@@ -0,0 +1,21 @@
+---
+'@objectstack/service-settings': patch
+'@objectstack/plugin-webhooks': patch
+'@objectstack/plugin-email': patch
+---
+
+fix(service-settings): Setup → Settings help says what a setting does in business words, and Country is a picker that shows names and stores the code
+
+Clause-②: no
+Metadata-protocol: none
+
+An administrator in Setup → Settings read help written like code comments. It now names the effect, and the technical detail stays in the deployment docs.
+
+- **Authentication.** The help names the Self-registration audience by the labels the page shows (Invitation only, Allowlisted email domains, Open), not by their stored keys. It no longer quotes env var names (the email-verification override, the Google client ID and secret), the stack-config paths, the API-key error codes or permission-set API names; it says "set in the server configuration" instead.
+- **Feature Flags.** The beta banner says a feature set in the server configuration is locked for the whole deployment, without quoting an env var.
+- **Mail.** The durable-queue help no longer names the queue's object, and the Send-test-email result for a log-only provider says the message was "kept in the email log" (`@objectstack/plugin-email`).
+- **Webhooks.** The `sys_webhook` description, shown as the Webhooks subtitle, says what a webhook is without `defineStack` / `defineWebhook()` or the auto-enqueuer (`@objectstack/plugin-webhooks`).
+- **The inherited-value badge** names the layer "Organization" (组织 / 組織 / Organización) instead of "Tenant".
+- **Country pickers.** Company → Country and Localization → Default country are `select`s whose options are every ISO 3166-1 alpha-2 code with its name, in each shipped locale (`Germany (DE)`, `德国 (DE)`). The stored value is still the code, a stored code is one of the options, and the `iso_3166_alpha2` value domain stays the enforcement boundary, so the set of accepted values is unchanged. The names come from `Intl.DisplayNames`; the codes come from the shared `ISO_3166_ALPHA2_CODES`.
+
+Every shipped pack (en, zh-CN, ja-JP, es-ES) carries the same wording.
@@ -807,7 +807,7 @@ export class EmailServicePlugin implements Plugin {
                   return {
                     ok: false,
                     severity: 'warning',
-                    message: 'No delivery transport is active — the message was only logged and recorded in sys_email. '
+                    message: 'No delivery transport is active — the message was only logged and kept in the email log. '
                       + 'Configure an SMTP host (or an API provider) and save before testing.',
                   };
                 }
@@ -819,7 +819,7 @@ export class EmailServicePlugin implements Plugin {
                     ok: false,
                     severity: 'warning',
                     message: 'Nothing was delivered — the provider on the form is "None (log only)", so the test message '
-                      + 'was only logged and recorded in sys_email; no mail left this machine. The live transport was '
+                      + 'was only logged and kept in the email log; no mail left this machine. The live transport was '
                       + `not used (${describeLiveMailTransport(svc).label}); save the form to stop delivery.`,
                   };
                 }
 
