general manager, all upcoming, and not its own rung.
+
+What changes:
+
+- `ApprovalRequestRow` gains `flow_route`, served on the same single reads as `flow_steps`. Its `steps` are the approval steps the request's flow run has passed (earlier requests of the same run, on another node, approved, in the order the run opened them, one entry per step), then the request's own step, then, for a pending request, the steps ahead that the flow's graph decides on its own when each step approves.
+- Nothing past an undecided branch is listed. The walk ahead stops at a decision node, a conditioned edge, several out-edges, a loop back, or a node that runs other nodes (`subflow`, `map`, `loop`). `ahead` then reads `undecided`. It reads `end` when the walk reached the flow's end, and `decided` for a request that is already decided, whose route ends at itself.
+- `flow_steps` is served unchanged. Its doc now says it is the trunk and that a step line never draws it.
+- The business record's approvals panel draws the pending request's `flow_route`, so a viewer who took no part in an earlier rung now sees it too. Before, the panel rebuilt the line from the request rows the list read served that viewer.
+- The approval request page draws its request's `flow_route`, at any status, where it had stopped drawing a step line at all.
+
+What to do: nothing. A client that reads `flow_steps` reads what it read before. A client that draws a request's progress should draw `flow_route` instead.

.changeset/26706-delegated-admin-scope-default-display.md

@@ -0,0 +1,12 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the delegated-admin scope facet shows the spec default for an unset key
+
+Clause-②: no
+Metadata-protocol: none
+
+In Studio › Access › a permission set › Delegated admin, each switch now draws the value the server enforces: the scope's own boolean when it sets one, and the `AdminScopeSchema` default when it leaves the key unset. Drawing a default writes nothing, so a save keeps an untouched key unset; flipping a switch writes an explicit boolean. Nothing the server accepts or enforces changes.
+
+What to do: nothing. Review a delegated-admin scope that you set up by reading this screen, and confirm that its switches show the scope you intended.

.changeset/26730-studio-publish-refusals-kept.md

@@ -0,0 +1,10 @@
+---
+'@object-ui/i18n': patch
+---
+
+feat(i18n): the `studio` namespace words a refused publish, and a refusal on a dashboard widget or a report input
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Rows for objectstack#26730.** Studio keeps a refused publish on its Pending changes entry until it is fixed, and its "Show me" now ends on the input a refusal names. The namespace gains the sentences for that: a publish refusal (`engine.studio.refusal.publishIssue`, `publishWhere`, `publishPlain`, `publishUnlocated`), the toast that points at the sheet (`engine.studio.publishRefused`, `publishRefusedOne`, `publishRefusedBatch`), and where a dashboard widget or a report's own input is named (`engine.studio.refusal.widget`, `widgetInput`, `reportInput`). Each row has its `zh` text. No existing row changes, and no export changes.

.changeset/26733-studio-rail-no-matches.md

@@ -0,0 +1,10 @@
+---
+'@object-ui/i18n': patch
+---
+
+feat(i18n): the `studio` namespace gains `engine.studio.rail.clearSearch` (en "Clear search", zh "清除搜索")
+
+Clause-②: no
+Metadata-protocol: none
+
+The Studio rails (Data, Automations, Access) now share one empty-search state: a search that matches nothing names the query under the box and offers a "Clear search" action that empties the box and puts every row back. This row is that action's label; the sentence reuses the existing `engine.list.emptyQuery` row.

.changeset/26740-studio-nav-inspector-keys.md

@@ -0,0 +1,10 @@
+---
+'@object-ui/i18n': patch
+---
+
+feat(i18n): `studio` namespace rows for the Studio nav-item inspector's badge, order and visible-condition fields
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Eleven new `engine.inspector.appNav.*` keys** in `@object-ui/i18n/namespaces/studio`, in `en` and `zh`: the badge and its style (with the four style names the spec's `badgeVariant` declares), the order and its hint, and two hints for the `visible` condition. They label the fields the Studio's Interfaces nav-item inspector now offers for keys a navigation entry already declares (objectstack#26740). Additive: no key changes or goes, no export changes.

.changeset/26745-studio-widget-type-registry.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/i18n': patch
+---
+
+fix(app-shell): the dashboard's Add-widget menu and the widget Type select offer every widget type the spec accepts, from one registry
+
+Clause-②: no
+Metadata-protocol: none
+
+Studio's two dashboard widget-type pickers kept their own lists and disagreed with each other and with the spec: the Add-widget menu offered 11 types, the inspector's Type select 10 (no `scatter`), and `ChartTypeSchema` accepts 20, all of which a dashboard draws. Both pickers now read one registry derived from `ChartTypeSchema`, so they offer the same 20 types and follow the spec when it changes.
+
+- The `studio` namespace gains the names of the newly offered types: `engine.inspector.widget.type.*` for `column`, `scatter`, `treemap`, `sankey`, `combo`, `gauge`, `solidGauge`, `kpi`, `bullet` and `radar`, and `engine.widgetPicker.type.*` for the same types except `scatter`, in en and zh.
+- `engine.inspector.widget.datasetHint` no longer mentions an "inline object query above", which the widget inspector has not had since ADR-0021; it describes the dataset, dimension and measure controls the inspector shows.

.changeset/26767-shared-record-readonly-rows.md

@@ -0,0 +1,13 @@
+---
+'@object-ui/console': patch
+---
+
+fix(console): a share link to a non-chat record shows the record's fields as read-only rows, not raw JSON
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** The share-link page `/s/:token` printed `JSON.stringify(record)` in a code block for every object except `ai_conversations`: field API names, unformatted values and nested objects as JSON.
+- **Now.** The page renders one read-only row per key the resolve answer carries. The label is the key humanized (`annual_revenue` reads "Annual Revenue"). The value is formatted by its JSON shape: ISO dates and date-times in the visitor's locale, numbers grouped, booleans as Yes / No, lists and nested objects as short text, and an empty value as a dash. System fields such as `id` and `created_at` are shown after the business fields. A record with no fields left reads "No data".
+- **Unchanged.** The page shows exactly the fields the server returned: redacted fields stay absent and the "Some fields are hidden by the owner" line still renders. The `ai_conversations` transcript, the resolve request, its headers and the password flow do not change.
+- **Not yet.** Field labels and field types are not in the resolve answer, and an anonymous visitor cannot read the object's metadata, so authored labels, picklist labels, currency and lookup names do not show yet.