@@ -71,6 +71,17 @@ export interface PasswordSessionPolicyHost {
   resolveActor: AuthManager['resolveActor'];
 }
 
+/**
+ * The MFA grace period in force, in whole days (ADR-0069 D3): the configured
+ * `mfaGracePeriodDays` (the `auth.mfa_grace_period_days` setting), 7 when
+ * unset, never below 0. The one reading of it: the gate's clock below and the
+ * organization MFA guard's save notice (`AuthManager#getMfaGracePeriodDays`)
+ * both ask here, so the number a saver is told is the number the gate holds to.
+ */
+export function resolveMfaGracePeriodDays(config: { mfaGracePeriodDays?: number }): number {
+  return Math.max(0, Math.floor(Number(config.mfaGracePeriodDays ?? 7)));
+}
+
 /** The body of `AuthManager#assertPasswordComplexity`; the method's docblock there is its contract. */
 export async function assertPasswordComplexity(this: Pick<PasswordSessionPolicyHost, 'config'>, password: string): Promise<void> {
   if (!this.config.passwordRequireComplexity) return;
@@ -222,7 +233,7 @@ export async function resolveUserAuthGates(
     if (mfaRequired && unenrolled && !this.isTwoFactorEnabled()) {
       this.noteMfaRequirementWithoutEnrollment();
     } else if (mfaRequired && unenrolled) {
-      const graceDays = Math.max(0, Math.floor(Number(this.config.mfaGracePeriodDays ?? 7)));
+      const graceDays = resolveMfaGracePeriodDays(this.config);
       let requiredAt = u?.mfa_required_at;
       if (!requiredAt) {
         requiredAt = new Date();
 
@@ -124,6 +124,7 @@ import {
   recordPasswordHistory,
   refreshMustChangeCacheIfStale,
   refreshOrgMfaCacheIfStale,
+  resolveMfaGracePeriodDays,
   resolvePasswordChangeUserId,
   resolveUserAuthGates,
   stampPasswordChangedAt,
@@ -5313,6 +5314,20 @@ export class AuthManager {
     return resolveTwoFactorEnabled(this.config.plugins);
   }
 
+  /**
+   * @internal Package-internal: read by the organization MFA enrollment guard
+   * `AuthPlugin` registers; not a supported entry point.
+   *
+   * [#30411] The MFA grace period in force, in whole days — the
+   * `auth.mfa_grace_period_days` setting as the settings pass applied it,
+   * {@link resolveMfaGracePeriodDays} over the live config, the same answer
+   * the MFA gate's clock reads. Read per call, so a settings change is seen at
+   * once.
+   */
+  public getMfaGracePeriodDays(): number {
+    return resolveMfaGracePeriodDays(this.config);
+  }
+
   /**
    * [#30201] Called by the MFA gate when a user is under an MFA requirement
    * (the global `mfaRequired` or their organization's `require_mfa`) that it
 
@@ -1914,6 +1914,9 @@ export class AuthPlugin implements Plugin {
         registerOrganizationMfaEnrollmentGuard(engine, {
           packageId: 'com.objectstack.plugin-auth.organization-mfa-enrollment-guard',
           isTwoFactorEnabled: () => this.authManager?.isTwoFactorEnabled() ?? false,
+          // [#30411] The grace period an admitted turn-on's save notice names.
+          // No manager means two-factor reads off above, so nothing is admitted.
+          mfaGracePeriodDays: () => this.authManager?.getMfaGracePeriodDays() ?? Number.NaN,
         });
         // A reader's own named list views: the body is judged on every save as
         // a ListView for the row's own object. See personal-view-hooks.ts.
 
