fix: Setup serves administrator wording and Chinese queue, mail status and test-toast text

Rows 1-3: business wording in the help on permission set and position
assignments, out-of-office rules, business units, organization and user
forms (English source and zh-CN). Row 7: sys_queue and sys_queue_member join
plugin-sharing's translation bundle, with zh-CN. Row 8: the mail live-status
statement and the Send test email answer are written in the caller's
display language; settings action handlers now receive that locale.

Claude-Session: https://claude.ai/code/session_01Utp6CbDNK83SuSb8zsRt2s
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -39,7 +39,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       banned: {
         label: "Banned",
-        help: "When true, the user cannot sign in. Toggle via Ban User / Unban User actions."
+        help: "When on, the user cannot sign in. Use the Ban User / Unban User actions to change it."
       },
       ban_reason: {
         label: "Ban Reason"
@@ -70,7 +70,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       must_change_password: {
         label: "Must Change Password",
-        help: "When true, the user is blocked (403 PASSWORD_RESET_REQUIRED) until they change their password. Stamped by the admin user-management routes; system-managed."
+        help: "When on, the user must change their password before they can continue. Turned on when an administrator creates or imports the account, or resets its password; system-managed."
       },
       mfa_required_at: {
         label: "MFA Required At",
@@ -557,7 +557,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       require_mfa: {
         label: "Require Multi-Factor Auth",
-        help: "When true, every member of this organization must enroll an authenticator app to access data."
+        help: "Turn on to require every member of this organization to set up an authenticator app before they can access data."
       },
       timezone: {
         label: "Timezone",
@@ -995,7 +995,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       kind: {
         label: "Kind",
-        help: "Categorisation hint — does not change graph semantics.",
+        help: "For grouping and reporting only; it does not change where the unit sits in the organization or who it covers.",
         options: {
           company: "Company",
           division: "Division",
@@ -1006,7 +1006,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       parent_business_unit_id: {
         label: "Parent Business Unit",
-        help: "Self-reference for the org tree. Null = root of tenant. A unit that still has child units cannot be deleted until they are re-parented or deleted."
+        help: "The unit this one sits under. Leave empty for a top-level unit. A unit that still has units under it cannot be deleted until they are moved under another unit or deleted."
       },
       timezone: {
         label: "Timezone",
@@ -1022,19 +1022,19 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       active: {
         label: "Active",
-        help: "When false, members are not expanded by graph queries."
+        help: "Turn off to retire the unit: sharing and other access given to this unit, or to a unit above it, no longer reaches its members or the units under it."
       },
       effective_from: {
         label: "Effective From",
-        help: "When this business unit came into existence (HRIS sync)."
+        help: "When this business unit came into existence. Usually filled in by a sync from your HR system."
       },
       effective_to: {
         label: "Effective To",
-        help: "When this business unit was retired (HRIS sync)."
+        help: "When this business unit was retired. Usually filled in by a sync from your HR system."
       },
       external_ref: {
         label: "External Reference",
-        help: "ID in upstream HRIS (Workday / SAP HR / 北森)."
+        help: "The unit's ID in your HR system (such as Workday, SAP HR or 北森), used to match it on each sync."
       },
       id: {
         label: "Business Unit ID"

