Merge remote-tracking branch 'origin/main' into claude/issue-14968-handshake-field

Author: claude

.changeset/great-clouds-repair.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/plugin-hono-server': patch
+---
+
+`GET /auth/me/localization` answers the deployment's resolved `currency` and `timezone` instead of `null`
+
+The handler read both off the request `ExecutionContext`, citing ADR-0053, but the resolver serving this surface is a hand-rolled envelope that never carried them — so every authenticated caller was answered `currency: null, timezone: null` whatever the `localization` settings said, and the console's regional-formatting seed was fed nulls. All three values now come from one reading of the same `resolveLocalizationContext` cascade the dispatcher's shared assembler uses. `locale` resolution is unchanged. `timezone` now always answers (cascade floor `UTC`); `currency` still answers `null` when the deployment configures none — that value has no floor.

.changeset/i18n-declared-fallback-chain-rest.md

@@ -0,0 +1,27 @@
+---
+"@objectstack/rest": patch
+---
+
+fix(rest): metadata label lookup honours the stack's declared `i18n.fallbackLocale` / `defaultLocale` instead of falling through to the `en` bundle (#14882)
+
+On a workspace whose labels are authored in `zh-CN` (`defaultLocale: 'zh-CN'`,
+`fallbackLocale: 'zh-CN'`) and which ships only a courtesy `en` translation bundle,
+`GET /api/v1/meta/object/:name`, the `/meta/:type` list, `GET /api/v1/meta` and the
+public-form schema served the ENGLISH bundle labels to a `zh-CN` request (`Entry Sheet`
+for an authored `填报单`, `KPI Assessment` for `KPI 考核管理`). The document translators walk
+`requested locale → fallback chain → authored label` and default the chain to a literal
+`['en']`; every REST seam passed none, so the declared fallback never reached the chain
+and `en` was consulted before the authored label.
+
+Every metadata translation seam now passes `fallbackChain: [i18n.getFallbackLocale()]` —
+the locale the i18n service's own `t()` falls back to, which `I18nServicePlugin` receives
+from the stack config as `fallbackLocale || defaultLocale || 'en'`. For the workspace
+above a `zh-CN` request now resolves `zh-CN → zh-CN → authored label` (the authored
+Chinese labels), an `en` request still gets the `en` bundle, and a `zh-CN` bundle, when one
+is shipped, still wins over the authored label.
+
+Feature-detected: an i18n service that does not declare a fallback (the method is
+optional on `II18nService`; the core in-memory fallback has none) gets no chain and the
+resolver's own default applies exactly as before. A stack declaring `defaultLocale: 'zh-CN'`
+with `fallbackLocale: 'en'` is likewise unchanged — the declared `en` is honoured as it
+reads.

.changeset/i18n-declared-fallback-chain-service.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/service-i18n": minor
+---
+
+feat(service-i18n): `FileI18nAdapter.getFallbackLocale()` reports the `fallbackLocale` the adapter was constructed with (#14882)
+
+Implements the new optional `II18nService.getFallbackLocale()`. `I18nServicePlugin`
+already receives `fallbackLocale || defaultLocale || 'en'` from the stack's `i18n`
+config on both boot paths (`os serve`, the dev plugin); this makes that declaration
+readable, so the REST metadata reads pass the document translators the same fallback
+locale `t()` itself consults. Returns `undefined` when no `fallbackLocale` was given.

.changeset/i18n-declared-fallback-chain-spec.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): `II18nService.getFallbackLocale()` — the declared fallback locale is readable, so the metadata-document translators can be handed the chain the deployment declared (#14882)
+
+`ResolveOptions.fallbackChain` on the `@objectstack/spec/system` label
+resolvers (`translateMetadataDocument`, `translateObject`, `translateApp`,
+`resolveViewLabel`, …) is the ordered list of locales consulted after the
+requested one and BEFORE the authored label. Nothing on `II18nService`
+exposed the deployment's declared fallback (`i18n.fallbackLocale`, else
+`defaultLocale`), so no serving layer could thread it, and every caller fell
+to the resolver's literal `['en']` default. A `zh-CN` workspace that shipped a
+courtesy `en` bundle therefore served English bundle text to a `zh-CN`
+request ahead of its own authored Chinese labels.
+
+- New optional contract member `II18nService.getFallbackLocale?(): string | undefined`
+  — the locale the service's own `t()` consults second. `undefined` (or the
+  method absent) means nothing was declared, and a serving layer must then
+  leave the resolver's default in place rather than invent a chain.
+- The `fallbackChain` documentation now states who supplies it (the serving
+  layer, from `getFallbackLocale()`) and that the `['en']` default applies
+  only when a caller declares no chain at all. The resolver's behaviour for
+  a caller that passes nothing is unchanged.
+
+Additive: no existing implementation or caller changes shape.

