Merge origin/main (7e8b3c0) into claude/issue-10918-console-ctx-org

Claude-Session: https://claude.ai/code/session_015AUunPkX7UTkCH9e7AdZo1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/10885-object-view-route2-named-grid.md

@@ -0,0 +1,15 @@
+---
+'@object-ui/plugin-view': patch
+---
+
+The registered `object-view` renderer reads a named grid view's own grid members off the named view (objectui#10885).
+
+`object-view` is registered without a `renderListView`, so an authored node, and the Studio's view preview (which renders a stored view through `SchemaRenderer`), draws a grid view as the `object-grid` node `ObjectView` builds for `ObjectGrid`. That node read `columns`, `filter`, `sort`, `grouping` and `rowColor` off the active named view and nothing else, so a stored or authored grid view's `rowHeight`, `pagination` and the rest were accepted and not shown.
+
+It now also reads, off the active named view first, ten members the protocol declares under the same name on both a named view and `object-grid` and that `ObjectGrid` reads: `pagination`, `selection`, `rowHeight`, `resizable`, `searchableFields`, `conditionalFormatting`, `rowActions`, `bulkActions`, `bulkActionDefs` and `exportOptions`. `pagination` and `selection` still fall back to the node's `table` when the named view omits them; the others have no node fallback on this path, as before. Three other members declared on both, `label`, `data` and `navigation`, are still not read off the named view on this path.
+
+A named view's `hiddenFields` is applied the way the protocol composes it: the hidden fields are removed from the column projection the grid receives. Only a declared projection is narrowed; with no `columns` anywhere the grid still derives its own.
+
+What moves: only a grid view that authors one of these members. A named view that carries none of them renders exactly as before, and the host `renderListView` delegation is unchanged.
+
+`Clause-②: no` — no declared type, accepted key or published export moves. A renderer starts honouring members the spec already declares on a named view and the grid already reads.

.changeset/10894-app-edit-keeps-navigation.md

@@ -0,0 +1,18 @@
+---
+'@object-ui/plugin-designer': patch
+---
+
+fix(plugin-designer): editing an app keeps its stored navigation (objectui#10894)
+
+**Clause-②: no** — an edit stops destroying stored navigation. No declared type, accepted key or published surface moves.
+
+The console's "edit app" page (`EditAppPage`) loads the stored app into `AppCreationWizard`. Leaving the wizard's Objects step replaced the draft's `navigation` with one generated object entry per selected object, and every edit passes through that step. So any edit, even a title change, saved a stored `[object, separator, group, url]` tree as `[object]`. It dropped every separator, group (with its children) and `url` / `dashboard` / `page` / `report` / `component` / `action` entry, and each object entry's own label, icon and order, with no warning.
+
+- **Leaving the Objects step no longer replaces the navigation.** An empty navigation (the create path) is still filled with one object entry per selected object. A non-empty one is merged:
+  - a newly selected object gets an object entry, appended at the end;
+  - the object entries of a deselected object are dropped, at the top level or inside a group. The group keeps its place and its other children, even when that leaves it with none;
+  - every other entry is kept as stored, in its position. That includes each object entry's label, icon and order, and an object entry for an object the Objects step does not list.
+- **`EditAppPage` counts an object as selected when the stored navigation has an object entry for it at the top level or inside a group, at any depth.** It counted only top-level entries, so a grouped object showed as unselected.
+- The same merge applies on the create path once the author has shaped the navigation. Going back to the Objects step and forward again keeps the added separators, groups and links, and the order.
+
+Pinned in `packages/plugin-designer/src/__tests__/EditAppPage.keepsNavigation-10894.test.tsx`.

.changeset/10895-plugin-detail-relatedlist-client-sort-gate.md

@@ -0,0 +1,9 @@
+---
+---
+
+Test-only, no package released: `RelatedList.unmaterializedSort.test.tsx`'s case "keeps that button in
+client mode" now awaits the object schema before it reads the `Total` sort button. Since
+objectui#10728 the sort-button row reads the masked stamp, which covers every column until
+`getObjectSchema` resolves, and the case gated only on the view type, which client mode reaches on the
+first commit. So whether the button existed when it was read depended on scheduling; on one merge-queue
+build it did not (objectui#10895). No source file changes.

.changeset/10899-assistant-fab-yields-to-open-dock.md

@@ -0,0 +1,15 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the assistant FAB is hidden while the chat dock is open (objectui#10899)
+
+The console's round assistant button is the chat dock's collapsed affordance
+(ADR-0057), but `ConsoleLayout` rendered it whether the dock was collapsed or
+open. With the right rail open inside an app, the `fixed bottom-6 right-6`
+button sat on top of the rail composer's send button, so only the Enter key
+could send.
+
+The FAB now renders only while the dock is collapsed — the same rule the Studio
+dock's `ChatDockLauncher` already follows. The open rail and the mobile sheet
+keep their own collapse and close controls.

.changeset/10899-chat-step-turns-no-empty-blocks.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/plugin-chatbot': patch
+---
+
+fix(plugin-chatbot): a reloaded multi-step build no longer shows an empty 「执行过程」 block under every step (objectui#10899)
+
+The conversation store persists each step of an agent turn as its own assistant
+row whose only text is a `(called …)` placeholder, so a reloaded build (the
+in-app dock, the Studio copilot) hydrates into one message per step. Each one
+rendered its tool row, then the italic 执行过程 note, then the message action
+bar — invisible until hover but full height — so every step read as an empty
+block with a large gap.
+
+- The 执行过程 note is now only the fallback for a placeholder turn that shows
+  nothing else. A turn whose tool row, build panel or design panel is on screen
+  does not repeat it.
+- The copy / regenerate bar renders only for a turn with visible prose. A
+  prose-less step has nothing to copy, and Copy used to copy the internal
+  placeholder.