packages/platform-objects/src/apps/translations/zh-CN.objects.generated.ts

@@ -39,7 +39,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       banned: {
         label: "已封禁",
-        help: "为 true 时，用户无法登录。可通过“封禁用户 / 解除封禁”操作切换。"
+        help: "开启后，用户无法登录。可通过“封禁用户 / 解除封禁”操作切换。"
       },
       ban_reason: {
         label: "封禁原因"
@@ -70,7 +70,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       must_change_password: {
         label: "须修改密码",
-        help: "为 true 时，用户会被阻止访问（403 PASSWORD_RESET_REQUIRED），直到修改密码。由管理员用户管理接口写入；系统维护。"
+        help: "开启后，用户必须先修改密码才能继续使用。管理员创建账号、导入用户或重置密码时会自动开启；系统维护。"
       },
       mfa_required_at: {
         label: "MFA 强制生效时间",
@@ -557,7 +557,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       require_mfa: {
         label: "强制多因素认证",
-        help: "为 true 时，该组织的每位成员都必须注册身份验证器 App 才能访问数据。"
+        help: "开启后，该组织的每位成员都必须先绑定身份验证器 App，才能访问数据。"
       },
       timezone: {
         label: "时区",
@@ -995,7 +995,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       kind: {
         label: "类型",
-        help: "分类提示——不会改变图谱语义。",
+        help: "仅用于分类和报表，不会改变该单元在组织中的位置和覆盖范围。",
         options: {
           company: "公司",
           division: "事业部",
@@ -1006,7 +1006,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       parent_business_unit_id: {
         label: "上级业务单元",
-        help: "组织树的自关联字段。Null 表示租户根节点。仍有下级单元的业务单元无法删除，须先将下级单元改挂到其他上级或删除。"
+        help: "该单元的上级单元。留空表示顶级单元。仍有下级单元的业务单元无法删除，须先将下级单元改挂到其他上级或删除。"
       },
       timezone: {
         label: "时区",
@@ -1022,19 +1022,19 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       active: {
         label: "启用",
-        help: "为 false 时，图谱查询不会展开该业务单元成员。"
+        help: "关闭后即停用该单元：授予该单元或其上级单元的共享等访问权限，将不再覆盖其成员及下级单元。"
       },
       effective_from: {
         label: "生效时间",
-        help: "该业务单元生效的时间（HRIS 同步）。"
+        help: "该业务单元成立的时间，通常由 HR 系统同步填写。"
       },
       effective_to: {
         label: "失效时间",
-        help: "该业务单元停用的时间（HRIS 同步）。"
+        help: "该业务单元撤销的时间，通常由 HR 系统同步填写。"
       },
       external_ref: {
         label: "外部引用",
-        help: "上游 HRIS 中的 ID（Workday / SAP HR / 北森）。"
+        help: "该单元在 HR 系统（如 Workday、SAP HR、北森）中的编号，每次同步时用它对应到本单元。"
       },
       id: {
         label: "业务单元 ID"

packages/platform-objects/src/identity/sys-business-unit.object.ts

@@ -121,7 +121,7 @@ export const SysBusinessUnit = ObjectSchema.create({
       label: 'Kind',
       required: true,
       defaultValue: 'department',
-      description: 'Categorisation hint — does not change graph semantics.',
+      description: 'For grouping and reporting only; it does not change where the unit sits in the organization or who it covers.',
       group: 'Identity',
       options: [
         { value: 'company', label: 'Company' },
@@ -145,7 +145,7 @@ export const SysBusinessUnit = ObjectSchema.create({
       required: false,
       deleteBehavior: 'restrict',
       description:
-        'Self-reference for the org tree. Null = root of tenant. A unit that still has child units cannot be deleted until they are re-parented or deleted.',
+        'The unit this one sits under. Leave empty for a top-level unit. A unit that still has units under it cannot be deleted until they are moved under another unit or deleted.',
       group: 'Hierarchy',
     }),
 
@@ -224,29 +224,29 @@ export const SysBusinessUnit = ObjectSchema.create({
       label: 'Active',
       required: false,
       defaultValue: true,
-      description: 'When false, members are not expanded by graph queries.',
+      description: 'Turn off to retire the unit: sharing and other access given to this unit, or to a unit above it, no longer reaches its members or the units under it.',
       group: 'Lifecycle',
     }),
 
     effective_from: Field.datetime({
       label: 'Effective From',
       required: false,
-      description: 'When this business unit came into existence (HRIS sync).',
+      description: 'When this business unit came into existence. Usually filled in by a sync from your HR system.',
       group: 'Lifecycle',
     }),
 
     effective_to: Field.datetime({
       label: 'Effective To',
       required: false,
-      description: 'When this business unit was retired (HRIS sync).',
+      description: 'When this business unit was retired. Usually filled in by a sync from your HR system.',
       group: 'Lifecycle',
     }),
 
     external_ref: Field.text({
       label: 'External Reference',
       required: false,
       maxLength: 200,
-      description: 'ID in upstream HRIS (Workday / SAP HR / 北森).',
+      description: 'The unit\'s ID in your HR system (such as Workday, SAP HR or 北森), used to match it on each sync.',
       group: 'Lifecycle',
     }),
 

packages/platform-objects/src/identity/sys-organization.object.ts

@@ -401,7 +401,7 @@ export const SysOrganization = ObjectSchema.create({
       required: false,
       defaultValue: false,
       group: 'Configuration',
-      description: 'When true, every member of this organization must enroll an authenticator app to access data.',
+      description: 'Turn on to require every member of this organization to set up an authenticator app before they can access data.',
     }),
 