content/docs/permissions/system-context.mdx

@@ -158,7 +158,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5048`, `:6474`, `:6722`, `:7153`, `:7346` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5084`, `:6510`, `:6758`, `:7189`, `:7382` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:422`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |

content/docs/ui/translations.mdx

@@ -66,20 +66,24 @@ export default defineStack({
 | Field labels, help text, placeholders | `objects.<name>.fields.<field>.label` / `help` / `placeholder` |
 | Picklist option labels | `objects.<name>.fields.<field>.options.<value>` |
 | View titles, descriptions, empty states | `objects.<name>._views.<view>` |
+| Bulk-action copy on a list view (button, confirm prompt, dialog fields) | `objects.<name>._views.<view>.bulkActions.<def>.label` / `.confirmText` / `.confirmLabel` / `.params.<param>.label` / `.help` / `.placeholder` — a bulk param's hint is `help`, not `helpText` |
 | Action labels, confirm text, success messages | `objects.<name>._actions.<action>` |
 | Action result dialogs (title / description / acknowledge / field labels) | `objects.<name>._actions.<action>.resultDialog` |
 | Form sections | `objects.<name>._sections.<section>` |
 | Custom validation-rule messages | `objects.<name>._validations.<rule>.message` |
 | App navigation | `apps.<app>.navigation.<id>.label` |
 | Dashboard label / description | `dashboards.<name>.label` / `description` |
 | Dashboard widget title / description / sub-caption | `dashboards.<name>.widgets.<widgetId>.title` / `description` / `subCaption` |
+| Analytics dataset label / description | `datasets.<name>.label` / `description` |
+| Dataset dimension and measure labels | `datasets.<name>.dimensions.<dimension>.label` / `datasets.<name>.measures.<measure>.label` |
 | Page labels and `page:header` copy | `pages.<name>.label` / `description` / `title` / `subtitle` |
 | Screen-flow wizards (flow label, screen headings, screen field copy) | `flows.<flow>.label` / `flows.<flow>.screens.<node_id>.title` / `.fields.<field>.label` / `.placeholder` — see the boundary note below |
 | Global actions, settings, messages | `globalActions`, `settings`, `messages` |
 
 The metadata types resolved per request are **object, view, action, app,
-dashboard, and page** — a field's labels are translated as part of its object
-document, and so are the labels of any actions the object declares inline
+dashboard, dataset, and page** — a field's labels are translated as part of
+its object document, and so are the labels of any actions the object declares
+inline
 (#3370). Before that, an object document went out with its authored action
 labels untouched: `sys_approval_request`'s Approve / Reject rendered in English
 in a zh-CN workspace for every consumer except the Console, which happened to
@@ -95,6 +99,21 @@ translates `widget.description`, `subCaption` translates
 `widget.options.description`, and neither reaches the other's field.
 </Callout>
 
+<Callout type="info">
+**Dataset copy is keyed at the top level, not under the dashboard
+(#14253).** A dataset is the analytics definition — its dimensions and its
+measures — that widgets bind to by reference, and a measure's label is drawn
+*on the dashboard*: under every metric tile and on every chart axis. It gets
+its own `datasets.<name>` group rather than a slot under `dashboards.<name>`
+because the same measure is drawn by many widgets across many dashboards —
+keying it per presentation would ask for the same string once per widget, and
+would leave a dataset no dashboard references unaddressable. Below the
+dataset the copy is `label` and nothing else: a dimension and a measure each
+declare exactly one display string, so `description` belongs to the dataset
+itself and writing one on a dimension or measure is rejected with a message
+saying so.
+</Callout>
+
 <Callout type="info">
 **Page headers are keyed by page name (#3589).** A page's `page:header`
 component has no stable id, so its `properties.title` / `properties.subtitle`

docs/qa/platform-checklist/areas/access-security.json

@@ -2572,9 +2572,9 @@
           "evidence": "the probe trace"
         },
         {
-          "clause": "localization rides the ExecutionContext without a setup gate: an ordinary member's /auth/me/localization answers 200 with currency/locale/timezone keys (nulls legal) — the SETTINGS surface is setup-gated, the resolved defaults deliberately are not",
+          "clause": "localization is RESOLVED without a setup gate: an ordinary member's /auth/me/localization answers 200 with currency/locale/timezone keys carrying the deployment cascade's own answers — the SETTINGS surface is setup-gated, the resolved defaults deliberately are not. \"Nulls legal\" no longer holds for all three (#15387, which repaired a resolver that carried none of them and made the endpoint answer null for currency AND timezone to every authenticated caller): locale and timezone ALWAYS answer, on cascade floors en-US / UTC, so a null for either is a FAIL and a regression of that repair. currency is the one key with no floor — null there is legal, and only when the deployment configures no localization.currency",
           "oracle": "api",
-          "verify": "member trace carries authenticated:true plus the three keys",
+          "verify": "member trace carries authenticated:true plus the three keys, with timezone and locale non-null; configure localization.currency and localization.timezone and re-trace — both must move to the configured values (an unmoved trace is the #15387 defect, not a pass)",
           "evidence": "the trace"
         }
       ],