@@ -32,10 +32,14 @@ import { AuthManager } from './auth-manager';
 import { AuthPlugin } from './auth-plugin.js';
 import {
   ORGANIZATION_MFA_ENROLLMENT_GUARD_PRIORITY,
+  ORGANIZATION_MFA_REFUSAL_COPY,
+  ORGANIZATION_MFA_REQUIRED_NOTICE_COPY,
+  organizationMfaRequiredNotice,
   organizationMfaWithoutEnrollmentRefusal,
   registerOrganizationMfaEnrollmentGuard,
   turnsMfaRequirementOn,
 } from './organization-mfa-enrollment-guard.js';
+import { resolveMfaGracePeriodDays } from './auth-manager-password-session-policy.js';
 import { registerIdentityWriteGuard, registerManagedUpdateWhitelist } from './identity-write-guard.js';
 import { managedExtensionEditableFields } from './managed-extension-fields.js';
 // The SAME in-memory engine the sibling two-factor suites drive: a new fake
@@ -82,6 +86,7 @@ async function judge(
   registerOrganizationMfaEnrollmentGuard(engine, {
     packageId: 'test.organization-mfa-enrollment-guard',
     isTwoFactorEnabled: () => enrollable,
+    mfaGracePeriodDays: () => 7,
   });
   try {
     for (const r of engine.registrations.filter((x) => x.event === event)) {
@@ -99,7 +104,11 @@ async function judge(
 describe('organization MFA enrollment guard — the rule', () => {
   it('registers insert and update hooks on sys_organization alone, after the D2 identity write guard', () => {
     const engine = captureEngine();
-    registerOrganizationMfaEnrollmentGuard(engine, { packageId: 'p', isTwoFactorEnabled: () => false });
+    registerOrganizationMfaEnrollmentGuard(engine, {
+      packageId: 'p',
+      isTwoFactorEnabled: () => false,
+      mfaGracePeriodDays: () => 7,
+    });
     expect(engine.registrations.map((r) => r.event).sort()).toEqual(['beforeInsert', 'beforeUpdate']);
     for (const r of engine.registrations) {
       expect(r.options).toEqual({ object: 'sys_organization', priority: 15, packageId: 'p' });
@@ -218,6 +227,20 @@ describe('auth-plugin registers the guard on `kernel:ready` and asks the live ma
     // The settings pass turns the plugin on (as `auth.mfa_required` does): the next write is admitted.
     (plugin as any).authManager.applyConfigPatch({ plugins: { twoFactor: true } });
     await expect(turnOn()).resolves.toBeUndefined();
+
+    // [#30411] …and its save notice names the grace period the live manager
+    // holds, read per write: the settings pass changes it, the next write says so.
+    const told: string[] = [];
+    const turnOnTold = () => update.handler({
+      object: 'sys_organization', input: { id: 'org_1', data: { require_mfa: true } },
+      session: { userId: 'usr_admin', locale: 'en-US' }, notice: (m: string) => told.push(m),
+    });
+    await turnOnTold();
+    expect(told).toEqual([organizationMfaRequiredNotice(7, 'en')]);
+    (plugin as any).authManager.applyConfigPatch({ mfaGracePeriodDays: 14 });
+    await turnOnTold();
+    expect(told[1]).toBe(organizationMfaRequiredNotice(14, 'en'));
+    expect(told[1]).toMatch(/has 14 days to enroll/);
   });
 });
 
@@ -233,7 +256,10 @@ const SYSTEM = { context: { isSystem: true, positions: [] as string[], permissio
 const ADMIN = { context: { userId: 'usr_admin', positions: [] as string[], permissions: [] as string[] } };
 
 /** A real sqlite engine with the real organization object and the production hook composition. */
-async function bootOrganizationEngine(enrollable: { value: boolean }): Promise<ObjectQL> {
+async function bootOrganizationEngine(
+  enrollable: { value: boolean },
+  graceDays: { value: number } = { value: 7 },
+): Promise<ObjectQL> {
   const engine = new ObjectQL();
   engines.push(engine);
   engine.registerDriver(
@@ -248,6 +274,7 @@ async function bootOrganizationEngine(enrollable: { value: boolean }): Promise<O
   registerOrganizationMfaEnrollmentGuard(engine, {
     packageId: 'test.organization-mfa-enrollment-guard',
     isTwoFactorEnabled: () => enrollable.value,
+    mfaGracePeriodDays: () => graceDays.value,
   });
   await engine.insert('sys_organization', { id: 'org_a', name: 'Acme', slug: 'acme' }, SYSTEM);
   await engine.insert('sys_organization', { id: 'org_b', name: 'Bolt', slug: 'bolt' }, SYSTEM);
@@ -343,6 +370,194 @@ describe('organization MFA enrollment guard — on a real engine', () => {
   });
 });
 
