@@ -0,0 +1,64 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The help on Setup's New business unit, Edit organization and user forms
+ * speaks to the administrator filling them in.
+ *
+ * A field's help tooltip is the served translation of its `description`.
+ * These used to describe the implementation: the org tree as a graph
+ * ("graph semantics", "expanded by graph queries"), a null value
+ * ("Null = root of tenant"), an acronym for the upstream system ("HRIS"), a
+ * boolean literal ("When true", zh-CN 「为 true 时」) and an HTTP status code.
+ * What the administrator needs is what turning the field on does, and what to
+ * fill in. This pins the served zh-CN text and the English source.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { SetupAppTranslations } from '../apps/translations/setup.translation.js';
+import { SysBusinessUnit } from './sys-business-unit.object.js';
+import { SysOrganization } from './sys-organization.object.js';
+import { SysUser } from './sys-user.object.js';
+
+/** Implementation vocabulary an administrator's field help must not carry. */
+const DEVELOPER_TERMS: ReadonlyArray<readonly [string, RegExp]> = [
+  ['graph vocabulary', /图谱|\bgraph\b/i],
+  ['a null literal', /\bNull\b|为空 =/],
+  ['an acronym for the upstream system', /\bHRIS\b/],
+  ['a boolean literal', /为 ?(true|false) ?时|\bWhen (true|false)\b/i],
+  ['an HTTP status code', /\b[45]\d\d [A-Z][A-Z_]{3,}\b/],
+];
+
+const FORMS = {
+  sys_business_unit: {
+    schema: SysBusinessUnit,
+    fields: ['kind', 'parent_business_unit_id', 'active', 'effective_from', 'effective_to', 'external_ref'],
+  },
+  sys_organization: { schema: SysOrganization, fields: ['require_mfa'] },
+  sys_user: { schema: SysUser, fields: ['banned', 'must_change_password'] },
+} as const;
+
+function termsIn(text: string): string[] {
+  return DEVELOPER_TERMS.filter(([, re]) => re.test(text)).map(([name]) => name);
+}
+
+type ObjectCopy = { fields?: Record<string, { help?: string }> };
+
+describe('Setup forms: business unit, organization and user help reads as administrator wording', () => {
+  const zhCN = (SetupAppTranslations['zh-CN'] as { objects: Record<string, ObjectCopy> }).objects;
+
+  for (const [object, { schema, fields }] of Object.entries(FORMS)) {
+    for (const field of fields) {
+      it(`${object}.${field}: the served zh-CN help is Chinese and names no implementation term`, () => {
+        const help = zhCN[object]?.fields?.[field]?.help ?? '';
+        expect(help).toMatch(/[一-鿿]/);
+        expect(termsIn(help), help).toEqual([]);
+      });
+
+      it(`${object}.${field}: the English source names no implementation term`, () => {
+        const description = (schema.fields as Record<string, { description?: string }>)[field]?.description ?? '';
+        expect(description.length).toBeGreaterThan(0);
+        expect(termsIn(description), description).toEqual([]);
+      });
+    }
+  }
+});
@@ -0,0 +1,36 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * An out-of-office rule's "Valid Until" help says when the rule stops, not
+ * which interval notation the check uses.
