fix(app-shell): the translation preview draws the positions and permissions groups, at an objectstack pin that declares them (objectui#13478) (#13485)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DSu9uoz6bLHskQmxnyBE86T)_

Fixes #13478
Clause-②: yes
Metadata-protocol: none

objectstack's `Console Pin Gate` is red on main because app-shell no
longer type-checks against objectstack `47af3dde42`
(objectstack-ai/objectstack#25701). That change added the `positions`
and `permissions` groups to the per-app `TranslationDataSchema`, and
`TranslationPreview`'s `CATEGORY_DEFS` is exhaustive over that schema's
shape by `satisfies`. This PR adds the two rows and moves objectui's own
pin to `47af3dde42`, so objectui type-checks against the same spec. Once
it merges, objectstack can move its `.objectui-sha` past the merge
commit (objectstack's own card names this one as its blocker).

## What changed

- **`TranslationPreview.tsx`**: two `CATEGORY_DEFS` rows, in the
schema's order (after `flows`, before `metadataForms`): `positions` with
`Users` and `permissions` with `ShieldCheck`, the icons
`PositionPreview` and `PermissionPreview` already draw. Both are nested
groups (`flat: false`), so each card counts the group's top-level keys
and samples them with their inner key count, as `objects` and `flows`
do.
- **`metadata-admin/i18n.ts`** (the designer table, the only pack these
keys live in, `en` and `zh`):
`engine.translationPreview.category.positions` = "Positions" / "岗位" and
`engine.translationPreview.category.permissions` = "Permission Sets" /
"权限集", the words the same table already uses for the two metadata types.
- **Tests**: `TranslationPreview.categories-11765.test.tsx` gets a
spec-valid fixture for each new group (its first case requires one per
schema group). `adminPreviews.i18n-10862-s2.test.tsx` lists the two
headings among the rendered locale sites and reads coverage over 13
groups (`2/13 (15%)`, was `2/11 (18%)`).
- **Changeset**
`.changeset/13478-translation-preview-positions-permissions.md`:
`@object-ui/app-shell` patch.

## The pin

- `.objectstack-sha` moves from `e649c2d91e` (the 18.1.0 release commit)
to `47af3dde42bb4e77fd92025605b89b4a473295a4`. REST compare
`e649c2d91e...47af3dde42`: `status: ahead`, `ahead_by: 51`, `behind_by:
0`; the bump script also reported "(on origin/main)". It is pinned at
the card's floor, not at objectstack main's head: the four commits after
it on objectstack main are left for the next bump.
- Path: `scripts/bump-objectstack.sh
47af3dde42bb4e77fd92025605b89b4a473295a4 --no-commit` (built and packed
the 7 packages), then `pnpm install`.
- What moved besides the sha: three packed manifests in
`.objectstack-pin/` (`core`, `lint`, `spec`), each only `zod` `^4.6.5`
to `^4.6.6` (objectstack-ai/objectstack#25657). The lockfile already
resolves `zod@4.6.7`, so **`pnpm-lock.yaml` is unchanged** and `pnpm
install --frozen-lockfile` exits 0.
- **Why the rows and the pin land together** (the seat's hypothesis; it
held). At `e649c2d91e` the schema declares neither group: `grep -c '^
positions: z.record'` over that commit's
`packages/spec/src/system/translation.zod.ts` reads 0, and 1 at
`47af3dde42`; the same for `permissions`. Under `satisfies`, an extra
key in an object literal is TS2353 "Object literal may only specify
known properties" (probed with this repo's tsc 6.0.3 on a two-key
`Record`). So the rows alone fail at the old pin, and the pin alone
fails as the gate does.

## Clause-② reading (the claim asked for it)

The claim declares `yes` because the seat could not tell whether
`metadata-admin/i18n.ts` reaches app-shell's published entry, and the
two lines above are copied from the claim. Measured on the built
declaration closure (`packages/app-shell/dist`, walking the relative
imports from `index.d.ts`, the only `exports` entry with types):

- The closure holds 182 `.d.ts` files. `views/metadata-admin/i18n.d.ts`
**is** one of them (the positive control), but its face is `t(key:
string, …)`, `tFormat(key: string, …)` and the other helpers: the key
table is not exported, and no key is a type.
- Closure files that carry the string `translationPreview`: **0**.
`previews/TranslationPreview.d.ts` is not in the closure at all.

So the diff widens no published accept set and no public face of
app-shell, and the reading is `no`. The declaration is the seat's, so
the lines stay as claimed.

