@@ -179,7 +179,7 @@
       "title": "Every translatable surface localizes on a zh-CN session — one pass over the full translation-group vocabulary, plus the runtime i18n routes it resolves through",
       "since": "v15",
       "status": "active",
-      "revision": 11,
+      "revision": 12,
       "priority": "P1",
       "surface": "browser",
       "personas": ["admin on a zh-CN session"],
@@ -214,7 +214,7 @@
         "GET /api/v1/i18n/translations/zh-CN — record whether it is non-empty and whether every key path sits under a declared translation group",
         "GET /api/v1/i18n/labels/showcase_task/zh-CN — record its { object, locale, labels } and hold it next to the zh-CN list-header the browser rendered for showcase_task",
         "unknown-locale probe: GET /api/v1/i18n/translations/zz-ZZ and GET /api/v1/i18n/labels/showcase_task/zz-ZZ — capture WHICH degradation the running server does (the FileI18nAdapter returns an empty {} map for an unloaded locale; getTranslations does NOT synthesize the default bundle — record the observed shape, do not assume a fallback)",
-        "feed/audit verb variant (E11): set the TENANT locale to zh-CN first (PUT /api/settings/localization {values:{locale:'zh-CN'}}), THEN trigger an activity-feed / audit entry (an assignment or a record edit) and screenshot its rendered verb/template — the verb is localized and frozen at write time, so an entry created before the flip stays in its original locale no matter which session reads it",
+        "feed verb variant (E11): with the tenant locale left at its default, trigger an activity-feed entry (an assignment or a record edit), then read the record's feed as a zh-CN reader (the user's language set to zh-CN, which the console sends as Accept-Language) and screenshot its rendered verb/template. Since #26167 a sys_activity row stores its summary as a code beside the English sentence, and a read with a locale re-composes it in the READER's language, so an entry written before any switch renders zh-CN too (packages/plugins/plugin-audit/src/activity-summary-message.ts)",
         "record a per-variant verdict table with the screenshot evidence"
       ],
       "acceptance": [
@@ -261,7 +261,7 @@
           "evidence": "the /i18n/locales response"
         },
         {
-          "clause": "GET /i18n/translations/:locale returns a non-empty bundle whose key paths all sit within the declared translation-group vocabulary (PlatformTranslationDataSchema — the SERVED document is the merged tree, so it is the twelve-group platform face — the eleven per-app groups plus the platform-only `settings` — and not the eleven-group per-app one) — a key outside the declared groups, or a raw dotted key handed to a consumer, is the silent-strip class",
+          "clause": "GET /i18n/translations/:locale returns a non-empty bundle whose key paths all sit within the declared translation-group vocabulary (ServedTranslationDataSchema — the SERVED document is the merged tree's platform face, PlatformTranslationDataSchema's sixteen groups (the fifteen per-app groups plus the platform-only `settings`), less metadataForms, the one server-resolved group (SERVER_RESOLVED_TRANSLATION_GROUPS), so fifteen groups) — a key outside the declared groups, or a raw dotted key handed to a consumer, is the silent-strip class",
           "oracle": "api",
           "verify": "translations for zh-CN is non-empty; spot-check that sampled keys resolve under objects/_views/_actions/_sections/apps.navigation/dashboards/pages/settings groups, not a fourth dialect",
           "evidence": "the /translations/zh-CN response + the key check"
@@ -279,9 +279,9 @@
           "evidence": "the two unknown-locale responses"
         },
         {
-          "clause": "the activity-feed / audit verb template localizes on the WRITE locale (E11) — the stored verb renders its zh-CN copy, not an English verb and not a raw key. ⚠️ It does NOT key on the reader's session: plugin-audit/src/audit-writers.ts renders the summary ONCE at write time via resolveWriteLocale(tenantId, userId) and STORES the string, with an EN literal as the fallback. Switching only the browser session locale therefore changes nothing, and reading that as a broken resolver is a false FAIL",
+          "clause": "the activity-feed verb template localizes in the READER's locale (E11, since #26167) — a zh-CN reader sees the zh-CN copy, not an English verb and not a raw key, whatever locale the row was written under. plugin-audit stores each sys_activity summary as a code (ACTIVITY_SUMMARY_MESSAGE_KEY in the row's metadata) beside the English sentence, and the read middleware (installActivitySummaryLocale) re-composes it in the request's locale: Accept-Language, else the localization settings",
           "oracle": "screenshot",