+ *
+ * The help tooltip on the `sys_approval_delegation` form is the served
+ * translation of the field's `description`. It used to read "half-open
+ * [from, until)" (zh-CN 「半开区间 [from, until)」): the shape of the check,
+ * which an administrator has no use for. This pins the served zh-CN text and
+ * the English source.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { ApprovalsTranslations } from './index.js';
+import { SysApprovalDelegation } from '../sys-approval-delegation.object.js';
+
+const INTERVAL_NOTATION = /半开区间|half-open|\[from, until\)/i;
+
+type ObjectCopy = { fields?: Record<string, { help?: string }> };
+
+describe('sys_approval_delegation.valid_until: help reads as administrator wording', () => {
+  it('the served zh-CN help is Chinese and carries no interval notation', () => {
+    const objects = (ApprovalsTranslations['zh-CN'] as { objects: Record<string, ObjectCopy> }).objects;
+    const help = objects.sys_approval_delegation?.fields?.valid_until?.help ?? '';
+    expect(help).toMatch(/[一-鿿]/);
+    expect(help).not.toMatch(INTERVAL_NOTATION);
+  });
+
+  it('the English source carries no interval notation', () => {
+    const description = (SysApprovalDelegation.fields as Record<string, { description?: string }>).valid_until
+      ?.description ?? '';
+    expect(description.length).toBeGreaterThan(0);
+    expect(description).not.toMatch(INTERVAL_NOTATION);
+  });
+});
@@ -27,30 +27,36 @@ interface Resolved { value: unknown; source?: string }
 function fakeSettings(values: Record<string, Resolved>) {
   const listeners: Array<() => void> = [];
   const actions = new Map<string, (a: any) => Promise<any>>();
-  let liveStatus: (() => Promise<LiveMailTransportStatus | undefined>) | undefined;
+  type LiveStatusFn = (input?: { locale?: string }) => Promise<LiveMailTransportStatus | undefined>;
+  let liveStatus: LiveStatusFn | undefined;
   return {
     values,
     createClient: () => ({}),
     getNamespace: async () => ({ values }),
     subscribe: (_ns: string, cb: () => void) => { listeners.push(cb); },
     registerAction: (ns: string, id: string, fn: (a: any) => Promise<any>) => { actions.set(`${ns}/${id}`, fn); },
-    registerLiveStatus: (ns: string, fn: () => Promise<LiveMailTransportStatus | undefined>) => {
+    registerLiveStatus: (ns: string, fn: LiveStatusFn) => {
       if (ns === 'mail') liveStatus = fn;
     },
     /** Patch the snapshot and emit settings:changed, as a page save does. */
     save(patch: Record<string, Resolved>) {
       Object.assign(values, patch);
       for (const l of listeners) l();
     },
-    /** What the page states, as the settings GET route asks for it (waits for a running re-apply). */
-    statement: () => liveStatus!(),
+    /**
+     * What the page states, as the settings GET route asks for it (waits for a
+     * running re-apply), in the caller's display `locale` when one is given.
+     */
+    statement: (locale?: string) => liveStatus!(locale ? { locale } : undefined),
     /**
      * The "Send test email" answer for the stored values — with nothing edited
-     * on the form, or with `form` as the unsaved form state the page posts.
+     * on the form, or with `form` as the unsaved form state the page posts —
+     * in the caller's display `locale` when one is given.
      */
-    sendTest: (form?: Record<string, unknown>) => actions.get('mail/test')!({
+    sendTest: (form?: Record<string, unknown>, locale?: string) => actions.get('mail/test')!({
       values: Object.fromEntries(Object.entries(values).map(([k, v]) => [k, v.value])),
       payload: form ? { to: 'admin@example.test', values: form } : { to: 'admin@example.test' },
+      ...(locale ? { locale } : {}),
     }),
   };
 }
@@ -226,3 +232,61 @@ describe('"Send test email" with provider "log" on the form, not saved, while SM
     expect(answer.message).toMatch(/^Sent test email to admin@example\.test via smtp \(smtp\.form\.test:587\)/);
   });
 });
+
+// Setup → Email in the caller's display language. The page's statement and the
+// "Send test email" answer are both composed here, per request, so both take
+// the locale the settings routes read from the request (`Accept-Language`,
+// else `?locale`). English stays the answer for no locale and for a language
+// this plugin ships no copy for.