.changeset/10899-dataset-tile-read-refusal-no-access.md

@@ -0,0 +1,23 @@
+---
+'@object-ui/data-objectstack': patch
+'@object-ui/plugin-dashboard': patch
+'@object-ui/i18n': patch
+---
+
+fix(data-objectstack, plugin-dashboard): a dataset tile the viewer may not read shows a localized "no access" state (objectui#10899)
+
+When the analytics read admission refused a dashboard dataset query — `403`
+with ADR-0112 `PERMISSION_DENIED` — `queryDataset` had no branch for that code,
+so it threw the generic `Dataset query failed: 403 Forbidden — [Analytics]
+Access denied: …` string, and `DatasetWidget` printed it verbatim in a red
+alert. The list view over the same object already says 「无权访问」.
+
+- `queryDataset` now throws a typed `AnalyticsForbiddenError` for that code,
+  carrying `httpStatus: 403` and `code: 'PERMISSION_DENIED'` (plus the server's
+  code and message for diagnostics). A code-less 403 — no ObjectStack route
+  wrote it — keeps the generic error.
+- `DatasetWidget` classifies a failed query with the shared `classifyLoadError`
+  and, for `forbidden`, renders a localized no-access state
+  (`dashboard.widgetForbiddenTitle` / `dashboard.widgetForbiddenMessage`, new in
+  all ten packs) instead of the exception text. Every other failure keeps the
+  detailed alert.

.changeset/10899-failed-comment-never-shown-as-sent.md

@@ -0,0 +1,20 @@
+---
+'@object-ui/app-shell': patch
+'@object-ui/plugin-detail': patch
+'@object-ui/i18n': patch
+---
+
+fix(app-shell, plugin-detail): a record comment whose write fails is never shown as sent (objectui#10899)
+
+The record page's discussion writers appended the new comment (or reply) to the
+panel first and then fired the `sys_comment` create, swallowing its rejection.
+On a tenant with no `sys_comment` the write answered 404 while the panel showed
+the comment and a bumped count, with no error — and the comment was gone after a
+reload.
+
+`RecordDetailView` now appends a comment or reply only after its write resolves.
+A failed write raises a localized error toast (`detail.commentFailed`, new in all
+ten packs) and rejects back to the composer. The composers — the activity
+timeline's comment box, the threaded reply input, and `RecordComments` — now
+treat a rejected `onAddComment` / `onAddReply` explicitly as "not written": they
+keep the draft for a retry instead of letting the rejection escape unhandled.

.changeset/10899-marketplace-update-is-higher-version.md

@@ -0,0 +1,19 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the marketplace offers an "update" only for a HIGHER version (objectui#10899)
+
+The environment marketplace detail page decided "update available" — the amber
+`Update available → vX` badge, the primary button's `Update` label, and the
+install dialog's per-environment `Update → vX` hint — by comparing the installed
+version with the latest approved one using `!==`. An environment holding a newer
+version than the latest approved one (a draft installed ahead of review) was
+therefore told `Installed v1.1.0 · Update available → v1.0.0`, and the button
+offered to "update" it to the older version.
+
+Both call sites now ask `isNewerVersion`, which orders the two by SemVer 2.0.0
+precedence — the grammar the package manifest contract declares for `version`.
+Only a version of higher precedence is an update; an equal, older or
+non-SemVer pair offers none, so the page never guesses an order the contract did
+not give it.

.changeset/10899-studio-bridges-need-authoring-capability.md

@@ -0,0 +1,18 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): the Studio edit/design affordances follow the server's authoring capability (objectui#10899)
+
+A page's "Edit in Studio" pencil and the top bar's "Design in Studio" hammer
+were gated on the workspace-admin ROLE alone. An organization owner is a
+workspace admin, but framework's `organization_admin` permission set
+deliberately withholds `manage_metadata` (ADR-0066), and
+`GET /api/v1/auth/me/permissions` reports that. So on the cloud control plane a
+freshly signed-up customer was offered the platform's own page metadata editor.
+
+Both affordances now also require `manage_metadata` through
+`useCanAuthorMetadata` — the server's answer, the same one HomePage's builder
+CTAs already consume. A server that reports no `systemPermissions` at all
+(predating ADR-0066) keeps today's admin-only behaviour, since an unknown answer
+fails open; the server refuses the write either way.

.changeset/10903-today-reference-day-rule.md

@@ -0,0 +1,6 @@
+---
+---
+
+Comment-only in `@object-ui/core`: the built-in `TODAY()` formula function now carries a docblock stating which calendar day it names, as ruled on objectui#10903 (option A). A client-evaluated `TODAY()` names the same reference day the server resolves for that user, on the compute-tz axis of objectstack ADR-0053, and the UTC day while no reference timezone reaches the client. The implementation reads no timezone, so it answers the UTC day, which is the ruled fallback; nothing it returns changes.
+
+Declared as releasing nothing because the emit was measured rather than assumed: the docblock sits inside the private `registerDateFunctions` body, so it cannot reach the emitted `FormulaFunctions.d.ts`, and the comment-stripped emit of `FormulaFunctions.ts` is byte-identical to the base. No published behaviour changes (objectui#10903).