fix(deps): move zod to ^4.6.6 and clear the lockfile's high and critical advisories - #25657

…ssions groups, at an objectstack pin that declares them (objectui#13478) (#13485)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DSu9uoz6bLHskQmxnyBE86T)_

Fixes #13478
Clause-②: yes
Metadata-protocol: none

objectstack's `Console Pin Gate` is red on main because app-shell no
longer type-checks against objectstack `47af3dde42`
(#25701). That change added the `positions`
and `permissions` groups to the per-app `TranslationDataSchema`, and
`TranslationPreview`'s `CATEGORY_DEFS` is exhaustive over that schema's
shape by `satisfies`. This PR adds the two rows and moves objectui's own
pin to `47af3dde42`, so objectui type-checks against the same spec. Once
it merges, objectstack can move its `.objectui-sha` past the merge
commit (objectstack's own card names this one as its blocker).

## What changed

- **`TranslationPreview.tsx`**: two `CATEGORY_DEFS` rows, in the
schema's order (after `flows`, before `metadataForms`): `positions` with
`Users` and `permissions` with `ShieldCheck`, the icons
`PositionPreview` and `PermissionPreview` already draw. Both are nested
groups (`flat: false`), so each card counts the group's top-level keys
and samples them with their inner key count, as `objects` and `flows`
do.
- **`metadata-admin/i18n.ts`** (the designer table, the only pack these
keys live in, `en` and `zh`):
`engine.translationPreview.category.positions` = "Positions" / "岗位" and
`engine.translationPreview.category.permissions` = "Permission Sets" /
"权限集", the words the same table already uses for the two metadata types.
- **Tests**: `TranslationPreview.categories-11765.test.tsx` gets a
spec-valid fixture for each new group (its first case requires one per
schema group). `adminPreviews.i18n-10862-s2.test.tsx` lists the two
headings among the rendered locale sites and reads coverage over 13
groups (`2/13 (15%)`, was `2/11 (18%)`).
- **Changeset**
`.changeset/13478-translation-preview-positions-permissions.md`:
`@object-ui/app-shell` patch.

## The pin

- `.objectstack-sha` moves from `e649c2d91e` (the 18.1.0 release commit)
to `47af3dde42bb4e77fd92025605b89b4a473295a4`. REST compare
`e649c2d91e...47af3dd`: `status: ahead`, `ahead_by: 51`, `behind_by:
0`; the bump script also reported "(on origin/main)". It is pinned at
the card's floor, not at objectstack main's head: the four commits after
it on objectstack main are left for the next bump.
- Path: `scripts/bump-objectstack.sh
47af3dd --no-commit` (built and packed
the 7 packages), then `pnpm install`.
- What moved besides the sha: three packed manifests in
`.objectstack-pin/` (`core`, `lint`, `spec`), each only `zod` `^4.6.5`
to `^4.6.6` (#25657). The lockfile already
resolves `zod@4.6.7`, so **`pnpm-lock.yaml` is unchanged** and `pnpm
install --frozen-lockfile` exits 0.
- **Why the rows and the pin land together** (the seat's hypothesis; it
held). At `e649c2d91e` the schema declares neither group: `grep -c '^
positions: z.record'` over that commit's
`packages/spec/src/system/translation.zod.ts` reads 0, and 1 at
`47af3dde42`; the same for `permissions`. Under `satisfies`, an extra
key in an object literal is TS2353 "Object literal may only specify
known properties" (probed with this repo's tsc 6.0.3 on a two-key
`Record`). So the rows alone fail at the old pin, and the pin alone
fails as the gate does.

## Clause-② reading (the claim asked for it)

The claim declares `yes` because the seat could not tell whether
`metadata-admin/i18n.ts` reaches app-shell's published entry, and the
two lines above are copied from the claim. Measured on the built
declaration closure (`packages/app-shell/dist`, walking the relative
imports from `index.d.ts`, the only `exports` entry with types):

- The closure holds 182 `.d.ts` files. `views/metadata-admin/i18n.d.ts`
**is** one of them (the positive control), but its face is `t(key:
string, …)`, `tFormat(key: string, …)` and the other helpers: the key
table is not exported, and no key is a type.
- Closure files that carry the string `translationPreview`: **0**.
`previews/TranslationPreview.d.ts` is not in the closure at all.

So the diff widens no published accept set and no public face of
app-shell, and the reading is `no`. The declaration is the seat's, so
the lines stay as claimed.

## Verification (local, this worktree, at the new pin)

- `pnpm exec turbo run build --filter=@object-ui/console...
--concurrency=2` (under the verify lock, 6144 MB heap): 35 of 35 tasks,
including `@object-ui/app-shell`'s `tsc` and the console's vite build,
SDUI manifest and plugin tsc. That is the build the Console Pin Gate
runs, here at objectui's own pin.
- `pnpm exec vitest run packages/app-shell/src/views/metadata-admin/
packages/types/` (under the lock): 980 files passed; 17091 tests passed,
1 skipped.
- The three TranslationPreview test files: 63 of 63. Reverse check: with
the two rows removed from `TranslationPreview.tsx` (on-disk count 0,
back to 2 after the restore), the `categories-11765` file goes red on
its order-and-coverage case and on every per-group case, the two new
groups included.
- Gates, each exit 0: `check:i18n-keys`, `check:i18n-designer-parity`,
`check:i18n-dead-keys`, `check:i18n-drift`,
`check:installed-pin-claims`, `check:spec-symbols`,
`check:icon-record-names`, `check:control-bytes`,
`check:new-line-citations` (0 new), `check-changeset-presence`,
`check-changeset-no-major`, and `eslint` on the four changed source
files.
- `check:spec-floors`: exit 1 with the same two `floor-too-low` findings
(`@object-ui/auth` `MEMBERSHIP_ROLE_EXTERNAL`, `@object-ui/types`
`navItemVisibleDataNeedsDataSource`) that #13472 recorded as
pre-existing on main. This diff touches neither package. The gate runs
on push and schedule with `--cross-check`, which is its measurement, and
that run is green on main `cd70b78`.

NOT MEASURED locally (left to CI): the rest of the workspace `vitest`
shards, `lint` and `type-check` across all packages, and e2e.

## Acceptance notes

- objectui#13477 (the label render of the same objectstack change) is a
different defect; it remains open and nothing here touches it.

- [x] Adds no product-specific widget, dialog, hook or string (see
AGENTS.md › Product-neutral renderer)

Implemented by the ui lane card thread, session
`https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp`; claim on the
card, comment 6391374949.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp

---
_Generated by [Claude
Code](https://claude.ai/code/session_01Usjyy1hT9FNxZHea9u7drp)_

---------

Co-authored-by: Claude <noreply@anthropic.com>