+describe('Setup → Email answers in the caller\'s language (zh-CN)', () => {
+  const HAN = /[一-鿿]/;
+  const SMTP_SAVED = {
+    provider: { value: 'smtp', source: 'global' },
+    smtp_host: { value: 'smtp.saved.test', source: 'global' },
+  };
+
+  it('the out-of-the-box statement says, in Chinese, that no mail is sent', async () => {
+    const h = await boot({});
+    const statement = await h.settings.statement('zh-CN');
+    expect(statement?.label).toBe('当前不会发出任何邮件');
+    expect(statement?.bannerSeverity).toBe('warning');
+    expect(statement?.bannerText).toMatch(HAN);
+    expect(statement?.bannerText).not.toMatch(/live transport|sys_email/);
+  });
+
+  it('a delivering transport is named in a Chinese statement', async () => {
+    const h = await boot(SMTP_SAVED);
+    const statement = await h.settings.statement('zh-CN');
+    expect(statement?.label).toBe('邮件通过 SMTP (smtp.saved.test:587) 投递');
+    expect(statement?.bannerSeverity).toBe('info');
+    expect(statement?.bannerText).toMatch(HAN);
+  });
+
+  it('the test toast reports the send in Chinese', async () => {
+    const h = await boot(SMTP_SAVED);
+    nm.sendMail.mockClear();
+    const answer = await h.settings.sendTest(
+      { provider: 'smtp', smtp_host: 'smtp.form.test', smtp_port: 587 },
+      'zh-CN',
+    );
+    expect(nm.sendMail).toHaveBeenCalledTimes(1);
+    expect(answer).toMatchObject({ ok: true, severity: 'info' });
+    expect(answer.message).toMatch(/^测试邮件已发送至 admin@example\.test，经由 smtp \(smtp\.form\.test:587\)/);
+    expect(answer.message).not.toMatch(/Sent test email/);
+  });
+
+  it('"None (log only)" on the form: the warning is Chinese and names the live transport in Chinese', async () => {
+    const h = await boot(SMTP_SAVED);
+    nm.sendMail.mockClear();
+    const answer = await h.settings.sendTest({ provider: 'log' }, 'zh-CN');
+    expect(nm.sendMail).not.toHaveBeenCalled();
+    expect(answer).toMatchObject({ ok: false, severity: 'warning' });
+    expect(answer.message).toMatch(/^没有投递任何邮件/);
+    expect(answer.message).toContain('邮件通过 SMTP (smtp.saved.test:587) 投递');
+  });
+
+  it('CONTROL — a language with no copy answers in English', async () => {
+    const h = await boot({});
+    expect((await h.settings.statement('fr-FR'))?.label).toBe('No mail leaves this machine');
+  });
+});
@@ -0,0 +1,58 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The validity-window and reason help on a permission set assignment and a
+ * position assignment speaks to the administrator filling in the form.
+ *
+ * Setup opens `sys_user_permission_set` (New permission set assignment) and
+ * `sys_user_position` from a user's record, and each field's help tooltip is
+ * the served translation of its `description`. The help used to describe the
+ * implementation: an enforcement posture ("fail-closed"), interval notation
+ * ("half-open [from, until)") and an internal grant class ("agent grants").
+ * What the administrator needs is when the assignment starts and stops, and
+ * what to write down. This pins the served zh-CN text and the English source.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { SecurityTranslations } from './index.js';
+import { SysUserPermissionSet, SysUserPosition } from '../objects/index.js';
+
+/** Implementation vocabulary an administrator's field help must not carry. */
+const DEVELOPER_TERMS: ReadonlyArray<readonly [string, RegExp]> = [
+  ['an enforcement posture', /fail-closed/i],
+  ['interval notation', /半开区间|half-open|\[from, until\)/i],
+  ['an internal grant class', /智能体授权|\bagent grants?\b|task\/run attribution/i],
+];
+
+const FORMS = {
+  sys_user_permission_set: SysUserPermissionSet,
+  sys_user_position: SysUserPosition,
+} as const;
+const FIELDS = ['valid_from', 'valid_until', 'reason'] as const;
+
+function termsIn(text: string): string[] {
+  return DEVELOPER_TERMS.filter(([, re]) => re.test(text)).map(([name]) => name);
+}
+
+type FieldCopy = { help?: string };
+type ObjectCopy = { fields?: Record<string, FieldCopy> };
+
+describe('assignment forms: validity and reason help reads as administrator wording', () => {
+  const zhCN = (SecurityTranslations['zh-CN'] as { objects: Record<string, ObjectCopy> }).objects;
+
+  for (const [object, schema] of Object.entries(FORMS)) {
+    for (const field of FIELDS) {
+      it(`${object}.${field}: the served zh-CN help is Chinese and names no implementation term`, () => {
+        const help = zhCN[object]?.fields?.[field]?.help ?? '';
+        expect(help).toMatch(/[一-鿿]/);
+        expect(termsIn(help), help).toEqual([]);
+      });
+
+      it(`${object}.${field}: the English source names no implementation term`, () => {
+        const description = (schema.fields as Record<string, { description?: string }>)[field]?.description ?? '';
+        expect(description.length).toBeGreaterThan(0);
+        expect(termsIn(description), description).toEqual([]);
+      });
+    }
+  }
+});
@@ -0,0 +1,53 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The 队列 and 队列成员 pages read in Chinese on a zh-CN console.