@@ -0,0 +1,55 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The Webhooks subtitle in Setup is the `sys_webhook` object description, and
+ * an administrator reads it (#27853). It used to explain the object in code —
+ * `defineStack({ webhooks })` / `defineWebhook()`, the "webhook auto-enqueuer",
+ * the "HTTP outbox". The source description and every shipped locale's copy
+ * now say it in business words; the code-level account lives in the comment
+ * beside the description in `sys-webhook.object.ts`.
+ *
+ * Pins SHAPES, never wording.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { SysWebhook } from './sys-webhook.object.js';
+import { enObjects } from './translations/en.objects.generated.js';
+import { zhCNObjects } from './translations/zh-CN.objects.generated.js';
+import { jaJPObjects } from './translations/ja-JP.objects.generated.js';
+import { esESObjects } from './translations/es-ES.objects.generated.js';
+
+const DEVELOPER_SHAPES: Array<[string, RegExp]> = [
+  ['code call', /\b[A-Za-z_$][\w$]*\(\s*[\w{}\s,]*\)/],
+  ['camelCase code identifier', /\b[a-z][a-z0-9]*[A-Z][A-Za-z0-9]*\b/],
+  ['object API name', /\b[a-z][a-z0-9]*_[a-z0-9_]*[a-z0-9]\b/],
+  ['internal component', /auto-enqueuer|outbox/i],
+];
+
+const shapesIn = (text: string) =>
+  DEVELOPER_SHAPES.filter(([, re]) => re.test(text)).map(([name]) => name);
+
+describe('sys_webhook description reads as business words (#27853)', () => {
+  it('the sweep has teeth on the old subtitle', () => {
+    expect(
+      shapesIn('declared in code via defineStack({ webhooks }) / defineWebhook() by the webhook auto-enqueuer'),
+    ).toEqual(['code call', 'camelCase code identifier', 'internal component']);
+  });
+
+  it('the source description carries no code', () => {
+    expect(typeof SysWebhook.description).toBe('string');
+    expect(shapesIn(SysWebhook.description as string)).toEqual([]);
+  });
+
+  for (const [locale, objects] of [
+    ['en', enObjects],
+    ['zh-CN', zhCNObjects],
+    ['ja-JP', jaJPObjects],
+    ['es-ES', esESObjects],
+  ] as const) {
+    it(`the ${locale} bundle's description carries no code`, () => {
+      const description = (objects as any).sys_webhook?.description;
+      expect(typeof description).toBe('string');
+      expect(shapesIn(description)).toEqual([]);
+    });
+  }
+});
@@ -55,8 +55,11 @@ export const SysWebhook = ObjectSchema.create({
   userActions: { create: true, edit: true, delete: true, import: false },
   // [ADR-0131 D2] A row is an organization's own subscription; a declared
   // webhook is read from the metadata registry (`declared-webhooks.ts`) and
-  // writes no row. The description says so to every Setup/Studio reader.
-  description: 'Outbound HTTP webhook subscription authored by an organization in the Studio editor or through the API. A webhook declared in code via defineStack({ webhooks }) / defineWebhook() is read from the metadata registry and writes no row here. Both are dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.',
+  // writes no row. The description says so to every Setup/Studio reader, in
+  // an administrator's words: a webhook declared in code (`defineStack({
+  // webhooks })` / `defineWebhook()`) is the one "built into an app", and the
+  // "delivery queue" is the auto-enqueuer's shared HTTP outbox.
+  description: 'An outbound HTTP webhook your organization creates here or through the API. Webhooks that come built into an app are not listed here. Both kinds are sent through the same delivery queue.',
   displayNameField: 'name',
   nameField: 'name', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: '{label}',
 
@@ -18,7 +18,7 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "Webhook",
     pluralLabel: "Webhooks",
-    description: "Outbound HTTP webhook subscription authored by an organization in the Studio editor or through the API. A webhook declared in code via defineStack({ webhooks }) / defineWebhook() is read from the metadata registry and writes no row here. Both are dispatched by the webhook auto-enqueuer onto the shared HTTP outbox.",
+    description: "An outbound HTTP webhook your organization creates here or through the API. Webhooks that come built into an app are not listed here. Both kinds are sent through the same delivery queue.",
     fields: {
       id: {
         label: "Webhook ID"
 
@@ -18,7 +18,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "Webhook",
     pluralLabel: "Webhooks",
-    description: "Suscripción saliente de Webhook HTTP creada por una organización con el editor de Studio o mediante la API. Un webhook declarado en código mediante defineStack({ webhooks }) / defineWebhook() se lee del registro de metadatos y no escribe ninguna fila aquí. Ambos los despacha el encolador automático de webhooks al outbox HTTP compartido.",
+    description: "Webhook HTTP saliente que su organización crea aquí o mediante la API. Los webhooks incluidos en una aplicación no aparecen aquí. Ambos tipos se envían por la misma cola de entrega.",
     fields: {
       id: {
         label: "ID de webhook"
 
@@ -18,7 +18,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "ウェブフック",
     pluralLabel: "ウェブフック",
-    description: "送信 HTTP Webhook サブスクリプション。組織がスタジオエディタまたは API で作成します。コードで defineStack({ webhooks }) / defineWebhook() により宣言した Webhook はメタデータレジストリから読み取られ、ここに行を書き込みません。どちらも Webhook 自動エンキューアが共有 HTTP アウトボックスへディスパッチします。",
+    description: "組織がここまたは API で作成する送信 HTTP Webhook。アプリに組み込まれた Webhook はここには表示されません。どちらも同じ配信キューを通じて送信されます。",
     fields: {
       id: {
         label: "Webhook ID"
 