-          "verify": "flip the TENANT locale (PUT /api/settings/localization {values:{locale:'zh-CN'}}), then perform the write; the newly stored entry's verb renders zh-CN. An entry written BEFORE the flip keeps its original string by design — re-reading it in a zh-CN session proves nothing. A raw key or an English verb on a post-flip write is the E11 gap (record which group backs it — the messages/globalActions area is the likely home)",
+          "verify": "write the entry with the tenant locale at its default, then read the feed as a zh-CN reader: the verb renders zh-CN; read the same row as an en reader: it renders English. A raw key, or an English verb for the zh-CN reader, is the E11 gap (record which group backs it). A row written before #26167 carries no code and keeps its stored sentence, so score only rows written on the run's boot",
           "evidence": "the feed/audit screenshot"
         }
       ],
@@ -313,7 +313,7 @@
         "ref": "objectui code under ui/, for acceptance[5]'s dialog COPY only: ui/packages/components/src/__tests__/page-header-action-i18n.test.tsx ('renders the translated button AND opens the confirm dialog with the translated body', 'passes the translated successMessage to the toast') + ui/packages/plugin-detail/src/renderers/__tests__/record-quick-actions.actionText-i18n.test.tsx ('resolves the button AND the confirm dialog body from the same bundle entry', 'resolves successMessage from the same entry'). Each runs the real ActionRunner under a real I18nProvider holding a zh-CN `_actions.NAME` entry, but the action handler, the confirm handler and the toast handler are vi.fn stubs: no request leaves the test, so acceptance[5]'s network clause (the toast attached to a real 2xx round-trip) stays the run's. Run them from this checkout (`pnpm --filter @object-ui/components exec vitest run --maxWorkers=2 FILE`, and the same under @object-ui/plugin-detail) and cite the output naming the commit (QA run #23951 ran them in objectui at daeb77fc84dd, 2 files, 7/7). acceptance[6], [7] and [9] have no pin: packages/qa/dogfood/test/showcase-anonymous-deny-surfaces.dogfood.test.ts reaches the i18n routes over HTTP (I18N_FACES, the signed-in member's 200 control), but asserts only that en and zh-CN are among the locales and one translated label, never the exact locale set, the group vocabulary or the zz-ZZ empty-map shape. Every other clause still needs the run"
       },
       "source": [
-        "packages/spec/src/system/translation.zod.ts#appTranslationDataShape (appTranslationDataShape — the eleven-group vocabulary an APPLICATION may author: objects (with _views/_actions/_sections), picklists, apps (navigation), messages, globalActions, dashboards, datasets, pages, flows, metadataForms, settingsCommon. `settings` is platform-only since #15178 and lives in platformSettingsShape, spread into PlatformTranslationDataSchema only — TranslationItemSchema refuses it too since #19620)",
+        "packages/spec/src/system/translation.zod.ts#appTranslationDataShape (appTranslationDataShape — the fifteen-group vocabulary an APPLICATION may author: objects (with _views/_actions/_sections), picklists, apps (navigation), messages, globalActions, dashboards, datasets, reports, pages, flows, positions, permissions, books, metadataForms, settingsCommon. `settings` is platform-only since #15178 and lives in platformSettingsShape, spread into PlatformTranslationDataSchema only — TranslationItemSchema refuses it too since #19620)",
         "examples/app-showcase/src/system/translations/index.ts (full-column coverage rationale)",
         "packages/services/service-i18n/src/i18n-service-plugin.ts#i18n (GET /i18n/locales | /translations/:locale | /labels/:object/:locale; { success, data } envelope #3636/#3675; resolveObjectFieldLabels nested shape #3778/#3833; the plugin mount and the dispatcher /i18n domain serve the same routes interchangeably)",
         "packages/services/service-i18n/src/file-i18n-adapter.ts#getLocales (getLocales / getTranslations — unloaded locale → {}; fallbackLocale applies per-KEY in t(), not to the bulk route)",
@@ -336,15 +336,21 @@
         { "revision": 8, "date": "2026-10-16", "change": "variants[5], acceptance[7].clause, steps[8] and [9], source[0] and automated.ref corrected (checklist-accuracy note 4 and the fixture gaps of QA run #23951, wave #23878). variants[5] still marked the view-empty-state variant blocked(fixture), contradicting knownGaps[1] and steps[6] — it ran and passed. acceptance[7] counted the served tree as an eleven-group platform face over a ten-group per-app one; the spec declares eleven per-app groups (appTranslationDataShape, picklists included — source[0]'s list had dropped it) and twelve platform groups (plus settings). The dashboard and page steps now name a translated specimen each, because no showcase page carries a translated title (the run scored pages on platform page connect_agent). automated.ref's revision note moves to the current pin. Wording and specimen names only: no request or oracle changed", "ref": "#24036" },
