fix(security): re-pin the assertions on the rewritten strings; locale help carries the shared-vocabulary decision (stage 5, wip)

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/plugins/plugin-security/src/default-report-sink.test.ts

@@ -77,7 +77,7 @@ describe('[#10556 (a)] SecurityPlugin default report sink', () => {
     expect(filter).toBeDefined();
 
     expect(seen).toHaveLength(1);
-    expect(String(seen[0]?.[0])).toContain('denying (fail-closed, #2852)');
+    expect(String(seen[0]?.[0])).toContain("denying (fail-closed: a delegated read is never scoped wider than its delegator's own)");
   });
 
   it('guarantees a `warn` channel on the default sink, and routes it to the console', () => {

packages/plugins/plugin-security/src/deployment-platform-global-exemption.test.ts

@@ -160,7 +160,7 @@ describe('[#12699] platformGlobalObjects — the deployment carve-out', () => {
     });
     // And nothing to refuse means nothing to warn about.
     const warned = logger.warn.mock.calls.map((c) => String(c[0]));
-    expect(warned.filter((m) => m.includes('#12699'))).toEqual([]);
+    expect(warned.filter((m) => m.includes('org-scoping entitlement key'))).toEqual([]);
   });
 
   it('composes with, never replaces, the object-level channel: `tenancy.enabled:false` stays exempt with no deployment declaration', async () => {

packages/plugins/plugin-security/src/metadata-outage-unresolved-cause.test.ts

@@ -347,7 +347,7 @@ describe('[#10424] the wording module states three distinct things', () => {
     expect(remedy).toContain('Do NOT change the declaration');
     expect(remedy).toContain('NOT a permissions problem');
     expect(unresolvedPostureExplainDetail('task', 'metadata_unavailable')).toContain('OUTAGE');
-    expect(unresolvedPostureExplainDetail('task', 'metadata_unavailable')).toContain('#3545');
+    expect(unresolvedPostureExplainDetail('task', 'metadata_unavailable')).toContain('rather than defaulting to public/uncontracted');
   });
 
   it('the outage denial keeps the pinned opening clause verbatim', () => {
@@ -362,7 +362,7 @@ describe('[#10424] the wording module states three distinct things', () => {
     for (const c of causes) {
       expect(unresolvedPostureDenialMessage('task', 'find', c)).toContain('[Security] Access denied:');
       expect(unresolvedPostureExplainDetail('task', c)).toContain('fails CLOSED');
-      expect(unresolvedPostureLogLine('task', 'find', 'u1', c)).toContain('fail-closed, #3545');
+      expect(unresolvedPostureLogLine('task', 'find', 'u1', c)).toContain('fail-closed: an unreadable posture never defaults to public');
     }
   });
 });

packages/plugins/plugin-security/src/translations/es-ES.objects.generated.ts

@@ -43,7 +43,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "Gestionado por",
-        help: "Procedencia del registro: platform (integrado) / package (declarado) / admin (creado por el inquilino).",
+        help: "Procedencia del registro, en el único vocabulario platform / package / admin que comparten capacidades, conjuntos de permisos y puestos: platform (integrado) / package (declarado) / admin (creado por el inquilino).",
         options: {
           platform: "Plataforma",
           package: "Paquete",
@@ -230,7 +230,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "Gestionado por",
-        help: "Procedencia del registro: platform (distribuido) / package (empaquetado) / admin (creado en el entorno).",
+        help: "Procedencia del registro, en el único vocabulario platform / package / admin que comparten capacidades, conjuntos de permisos y puestos: platform (distribuido) / package (empaquetado) / admin (creado en el entorno).",
         options: {
           platform: "Plataforma",
           package: "Paquete",

packages/plugins/plugin-security/src/translations/ja-JP.objects.generated.ts

@@ -43,7 +43,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "管理元",
-        help: "レコードの出所：platform（組み込み）/ package（宣言済み）/ admin（テナント作成）。",
+        help: "レコードの出所（ケイパビリティ・権限セット・ポジションで共通の platform / package / admin の語彙）：platform（組み込み）/ package（宣言済み）/ admin（テナント作成）。",
         options: {
           platform: "プラットフォーム",
           package: "パッケージ",
@@ -230,7 +230,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "管理元",
-        help: "レコードの出所：platform（配布）/ package（パッケージ）/ admin（環境作成）。",
+        help: "レコードの出所（ケイパビリティ・権限セット・ポジションで共通の platform / package / admin の語彙）：platform（配布）/ package（パッケージ）/ admin（環境作成）。",
         options: {
           platform: "プラットフォーム",
           package: "パッケージ",

packages/plugins/plugin-security/src/translations/zh-CN.objects.generated.ts

@@ -43,7 +43,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "管理来源",
-        help: "记录来源：platform（平台内置）/ package（应用包声明）/ admin（租户创建）。",
+        help: "记录来源（能力、权限集与岗位共用同一套 platform / package / admin 取值）：platform（平台内置）/ package（应用包声明）/ admin（租户创建）。",
         options: {
           platform: "平台",
           package: "应用包",
@@ -230,7 +230,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       managed_by: {
         label: "管理来源",
-        help: "记录来源：platform（平台发布）/ package（应用包发布）/ admin（环境自建）。",
+        help: "记录来源（能力、权限集与岗位共用同一套 platform / package / admin 取值）：platform（平台发布）/ package（应用包发布）/ admin（环境自建）。",
         options: {
           platform: "平台",
           package: "应用包",