@@ -18,7 +18,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "Webhook",
     pluralLabel: "Webhook",
-    description: "外发 HTTP Webhook 订阅，由组织在 Studio 编辑器中或通过 API 编写。在代码中通过 defineStack({ webhooks }) / defineWebhook() 声明的 Webhook 从元数据注册表读取，不会在此写入数据行。两者均由 Webhook 自动入队器分发到共享的 HTTP 发件箱。",
+    description: "由您的组织在此处或通过 API 创建的外发 HTTP Webhook。应用内置的 Webhook 不在此列出。两者都通过同一个投递队列发送。",
     fields: {
       id: {
         label: "Webhook ID"
 
@@ -244,28 +244,35 @@ describe('authSettingsManifest', () => {
     expect(signup.visible).toBe('${data.email_password_enabled !== false}');
 
     // The help names every posture the select declares, read from the option
-    // table, so a posture added later reds here until the help covers it.
+    // table, so a posture added later reds here until the help covers it. It
+    // names each one the way the page shows it, by the option's label, never
+    // by the stored key (#27853).
     expect(typeof signup.description).toBe('string');
-    for (const value of posture.options.map((o: any) => o.value)) {
-      expect(signup.description, `signup_enabled help names posture ${value}`).toContain(value);
+    for (const option of posture.options as Array<{ value: string; label: string }>) {
+      const shown = option.label.split(' — ')[0].replace(/ only$/, '');
+      expect(signup.description, `signup_enabled help names posture ${option.value}`).toContain(shown);
+      expect(signup.description, `signup_enabled help spells no key ${option.value}`).not.toMatch(
+        new RegExp(`\\b${option.value}\\b`),
+      );
     }
     expect(signup.description).toContain(posture.label);
   });
 
   // plugin-auth registers Google only when the toggle is on AND a client ID and
   // secret both resolve, from the stored keys or from GOOGLE_CLIENT_ID /
   // GOOGLE_CLIENT_SECRET, which the settings service cannot see. The page can
-  // only say so; the help is where it does.
-  it('google_enabled keeps the runtime default and names the env credentials that complete it', () => {
+  // only say so; the help is where it does — in an administrator's words, the
+  // server configuration, not the env var names (#27853).
+  it('google_enabled keeps the runtime default and says the server configuration completes it', () => {
     const specs = authSettingsManifest.specifiers as any[];
     const google = specs.find((s) => s.key === 'google_enabled');
 
     // `true` is what the runtime assumes for an undeclared toggle; a `false`
     // default would read OFF on a deployment that signs in with Google through
     // the env credentials, and hide its stored credentials behind `visible`.
     expect(google.default).toBe(true);
-    expect(google.description).toContain('GOOGLE_CLIENT_ID');
-    expect(google.description).toContain('GOOGLE_CLIENT_SECRET');
+    expect(google.description).toContain('server configuration');
+    expect(google.description).not.toContain('GOOGLE_CLIENT_');
   });
 
   // The console resolves `settings.auth.keys.<key>.label` / `.help` from the
 
@@ -45,7 +45,7 @@ const manifest = {
       required: false,
       default: true,
       description:
-        'Opens the email-and-password sign-up form. Who it admits is decided by the Self-registration audience below: under invite_only, only an address holding a pending invitation; under email_domain, the allowlisted domains and invited addresses; under open, anyone. Off closes the form under every audience, invitations included.',
+        'Opens the email-and-password sign-up form. Who it admits is decided by the Self-registration audience below: under Invitation only, only an address holding a pending invitation; under Allowlisted email domains, the allowlisted domains and invited addresses; under Open, anyone. Off closes the form under every audience, invitations included.',
       visible: "${data.email_password_enabled !== false}",
     },
     {
@@ -113,7 +113,7 @@ const manifest = {
         { value: 'open', label: 'Open — anyone may self-register' },
       ],
       description:
-        'invite_only closes self-registration: users come into existence only through an operator-side act (invitation, admin create/import, SCIM, enterprise SSO). email_domain opens it to the allowlisted domains below. open admits anyone. Both email_domain and open require the self-registration permission set below. email_domain always forces email verification on. open forces it on unless the deployment turns it off (OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false, or emailAndPassword.requireEmailVerification: false in the stack config); a false saved in this console is refused under open.',
+        'Invitation only closes self-registration: people become users only when an administrator invites, creates or imports them, or through directory provisioning (SCIM) or enterprise single sign-on. Allowlisted email domains opens it to the domains listed below. Open admits anyone. Both Allowlisted email domains and Open need the self-registration permission set below. Allowlisted email domains always requires email verification. Open requires it unless the server configuration turns it off; turning it off in this console is refused under Open.',
     },
     {
       type: 'textarea',
@@ -130,7 +130,7 @@ const manifest = {
       label: 'Self-registration permission set',
       required: false,
       description:
-        'Name of the permission set granted to each self-registrant (declaring member_default explicitly is fine; admin_full_access is refused). Required whenever the posture permits self-registration.',
+        'Name of the permission set each self-registered user receives. The standard member set is fine; the full administrator set is refused. Required whenever the audience allows self-registration.',
       visible: "${data.audience_posture === 'email_domain' || data.audience_posture === 'open'}",
     },
 