         { "revision": 9, "date": "2026-10-19", "change": "acceptance[2].verify says how to find an untranslated key — checklist-accuracy finding of the 18.0 QA sweep (QA run #24553, i18n.surface-matrix; wave anchor #24579 §3): the coverage baseline debt is a count, not a key list. Re-derived at base 9a7838edf5 (scripts/i18n-coverage-baseline.json maps each config path to a number). No clause changed", "ref": "#24649" },
         { "revision": 10, "date": "2026-10-26", "change": "automated.ref corrected (checklist-accuracy findings a5 and a6/a7/a9 of QA run #25815, release-18.2.0-tier1 at 6679644a; wave anchor #25807), with the retired objectui-pin wording replaced (#26035 left this file to its card). a5: the two objectui pins cover the confirm copy and the successMessage handed to the toast, under stubbed action, confirm and toast handlers with no server round-trip, so the network-oracle clause stays the run's. a6/a7/a9: the i18n routes have HTTP coverage only as the anonymous-deny suite's member 200 control, which asserts none of the locale set, the group vocabulary or the zz-ZZ shape these clauses name. The pins now resolve under ui/ in this checkout, not in an objectui checkout at a .objectui-sha revision. No clause is loosened", "ref": "#25842" },
-        { "revision": 11, "date": "2026-10-27", "change": "fixtures.knownGaps[3]: the CONFIRM half is scored from the unit pins under ui/ that automated names, not 'the objectui pins' (#26626, maintainer-directed). No clause changed, no status changed", "ref": "#26626" }
+        { "revision": 11, "date": "2026-10-27", "change": "fixtures.knownGaps[3]: the CONFIRM half is scored from the unit pins under ui/ that automated names, not 'the objectui pins' (#26626, maintainer-directed). No clause changed, no status changed", "ref": "#26626" },
+        {
+          "revision": 12,
+          "date": "2026-10-28",
+          "change": "acceptance[7], acceptance[10], steps[17] and the appTranslationDataShape source line corrected. Checklist-accuracy findings of the 18.2.0 wave 2 (QA run #26450, Tier 1 half B, at 756220c4; wave anchor #25807, slice B). (1) acceptance[7] called the served document the twelve-group face; the served document is ServedTranslationDataSchema, the platform face's sixteen groups less the server-resolved metadataForms, so fifteen, and the per-app vocabulary is fifteen groups (reports, positions, permissions and books were missing from the source line). (2) acceptance[10] and steps[17] pinned the pre-#26167 write-locale premise; since #26167 an activity summary is stored as a code and re-composed in the reader's locale, so the clause now scores the reader's language and drops the tenant-locale flip. Re-read at base fd246c22: packages/spec/src/system/translation.zod.ts (appTranslationDataShape, 15 keys; PlatformTranslationDataSchema; SERVER_RESOLVED_TRANSLATION_GROUPS; ServedTranslationDataSchema), packages/plugins/plugin-audit/src/activity-summary-message.ts and activity-summary-reader-locale.integration.test.ts. acceptance[10]'s clause changed meaning with the product, so a verdict for revision 11 or older does not carry to it. The run's n1 FAIL was a product defect, extracted as #26452 (closed); no edit here",
+          "ref": "#25807"
+        }
       ]
     },
     {
       "id": "i18n.strict-translation-key-rejection",
       "title": "Unknown, legacy-dialect, and retired translation keys are rejected loudly at BOTH authoring doors — never silently stripped",
       "since": "v17",
       "status": "active",
-      "revision": 3,
+      "revision": 4,
       "priority": "P1",
       "surface": "mixed",
       "personas": ["admin"],
@@ -358,7 +364,7 @@
         "item door — via the metadata API, attempt to save a zh-CN `translation` item carrying each variant in turn (one save per variant), always alongside one VALID key (e.g. objects.showcase_task.label) so the rejection provably targets the bad key, not the document. Name the item in snake_case (e.g. qa_strict_zh_cn) and set `locale: zh-CN`: the conventional name `zh-CN` is refused first by the item-name rule (400 INVALID_REQUEST, 'is not a legal metadata item name'), before any key is judged, so a run that keeps it never reaches the gate this item tests. The `name` describe in translation.zod.ts still calls the locale code the convention; do not follow it at this door",
         "capture the exact error text for each attempted save",
         "after each rejection, read the item back and record that nothing (including the valid key) was persisted by the failed save",
