fix(plugin-security,plugin-sharing): repair the ADR-0090 position rename in the es-ES bundles, bounded and guarded (#8788)

* wip(recovered): es-ES position rename repairs + consistency test (pre-verification)

* fix(plugin-sharing): repair remaining ADR-0090 rename misses in sys_record_share recipient enum

* test(plugin-sharing): guard shared recipient vocabulary; changeset

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Jack Q

.changeset/es-es-position-rename-damage.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/plugin-security": patch
+"@objectstack/plugin-sharing": patch
+---
+
+Repair the ADR-0090 `sys_role` → `sys_position` rename in the es-ES object
+translation bundles, and guard it mechanically.
+
+The rename half-landed in Spanish: an unreviewed substring find-replace produced
+two non-words (`Puestoes` as the plural of `Puesto`, and `contpuesto` where the
+replace ate the unrelated word `control`), while nine further leaves in
+`plugin-security` and three in `plugin-sharing` were missed entirely and still
+named the pre-rename concept. In `plugin-sharing` the same picklist key rendered
+two different ways in one file — `position` was `Puesto` on the sharing rule and
+`posición` on the record share, and `unit_and_subordinates` read `Rol y
+subordinados` (naming the removed role concept) against `Unidad de negocio y
+subordinados` on its sibling.
+
+Spanish-facing admins saw `Puestoes` as the object's plural label in navigation
+and list views, and two different words for one recipient kind across two Setup
+screens.
+
+Two regression guards now cover the classes involved: a malformed-compound and
+stale-term check on the renamed security objects, and a self-consistency check
+asserting that a picklist option key shared by several sharing objects renders
+identically within a locale. Neither needs a reader of the locale to review it.

packages/plugins/plugin-security/src/translations/es-ES.objects.generated.ts

@@ -11,8 +11,8 @@ import type { TranslationData } from '@objectstack/spec/system';
 export const esESObjects: NonNullable<TranslationData['objects']> = {
   sys_position: {
     label: "Puesto",
-    pluralLabel: "Puestoes",
-    description: "Definiciones de puesto para el contpuesto de acceso RBAC",
+    pluralLabel: "Puestos",
+    description: "Definiciones de puesto para el control de acceso RBAC",
     fields: {
       label: {
         label: "Nombre visible"
@@ -49,7 +49,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         }
       },
       id: {
-        label: "ID de rol"
+        label: "ID de puesto"
       },
       created_at: {
         label: "Creado el"
@@ -74,12 +74,12 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
     },
     _actions: {
       activate_position: {
-        label: "Activar rol",
+        label: "Activar puesto",
         successMessage: "Puesto activado"
       },
       deactivate_position: {
-        label: "Desactivar rol",
-        confirmText: "¿Desactivar este rol? Los usuarios con el puesto conservan su asignación, pero el puesto deja de otorgar permisos hasta que se vuelva a activar.",
+        label: "Desactivar puesto",
+        confirmText: "¿Desactivar este puesto? Los usuarios con el puesto conservan su asignación, pero el puesto deja de otorgar permisos hasta que se vuelva a activar.",
         successMessage: "Puesto desactivado"
       },
       set_default_position: {
@@ -88,7 +88,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         successMessage: "Puesto predeterminado actualizado"
       },
       clone_position: {
-        label: "Clonar rol",
+        label: "Clonar puesto",
         successMessage: "Puesto clonado",
         params: {
           label: {
@@ -338,13 +338,13 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
     }
   },
   sys_position_permission_set: {
-    label: "Conjunto de permisos de rol",
-    pluralLabel: "Conjuntos de permisos de rol",
-    description: "Vincula un conjunto de permisos a un rol.",
+    label: "Conjunto de permisos de puesto",
+    pluralLabel: "Conjuntos de permisos de puesto",
+    description: "Vincula un conjunto de permisos a un puesto.",
     fields: {
       id: {
         label: "ID de vinculación",
-        help: "UUID de la vinculación rol-conjunto de permisos."
+        help: "UUID de la vinculación puesto-conjunto de permisos."
       },
       position_id: {
         label: "Puesto",

packages/plugins/plugin-security/src/translations/position-rename-consistency.test.ts