@@ -369,7 +369,7 @@ const manifest = {
       label: 'Allowed IP ranges',
       required: false,
       description:
-        'CIDR ranges or exact IPs (one per line, or comma-separated), e.g. 203.0.113.0/24. When set, sign-in from outside these ranges is rejected, and so is any request whose client address the server cannot establish. Empty = no restriction. The address judged is the connection\'s peer; behind a reverse proxy, declare server.trustProxy in the stack so the forwarded client address is judged instead.',
+        'CIDR ranges or exact IPs (one per line, or comma-separated), e.g. 203.0.113.0/24. When set, sign-in from outside these ranges is rejected, and so is any request whose client address the server cannot establish. Empty = no restriction. The address judged is the one the connection comes from; behind a reverse proxy, the server must be configured to trust that proxy so the original client address is judged instead.',
     },
     // [#23367, ruling A] The API-key lifecycle policy. Two readers, one
     // source: `bindAuthSettings` binds these into the auth service
@@ -405,7 +405,7 @@ const manifest = {
       min: 1,
       max: 3650,
       description:
-        'The furthest expiry date a new key may ask for, counted from its creation. A longer one is refused (API_KEY_EXPIRY_TOO_LONG); exactly this many days is accepted.',
+        'The furthest expiry date a new key may ask for, counted from its creation. A longer one is refused; exactly this many days is accepted.',
     },
     {
       type: 'number',
@@ -416,7 +416,7 @@ const manifest = {
       min: 0,
       max: 3650,
       description:
-        'A key with no recorded use for this many days is refused (API_KEY_INACTIVE). It is not revoked; create a new key. A key never used counts from its creation, or from the policy start below when it is older. 0 turns inactivity expiry off.',
+        'A key with no recorded use for this many days is refused. It is not revoked; create a new key. A key never used counts from its creation, or from the policy start below when it is older. 0 turns inactivity expiry off.',
     },
     {
       type: 'text',
@@ -434,7 +434,7 @@ const manifest = {
       label: 'Social sign-in',
       required: false,
       description:
-        'Configure the built-in Google sign-in provider. Deployment env vars still win.',
+        'Configure the built-in Google sign-in provider. Credentials set in the server configuration still win.',
     },
     // Google is offered only when this is on AND a client ID and secret both
     // resolve (saved here, or GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET, which
@@ -458,15 +458,15 @@ const manifest = {
       required: false,
       default: true,
       description:
-        'Offers Google sign-in once a client ID and a client secret both resolve: saved below, or GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the server, which win over saved values. Until both resolve, the login page shows no Google button, even while this is on. Off withdraws Google sign-in even when the server sets both. Create the OAuth client in Google Cloud Console.',
+        'Offers Google sign-in once a client ID and a client secret are both available: saved below, or set in the server configuration, which wins over saved values. Until both are available, the login page shows no Google button, even while this is on. Off withdraws Google sign-in even when the server sets both. Create the OAuth client in Google Cloud Console.',
     },
     {
       type: 'text',
       key: 'google_client_id',
       label: 'Google client ID',
       required: false,
       description:
-        'OAuth client ID from Google Cloud Console. GOOGLE_CLIENT_ID can also be set on the server.',
+        'OAuth client ID from Google Cloud Console. It can also be set in the server configuration.',
       visible: "${data.google_enabled !== false}",
     },
     {
@@ -476,7 +476,7 @@ const manifest = {
       required: false,
       encrypted: true,
       description:
-        'Stored encrypted at rest. GOOGLE_CLIENT_SECRET can also be set on the server.',
+        'Stored encrypted at rest. It can also be set in the server configuration.',
       visible: "${data.google_enabled !== false}",
     },