-        "bundle door — in a scratch script inside the worktree, call defineTranslation and defineTranslationBundle with the same variants and capture each parse error (this is the door #3778's item-only guard missed; #4001's strict shapes must cover both). ⚠️ They are NOT on the same entry point: defineTranslationBundle is re-exported from the package ROOT (@objectstack/spec), while defineTranslation resolves only through the @objectstack/spec/system subpath. Importing both from the root yields 'defineTranslation is not a function', which reads exactly like a missing guard",
+        "bundle door — in a scratch script inside the worktree (a runner barred from writing in the tree can run the script from a scratch dir and require the built packages/spec/dist entry points by absolute path, after a spec build), call defineTranslation and defineTranslationBundle with the same variants and capture each parse error (this is the door #3778's item-only guard missed; #4001's strict shapes must cover both). ⚠️ They are NOT on the same entry point: defineTranslationBundle is re-exported from the package ROOT (@objectstack/spec), while defineTranslation resolves only through the @objectstack/spec/system subpath. Importing both from the root yields 'defineTranslation is not a function', which reads exactly like a missing guard",
         "verify the alias suggestion channel: a near-miss key (helpText on a FIELD translation, label on a WIDGET translation) must be rejected WITH the did-you-mean pointing at the declared spelling (help; title)",
         "verify the guidance channel: legacy object-first keys (o, app, nav, dashboard, errors, _meta) and retired validationMessages must carry their prescription (where the content belongs now, or that it has no home), not just 'unrecognized key'",
         "save a correct version of the same content and confirm it persists and resolves (the gate rejects keys, not translations)"
@@ -425,7 +431,13 @@
       "history": [
         { "revision": 1, "date": "2026-08-07", "change": "new item: strict-key rejection at both translation doors, variants from the spec's own legacy/guidance/alias tables", "ref": "claude/platform-test-checklist-ocwugl" },
         { "revision": 2, "date": "2026-08-18", "change": "named the two bundle-door entry points separately in step 4. packages/spec/src/index.ts re-exports only defineTranslationBundle; defineTranslation is reachable solely through the @objectstack/spec/system subpath (system/index.ts re-exports translation.zod). A scratch script importing both from the root fails with 'defineTranslation is not a function' and reads as an absent guard rather than a wrong import path (#9467 CF-3)", "ref": "#9386" },
-        { "revision": 3, "date": "2026-10-26", "change": "steps[0], acceptance[0].verify, acceptance[3].verify and acceptance[5].verify corrected (checklist-accuracy findings of QA run #25817, release-18.2.0-manual-set at 6679644a; wave anchor #25807). The conventional item name `zh-CN` is refused by the item-name rule (400 INVALID_REQUEST) before the key gate runs, so the steps name a snake_case item and the clause scores the 422 INVALID_METADATA. The live validationMessages guidance cites ADR-0049 and spec 17.0.0, not #4667. The singular label renders on the record-page badge and the New dialog, while the list header and the nav read pluralLabel. The stale `name` describe in translation.zod.ts that still calls `zh-CN` the convention is a spec text, not ledger text: it goes to the seat as a finding, and steps[0] only warns the runner", "ref": "#25842" }
+        { "revision": 3, "date": "2026-10-26", "change": "steps[0], acceptance[0].verify, acceptance[3].verify and acceptance[5].verify corrected (checklist-accuracy findings of QA run #25817, release-18.2.0-manual-set at 6679644a; wave anchor #25807). The conventional item name `zh-CN` is refused by the item-name rule (400 INVALID_REQUEST) before the key gate runs, so the steps name a snake_case item and the clause scores the 422 INVALID_METADATA. The live validationMessages guidance cites ADR-0049 and spec 17.0.0, not #4667. The singular label renders on the record-page badge and the New dialog, while the list header and the nav read pluralLabel. The stale `name` describe in translation.zod.ts that still calls `zh-CN` the convention is a spec text, not ledger text: it goes to the seat as a finding, and steps[0] only warns the runner", "ref": "#25842" },
+        {
+          "revision": 4,
+          "date": "2026-10-28",
+          "change": "steps[3] names the out-of-tree route. Checklist-accuracy finding of the 18.2.0 wave 2 (QA run #26456, manual browser set, at 756220c4; wave anchor #25807, slice B): a runner barred from writing in the tree drove the bundle door by requiring packages/spec/dist by absolute path from a scratch dir. The step said only 'inside the worktree'. The entry-point warning (defineTranslation through the system subpath) is unchanged. No clause changed",
+          "ref": "#25807"
+        }
       ]
     },
     {