fix(platform-objects): remove the permanently-empty permission_change dashboard tile

The System Overview board's "Permission Changes" tile filtered
`sys_audit_log.action = 'permission_change'`, a value nothing in the repo has
ever written — the only two audit writers are plugin-audit's generic hook
(create/update/delete) and plugin-auth's admin user-import. The tile read `0` on
every deployment that has ever existed, and #8147 then retired the value from
the enum outright, leaving a filter no row can match.

On a compliance surface an empty tile is worse than a missing one: "Permission
Changes: 0" reads as a negative finding rather than an absent feature.

- remove the tile; the two surviving Row 2 tiles split the 12-col row in half
  rather than leaving a hole where it sat
- drop its title/description from all four locale bundles
- stop naming `permission` among the example actions in the by-action tile's
  description (source + all four locales — the translations are the served text)
- pin both directions: a tombstone for retired action values on the board, and
  the missing reverse direction in the app/dashboard translation parity test,
  which had no guard against a translation outliving its widget

`import` is deliberately untouched: it was named in the same ruling but keeps a
live writer and a shipped list view, so retiring it from the UI would produce
the inverse defect.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8

Author: claude

packages/platform-objects/src/apps/dashboards/system-overview-tile-semantics.test.ts

@@ -238,7 +238,6 @@ describe('the dashboard filter the Row 1 inventory tiles opt out of', () => {
   it('still reaches every audit widget', () => {
     const auditWidgets = [
       'widget_login_events',
-      'widget_permission_changes',
       'widget_config_changes',
       'widget_events_by_type',
       'widget_events_by_user',
@@ -250,6 +249,64 @@ describe('the dashboard filter the Row 1 inventory tiles opt out of', () => {
   });
 });
 
+// ── Tombstone: no tile filters on a retired action value ────────────────────
+//
+// The board carried a "Permission Changes" tile filtering
+// `action: 'permission_change'` for its whole life. Nothing ever wrote that
+// value — the only two `sys_audit_log` writers are plugin-audit's generic hook
+// (`actionFor` maps afterInsert/Update/Delete to create/update/delete and
+// nothing else) and plugin-auth's admin user-import — so the tile reported `0`
+// on every deployment that has ever existed, and the value was then retired
+// from the enum outright. `export` retired alongside it.
+//
+// This is the same defect class as the rest of this file, one level up: not "the
+// query answers a different question from the label" but "the query can answer
+// nothing at all, under a label that implies it did". On a COMPLIANCE board the
+// empty tile is the more dangerous of the two — "Permission Changes: 0" reads as
+// a negative finding, not as an absent feature.
+//
+// ⚠️ `import` is NOT on this list and must not be added. It was named in the
+// same ruling but survives with a live writer (plugin-auth's admin user-import
+// writes a run-level row) and a shipped list view that filters it. Retiring it
+// from the UI while the platform still emits it would produce the inverse defect
+// — an action that can be written but not found.
+//
+// Why hard-coded rather than diffed against the enum: `sys_audit_log` lives in
+// `@objectstack/plugin-audit`, which this package does not depend on (the audit
+// objects moved OUT of here under ADR-0029 K2/D8) — and it must not start
+// depending on it for a test. Hard-coded ids checked one by one is the same
+// disposition `setup-nav-dead-key-tombstone.test.ts` records for the same
+// reason.
+describe('retired `sys_audit_log.action` values are gone from the board', () => {
+  const RETIRED_ACTIONS = ['permission_change', 'export'];
+
+  const actionFilterOf = (w: { filter?: FilterCondition }): unknown =>
+    (w.filter as Record<string, unknown> | undefined)?.action;
+
+  it('no widget filters on one', () => {
+    const offenders = (board.widgets ?? [])
+      .filter((w) => RETIRED_ACTIONS.includes(String(actionFilterOf(w))))
+      .map((w) => `${w.id} → action=${String(actionFilterOf(w))}`);
+    expect(offenders, 'widgets filtering a retired audit action').toEqual([]);
+  });
+
+  it('and the removed tile itself is not back', () => {
+    expect((board.widgets ?? []).map((w) => w.id)).not.toContain('widget_permission_changes');
+  });
+
+  // Opposite direction. Both assertions above also pass on a board with no
+  // widgets, or if `filter.action` stopped being where a tile's action
+  // predicate lives — in which case they would be pinning nothing at all. A
+  // LIVE action filter must still be visible through exactly the same read.
+  it('opposite direction — a live action filter is still found by the same read', () => {
+    const live = (board.widgets ?? [])
+      .map((w) => actionFilterOf(w))
+      .filter((a): a is string => typeof a === 'string');
+    expect(live, 'the board still filters on live actions').toContain('login');
+    expect(live).toContain('config_change');
+  });
+});
+
 // ── Tile 1: "Total Users" ───────────────────────────────────────────────────
 
 describe('widget_total_users — "Total" means total', () => {

packages/platform-objects/src/apps/dashboards/system_overview.dashboard.ts

@@ -13,7 +13,7 @@ import { Dashboard } from '@objectstack/spec/ui';
  *
  * Layout (4 rows on a 12-col grid):
  *   1. Platform KPIs       — users / orgs / sessions / packages
- *   2. Security KPIs       — login / permission / config audit counts
+ *   2. Security KPIs       — login / config audit counts
  *   3. Distribution charts — audit events by action + by user
  *   4. Recent audit events table
  *
@@ -134,32 +134,45 @@ export const SystemOverviewDashboard = Dashboard.create({
     // successful logins (both fold into `action='login'`). Surfacing a
     // total Login Events count is honest; a "Failed Logins" widget will
     // need a richer enum or a separate detail field first.
+    //
+    // This row carried a THIRD tile, "Permission Changes", filtering
+    // `action: 'permission_change'`. It is gone, and no replacement tile takes
+    // its place. The value had no writer anywhere in the repo — the only two
+    // `sys_audit_log` writers are plugin-audit's generic hook (whose `actionFor`
+    // maps afterInsert/Update/Delete to create/update/delete and nothing else)
+    // and plugin-auth's admin user-import — so the tile read `0` on every
+    // deployment that has ever existed, and then its action value was retired
+    // from the enum outright, leaving a filter no row can ever match. An empty
+    // widget on a COMPLIANCE surface is worse than a missing one: an auditor
+    // reading "Permission Changes: 0" concludes the platform watched for them
+    // and found none, which is false. 审计面宁窄勿谎 — a narrow audit surface
+    // beats a lying one.
+    //
+    // Not replaced by a refiltered tile, deliberately: permission and role
+    // edits ARE captured, as ordinary `create`/`update` rows on the permission
+    // objects written by the generic hook, so the honest lens on them is
+    // `object_name` on the audit list view — a row-level question, not a
+    // single-number KPI. Inventing a tile that approximates it here would put
+    // a second not-quite-true number on the same board.
+    //
+    // The two survivors split the 12-col row in half (the Row 3 shape) rather
+    // than leaving a 4-col hole where the removed tile sat.
     {
       id: 'widget_login_events',
       dataset: 'sys_audit_log_metrics', values: ['event_count'],
       title: 'Login Events',
       type: 'metric',
-      layout: { x: 0, y: 2, w: 4, h: 2 },
+      layout: { x: 0, y: 2, w: 6, h: 2 },
       filter: { action: 'login' },
       colorVariant: 'blue',
       description: 'Authentication events recorded by the audit log',
     },
-    {
-      id: 'widget_permission_changes',
-      dataset: 'sys_audit_log_metrics', values: ['event_count'],
-      title: 'Permission Changes',
-      type: 'metric',
-      layout: { x: 4, y: 2, w: 4, h: 2 },
-      filter: { action: 'permission_change' },
-      colorVariant: 'warning',
-      description: 'Recent permission and role modifications',
-    },
     {
       id: 'widget_config_changes',
       dataset: 'sys_audit_log_metrics', values: ['event_count'],
       title: 'Config Changes',
       type: 'metric',
-      layout: { x: 8, y: 2, w: 4, h: 2 },
+      layout: { x: 6, y: 2, w: 6, h: 2 },
       filter: { action: 'config_change' },
       colorVariant: 'blue',
       description: 'System configuration modifications',
@@ -195,7 +208,10 @@ export const SystemOverviewDashboard = Dashboard.create({
     {
       id: 'widget_recent_events',
       title: 'Audit Events by Action',
-      description: 'Event volume grouped by action (login, permission, config, …)',
+      // The example actions named here have to be actions the platform can
+      // actually emit — this string used to lead with `permission`, which
+      // advertised the retired value from a second place on the same board.
+      description: 'Event volume grouped by action (login, logout, config, …)',
       type: 'table',
       dataset: 'sys_audit_log_metrics',
       dimensions: ['action'],

packages/platform-objects/src/apps/translations/app-nav-translation-parity.test.ts

@@ -111,4 +111,27 @@ describe('dashboard widgets are translated in every locale', () => {
       expect(missing, `untranslated widget titles in dashboards.${dashboard.name}`).toEqual([]);
     });
   }
+
+  // The reverse direction, for the same reason it exists for Studio's nav above:
+  // a translation for a widget the board no longer declares is dead weight that
+  // reads as coverage. This half was missing, and a removal proved why — when
+  // `widget_permission_changes` was deleted from the board, its title and
+  // description stayed behind in all four locales and every gate in this package
+  // was green. A dashboard CAN be walked statically (unlike Setup, which is
+  // composed at runtime — see `setup-nav-dead-key-tombstone.test.ts`), so there
+  // is nothing here to stop the general claim being made.
+  for (const [locale, data] of Object.entries(LOCALES)) {
+    it(`${dashboard.name} — ${locale} carries no translation for a removed widget`, () => {
+      const declared = new Set(
+        (dashboard.widgets ?? []).map((w) => w.id).filter((id): id is string => !!id),
+      );
+      const translated = Object.keys(
+        (data.dashboards?.[dashboard.name]?.widgets ?? {}) as Record<string, unknown>,
+      );
+      expect(
+        translated.filter((id) => !declared.has(id)),
+        `dashboards.${dashboard.name}.widgets keys with no declaring widget`,
+      ).toEqual([]);
+    });
+  }
 });

packages/platform-objects/src/apps/translations/en.ts

@@ -211,10 +211,6 @@ export const en: TranslationData = {
           title: 'Login Events',
           description: 'Authentication events recorded by the audit log',
         },
-        widget_permission_changes: {
-          title: 'Permission Changes',
-          description: 'Recent permission and role modifications',
-        },
         widget_config_changes: {
           title: 'Config Changes',
           description: 'System configuration modifications',
@@ -229,7 +225,7 @@ export const en: TranslationData = {
         },
         widget_recent_events: {
           title: 'Recent Audit Events',
-          description: 'Latest platform events (login, permission, config, …)',
+          description: 'Latest platform events (login, logout, config, …)',
         },
       },
     },

packages/platform-objects/src/apps/translations/es-ES.ts

@@ -148,11 +148,10 @@ export const esES: TranslationData = {
         widget_active_sessions: { title: 'Sesiones Activas', description: 'Número de sesiones de usuario activas en este momento' },
         widget_packages_installed: { title: 'Paquetes Instalados', description: 'Instalaciones de paquetes activas en los proyectos' },
         widget_login_events: { title: 'Eventos de Inicio de Sesión', description: 'Eventos de autenticación registrados por el log de auditoría' },
-        widget_permission_changes: { title: 'Cambios de Permisos', description: 'Modificaciones recientes de permisos y roles' },
         widget_config_changes: { title: 'Cambios de Configuración', description: 'Modificaciones de configuración del sistema' },
         widget_events_by_type: { title: 'Eventos de Auditoría por Acción', description: 'Distribución de eventos de auditoría por tipo de acción' },
         widget_events_by_user: { title: 'Eventos por Usuario', description: 'Distribución de actividad entre usuarios' },
-        widget_recent_events: { title: 'Eventos de Auditoría Recientes', description: 'Últimos eventos de la plataforma (inicio de sesión, permisos, configuración, …)' },
+        widget_recent_events: { title: 'Eventos de Auditoría Recientes', description: 'Últimos eventos de la plataforma (inicio de sesión, cierre de sesión, configuración, …)' },
       },
     },
   },

packages/platform-objects/src/apps/translations/ja-JP.ts

@@ -148,11 +148,10 @@ export const jaJP: TranslationData = {
         widget_active_sessions: { title: 'アクティブセッション', description: '現在アクティブなユーザーセッション数' },
         widget_packages_installed: { title: 'インストール済みパッケージ', description: 'プロジェクトでアクティブなパッケージインストール数' },
         widget_login_events: { title: 'ログインイベント', description: '監査ログに記録された認証イベント' },
-        widget_permission_changes: { title: '権限変更', description: '最近の権限とロールの変更' },
         widget_config_changes: { title: '構成変更', description: 'システム構成の変更' },
         widget_events_by_type: { title: 'アクション別監査イベント', description: 'アクションタイプ別の監査イベント分布' },
         widget_events_by_user: { title: 'ユーザー別イベント', description: 'ユーザー別アクティビティ分布' },
-        widget_recent_events: { title: '最近の監査イベント', description: '最新のプラットフォームイベント（ログイン、権限、構成など）' },
+        widget_recent_events: { title: '最近の監査イベント', description: '最新のプラットフォームイベント（ログイン、ログアウト、構成など）' },
       },
     },
   },

packages/platform-objects/src/apps/translations/zh-CN.ts

@@ -158,11 +158,10 @@ export const zhCN: TranslationData = {
         widget_active_sessions: { title: '活跃会话', description: '当前活跃用户会话数量' },
         widget_packages_installed: { title: '已安装包', description: '项目中已激活的安装包数' },
         widget_login_events: { title: '登录事件', description: '审计日志中记录的认证事件' },
-        widget_permission_changes: { title: '权限变更', description: '最近的权限和角色修改' },
         widget_config_changes: { title: '配置变更', description: '系统配置修改' },
         widget_events_by_type: { title: '按操作分布的审计事件', description: '审计事件按操作类型分布' },
         widget_events_by_user: { title: '按用户分布的事件', description: '用户活动分布' },
-        widget_recent_events: { title: '最近审计事件', description: '最新的平台事件（登录、权限、配置等）' },
+        widget_recent_events: { title: '最近审计事件', description: '最新的平台事件（登录、登出、配置等）' },
       },
     },
   },