@@ -0,0 +1,120 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Regression guard for the ADR-0090 P1 rename (sys_role → sys_position). The
+// rename half-landed in es-ES and shipped for a month: the object label said
+// "Puesto" while the plural said "Puestoes", the description said "contpuesto"
+// (the rename caught the unrelated word `control` — con+trol → con+tpuesto), and
+// nine leaf values still said "rol" — including one string that says both, in the
+// same sentence.
+//
+// Nothing mechanical caught it: `check:i18n` compares bundle STRUCTURE against
+// what the extractor emits and is green either way, and the generator's merge
+// mode never rewrites an existing translated leaf, so both drift and damage
+// survive a green gate indefinitely. This test is the missing judgement, and it
+// is deliberately modelled on `bu-rename-consistency.test.ts` (ADR-0057), which
+// exists because that rename half-landed the same way.
+//
+// Two independent failure modes are asserted, because the damage produced both:
+//
+//   1. STALE TERM — a leaf still naming the pre-rename concept ("rol", "Role",
+//      "角色", "ロール"). Scope is the three renamed objects, walked to every
+//      string leaf (labels, descriptions, field help, action confirm text,
+//      action-param help) — unlike the ADR-0057 guard this cannot be
+//      labels-only, because the damage reached descriptions and help text.
+//   2. MALFORMED COMPOUND — a Spanish word that merely CONTAINS "puesto"
+//      without being one. `Puestoes` and `contpuesto` are both of this class and
+//      neither is a word; a word-level allowlist catches them without tripping
+//      on the legitimate Spanish words that do contain the substring
+//      (`presupuesto`, `expuesto`, `compuesto`, …).
+
+import { describe, it, expect } from 'vitest';
+import { enObjects } from './en.objects.generated.js';
+import { zhCNObjects } from './zh-CN.objects.generated.js';
+import { jaJPObjects } from './ja-JP.objects.generated.js';
+import { esESObjects } from './es-ES.objects.generated.js';
+
+/** The objects ADR-0090 P1 renamed — the exact surface the rename had to land on. */
+const RENAMED_OBJECTS = ['sys_position', 'sys_position_permission_set', 'sys_user_position'];
+
+const LOCALES = [
+  // `\b` keeps this off `control` / `controlar`, which legitimately contain "rol".
+  { name: 'en', objs: enObjects as Record<string, unknown>, stale: /\brole?s?\b/i },
+  { name: 'es-ES', objs: esESObjects as Record<string, unknown>, stale: /\brol(es)?\b/i },
+  { name: 'zh-CN', objs: zhCNObjects as Record<string, unknown>, stale: /角色/ },
+  { name: 'ja-JP', objs: jaJPObjects as Record<string, unknown>, stale: /ロール/ },
+];
+
+/** Every string leaf under `node`, as `[dottedPath, value]`. */
+function stringLeaves(node: unknown, path = ''): Array<[string, string]> {
+  if (typeof node === 'string') return [[path, node]];
+  if (node === null || typeof node !== 'object') return [];
+  return Object.entries(node as Record<string, unknown>).flatMap(([k, v]) =>
+    stringLeaves(v, path ? `${path}.${k}` : k),
+  );
+}
+
+describe('ADR-0090 position rename — no stale role term in the renamed objects', () => {
+  for (const { name, objs, stale } of LOCALES) {
+    for (const objName of RENAMED_OBJECTS) {
+      it(`${name}: ${objName} carries no pre-rename term`, () => {
+        const obj = objs[objName];
+        expect(obj, `${objName} missing from the ${name} bundle`).toBeTruthy();
+        const offenders = stringLeaves(obj)
+          .filter(([, value]) => stale.test(value))
+          .map(([leafPath, value]) => `${objName}.${leafPath} = ${JSON.stringify(value)}`);
+        expect(
+          offenders,
+          `${name}: leaves below still name the pre-rename concept — ADR-0090 renamed ` +
+            `sys_role to sys_position, so no translated leaf on these objects may say "role".`,
+        ).toEqual([]);
+      });
+    }
+  }
+});
+
+// Spanish words that legitimately contain the substring "puesto" but are not it.
+// A word containing "puesto" and absent here is find-replace residue, not Spanish.
+const LEGITIMATE_PUESTO_WORDS = new Set([
+  'puesto',
+  'puestos',
+  'presupuesto',
+  'presupuestos',
+  'expuesto',
+  'expuestos',
+  'supuesto',
+  'supuestos',
+  'dispuesto',
+  'dispuestos',
+  'compuesto',
+  'compuestos',
+  'impuesto',
+  'impuestos',
+  'propuesto',
+  'propuestos',
+  'repuesto',
+  'repuestos',
+  'opuesto',
+  'opuestos',
+]);
+
+describe('ADR-0090 position rename — es-ES carries no malformed "puesto" compound', () => {
+  it('every word containing "puesto" is a real Spanish word', () => {
+    const offenders: string[] = [];
+    for (const [leafPath, value] of stringLeaves(esESObjects)) {
+      // Split on anything that is not a Spanish letter, so punctuation and the
+      // machine names embedded in help text do not masquerade as words.
+      for (const word of value.split(/[^\p{L}]+/u)) {
+        const lower = word.toLowerCase();
+        if (lower.includes('puesto') && !LEGITIMATE_PUESTO_WORDS.has(lower)) {
+          offenders.push(`${leafPath}: ${JSON.stringify(word)}`);
+        }
+      }
+    }
+    expect(
+      offenders,
+      'malformed "puesto" compounds — these are find-replace residue from the ADR-0090 ' +
+        'rename (e.g. "Puestoes" for the plural, or "contpuesto" where the rename ate the ' +
+        'unrelated word "control"), not Spanish words.',
+    ).toEqual([]);
+  });
+});

