fix(plugin-security): say "unique per organization" in sys_position's es-ES/ja-JP/zh-CN help

[hotlong]

Fixes#8601
Fixes#8718

sys_position.name's declared index is { fields: ['name'], unique: 'organization' }, and #8556/#8468 corrected the source to say so — in both places the object states the rule. The en bundle was brought in line; the three other shipped locales were not. They asserted bare, unqualified uniqueness, so an admin reading Setup in Spanish, Japanese or Chinese was told a position's machine name had to be free installation-wide, which is not what the index enforces.

The change — six leaf string values, two per locale

packages/plugins/plugin-security/src/translations/{es-ES,ja-JP,zh-CN}.objects.generated.ts.

1. sys_position.fields.name.help — the field help in detail and edit views. Also still carried the superseded examples (admin, editor, viewer) the source replaced with sales_manager, hr_specialist.

locale	before	after
es-ES	"Nombre técnico único del puesto (p. ej. admin, editor, viewer)."	"Nombre técnico del puesto, único por organización (p. ej. sales_manager, hr_specialist)."
ja-JP	"ポジションの一意の機械名（例: admin、editor、viewer）"	"ポジションのマシン名（組織ごとに一意。例: sales_manager、hr_specialist）"
zh-CN	"岗位的唯一机器名称（例如 admin、editor、viewer）"	"岗位的机器名称，在每个组织内唯一（例如 sales_manager、hr_specialist）"

2. sys_position.actions.clone_position.params.name.helpText — the Clone Position dialog's API-name input, i.e. the text an admin reads at the exact moment they type a new name. Source: sys-position.object.ts:116, whose own comment at :112-114 states this is #8468's doing ("the name must be free within THIS organization, not across").

locale	before	after
es-ES	"Nombre de máquina snake_case único"	"Nombre de máquina snake_case, único por organización"
ja-JP	"一意の snake_case マシン名"	"snake_case マシン名（組織ごとに一意）"
zh-CN	"唯一的 snake_case 机器名称"	"snake_case 机器名称，在每个组织内唯一"

No new phrasing was invented

Every one of the six targets is a string this repo has already accepted, landed by PR #8599in these same files:

• The fields.name.help values mirror sys_permission_set.fields.name.help at :188 — único por organización / 組織ごとに一意 / 在每个组织内唯一.
• The clone_position values are copied from each locale's own :277 (the sys_permission_set clone param). That is the correct target because en is byte-identical at :99 and :277 — so if the English says the same thing in both places, each translation should too. Verified after editing: all four locales now match at :99 and :277.

ja-JP additionally moves 機械名 to マシン名, the term the rest of that bundle already uses.

Leaf string values only. No bundle structure was hand-edited, per the bundle header's documented workflow.

Why the second leaf is here rather than in its own PR

It was folded in on PM instruction. #8601's body asks to "correct sys_position's leaf values in all four shipped locales to match the source describe() that #8556 landed", and #8468/#8556 corrected both source leaves — so the clone-dialog helpText was always inside this card's stated scope; the dispatch narrowed it before the second leaf was known to exist. It was reported as an out-of-scope finding first (#8718) and widened back deliberately. A separate PR would touch the identical three files for three lines, making the two PRs merge-conflict magnets against each other.

Scope notes

• en was already correct and is deliberately untouched. The card states en.objects.generated.ts "still reads «Unique machine name for the position»"; on current main that string does not exist. Re-measured independently — the grep is not vacuous (sys_position is present in that file at :12).
• The generator is not touched. That is check-i18n-bundles merge mode never updates an EXISTING field description, so editing one leaves the en bundle silently stale (and the gate green) #8543, another seat's card, and the reason this drift survived: merge mode never updates an existing field description, so check:i18n is green either way.
• No bundle sweep was done — out of scope by dispatch. One sample of unrelated damage was found in passing and filed as es-ES object bundle carries rol→puesto find-replace damage (Puestoes, contpuesto, a surviving Clonar rol) #8735 (find-replace artifacts in the es-ES bundle: Puestoes, contpuesto, a surviving Clonar rol). Deliberately not addressed here, and explicitly a sample rather than a bounded set.

The gate cannot judge this change

check:i18n is green both before and after the defect, so it is evidence of structural integrity only, not of correctness. Correctness here is a translation judgement, anchored to the already-accepted strings above.

Two things were verified because of that:

1. node scripts/check-i18n-bundles.mjs --write was run against the committed fix. It reports regenerated for all nine packages and rewrites these three files byte-identically — git status comes back clean. The sanctioned edit-in-place workflow is intact; hand-edited leaves are preserved, not clobbered.
2. check:i18n --self-test passes, confirming the drift classifier can still go red.

Verification

All gates below were run at 31aeb70, the head of this branch, after the final commit.

pnpm check:i18n OK (9 packages, all bundles in sync; --self-test passes)
pnpm check:cross-package-test-inputs OK
pnpm check:test-source-alias OK
pnpm check:type-source-resolution OK
pnpm check:changeset-gate-self-tests OK
pnpm check:objectui-changeset OK
node scripts/check-cross-package-test-inputs.mjs OK (9 packages read outside themselves)
node scripts/check-empty-changeset.mjs OK (1 declaring changeset)
node scripts/check-changeset-no-major.mjs OK
node scripts/check-adr-0087-registration.mjs OK
node scripts/check-nul-bytes.mjs OK (5745 files)

Gate set re-derived with node scripts/pm/dispatch-gates.mjs against the actual changed paths, both before and after the fold-in commit; the set is unchanged because the paths are. The changeset-triggered gates were not in the original dispatch list — that list predates this PR's changeset.

pnpm --filter @objectstack/plugin-security test was not run locally: the shared verification lock was held throughout by a long-running sibling build/test sweep. CI runs this suite and its conclusion is the reading that counts.

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 14, 2026 4:42pm

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security.

12 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via @objectstack/plugin-security)
• content/docs/kernel/runtime-services/sharing-service.mdx(via @objectstack/plugin-security)
• content/docs/kernel/services-checklist.mdx(via @objectstack/plugin-security)
• content/docs/permissions/access-recipes.mdx(via packages/plugins/plugin-security)
• content/docs/permissions/authorization.mdx(via @objectstack/plugin-security)
• content/docs/permissions/explain.mdx(via @objectstack/plugin-security)
• content/docs/permissions/permissions-matrix.mdx(via packages/plugins/plugin-security)
• content/docs/permissions/sharing-rules.mdx(via @objectstack/plugin-security)
• content/docs/plugins/index.mdx(via @objectstack/plugin-security)
• content/docs/plugins/packages.mdx(via @objectstack/plugin-security)
• content/docs/ui/audience-based-interfaces.mdx(via packages/plugins/plugin-security)
• content/docs/ui/dashboards.mdx(via @objectstack/plugin-security)

⛔ 1 release-owned page(s) also reference the affected code. These are read-only:

• content/docs/releases/implementation-status.mdx(via @objectstack/plugin-security)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.