     // #14238 — maintainer ruling 2026-09-02, option A (verbatim 「同意」): the

packages/platform-objects/src/identity/sys-user.object.ts

@@ -981,7 +981,7 @@ export const SysUser = ObjectSchema.create({
       defaultValue: false,
       readonly: true, // ADR-0092 — toggled via Ban/Unban actions (session side effects)
       group: 'Account',
-      description: 'When true, the user cannot sign in. Toggle via Ban User / Unban User actions.',
+      description: 'When on, the user cannot sign in. Use the Ban User / Unban User actions to change it.',
     }),
 
     ban_reason: Field.text({
@@ -1085,8 +1085,8 @@ export const SysUser = ObjectSchema.create({
       readonly: true,
       group: 'Admin',
       description:
-        'When true, the user is blocked (403 PASSWORD_RESET_REQUIRED) until they change ' +
-        'their password. Stamped by the admin user-management routes; system-managed.',
+        'When on, the user must change their password before they can continue. ' +
+        'Turned on when an administrator creates or imports the account, or resets its password; system-managed.',
     }),
 
     // ADR-0069 D3 — when enforced MFA first applied to this user; starts the

packages/plugins/plugin-approvals/src/sys-approval-delegation.object.ts

@@ -137,7 +137,7 @@ export const SysApprovalDelegation = ObjectSchema.create({
       required: false,
       group: 'Delegation',
       description:
-        'Rule is inactive AT and AFTER this instant (half-open [from, until), UTC). Null = never expires.',
+        'The rule stops applying at this time (UTC). Leave empty for no end date.',
     }),
 
     reason: Field.text({

packages/plugins/plugin-approvals/src/translations/en.objects.generated.ts

@@ -366,7 +366,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       },
       valid_until: {
         label: "Valid Until",
-        help: "Rule is inactive AT and AFTER this instant (half-open [from, until), UTC). Null = never expires."
+        help: "The rule stops applying at this time (UTC). Leave empty for no end date."
       },
       reason: {
         label: "Reason",

packages/plugins/plugin-approvals/src/translations/zh-CN.objects.generated.ts

@@ -366,7 +366,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       valid_until: {
         label: "失效时间",
-        help: "此刻（含）及之后规则不生效（半开区间 [from, until)，UTC）。留空 = 永不过期。"
+        help: "规则到此时间即失效（按 UTC 计）。留空 = 永不过期。"
       },
       reason: {
         label: "原因",

packages/plugins/plugin-email/src/email-plugin.ts

@@ -35,7 +35,7 @@ import type {
 import { bindEmailTemplateDoor, unbindEmailTemplateDoor } from './email-template-door.js';
 import { sweepStrandedOutbox, type OutboxSweepResult } from './outbox-sweep.js';
 import { readInternalHeadersJson } from './internal-header-readback.js';
-import { describeLiveMailTransport, type LiveMailTransportStatus } from './live-transport-status.js';
+import { describeLiveMailTransport, mailDeliveryCopy, type LiveMailTransportStatus } from './live-transport-status.js';
 import {
   EMAIL_LOG_OBJECTS,
   TENANT_EMAIL_OBJECT,
@@ -153,12 +153,17 @@ interface MailSettingsSurface {
       payload?: Record<string, unknown>;
       /** The caller's settings context; `userId` is the signed-in admin who pressed the button. */
       ctx?: { userId?: string };
+      /** The caller's display language, which the answer is written in. Absent: English. */
+      locale?: string;
     }) => Promise<unknown>,
   ): void;
   /** State the live transport at the top of Setup → Email (service-settings' `registerLiveStatus`). */
   registerLiveStatus?(
     namespace: string,
-    provider: () => Promise<LiveMailTransportStatus | undefined>,
+    provider: (input?: {
+      /** The caller's display language, which the statement is written in. Absent: English. */
+      locale?: string;
+    }) => Promise<LiveMailTransportStatus | undefined>,
   ): void;
 }
 
@@ -658,9 +663,9 @@ export class EmailServicePlugin implements Plugin {
           // each page read, after any re-apply still running, so it follows a
           // transport swap made from the same page.
           if (typeof settings.registerLiveStatus === 'function') {
-            settings.registerLiveStatus('mail', async () => {
+            settings.registerLiveStatus('mail', async (input) => {
               await Promise.allSettled([...applying]);
-              return this.service ? describeLiveMailTransport(this.service) : undefined;
+              return this.service ? describeLiveMailTransport(this.service, input?.locale) : undefined;
             });
           }
 
@@ -681,7 +686,11 @@ export class EmailServicePlugin implements Plugin {
           // `from_email`.
           if (typeof settings.registerAction === 'function') {
             const svc = this.service;
-            settings.registerAction('mail', 'test', async ({ values, payload, ctx: actionCtx }: any) => {
+            settings.registerAction('mail', 'test', async ({ values, payload, ctx: actionCtx, locale }: any) => {
+              // The answer is the toast the administrator reads: written in
+              // the caller's display language (English when none is given).
+              const callerLocale = typeof locale === 'string' ? locale : undefined;
+              const copy = mailDeliveryCopy(callerLocale);
               const overrides = extractOverrides(payload);
               const merged: Record<string, unknown> = { ...(values ?? {}), ...overrides };
               const recipient = await resolveMailTestRecipient(payload, actionCtx?.userId, engine);
@@ -699,7 +708,8 @@ export class EmailServicePlugin implements Plugin {
               // (#5087 — this action used to report success for SMTP
               // while the live transport was still the LogTransport).
               let target: EmailService = svc;
-              let tempDescription = '';
+              /** The form's transport the test used, when not the live one — named in the answer. */
+              let testedVia: string | undefined;
               /** One-shot SMTP transport built for this test — closed below. */
               let tempSmtp: SmtpTransport | undefined;
               const provider = String(merged.provider ?? 'smtp');
@@ -724,7 +734,7 @@ export class EmailServicePlugin implements Plugin {
                     ...(svc.options.persistence ? { persistence: svc.options.persistence } : {}),
                     logger: ctx.logger,
                   });
-                  tempDescription = ` via smtp (${smtp.host}:${smtp.port ?? 587})`;
+                  testedVia = `smtp (${smtp.host}:${smtp.port ?? 587})`;
                 } catch (err: any) {
                   return { ok: false, severity: 'error', message: `Failed to build SMTP transport: ${err?.message ?? String(err)}` };
                 }
@@ -782,7 +792,7 @@ export class EmailServicePlugin implements Plugin {
                     ...(svc.options.persistence ? { persistence: svc.options.persistence } : {}),
                     logger: ctx.logger,
                   });
-                  tempDescription = ` via ${provider}`;
+                  testedVia = provider;
                 } catch (err: any) {
                   return { ok: false, severity: 'error', message: `Failed to build ${provider} transport: ${err?.message ?? String(err)}` };
                 }
@@ -808,7 +818,7 @@ export class EmailServicePlugin implements Plugin {
                   return {
                     ok: false,
                     severity: 'error',
-                    message: `Test send failed${tempDescription}: ${result.error ?? 'unknown transport error'}`,
+                    message: copy.testFailed(testedVia, result.error ?? 'unknown transport error'),
                   };
                 }
                 // A LogTransport "send" is not a delivery. Say so instead of
@@ -817,8 +827,7 @@ export class EmailServicePlugin implements Plugin {
                   return {
                     ok: false,
                     severity: 'warning',
-                    message: 'No delivery transport is active — the message was only logged and kept in the email log. '
-                      + 'Configure an SMTP host (or an API provider) and save before testing.',
+                    message: copy.testLoggedLive,
                   };
                 }
                 // The form's unsaved "None (log only)": the same severity and
@@ -828,15 +837,13 @@ export class EmailServicePlugin implements Plugin {
                   return {
                     ok: false,
                     severity: 'warning',
-                    message: 'Nothing was delivered — the provider on the form is "None (log only)", so the test message '
-                      + 'was only logged and kept in the email log; no mail left this machine. The live transport was '
-                      + `not used (${describeLiveMailTransport(svc).label}); save the form to stop delivery.`,
+                    message: copy.testLoggedForm(describeLiveMailTransport(svc, callerLocale).label),
                   };
                 }
                 return {
                   ok: true,
                   severity: 'info',
-                  message: `Sent test email to ${to}${tempDescription} (id=${result.id}).`,
+                  message: copy.testSent(to, testedVia, String(result.id)),
                 };
               } catch (err: any) {
                 return { ok: false, severity: 'error', message: err?.message ?? String(err) };