packages/plugins/plugin-sharing/src/translations/es-ES.objects.generated.ts

@@ -31,14 +31,14 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         options: {
           user: "Usuario",
           group: "Grupo",
-          position: "posición",
-          unit_and_subordinates: "Rol y subordinados",
+          position: "Puesto",
+          unit_and_subordinates: "Unidad de negocio y subordinados",
           guest: "Invitado"
         }
       },
       recipient_id: {
         label: "Destinatario",
-        help: "ID del usuario/grupo/rol que recibe acceso."
+        help: "ID del usuario/grupo/puesto que recibe acceso."
       },
       access_level: {
         label: "Nivel de acceso",

packages/plugins/plugin-sharing/src/translations/recipient-vocabulary-consistency.test.ts

@@ -0,0 +1,112 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Recipient-vocabulary guard for the ADR-0090 P1 rename (sys_role → sys_position),
+// the plugin-sharing half of #8735.
+//
+// `sys_record_share` and `sys_sharing_rule` describe the SAME recipient
+// vocabulary — both carry a `recipient_type` picklist over the same principal
+// kinds. The rename landed on `sys_sharing_rule` and was missed on
+// `sys_record_share`, so for a month the es-ES bundle rendered one enum key two
+// different ways in one file: `position` was "Puesto" in the rule object and
+// "posición" in the share object, and `unit_and_subordinates` was "Unidad de
+// negocio y subordinados" in one and "Rol y subordinados" — naming the
+// pre-rename *role* concept — in the other. An admin switching between the two
+// screens saw two different words for one thing.
+//
+// Nothing mechanical caught it: `check:i18n` compares bundle STRUCTURE against
+// what the extractor emits and is green either way, and the generator's merge
+// mode never rewrites an existing translated leaf (#8543), so a half-landed
+// rename survives a green gate indefinitely.
+//
+// The invariant asserted here is the one that would have caught it, and it needs
+// no per-string judgement: within one locale, an option key shared by more than
+// one object must render identically everywhere it appears. That is a fact about
+// self-consistency, not a translation-quality opinion, so it stays reviewable by
+// someone who does not read the locale.
+
+import { describe, it, expect } from 'vitest';
+import { enObjects } from './en.objects.generated.js';
+import { esESObjects } from './es-ES.objects.generated.js';
+import { zhCNObjects } from './zh-CN.objects.generated.js';
+import { jaJPObjects } from './ja-JP.objects.generated.js';
+
+const LOCALES: Array<[string, Record<string, unknown>]> = [
+  ['en', enObjects as Record<string, unknown>],
+  ['es-ES', esESObjects as Record<string, unknown>],
+  ['zh-CN', zhCNObjects as Record<string, unknown>],
+  ['ja-JP', jaJPObjects as Record<string, unknown>],
+];
+
+/**
+ * `field.optionKey` → the distinct renderings seen for it, each tagged with the
+ * object it came from. Walks `<object>.fields.<field>.options.<key>` only, which
+ * is where the picklist vocabulary lives.
+ */