+ *
+ * Setup's Queues and Queue Members pages draw their title, the 新建 button
+ * (「新建」 + the object label), the list columns and every form field's
+ * label and help from the served translation of `sys_queue` and
+ * `sys_queue_member`. This package's bundle carried its three sharing objects
+ * only, so both pages fell back to the English object metadata and the button
+ * read 「新建Queue」. This pins what the bundle serves for both objects.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { SharingTranslations } from './index.js';
+import { SysQueue, SysQueueMember } from '../objects/index.js';
+
+type FieldCopy = { label?: string; help?: string; options?: Record<string, string> };
+type ObjectCopy = { label?: string; pluralLabel?: string; description?: string; fields?: Record<string, FieldCopy> };
+
+const HAN = /[一-鿿]/;
+
+describe('queue pages: the served zh-CN bundle translates sys_queue and sys_queue_member', () => {
+  const zhCN = (SharingTranslations['zh-CN'] as { objects: Record<string, ObjectCopy> }).objects;
+
+  it('names the two objects 队列 and 队列成员', () => {
+    expect(zhCN.sys_queue?.label).toBe('队列');
+    expect(zhCN.sys_queue?.pluralLabel).toBe('队列');
+    expect(zhCN.sys_queue_member?.label).toBe('队列成员');
+    expect(zhCN.sys_queue_member?.pluralLabel).toBe('队列成员');
+  });
+
+  for (const schema of [SysQueue, SysQueueMember]) {
+    it(`${schema.name}: the page description and every field label and help are Chinese`, () => {
+      const copy = zhCN[schema.name];
+      expect(copy?.description ?? '').toMatch(HAN);
+      for (const [field, def] of Object.entries(schema.fields as Record<string, { description?: string }>)) {
+        expect(copy?.fields?.[field]?.label ?? '', `${schema.name}.${field}.label`).toMatch(HAN);
+        if (def.description) {
+          expect(copy?.fields?.[field]?.help ?? '', `${schema.name}.${field}.help`).toMatch(HAN);
+        }
+      }
+    });
+  }
+
+  it('sys_queue_member: every member type option is Chinese', () => {
+    const options = zhCN.sys_queue_member?.fields?.recipient_type?.options ?? {};
+    expect(Object.keys(options).sort()).toEqual(
+      ['business_unit', 'position', 'team', 'unit_and_subordinates', 'user'],
+    );
+    for (const [value, label] of Object.entries(options)) expect(label, value).toMatch(HAN);
+  });
+});
@@ -151,6 +151,36 @@ describe('settings-routes', () => {
     expect(state.body.data.ok).toBe(true);
   });
 
+  // The answer an action composes (the "Send test email" toast) is shown to
+  // the caller, so the handler is told the caller's display language: the top
+  // Accept-Language tag, else `?locale`, the same reading the page's
+  // live-status statement gets. It authorizes nothing and stays out of `ctx`.
+  it('POST action hands the handler the caller\'s display locale, outside ctx', async () => {
+    const http = new MockHttp();
+    const svc = new SettingsService({ env: {} });
+    svc.registerManifest(brandingSettingsManifest);
+    const seen: Array<{ locale?: string; ctxKeys: string[] }> = [];
+    svc.registerAction('branding', 'ping', ({ locale, ctx }) => {
+      seen.push({ locale, ctxKeys: Object.keys(ctx) });
+      return { ok: true, message: 'pong' };
+    });
+    registerSettingsRoutes(http, svc, { contextFromRequest: adminProvider });
+
+    const h = http.routes.get('POST /api/settings/:namespace/:actionId')!;
+    const zh = makeReqRes({
+      params: { namespace: 'branding', actionId: 'ping' },
+      body: null,
+      headers: { 'accept-language': 'zh-CN,zh;q=0.9,en;q=0.8' },
+    });
+    await h(zh.req, zh.res);
+    const none = makeReqRes({ params: { namespace: 'branding', actionId: 'ping' }, body: null });
+    await h(none.req, none.res);
+
+    expect(zh.state.status).toBe(200);
+    expect(seen.map((s) => s.locale)).toEqual(['zh-CN', undefined]);
+    expect(seen[0].ctxKeys).not.toContain('locale');
+  });
+
   // ── [Finding-1] the DEFAULT (no verified provider) is SECURE ──────────────
   // Header-trusted identity is gone; an unauthenticated request can neither
   // enumerate protected namespaces nor write them. Since the family took the