## Verification (local, this worktree, at the new pin)

- `pnpm exec turbo run build --filter=@object-ui/console...
--concurrency=2` (under the verify lock, 6144 MB heap): 35 of 35 tasks,
including `@object-ui/app-shell`'s `tsc` and the console's vite build,
SDUI manifest and plugin tsc. That is the build the Console Pin Gate
runs, here at objectui's own pin.
- `pnpm exec vitest run packages/app-shell/src/views/metadata-admin/
packages/types/` (under the lock): 980 files passed; 17091 tests passed,
1 skipped.
- The three TranslationPreview test files: 63 of 63. Reverse check: with
the two rows removed from `TranslationPreview.tsx` (on-disk count 0,
back to 2 after the restore), the `categories-11765` file goes red on
its order-and-coverage case and on every per-group case, the two new
groups included.
- Gates, each exit 0: `check:i18n-keys`, `check:i18n-designer-parity`,
`check:i18n-dead-keys`, `check:i18n-drift`,
`check:installed-pin-claims`, `check:spec-symbols`,
`check:icon-record-names`, `check:control-bytes`,
`check:new-line-citations` (0 new), `check-changeset-presence`,
`check-changeset-no-major`, and `eslint` on the four changed source
files.
- `check:spec-floors`: exit 1 with the same two `floor-too-low` findings
(`@object-ui/auth` `MEMBERSHIP_ROLE_EXTERNAL`, `@object-ui/types`
`navItemVisibleDataNeedsDataSource`) that #13472 recorded as
pre-existing on main. This diff touches neither package. The gate runs
on push and schedule with `--cross-check`, which is its measurement, and
that run is green on main `cd70b78`.

NOT MEASURED locally (left to CI): the rest of the workspace `vitest`
shards, `lint` and `type-check` across all packages, and e2e.

## Acceptance notes

- objectui#13477 (the label render of the same objectstack change) is a
different defect; it remains open and nothing here touches it.

- [x] Adds no product-specific widget, dialog, hook or string (see
AGENTS.md › Product-neutral renderer)

Implemented by the ui lane card thread, session
`https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp`; claim on the
card, comment 6391374949.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/13478-translation-preview-positions-permissions.md

@@ -0,0 +1,11 @@
+---
+"@object-ui/app-shell": patch
+"@object-ui/i18n": patch
+---
+
+Clause-②: yes
+Metadata-protocol: none
+
+The metadata designer's translation preview draws the `positions` and `permissions` groups that `@objectstack/spec` now declares on a translation bundle, each with its own card, count and sample, and counts them in the coverage bar. Before, the preview did not type-check against that spec, and a bundle that translated only position or permission-set labels read as empty.
+
+`isSpecTranslationData` recognises a served translation document by those two groups as well, so a bundle that translates only positions or permission sets is namespaced under `app` like any other spec bundle instead of being returned untransformed.

.objectstack-pin/core/package.json

@@ -29,7 +29,7 @@
   "dependencies": {
     "@objectstack/spec": "18.1.0",
     "@objectstack/types": "18.1.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "keywords": [
     "objectstack",

.objectstack-pin/lint/package.json

@@ -50,7 +50,7 @@
   "devDependencies": {
     "@types/node": "^26.6.3",
     "vitest": "^4.1.11",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "keywords": [
     "objectstack",

.objectstack-pin/spec/package.json

@@ -282,7 +282,7 @@
   },
   "dependencies": {
     "pg-connection-string": "^2.14.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "peerDependencies": {
     "ai": "^7.0.0"

.objectstack-sha

@@ -1 +1 @@
-e649c2d91e270e3da26820bcfe54a28445305a75
+47af3dde42bb4e77fd92025605b89b4a473295a4

packages/app-shell/src/views/metadata-admin/i18n.ts

@@ -1785,6 +1785,8 @@ const ENGINE_STRINGS_EN: Record<string, string> = {
   'engine.translationPreview.category.datasets': 'Datasets',
   'engine.translationPreview.category.pages': 'Pages',
   'engine.translationPreview.category.flows': 'Flows',
+  'engine.translationPreview.category.positions': 'Positions',
+  'engine.translationPreview.category.permissions': 'Permission Sets',
   'engine.translationPreview.category.metadataForms': 'Metadata Forms',
   'engine.translationPreview.category.settingsCommon': 'Settings UI',
   'engine.translationPreview.coverage': 'Category coverage:',
@@ -5407,6 +5409,8 @@ const ENGINE_STRINGS_ZH: Record<string, string> = {
   'engine.translationPreview.category.datasets': '数据集',
   'engine.translationPreview.category.pages': '页面',
   'engine.translationPreview.category.flows': '流程',
+  'engine.translationPreview.category.positions': '岗位',
+  'engine.translationPreview.category.permissions': '权限集',
   'engine.translationPreview.category.metadataForms': '元数据表单',
   'engine.translationPreview.category.settingsCommon': '设置界面',
   'engine.translationPreview.coverage': '分类覆盖率：',

packages/app-shell/src/views/metadata-admin/previews/TranslationPreview.categories-11765.test.tsx