+function optionRenderings(objs: Record<string, unknown>): Map<string, Map<string, string[]>> {
+  const seen = new Map<string, Map<string, string[]>>();
+  for (const [objName, obj] of Object.entries(objs)) {
+    const fields = (obj as { fields?: Record<string, unknown> })?.fields;
+    if (!fields || typeof fields !== 'object') continue;
+    for (const [fieldName, field] of Object.entries(fields)) {
+      const options = (field as { options?: Record<string, unknown> })?.options;
+      if (!options || typeof options !== 'object') continue;
+      for (const [optKey, value] of Object.entries(options)) {
+        if (typeof value !== 'string') continue;
+        const id = `${fieldName}.${optKey}`;
+        const byValue = seen.get(id) ?? new Map<string, string[]>();
+        byValue.set(value, [...(byValue.get(value) ?? []), objName]);
+        seen.set(id, byValue);
+      }
+    }
+  }
+  return seen;
+}
+
+describe('ADR-0090 — shared recipient vocabulary renders consistently (#8735)', () => {
+  for (const [locale, objs] of LOCALES) {
+    it(`${locale}: an option key shared by several objects has one rendering`, () => {
+      const conflicts: string[] = [];
+      for (const [id, byValue] of optionRenderings(objs)) {
+        if (byValue.size < 2) continue;
+        const shown = [...byValue]
+          .map(([value, owners]) => `${owners.join('+')}=${JSON.stringify(value)}`)
+          .join('  vs  ');
+        conflicts.push(`${id}: ${shown}`);
+      }
+      expect(
+        conflicts,
+        `${locale}: the same picklist option key renders differently across objects. ` +
+          'Both sharing objects describe one recipient vocabulary, so a key that disagrees ' +
+          'with itself means a rename landed on one object and was missed on the other ' +
+          '(ADR-0090 renamed sys_role to sys_position). Pick the rendering the renamed ' +
+          'concept actually uses and make both objects say it.',
+      ).toEqual([]);
+    });
+  }
+});
+
+// The en bundle contains no "role" at all — the concept is `position` throughout —
+// so any surviving `rol` in the Spanish bundle is a missed rename, not a
+// legitimate word. `\b` keeps this off `control` / `controlar`, which contain
+// "rol" innocently.
+describe('ADR-0090 — es-ES carries no pre-rename "rol" (#8735)', () => {
+  it('no leaf in the es-ES bundle still names the role concept', () => {
+    const offenders: string[] = [];
+    const walk = (node: unknown, path: string): void => {
+      if (typeof node === 'string') {
+        if (/\brol(es)?\b/i.test(node)) offenders.push(`${path} = ${JSON.stringify(node)}`);
+        return;
+      }
+      if (node === null || typeof node !== 'object') return;
+      for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
+        walk(v, path ? `${path}.${k}` : k);
+      }
+    };
+    walk(esESObjects, '');
+    expect(
+      offenders,
+      'es-ES leaves still naming the pre-rename concept — the en bundle for this package ' +
+        'contains no "role" anywhere, so every one of these is a missed ADR-0090 rename.',
+    ).toEqual([]);
+  });
+});