release 2026.08.23.03

Roles become a table and localization phase 0 lands. Both groundwork; nothing in
the UI changes and nothing reads the new table yet.

Schema change, additive only — the roles table is new and no constraint is added
to an existing column, so it cannot fail on existing data. postdb:push seeds it.
No dependency change; the two lockfile lines are the local i18n workspace being
declared as a dependency of officerdev.

The plan names the check that matters: four rows in roles, per host, by query —
db:push can fail and exit 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

bun.lock

@@ -210,6 +210,7 @@
         "dotenv": "^16.4.7",
         "embla-carousel-react": "^8.5.1",
         "hooks": "*",
+        "i18n": "*",
         "input-otp": "^1.4.1",
         "lucide-react": "^0.468.0",
         "next-themes": "^0.4.4",
@@ -271,6 +272,7 @@
       "version": "0.0.1",
       "dependencies": {
         "hooks": "workspace:*",
+        "i18n": "workspace:*",
         "state": "workspace:*",
         "widgets": "workspace:*",
       },

deploy/2026.08.23.03.md

@@ -0,0 +1,64 @@
+# 2026.08.23.03
+
+Roles become a table, and the localization infrastructure lands. Both are groundwork — nothing in the UI
+changes and nothing reads the new table yet.
+
+**SCHEMA CHANGE.** `bun db:push` is a step, and `postdb:push` now seeds the new table automatically. The
+`roles` table is new. Additive only: no constraint is added to an existing column, so this cannot fail on
+existing data.
+
+**No dependency change.** `bun.lock` gained two lines and they are the local `i18n` workspace package being
+declared as a dependency of `officerdev` — a workspace path, not a registry fetch. **Do not run
+`bun install`.**
+
+## What is in it
+
+- **`roles` is a table**, seeded with the four the platform already had, each marked `isSystem` because the
+  code names it: `rolePermitsDevTools()` tests for `Developer`, bootstrap writes `Super Admin`, `users.role`
+  defaults to `Member`. Nothing reads the table yet — `USER_ROLES` is still the type and `authorize.ts` is
+  untouched. **There is deliberately no foreign key on `users.role`**; that change cannot go through
+  `db:push` and is a later release.
+- **The seed runs from `postdb:push`**, so a host gets the four rows on its next schema push with no extra
+  step here. It never overwrites an existing row.
+- **Localization phase 0** — plural selection through `Intl.PluralRules`, a `useFormat()` hook for dates and
+  numbers, three namespaced catalogs deep-merged at the bridge, `dir` on `<html>`, and key-parity tests that
+  fail the build on a missing key. The language picker now offers only the two catalogs that exist rather
+  than twenty codes, eighteen of which silently rendered English. Stored bare codes widen on read
+  (`en` → `en-GB`), with no database migration.
+- **SendOff's folder name is served rather than derived** — `/sendoff/targets` carries `displayName` and
+  `myFolder` from the same helper the writer uses, so a picker cannot name a folder the writer will not
+  create.
+
+## Every host
+
+1. `git fetch origin --tags` then `git merge --ff-only deploy/2026.08.23.03`
+2. **`bun db:push`** — and per the procedure, **verify by query, not by exit code.** Check that `roles`
+   exists and holds four rows on that host. `db:push` can fail and still exit 0.
+3. `bun run plugins:update`
+4. `pm2 restart officer`
+
+`officer` only. Step 3 restarts each plugin's own sidecar; that is the script's behaviour and belongs in
+the report.
+
+**`macbookpro`:** append `/opt/homebrew/bin` to PATH for the `bun` commands, run `pm2` separately.
+
+## The check that matters this release
+
+```sql
+select count(*) from roles;   -- expect 4
+```
+
+Four rows named `Super Admin`, `Admin`, `Developer`, `Member`. If a host shows the table but zero rows, the
+`postdb:push` hook did not run — report it as a failure for that host rather than as a success, and say so
+per host in the report.
+
+No direct SQL is needed and none is authorised for this release.
+
+## Hosts to expect trouble from
+
+- **`edge-pertento-bridge`** — skipped, per `docs/servers.md`. Name it and spend nothing on it.
+- **`production-pertento-bridge`** — came back last release after two behind. Nothing special expected.
+
+## `officer-dev` — skip it
+
+The rollout runs from here. It already holds the release and the four rows, verified locally.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "officer",
-  "version": "2026.08.23.02",
+  "version": "2026.08.23.03",
   "private": true,
   "type": "module",
   "workspaces": [
@@ -30,7 +30,7 @@
     "build:dashboard": "bun run ./scripts/build/dashboard.ts",
     "db:gen": "cd src/databases/officer_db && bun run generate",
     "db:push": "bun run scripts/gen-plugin-schemas.ts && cd src/databases/officer_db && bun run push",
-    "postdb:push": "bun run --env-file=.env scripts/backfill-session-models.ts",
+    "postdb:push": "bun run --env-file=.env scripts/backfill-session-models.ts && bun run --env-file=.env scripts/seed-roles.ts",
     "db:migrate": "cd src/databases/officer_db && bun run migrate",
     "dev:emailer": "cd src/workspaces/emailer && bun run dev",
     "format": "{ git diff --name-only HEAD -- 'src/**/*.ts' 'src/**/*.tsx'; git ls-files --others --exclude-standard -- 'src/**/*.ts' 'src/**/*.tsx'; } | xargs -r prettier --write",

prompts/deploy-commander.md

@@ -192,6 +192,51 @@ assemble at the end from memory is a report that will be wrong about the host th
 If a host fails, **continue to the next one**. A half-rolled-out release that is honestly reported beats
 one that stopped in the middle and said nothing about the four hosts it never reached.
 
+### Schema changes, and why `db:push` cannot be trusted
+
+**`drizzle-kit push` can fail and still exit 0.** Verified on 2026-08-23 against a scratch database: a
+change that violated a foreign key printed the Postgres error, created part of the change, left the rest
+undone, and returned zero. `bun db:push` wraps it, so a plan step that reads `bun db:push` can report
+success while the schema is half-applied.
+
+So on any release whose plan says the schema changed:
+
+**Never take the exit code as the answer. Check the database.** Query for the specific thing the plan
+introduced — the table, the column — on that host, against that host's own database. `Changes applied` on
+stdout is not evidence, and neither is exit 0. A report that says "schema ✓" without a query behind it is
+a guess.
+
+**Some changes cannot go through `db:push` at all, and the plan should say so.** The shape that fails is
+create-then-constrain: a new table plus a foreign key onto it from an existing column. `push` creates the
+table empty and adds the constraint in the same run, so every existing row violates it. There is no
+ordering of `push` invocations that fixes this, because the seed has to happen between the two halves.
+
+**When the plan says the schema needs direct SQL — last resort, and only when the plan says it.**
+
+This is allowed and it is not a licence to improvise. The rules, in order:
+
+1. **The Drizzle schema is the source of truth, always.** The SQL you run exists to make the database match
+   what the schema code already says. If you find yourself writing SQL the schema does not describe, stop —
+   that is a code change and it is not yours to make on five production hosts at 3am.
+2. **The plan must contain the exact SQL.** Written by whoever cut the release, reviewed before the tag.
+   Do not compose it yourself from the diff, and do not adapt it per host: same statements, every host, or
+   the fleet has diverged in a way nothing will detect.
+3. **Idempotent, or guarded.** `create table if not exists`, `insert … on conflict do nothing`,
+   `alter table … add constraint` only after checking `pg_constraint`. A deploy that is safe to run twice
+   is a deploy that can be retried, and being retryable is what stops a partial rollout becoming a
+   forensic exercise.
+4. **Then run `bun db:push` anyway**, and expect it to be a no-op. That is the proof the two agree: if
+   `push` still wants to change something after your SQL, the SQL was wrong or incomplete, and that is a
+   finding for the report rather than something to push past.
+5. **Verify per host, by query**, and put the result in the report per host. Not "applied on all five" —
+   the specific check, and its answer, for each.
+6. **A host where the SQL fails is a failed host.** Report it, move to the next, and do not attempt a
+   repair you invented.
+
+**One thing to refuse outright:** `--force`. It exists to answer prompts unattended, and the prompts it
+answers are the destructive ones. On five hosts holding real data, a flag whose whole job is to say yes to
+"this will truncate a table" is not a convenience. If a change needs `--force` to apply, it needs a human.
+
 ### Skip the host you are running on
 
 Entirely. Do not pull it, do not restart anything on it, and **name it in the report as skipped**.

scripts/seed-roles.ts

@@ -0,0 +1,53 @@
+/**
+ * Seed the `roles` table with the roles the platform's own code names.
+ *
+ * Runs from `postdb:push`, so every machine gets the rows on its next schema push rather than needing a
+ * per-server step in a deploy plan. Bun fires `pre`/`post` hooks for colon-named scripts — the same
+ * mechanism `backfill-session-models.ts` relies on.
+ *
+ * ── Why these four are `isSystem` ──
+ *
+ * Each is named by name somewhere in the code: `rolePermitsDevTools()` tests for `'Developer'`,
+ * `bootstrap.ts` writes `'Super Admin'`, `users.role` defaults to `'Member'`, and `'Admin'` is the one
+ * `rolePermitsDevTools` deliberately excludes. Renaming or deleting one of those is not a data change, it
+ * is a code change that has not happened — so the flag exists for the delete and rename paths to refuse on,
+ * rather than for the failure to turn up later as a missing database role or an account that cannot log in.
+ *
+ * ── What this deliberately does NOT do ──
+ *
+ * No foreign key from `users.role`. That change cannot go through `db:push`: push creates the table empty
+ * and adds the constraint in the same run, so every existing account violates it — verified against a
+ * scratch database on 2026-08-23, where push reported the violation, created the table, skipped the
+ * constraint, and exited 0. The FK is a separate release, once every host holds these rows.
+ *
+ * So today `users.role` is still a plain text column and nothing enforces that its value is a real role.
+ * That is the intended state of this phase: additive, unable to fail, and safe to run on five hosts
+ * unattended.
+ *
+ * Never overwrites. A description edited on one server must not be reverted by the next deploy.
+ */
+import { seedRole, waitForDatabase } from '../src/databases/officer_db/src/index';
+
+const SEED: { name: string; description: string }[] = [
+  { name: 'Super Admin', description: 'Full authority over the platform, and an OS account with sudo' },
+  { name: 'Admin', description: 'Administers the platform. No operating-system privilege' },
+  { name: 'Developer', description: 'A member who is also trusted with developer tooling on the machine' },
+  { name: 'Member', description: 'The default. Reaches only what their role has been granted' },
+];
+
+async function main(): Promise<void> {
+  await waitForDatabase();
+  let created = 0;
+  for (const role of SEED) {
+    if (await seedRole({ ...role, isSystem: true })) created += 1;
+  }
+  console.log(`[seed:roles] ${created} seeded, ${SEED.length - created} already present (of ${SEED.length})`);
+}
+
+// Never fatal. This runs from a `post` hook after a schema push, and a seed that cannot write must not make
+// a successful push look like a failed one — the rows are additive and the next push tries again.
+main()
+  .catch((err: unknown) => {
+    console.error('[seed:roles] could not seed:', err instanceof Error ? err.message : err);
+  })
+  .finally(() => process.exit(0));

src/apps/officer-web/Screens/Dashboard/Settings/ProfileSettings/Languages.tsx

@@ -3,6 +3,7 @@ import { X } from 'lucide-react';
 import { Label } from '@/components/ui/label';
 import { useSettings } from 'state/useSettings';
 import { useTranslation } from '@/lib/i18n';
+import { SHIPPED_LOCALES } from '@/lib/locales';
 
 const LANGUAGES = [
   { code: 'en', label: 'English' },
@@ -56,7 +57,8 @@ export const Languages = () => {
   const removeSpoken = (code: string) => {
     const next = spoken.filter((s) => s !== code);
     const updates = { ...settings.languages, spoken: next };
-    if (defaultLang === code) updates.default = next[0] ?? 'en';
+    // `default` (UI localization) draws from SHIPPED_LOCALES, not `spoken` — removing a spoken
+    // language never leaves it without a valid value.
     if (translateTo === code) updates.translateTo = next[0] ?? 'en';
     save(updates);
   };
@@ -104,7 +106,7 @@ export const Languages = () => {
         )}
       </div>
 
-      {/* Default language */}
+      {/* Default language — UI localization, so it only offers locales that actually ship (D2) */}
       <Label className="grid gap-2">
         <span className="text-duck-dark/70">{t('settings.profile.languages.defaultLabel')}</span>
         <select
@@ -112,9 +114,9 @@ export const Languages = () => {
           onChange={(ev) => save({ ...settings.languages, default: ev.target.value })}
           className="text-sm border border-duck-dark/20 rounded-md px-3 py-2 bg-background/60 text-duck-dark cursor-pointer"
         >
-          {spoken.map((code) => (
+          {SHIPPED_LOCALES.map(({ code, label }) => (
             <option key={code} value={code}>
-              {getLabel(code)}
+              {label}
             </option>
           ))}
         </select>

src/apps/officer-web/lib/I18nBridge.tsx

@@ -1,11 +1,30 @@
+import { useEffect } from 'react';
 import type { ReactNode } from 'react';
 import type { TranslationMap } from 'i18n';
-import { I18nProvider } from 'i18n';
+import { I18nProvider, localeDirection } from 'i18n';
+import { panelCatalogs } from 'officerdev';
+import { uiCatalogs } from '@/components/locales';
 import { useSettings } from 'state/useSettings';
-import en from '../locales/en.json';
-import pt from '../locales/pt.json';
+import { FALLBACK_LOCALE, SHIPPED_LOCALES } from './locales';
+import appEnGB from '../locales/en-GB.json';
+import appPtPT from '../locales/pt-PT.json';
 
-const translations: TranslationMap = { en, pt };
+const appCatalogs: TranslationMap = { 'en-GB': appEnGB, 'pt-PT': appPtPT };
+
+/**
+ * Deep-merges the three per-workspace catalogs (D6) into one map per shipped locale — `app.*` from
+ * officer-web, `panel.*` from officerdev's panel apps, `ui.*` from shared components.
+ */
+const translations: TranslationMap = Object.fromEntries(
+  SHIPPED_LOCALES.map(({ code }) => [
+    code,
+    {
+      app: appCatalogs[code] ?? {},
+      panel: panelCatalogs[code] ?? {},
+      ui: uiCatalogs[code] ?? {},
+    },
+  ]),
+);
 
 type I18nBridgeProps = {
   children: ReactNode;
@@ -15,8 +34,14 @@ export const I18nBridge = ({ children }: I18nBridgeProps) => {
   const { settings } = useSettings();
   const locale = settings.languages.default;
 
+  // Prepared for RTL (D3) — every shipped locale is `ltr` today, but the wiring exists so a future
+  // RTL catalog needs no second pass over the tree.
+  useEffect(() => {
+    document.documentElement.dir = localeDirection(locale);
+  }, [locale]);
+
   return (
-    <I18nProvider translations={translations} locale={locale}>
+    <I18nProvider translations={translations} locale={locale} fallbackLocale={FALLBACK_LOCALE}>
       {children}
     </I18nProvider>
   );

src/apps/officer-web/lib/i18n.ts

@@ -1,12 +1,14 @@
 import type { TranslationKeys } from 'i18n';
 import type { InterpolationParams } from 'i18n';
 import { useTranslation as useTranslationBase } from 'i18n';
-import type en from '../locales/en.json';
+import type en from '../locales/en-GB.json';
 
 type AppTranslationKey = TranslationKeys<typeof en>;
 
+// The `app.` prefix is namespace wiring for the merged catalog (D6) — callers never spell it, they
+// pass the same bare key the JSON file uses.
 export const useTranslation = () => {
   const { t: baseT, locale } = useTranslationBase();
-  const t = (key: AppTranslationKey, params?: InterpolationParams) => baseT(key, params);
+  const t = (key: AppTranslationKey, params?: InterpolationParams) => baseT(`app.${key}`, params);
   return { t, locale };
 };

src/apps/officer-web/lib/locales.ts

@@ -0,0 +1,14 @@
+/**
+ * The UI locales that actually ship — regional BCP 47 tags, per docs/localization.md D2. This is the
+ * one list `I18nBridge` merges catalogs for and `Languages.tsx` offers for UI localization; it is
+ * deliberately separate from the broader "languages you speak" / "translate to" lists, which are a
+ * different feature (see the doc's open question 4) and are not limited to locales with a catalog.
+ */
+export type ShippedLocale = { code: string; label: string };
+
+export const SHIPPED_LOCALES: ShippedLocale[] = [
+  { code: 'en-GB', label: 'English (UK)' },
+  { code: 'pt-PT', label: 'Português (Portugal)' },
+];
+
+export const FALLBACK_LOCALE = 'en-GB';

src/apps/officer-web/locales/parity.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, test } from 'bun:test';
+import { findMissingKeys } from 'i18n';
+import en from './en-GB.json';
+import ptPT from './pt-PT.json';
+
+// D2: every shipped locale ships a COMPLETE catalog. A key en-GB has and pt-PT lacks is a red build,
+// not a warning — there is no regional fallback to paper over the gap.
+describe('officer-web (app.*) locale catalogs', () => {
+  test('pt-PT has every key en-GB has', () => {
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([]);
+  });
+});

src/databases/officer_db/src/index.ts

@@ -41,6 +41,7 @@ export * from './anthropic-accounts';
 export * from './theme-favorites';
 export { forgetChatSessions, sessionKeyForTranscriptId } from './chat-session-cleanup';
 export * from './sendoff';
+export * from './roles';
 export * from './command-hq';
 export * from './dashboards';
 export * from './integrations';

src/databases/officer_db/src/roles/index.ts

@@ -0,0 +1,2 @@
+export { roles } from './schema';
+export { listRoles, getRole, seedRole, type RoleRow } from './queries';

src/databases/officer_db/src/roles/queries.ts

@@ -0,0 +1,61 @@
+import { asc, eq, sql } from 'drizzle-orm';
+import { db } from '../db';
+import { users } from '../auth/schema';
+import { roles } from './schema';
+
+export type RoleRow = {
+  name: string;
+  description: string | null;
+  isSystem: boolean;
+  provisioningScript: string | null;
+  createdAt: Date;
+};
+
+/**
+ * Every role, with how many accounts hold each.
+ *
+ * The count is here rather than in a second query because every caller needs it: a picker wants to show
+ * it, and the delete guard is defined in terms of it. One left join beats two round trips and a race
+ * between them.
+ */
+export async function listRoles(): Promise<(RoleRow & { userCount: number })[]> {
+  const rows = await db
+    .select({
+      name: roles.name,
+      description: roles.description,
+      isSystem: roles.isSystem,
+      provisioningScript: roles.provisioningScript,
+      createdAt: roles.createdAt,
+      userCount: sql<number>`count(${users.id})::int`,
+    })
+    .from(roles)
+    .leftJoin(users, eq(users.role, roles.name))
+    .groupBy(roles.name, roles.description, roles.isSystem, roles.provisioningScript, roles.createdAt)
+    .orderBy(asc(roles.name));
+  return rows;
+}
+
+export async function getRole(name: string): Promise<RoleRow | undefined> {
+  const [row] = await db.select().from(roles).where(eq(roles.name, name)).limit(1);
+  return row;
+}
+
+/**
+ * Seed a role if it is not there. Idempotent, and it does NOT overwrite an existing row.
+ *
+ * Called from `postdb:push` on every machine, so it runs again on every schema push for the rest of this
+ * platform's life. An upsert would mean a description edited on one server is silently reverted by the next
+ * deploy — so the seed establishes a row and never touches it again.
+ */
+export async function seedRole(row: {
+  name: string;
+  description?: string | null;
+  isSystem?: boolean;
+}): Promise<boolean> {
+  const inserted = await db
+    .insert(roles)
+    .values({ name: row.name, description: row.description ?? null, isSystem: row.isSystem ?? false })
+    .onConflictDoNothing({ target: roles.name })
+    .returning({ name: roles.name });
+  return inserted.length > 0;
+}

src/databases/officer_db/src/roles/schema.ts

@@ -0,0 +1,52 @@
+import { pgTable, text, boolean, timestamp } from 'drizzle-orm/pg-core';
+
+/**
+ * The roles this server has, as data rather than a TypeScript union.
+ *
+ * ── Why the NAME is the primary key ──
+ *
+ * `users.role` and `role_permissions.role` both hold a role name today, and `authorize.ts` reads a name off
+ * the user to look up grants. Re-keying those onto a serial id would touch the authorization path — the one
+ * file standing between a Member and a shell — to buy nothing the name does not already give, because
+ * Postgres will cascade a rename for us. So both columns become foreign keys onto this one with
+ * `ON UPDATE CASCADE`: renaming a role moves every user and every grant with it, atomically, and no code
+ * changes.
+ *
+ * The cost is that a rename is a data migration rather than a label edit. That is honest — a role name
+ * appears in `rolePermitsDevTools`, in report text and in whatever a plugin has written down.
+ *
+ * ── What is NOT here ──
+ *
+ * **Ownership.** The owner is `OWNER_USER_ID`, an identity, not a role — see `super-admin.ts`. Before this
+ * table existed, "who owns this server" was answered by `users.role === 'Super Admin'`, which meant that
+ * making roles editable would have made "add a role" and "become the owner" the same feature. Several
+ * accounts may now hold `Super Admin`; exactly one account is the owner, and no role grants it.
+ *
+ * **Permissions.** They stay in `role_permissions`, keyed on the name. A role row is the role's identity and
+ * its provisioning, not its grants.
+ */
+export const roles = pgTable('roles', {
+  /** The name, and the key. Referenced by `users.role` and `role_permissions.role` with ON UPDATE CASCADE. */
+  name: text('name').primaryKey(),
+  /** One line, for a picker. Never load-bearing — nothing branches on it. */
+  description: text('description'),
+  /**
+   * A role the platform's own code names, so it cannot be deleted or renamed.
+   *
+   * `rolePermitsDevTools()` tests for `'Developer'` by name, `bootstrap.ts` sets `'Super Admin'`, and the
+   * users table defaults to `'Member'`. Deleting or renaming one of those is not a data change, it is a
+   * code change that has not happened yet — so the delete and rename paths refuse on this flag rather than
+   * discovering it as a runtime failure somewhere else.
+   */
+  isSystem: boolean('is_system').notNull().default(false),
+  /**
+   * Reserved for the per-role provisioning that comes next: a script run when an account is given this
+   * role, so "Developer gets rootless Docker" stops being a special case in `os-user-postgres.ts` and
+   * becomes a row. Null today, and nothing reads it.
+   *
+   * Declared now rather than later on purpose — it is the reason the owner wanted a table at all, and a
+   * column that arrives with the feature that uses it is a second migration for no gain.
+   */
+  provisioningScript: text('provisioning_script'),
+  createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+});

src/databases/officer_db/src/schema.ts

@@ -38,6 +38,7 @@ export * from './anthropic-accounts/schema'; // anthropic_accounts — switchabl
 export * from './theme-favorites/schema'; // theme_favorites — starred themes, per account
 export * from './command-hq/schema'; // command_hq_categories, command_hq_sessions, command_hq_tags, command_hq_session_tags
 export * from './sendoff/schema'; // sendoff_devices, sendoff_senders
+export * from './roles/schema'; // roles
 export * from './agent-panels/schema'; // agent_panels
 
 // Core because the tailnet is the perimeter — a security model resting on it cannot treat administering

src/workspaces/components/locales/en-GB.json

@@ -0,0 +1 @@
+{}

src/workspaces/components/locales/index.ts

@@ -0,0 +1,8 @@
+import type { TranslationMap } from 'i18n';
+import enGB from './en-GB.json';
+import ptPT from './pt-PT.json';
+
+/** Shared components' own catalog, per locale — merged into the app-wide map by `I18nBridge` under `ui.*`. */
+export const uiCatalogs: TranslationMap = { 'en-GB': enGB, 'pt-PT': ptPT };
+
+export { useTranslation } from './useTranslation';

src/workspaces/components/locales/parity.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, test } from 'bun:test';
+import { findMissingKeys } from 'i18n';
+import en from './en-GB.json';
+import ptPT from './pt-PT.json';
+
+// D2: every shipped locale ships a COMPLETE catalog. Phase 0 scaffolds this catalog with no keys yet
+// (ui.* strings land in phase 1) — the test still runs so it is load-bearing from day one.
+describe('shared components (ui.*) locale catalogs', () => {
+  test('pt-PT has every key en-GB has', () => {
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([]);
+  });
+});

src/workspaces/components/locales/pt-PT.json

@@ -0,0 +1 @@
+{}

src/workspaces/components/locales/useTranslation.ts

@@ -0,0 +1,13 @@
+import type { InterpolationParams, TranslationKeys } from 'i18n';
+import { useTranslation as useTranslationBase } from 'i18n';
+import type en from './en-GB.json';
+
+type UiTranslationKey = TranslationKeys<typeof en>;
+
+// The `ui.` prefix is namespace wiring for the merged catalog (D6) — callers never spell it, they
+// pass the same bare key the JSON file uses. `ui.*` may not name a feature (see the naming convention).
+export const useTranslation = () => {
+  const { t: baseT, locale } = useTranslationBase();
+  const t = (key: UiTranslationKey, params?: InterpolationParams) => baseT(`ui.${key}`, params);
+  return { t, locale };
+};

src/workspaces/components/package.json

@@ -45,6 +45,7 @@
     "dotenv": "^16.4.7",
     "embla-carousel-react": "^8.5.1",
     "hooks": "*",
+    "i18n": "*",
     "input-otp": "^1.4.1",
     "lucide-react": "^0.468.0",
     "next-themes": "^0.4.4",

src/workspaces/i18n/src/I18nProvider.tsx

@@ -11,15 +11,19 @@ export const I18nContext = createContext<I18nContextValue>({
 type I18nProviderProps = {
   translations: TranslationMap;
   locale: string;
+  /** The catalog `resolveKey` falls back to on a miss — a bug path, per D8, not a regional chain. */
+  fallbackLocale?: string;
   children: ReactNode;
 };
 
-export const I18nProvider = ({ translations, locale, children }: I18nProviderProps) => {
+export const I18nProvider = ({ translations, locale, fallbackLocale = 'en', children }: I18nProviderProps) => {
   const value = useMemo<I18nContextValue>(() => {
-    const t = (key: string, params?: InterpolationParams) =>
-      interpolate(resolveKey(translations, locale, key), params);
+    const t = (key: string, params?: InterpolationParams) => {
+      const count = typeof params?.count === 'number' ? params.count : undefined;
+      return interpolate(resolveKey(translations, locale, key, fallbackLocale, count), params);
+    };
     return { t, locale };
-  }, [translations, locale]);
+  }, [translations, locale, fallbackLocale]);
 
   return <I18nContext.Provider value={value}>{children}</I18nContext.Provider>;
 };

src/workspaces/i18n/src/index.ts

@@ -1,4 +1,7 @@
 export { I18nProvider, I18nContext } from './I18nProvider';
 export { useTranslation } from './useTranslation';
-export { resolveKey, interpolate } from './resolve';
-export type { TranslationMap, InterpolationParams, I18nContextValue, TranslationKeys } from './types';
+export { useFormat } from './useFormat';
+export { resolveKey, interpolate, isPluralForms, localeDirection } from './resolve';
+export { findMissingKeys } from './parity';
+export type { MissingKey } from './parity';
+export type { TranslationMap, InterpolationParams, I18nContextValue, TranslationKeys, PluralForms } from './types';

src/workspaces/i18n/src/parity.ts

@@ -0,0 +1,27 @@
+import { isPluralForms } from './resolve';
+
+type Catalog = Record<string, unknown>;
+
+const flattenKeys = (obj: Catalog, prefix = ''): string[] =>
+  Object.entries(obj).flatMap(([k, v]) => {
+    const path = prefix ? `${prefix}.${k}` : k;
+    if (v !== null && typeof v === 'object' && !Array.isArray(v) && !isPluralForms(v)) {
+      return flattenKeys(v as Catalog, path);
+    }
+    return [path];
+  });
+
+export type MissingKey = { locale: string; key: string };
+
+/**
+ * Per D2, every shipped locale is a COMPLETE catalog — no regional inheritance. So a key `en` has
+ * and a locale's own file lacks is not a fallback case, it's a red build (docs/localization.md,
+ * "Tooling and guardrails").
+ */
+export const findMissingKeys = (en: Catalog, locales: Record<string, Catalog>): MissingKey[] => {
+  const enKeys = flattenKeys(en);
+  return Object.entries(locales).flatMap(([locale, catalog]) => {
+    const ownKeys = new Set(flattenKeys(catalog));
+    return enKeys.filter((key) => !ownKeys.has(key)).map((key) => ({ locale, key }));
+  });
+};

src/workspaces/i18n/src/resolve.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, test } from 'bun:test';
+import { resolveKey, interpolate, isPluralForms, localeDirection } from './resolve';
+import { findMissingKeys } from './parity';
+import type { TranslationMap } from './types';
+
+describe('resolveKey', () => {
+  const translations: TranslationMap = {
+    'pt-PT': { greeting: 'Olá {{name}}' },
+    'en-GB': { greeting: 'Hello {{name}}', onlyInEnglish: 'English only' },
+  };
+
+  test('resolves from the active locale', () => {
+    expect(resolveKey(translations, 'pt-PT', 'greeting', 'en-GB')).toBe('Olá {{name}}');
+  });
+
+  test('falls back to the fallback locale on a miss', () => {
+    expect(resolveKey(translations, 'pt-PT', 'onlyInEnglish', 'en-GB')).toBe('English only');
+  });
+
+  test('renders the raw key when even the fallback is missing', () => {
+    expect(resolveKey(translations, 'pt-PT', 'nowhere', 'en-GB')).toBe('nowhere');
+  });
+
+  test('never walks a chain between two non-fallback locales', () => {
+    const withThird: TranslationMap = { ...translations, 'pt-BR': {} };
+    // pt-BR has no key of its own and must NOT inherit pt-PT's — only the fallback locale counts.
+    expect(resolveKey(withThird, 'pt-BR', 'greeting', 'en-GB')).toBe('Hello {{name}}');
+  });
+
+  test('selects a plural branch via Intl.PluralRules', () => {
+    const plurals: TranslationMap = {
+      'en-GB': { files: { one: '{{count}} file', other: '{{count}} files' } },
+    };
+    expect(resolveKey(plurals, 'en-GB', 'files', 'en-GB', 1)).toBe('{{count}} file');
+    expect(resolveKey(plurals, 'en-GB', 'files', 'en-GB', 2)).toBe('{{count}} files');
+    expect(resolveKey(plurals, 'en-GB', 'files', 'en-GB', 0)).toBe('{{count}} files');
+  });
+});
+
+describe('interpolate', () => {
+  test('substitutes params', () => {
+    expect(interpolate('Hello {{name}}', { name: 'Ana' })).toBe('Hello Ana');
+  });
+
+  test('leaves an unknown placeholder untouched', () => {
+    expect(interpolate('Hello {{name}}', {})).toBe('Hello {{name}}');
+  });
+
+  test('passes a plain string through with no params', () => {
+    expect(interpolate('Hello')).toBe('Hello');
+  });
+});
+
+describe('isPluralForms', () => {
+  test('accepts an open record of CLDR categories', () => {
+    expect(isPluralForms({ one: 'a', other: 'b' })).toBe(true);
+    expect(isPluralForms({ other: 'b' })).toBe(true);
+  });
+
+  test('rejects a plain nested catalog node', () => {
+    expect(isPluralForms({ title: 'a', description: 'b' })).toBe(false);
+  });
+
+  test('rejects non-objects', () => {
+    expect(isPluralForms('a string')).toBe(false);
+    expect(isPluralForms(null)).toBe(false);
+    expect(isPluralForms(['one', 'other'])).toBe(false);
+  });
+});
+
+describe('localeDirection', () => {
+  test('ltr for English and Portuguese', () => {
+    expect(localeDirection('en-GB')).toBe('ltr');
+    expect(localeDirection('pt-PT')).toBe('ltr');
+  });
+
+  test('rtl for Arabic and Hebrew, by language subtag', () => {
+    expect(localeDirection('ar')).toBe('rtl');
+    expect(localeDirection('ar-EG')).toBe('rtl');
+    expect(localeDirection('he-IL')).toBe('rtl');
+  });
+});
+
+describe('findMissingKeys', () => {
+  test('flags a key en has and a locale lacks', () => {
+    const en = { common: { save: 'Save', cancel: 'Cancel' } };
+    const ptPT = { common: { save: 'Guardar' } };
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([{ locale: 'pt-PT', key: 'common.cancel' }]);
+  });
+
+  test('a complete catalog has no gaps', () => {
+    const en = { common: { save: 'Save' } };
+    const ptPT = { common: { save: 'Guardar' } };
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([]);
+  });
+
+  test('a plural-forms leaf counts as one key, not one per category', () => {
+    const en = { files: { one: '{{count}} file', other: '{{count}} files' } };
+    const ptPT = { files: { one: '{{count}} ficheiro', other: '{{count}} ficheiros' } };
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([]);
+  });
+});

src/workspaces/i18n/src/types.ts

@@ -2,6 +2,12 @@ export type TranslationMap = Record<string, Record<string, unknown>>;
 
 export type InterpolationParams = Record<string, string | number>;
 
+/**
+ * A pluralizable catalog entry — CLDR's category set (Intl.PluralRules), never a fixed
+ * `{one, other}` shape, because some locales need up to all six (see docs/localization.md D7).
+ */
+export type PluralForms = Partial<Record<Intl.LDMLPluralRule, string>>;
+
 export type I18nContextValue = {
   t: (key: string, params?: InterpolationParams) => string;
   locale: string;

src/workspaces/i18n/src/useFormat.ts

@@ -0,0 +1,32 @@
+import { useContext, useMemo } from 'react';
+import { I18nContext } from './I18nProvider';
+
+type DateInput = Date | number | string;
+
+/**
+ * Date, time and number formatting bound to the active locale, via `Intl` (D7) — the replacement for
+ * the ~23 `toLocale*()` call sites that otherwise follow the browser's locale and quietly contradict
+ * the rest of the UI. Moving those call sites is phase 1-3 work; this is just the hook they move to.
+ */
+export const useFormat = () => {
+  const { locale } = useContext(I18nContext);
+
+  return useMemo(() => {
+    const date = (value: DateInput, options?: Intl.DateTimeFormatOptions) =>
+      new Intl.DateTimeFormat(locale, options).format(new Date(value));
+
+    const time = (value: DateInput, options?: Intl.DateTimeFormatOptions) =>
+      new Intl.DateTimeFormat(locale, { timeStyle: 'short', ...options }).format(new Date(value));
+
+    const dateTime = (value: DateInput, options?: Intl.DateTimeFormatOptions) =>
+      new Intl.DateTimeFormat(locale, { dateStyle: 'medium', timeStyle: 'short', ...options }).format(new Date(value));
+
+    const number = (value: number, options?: Intl.NumberFormatOptions) =>
+      new Intl.NumberFormat(locale, options).format(value);
+
+    const relative = (value: number, unit: Intl.RelativeTimeFormatUnit, options?: Intl.RelativeTimeFormatOptions) =>
+      new Intl.RelativeTimeFormat(locale, options).format(value, unit);
+
+    return { date, time, dateTime, number, relative };
+  }, [locale]);
+};

src/workspaces/officerdev/package.json

@@ -9,6 +9,7 @@
   },
   "dependencies": {
     "hooks": "workspace:*",
+    "i18n": "workspace:*",
     "state": "workspace:*",
     "widgets": "workspace:*"
   }

src/workspaces/officerdev/src/index.ts

@@ -1,5 +1,7 @@
 export * from './hooks';
 export * from './channels';
+// The panel apps' own i18n catalog — I18nBridge merges it into the app-wide map under `panel.*`.
+export { panelCatalogs } from './locales';
 // For the shell: a screen naming itself better than its route can — see usePageTitle's precedence.
 export { usePageTitleOverride, usePublishPageTitle } from './page-title';
 export type { PageTitleOverride } from './page-title';
@@ -49,13 +51,11 @@ export type {
   CommandHqCostSummary,
 } from './apps/CommandHQ';
 
-
 // /calendar and /contacts select with a query param rather than a path segment, so what the screens need
 // from the app is the param name and the link builder.
 export { COLLECTION_PARAM, davCollectionPath } from './apps/Dav/shared';
 export type { DavCollection, CalendarEvent, DavContact } from './apps/Dav/shared';
 
-
 export {
   useFilesAPI,
   useTasks,

src/workspaces/officerdev/src/locales/en-GB.json

@@ -0,0 +1 @@
+{}

src/workspaces/officerdev/src/locales/index.ts

@@ -0,0 +1,8 @@
+import type { TranslationMap } from 'i18n';
+import enGB from './en-GB.json';
+import ptPT from './pt-PT.json';
+
+/** Panel apps' own catalog, per locale — merged into the app-wide map by `I18nBridge` under `panel.*`. */
+export const panelCatalogs: TranslationMap = { 'en-GB': enGB, 'pt-PT': ptPT };
+
+export { useTranslation } from './useTranslation';

src/workspaces/officerdev/src/locales/parity.test.ts

@@ -0,0 +1,12 @@
+import { describe, expect, test } from 'bun:test';
+import { findMissingKeys } from 'i18n';
+import en from './en-GB.json';
+import ptPT from './pt-PT.json';
+
+// D2: every shipped locale ships a COMPLETE catalog. Phase 0 scaffolds this catalog with no keys yet
+// (no panel is converted in this phase) — the test still runs so it is load-bearing from day one.
+describe('officerdev (panel.*) locale catalogs', () => {
+  test('pt-PT has every key en-GB has', () => {
+    expect(findMissingKeys(en, { 'pt-PT': ptPT })).toEqual([]);
+  });
+});

src/workspaces/officerdev/src/locales/pt-PT.json

@@ -0,0 +1 @@
+{}

src/workspaces/officerdev/src/locales/useTranslation.ts

@@ -0,0 +1,13 @@
+import type { InterpolationParams, TranslationKeys } from 'i18n';
+import { useTranslation as useTranslationBase } from 'i18n';
+import type en from './en-GB.json';
+
+type PanelTranslationKey = TranslationKeys<typeof en>;
+
+// The `panel.` prefix is namespace wiring for the merged catalog (D6) — callers never spell it, they
+// pass the same bare key the JSON file uses.
+export const useTranslation = () => {
+  const { t: baseT, locale } = useTranslationBase();
+  const t = (key: PanelTranslationKey, params?: InterpolationParams) => baseT(`panel.${key}`, params);
+  return { t, locale };
+};

src/workspaces/state/src/useSettings.ts

@@ -5,6 +5,13 @@ import { useAuth } from 'hooks/useAuth';
 
 const QUERY_KEY = ['USER_SETTINGS'];
 
+/**
+ * UI locales went from bare codes to regional BCP 47 tags (docs/localization.md D2). A stale bare
+ * code must resolve rather than fail, and this is a one-time widening on read, not a DB migration.
+ */
+const WIDEN_BARE_LOCALE: Record<string, string> = { en: 'en-GB', pt: 'pt-PT' };
+const widenLocale = (code: string): string => WIDEN_BARE_LOCALE[code] ?? code;
+
 const mergeWithDefaults = (saved: Partial<UserSettings>): UserSettings => ({
   chat: { ...DEFAULT_SETTINGS.chat, ...saved.chat },
   ai: {
@@ -14,7 +21,11 @@ const mergeWithDefaults = (saved: Partial<UserSettings>): UserSettings => ({
   },
   tasks: { ...DEFAULT_SETTINGS.tasks, ...saved.tasks },
   appearance: { ...DEFAULT_SETTINGS.appearance, ...saved.appearance },
-  languages: { ...DEFAULT_SETTINGS.languages, ...saved.languages },
+  languages: {
+    ...DEFAULT_SETTINGS.languages,
+    ...saved.languages,
+    default: widenLocale(saved.languages?.default ?? DEFAULT_SETTINGS.languages.default),
+  },
   tts: { ...DEFAULT_SETTINGS.tts, ...saved.tts },
 });
 
@@ -121,7 +132,7 @@ export const DEFAULT_SETTINGS: UserSettings = {
   },
   languages: {
     spoken: ['en'],
-    default: 'en',
+    default: 'en-GB',
     translateTo: 'en',
   },
   tts: {