@@ -58,6 +58,12 @@ const ONE_ENTRY: Record<string, { data: Record<string, unknown>; key: string; ro
   },
   pages: { data: { home: { label: 'Accueil' } }, key: 'home', row: () => keys(1) },
   flows: { data: { onboarding: { label: 'Intégration' } }, key: 'onboarding', row: () => keys(1) },
+  positions: { data: { legal_counsel: { label: 'Conseiller juridique' } }, key: 'legal_counsel', row: () => keys(1) },
+  permissions: {
+    data: { contract_reviewer: { label: 'Revue des contrats', description: 'Lire et approuver les contrats' } },
+    key: 'contract_reviewer',
+    row: () => keys(2),
+  },
   metadataForms: { data: { object: { label: 'Objet' } }, key: 'object', row: () => keys(1) },
   // `settingsCommon` is one strict object, not a record of author-named nodes:
   // its members (`sourceLabels`) are what the card counts and samples.

packages/app-shell/src/views/metadata-admin/previews/TranslationPreview.tsx

@@ -43,7 +43,9 @@ import {
   MessageCircle,
   PanelsTopLeft,
   Settings2,
+  ShieldCheck,
   SquareChevronDown,
+  Users,
   Workflow,
 } from 'lucide-react';
 import { EmptyDescription } from '@object-ui/components';
@@ -94,6 +96,8 @@ const CATEGORY_DEFS = {
   datasets: { label: 'engine.translationPreview.category.datasets', icon: Database, flat: false },
   pages: { label: 'engine.translationPreview.category.pages', icon: PanelsTopLeft, flat: false },
   flows: { label: 'engine.translationPreview.category.flows', icon: Workflow, flat: false },
+  positions: { label: 'engine.translationPreview.category.positions', icon: Users, flat: false },
+  permissions: { label: 'engine.translationPreview.category.permissions', icon: ShieldCheck, flat: false },
   metadataForms: { label: 'engine.translationPreview.category.metadataForms', icon: FileText, flat: false },
   settingsCommon: { label: 'engine.translationPreview.category.settingsCommon', icon: Settings2, flat: false },
 } satisfies Record<TranslationGroup, Omit<CategoryDef, 'key'>>;

packages/app-shell/src/views/metadata-admin/previews/adminPreviews.i18n-10862-s2.test.tsx

@@ -461,14 +461,16 @@ describe('TranslationPreview reads the designer locale (objectui#10862)', () =>
         { key: 'engine.translationPreview.category.datasets' },
         { key: 'engine.translationPreview.category.pages' },
         { key: 'engine.translationPreview.category.flows' },
+        { key: 'engine.translationPreview.category.positions' },
+        { key: 'engine.translationPreview.category.permissions' },
         { key: 'engine.translationPreview.category.metadataForms' },
         { key: 'engine.translationPreview.category.settingsCommon' },
         { key: 'engine.translationPreview.categoryEmpty' },
         { key: 'engine.translationPreview.more', vars: { count: 1 } },
         { key: 'engine.translationPreview.keyCountOne', vars: { count: 1 } },
       ]);
       // The bundle's own locale is author data, not the designer's language.
-      expectAsWritten(['French', 'fr-FR', 'account', '"Un"', '2/11 (18%)']);
+      expectAsWritten(['French', 'fr-FR', 'account', '"Un"', '2/13 (15%)']);
     });
   }
 });

packages/i18n/src/utils/spec-translations.ts

@@ -89,6 +89,11 @@ const SPEC_TRANSLATION_GROUPS = [
   // `picklist` metadata kind); added at that bump (objectui#11438). The
   // transform below copies it through onto `app` like any other group.
   'picklists',
+  // objectstack `47af3dde42` serves `positions` and `permissions` (positions
+  // and permission sets are translatable); added at the pin move to that
+  // commit (objectui#13478), copied through onto `app` the same way.
+  'positions',
+  'permissions',
 ] as const;
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {