# Issue 5872: Org navigation and global search

The two missing surfaces have different owners:

- `configs/pingcap-crm-app-shell.json` is the sealed L2 navigation template. It
  now includes `Org__c` with the `Network` icon, distinct from Account.
- `packs/Salesforce-PingCAP-L2/ux/pingcap_search_scope_order.json` already owns
  the intended ten-object search scope, including `Org__c` and
  `Invoice_Collection__c`. Do not duplicate this payload or put tenant object
  names in L0/L1 code. The fix is the upstream installed-scope projection and
  SF CRM reader described in app-packs `docs/search-scope-installed-metadata.md`.

## Release and existing navigation

Select the paired contract/controlplane/AppService/AppRelease changes through
the normal L2 frozen BOM and deployment workflow. Complete the local candidate
proof before an environment run. The source changes alone do not change test2.

The current application-navigation initializer preserves an existing authored
navigation document, including an explicitly empty document. Changing the L2
template fixes a fresh application; it must not be described as repairing every
existing application on upgrade. Do not reset NavigationRevision or write the
navigation JSON directly in the database to bypass that ownership.

After deploying the paired candidate, use the supported App Manager navigation
editor for the existing `crm_pack_app`: load its current document, add Org once,
retain the other items and their order, and save. The API equivalent is
`GET /services/data/v63.0/app-navigation/crm_pack_app`, followed by `PUT` to the
same path with the observed `expected_revision`, a fresh `idempotency_key`, and
the complete edited `items` array. The new item is:

```json
{"id":"org","label":"Orgs","icon":"Network","target":{"resource":{"resource_type":"Org__c"}}}
```

If Org is already present, no repair write is needed. A revision conflict
requires re-reading and reviewing the current document; do not retry a stale
replacement. This is a one-time authorized configuration correction, not a Seed
module or a new deploy-time navigation reconciler.

## Acceptance

For an administrator with read access, verify in the deployed candidate:

1. Both search-scope endpoints include Org and Collection from the installed
   L2 scope. The v63 response uses effective object labels and key prefixes.
2. The search dropdown includes them even with no recent object history.
   Search actual records under each selected scope.
3. A user without object read permission cannot discover that object through
   either scope endpoint. A non-searchable object is also excluded.
4. The CRM sidebar shows Org with a distinct icon; selecting it opens its list.
5. Reapplying initialization preserves the saved navigation and explicit empty
   navigation. Restarting services preserves installed search scope.

Local verification covers the L2 template translation, the retained baseline
contracts and Catalog closure for local, CI, test, EXP, staging and production.
It does not claim that the paired candidate or the existing-navigation repair
has already been deployed to test2.