+// ── #30411. What the saver is told, in the saver's language ─────────────────
+
+/** The first sentence of each copy: the language is the contract, so the sentence that carries it is pinned. */
+const REFUSAL_FIRST = {
+  en: 'This organization cannot require multi-factor authentication yet:',
+  'zh-CN': '本组织暂时无法强制多因素认证：',
+} as const;
+const NOTICE_FIRST = {
+  en: 'Multi-factor authentication is now required for this organization.',
+  'zh-CN': '本组织现已强制多因素认证。',
+} as const;
+
+/** Run the guard's hook for `event` with a session locale and a notice listener; the outcome and what it told. */
+async function judgeTold(opts: {
+  enrollable: boolean;
+  event: 'beforeInsert' | 'beforeUpdate';
+  data: Record<string, unknown>;
+  previous?: Record<string, unknown>;
+  locale?: string;
+  graceDays?: number;
+  noNoticeMember?: boolean;
+}): Promise<{ error: any; told: string[] }> {
+  const engine = captureEngine();
+  registerOrganizationMfaEnrollmentGuard(engine, {
+    packageId: 'test.organization-mfa-enrollment-guard',
+    isTwoFactorEnabled: () => opts.enrollable,
+    mfaGracePeriodDays: () => opts.graceDays ?? 7,
+  });
+  const told: string[] = [];
+  try {
+    for (const r of engine.registrations.filter((x) => x.event === opts.event)) {
+      await r.handler({
+        object: 'sys_organization', event: opts.event, input: { id: 'org_1', data: opts.data },
+        ...(opts.previous ? { previous: opts.previous } : {}),
+        ...(opts.locale ? { session: { userId: 'usr_admin', locale: opts.locale } } : {}),
+        ...(opts.noNoticeMember ? {} : { notice: (m: string) => told.push(m) }),
+      });
+    }
+    return { error: null, told };
+  } catch (e) {
+    return { error: e, told };
+  }
+}
+
+describe('#30411 the refusal is in the caller\'s language, with the same field-level shape', () => {
+  it('zh-CN: the refusal reads in Chinese and still names the env var and the setting key', () => {
+    const err: any = organizationMfaWithoutEnrollmentRefusal('zh-CN');
+    expectRequireMfaRefusal(err);
+    expect(err.message.startsWith(REFUSAL_FIRST['zh-CN'])).toBe(true);
+    expect(err.message).toMatch(/OS_AUTH_TWO_FACTOR=true/);
+    expect(err.message).toMatch(/auth\.mfa_required/);
+    expect(err.fields[0].message).toBe(err.message);
+  });
+
+  it('en: the refusal is the English sentence it was, top level and on the field', () => {
+    for (const locale of ['en', 'en-US', undefined]) {
+      const err: any = organizationMfaWithoutEnrollmentRefusal(locale);
+      expectRequireMfaRefusal(err);
+      expect(err.message.startsWith(REFUSAL_FIRST.en)).toBe(true);
+      expect(err.message).toBe(ORGANIZATION_MFA_REFUSAL_COPY.en);
+      expect(err.fields[0].message).toBe(err.message);
+    }
+  });
+
+  it.each([
+    ['zh', 'zh-CN'], ['zh-cn', 'zh-CN'], ['zh-Hans-CN', 'zh-CN'], ['ja', 'ja-JP'], ['es-MX', 'es-ES'],
+    ['fr-FR', 'en'], ['', 'en'],
+  ] as const)('the request locale %j reads the %s copy (exact, then by language, else English)', (asked, served) => {
+    expect((organizationMfaWithoutEnrollmentRefusal(asked) as any).message).toBe(ORGANIZATION_MFA_REFUSAL_COPY[served]);
+  });
+
+  it('every language names what an operator types, and carries no tracker number', () => {
+    for (const [locale, message] of Object.entries(ORGANIZATION_MFA_REFUSAL_COPY)) {
+      expect(message, locale).toMatch(/OS_AUTH_TWO_FACTOR=true/);
+      expect(message, locale).toMatch(/OS_AUTH_TWO_FACTOR .*false|false.*OS_AUTH_TWO_FACTOR/);
+      expect(message, locale).toMatch(/auth\.mfa_required/);
+      expect(message, locale).not.toMatch(/#\d/);
+      expectRequireMfaRefusal(organizationMfaWithoutEnrollmentRefusal(locale));
+    }
+  });
+
+  it('the hook answers in the session\'s locale, and in English for a write with no caller locale', async () => {
+    for (const event of ['beforeInsert', 'beforeUpdate'] as const) {
+      const zh = await judgeTold({ enrollable: false, event, data: { require_mfa: true }, locale: 'zh-CN' });
+      expectRequireMfaRefusal(zh.error);
+      expect(zh.error.message.startsWith(REFUSAL_FIRST['zh-CN'])).toBe(true);
+      expect(zh.told, 'a refused write tells no notice').toEqual([]);
+      const none = await judgeTold({ enrollable: false, event, data: { require_mfa: true } });
+      expectRequireMfaRefusal(none.error);
+      expect(none.error.message.startsWith(REFUSAL_FIRST.en)).toBe(true);
+    }
+  });
+});
+
+describe('#30411 an admitted turn-on answers the grace period in force as its save notice', () => {
+  it('turning it on (insert, or update of a row stored off) tells who must enroll and the grace period, once', async () => {
+    for (const [event, previous] of [
+      ['beforeInsert', undefined],
+      ['beforeUpdate', { require_mfa: false }],
+      ['beforeUpdate', undefined],
+    ] as const) {
+      const out = await judgeTold({ enrollable: true, event, data: { require_mfa: true }, previous, graceDays: 30 });
+      expect(out.error).toBeNull();
+      expect(out.told).toEqual([organizationMfaRequiredNotice(30, 'en')]);
+      expect(out.told[0].startsWith(NOTICE_FIRST.en)).toBe(true);
+      expect(out.told[0]).toMatch(/has 30 days to enroll/);
+    }
+  });
+
+  it('zh-CN: the notice reads in Chinese and names the configured days', async () => {
+    const out = await judgeTold({
+      enrollable: true, event: 'beforeUpdate', data: { require_mfa: true }, previous: { require_mfa: false },
+      locale: 'zh-CN', graceDays: 14,
+    });
+    expect(out.told).toHaveLength(1);
+    expect(out.told[0].startsWith(NOTICE_FIRST['zh-CN'])).toBe(true);
+    expect(out.told[0]).toMatch(/有 14 天时间完成绑定/);
+  });
+
+  it('a grace period of 0 and of 1 day get their own sentence in every language', () => {
+    for (const [locale, copy] of Object.entries(ORGANIZATION_MFA_REQUIRED_NOTICE_COPY)) {
+      expect(copy(0), locale).toMatch(/\b0\b/);
+      expect(copy(0), locale).not.toBe(copy(1));
+      expect(copy(1), locale).toMatch(/\b1\b/);
+      expect(copy(45), locale).toMatch(/\b45\b/);
+      expect(copy(45), locale).not.toMatch(/#\d/);
+    }
+    expect(ORGANIZATION_MFA_REQUIRED_NOTICE_COPY.en(1)).toMatch(/has 1 day to enroll/);
+    expect(ORGANIZATION_MFA_REQUIRED_NOTICE_COPY.en(0)).toMatch(/blocked from data the next time they use the app/);
+  });
+
+  it('says nothing for a write that turns nothing on', async () => {
+    for (const event of ['beforeInsert', 'beforeUpdate'] as const) {
+      for (const data of [{ require_mfa: false }, { timezone: 'Asia/Shanghai' }, { name: 'Acme' }]) {
+        const out = await judgeTold({ enrollable: true, event, data });
+        expect(out, `${event} ${JSON.stringify(data)}`).toEqual({ error: null, told: [] });
+      }
+    }
+    // A re-save of a stored `true` (a whole-row door, an import re-run).
+    const resave = await judgeTold({
+      enrollable: true, event: 'beforeUpdate', data: { require_mfa: true }, previous: { require_mfa: true },
+    });
+    expect(resave).toEqual({ error: null, told: [] });
+  });
+
+  it('a dispatch with no notice member is admitted all the same', async () => {
+    const out = await judgeTold({ enrollable: true, event: 'beforeInsert', data: { require_mfa: true }, noNoticeMember: true });
+    expect(out).toEqual({ error: null, told: [] });
+  });
+});
+
+describe('#30411 on a real engine: the caller\'s locale reaches the refusal, the notice reaches the write\'s answer', () => {
+  const zhAdmin = { context: { ...ADMIN.context, locale: 'zh-CN' } };
+
+  it('refuses the zh-CN administrator\'s save in Chinese, envelope unchanged, and the row keeps its value', async () => {
+    const engine = await bootOrganizationEngine({ value: false });
+    const err = await caught(engine.update('sys_organization', { id: 'org_a', require_mfa: true }, zhAdmin));
+    expectRequireMfaRefusal(err);
+    expect(err.message.startsWith(REFUSAL_FIRST['zh-CN'])).toBe(true);
+    expect(await storedRequireMfa(engine, 'org_a')).toBe(false);
+    // Control: the same write with no caller locale reads English.
+    const en = await caught(engine.update('sys_organization', { id: 'org_a', require_mfa: true }, ADMIN));
+    expect(en.message.startsWith(REFUSAL_FIRST.en)).toBe(true);
+  });
+
+  it('the admitted save hands its listener the notice, with the grace period read per write', async () => {
+    const grace = { value: 21 };
+    const engine = await bootOrganizationEngine({ value: true }, grace);
+    const told: string[] = [];
+    await engine.update('sys_organization', { id: 'org_a', require_mfa: true }, {
+      ...zhAdmin, onNotice: (m: string) => told.push(m),
+    } as any);
+    expect(await storedRequireMfa(engine, 'org_a')).toBe(true);
+    expect(told).toEqual([organizationMfaRequiredNotice(21, 'zh-CN')]);
+    // The setting changes; the next write that turns it on names the new number.
+    grace.value = 3;
+    await engine.insert('sys_organization', { id: 'org_c', name: 'Cove', slug: 'cove', require_mfa: true }, {
+      ...ADMIN, onNotice: (m: string) => told.push(m),
+    } as any);
+    expect(told[1]).toBe(organizationMfaRequiredNotice(3, 'en'));
+    // A re-save of the stored `true` answers no notice.
+    await engine.update('sys_organization', { id: 'org_a', require_mfa: true, timezone: 'UTC' }, {
+      ...ADMIN, onNotice: (m: string) => told.push(m),
+    } as any);
+    expect(told).toHaveLength(2);
+  });
+});
+
 // ── 3. End to end ───────────────────────────────────────────────────────────
 
 const SECRET = 'test-secret-at-least-32-chars-long!!';
@@ -366,15 +581,16 @@ const post = (manager: AuthManager, path: string, body: unknown, headers: Record
 /**
  * A member of an organization that requires MFA, unenrolled, whose grace clock
  * started 30 days ago, in a session whose active organization is that one —
- * the card's measured state, on a deployment with two-factor on or off.
+ * the card's measured state, on a deployment with two-factor on or off, and a
+ * grace period of `graceDays` (7 unless a case says otherwise).
  */
-async function arrangeHeldMember(twoFactor: boolean) {
+async function arrangeHeldMember(twoFactor: boolean, graceDays: number | undefined = 7) {
   const engine: any = createMemoryEngine();
   const manager = new AuthManager({
     secret: SECRET,
     baseUrl: 'http://localhost:3000',
     dataEngine: engine,
-    mfaGracePeriodDays: 7,
+    ...(graceDays === undefined ? {} : { mfaGracePeriodDays: graceDays }),
     ...(twoFactor ? { plugins: { twoFactor: true } } : {}),
   } as any);
   const signedUp = await post(manager, '/sign-up/email', { email: EMAIL, password: PASSWORD, name: 'Member' });
@@ -427,3 +643,20 @@ describe('end to end — a member is never held for MFA while the enrollment end
     expect(((await enable.clone().json()) as { totpURI?: string }).totpURI).toMatch(/^otpauth:\/\/totp\//);
   });
 });
+
+describe('#30411 the grace period the notice names is the one the gate holds to', () => {
+  it.each([
+    [undefined, 7], [0, 0], [14, 14], [2.9, 2], [-3, 0], [120, 120],
+  ] as const)('resolveMfaGracePeriodDays(%j) = %j, the reading the gate\'s clock always took', (configured, days) => {
+    expect(resolveMfaGracePeriodDays({ mfaGracePeriodDays: configured as number | undefined })).toBe(days);
+  });
+
+  it.each([
+    [40, false], [20, true], [undefined, true],
+  ] as const)('grace %j days, clock started 30 days ago: held = %j, and the manager answers the same number', async (graceDays, held) => {
+    const { manager, userId } = await arrangeHeldMember(true, graceDays);
+    expect(manager.getMfaGracePeriodDays()).toBe(graceDays ?? 7);
+    const gates = await manager.resolveUserAuthGates(userId, { organizationId: ORG });
+    expect(gates.some((g) => g.code === 'MFA_REQUIRED')).toBe(held);
+  });
+});