fix(plugin-webhooks,plugin-audit,plugin-security): re-translate the object leaves that contradict their current en source (#20684)

Fixes #20653

Clause-②: no

## What changed

A translated leaf in a plugin's
`src/translations/{ja-JP,es-ES,zh-CN}.objects.generated.ts` that a
translator wrote by hand keeps its value when its `en` source changes
later. This PR measures that set in the four plugin bundles the card
names (`plugin-webhooks`, `plugin-audit`, `plugin-approvals`,
`plugin-security`), then re-translates the leaves whose meaning now
**contradicts** the current `en`: **18 leaves**, six paths in all three
locales (ja-JP 6, es-ES 6, zh-CN 6). The triage-ordered leaf,
`sys_webhook.fields.definition_json.help`, is the first commit.

- Values only. No key is added or dropped, no `en` file is edited, and
no provenance companion (`*.source-hashes.generated.ts`) changes: the
repo's own tooling was run and writes nothing (measured below).
- `.changeset/20653-stale-authored-plugin-bundle-leaves.md`:
`@objectstack/plugin-webhooks`, `@objectstack/plugin-audit`,
`@objectstack/plugin-security`, each `patch`.
`@objectstack/plugin-approvals` has no change and is not named.
- No new gate, per triage. No test pins any of the old or new strings.
- Scope per the claim: the four plugin bundles only. The
`platform-objects` metadata-forms leaves are the engine lane's card,
#20666, which remains open and is not touched here.

## The measurement (base `6bff748bb`, before any edit)

### Instrument

PR #20652's condensed instrument, ported with one change: the bundle
directory comes from argv instead of the `platform-objects` constant.
Population = every string leaf of the locale's objects bundle, minus
echoes of the current `en` and paths recorded in
`*.source-hashes.generated.ts`; last edit = the first-parent commit
where the parsed value last changed; a leaf is a candidate when `en` at
that commit differs from `en` today. Meaning is then judged by hand.
Full history (the clone is not shallow: `git rev-parse
--is-shallow-repository` answers `false`).

Four widening checks ran beside it:

- **Carve-out continuity.** These bundles were carved out of
`packages/platform-objects/src/apps/translations/` at `44045721c`
(ADR-0029 D8: webhooks, approvals, security) and `be1b9165f` (K2:
audit). The condensed walk starts at the carve-out, so it dates every
carried leaf there and reads the `en` of that day. The widened walk
replays the platform-objects file's first-parent history (from its birth
at `6bacbced2`, the horizon #20652 covered) before the plugin file's
own. It re-dated every candidate the condensed walk had dated at a
carve-out commit (for example `definition_json.help`, to `7bb92056e`)
and changed no candidate set.
- **Merge side.** For a leaf last edited by a merge commit, `en` is also
read at the second parent. 0 hits.
- **Penultimate edit.** For each non-candidate, `en` at its previous
edit, and whether `en` moved in the last-edit commit itself. Every flag
where `en` moved EARLIER than the last edit was read by hand:
`sys_webhook.fields.method.help`, `sys_position.fields.name.help` and
`sys_position._actions.clone_position.params.name.helpText` already say
what `en` says; es-ES
`sys_position._actions.deactivate_position.confirmText` differs by
rewording only; es-ES `sys_position.description` **contradicts** (it was
edited at `4ea921ca8`, after `en` moved, and kept the old framing), so
it is re-translated.
- **Retired terms and renamed keys.** A leaf carrying the locale's word
for `project` or `department` where `en` at the same path does not carry
the English term; the locale's word for `role` or `RBAC` anywhere in the
four bundles; and a leaf whose path was born at its last edit while the
same value sat under a sibling path of the same object that disappeared
in that commit (a renamed key). One path, found by both the term scan
and the renamed-key check: `sys_activity.fields.environment_id.help`.
The key was renamed from `project_id` at `944f18758` with the value
carried, so the since-last-edit instrument dates it at the rename, where
`en` already said Environment, and cannot see it.

### Known-positive control

`plugin-webhooks` `sys_webhook.fields.definition_json.help`, line 72 of
all four bundles. The source has said "Credentials are NOT stored here"
since `160294963` (the custom headers moved onto the encrypted channel,
after `e3a6f6e7e` moved the signing secret), and the `en` bundle since
`8af76aebf`. The three translations were last edited at `7bb92056e`,
when `en` said "full headers/auth/retry/payload config". The ported
instrument flags it in **all three** locales. A1 held: the port is live
before anything is counted.

### Counts per bundle (ja-JP / es-ES / zh-CN)

| bundle | authored leaves | candidates, before | contradicting, before
| widening checks, before | **re-translated** | candidates, after |
contradicting after | widening after |
|---|---|---|---|---|---|---|---|---|
| plugin-webhooks | 41 / 40 / 40 | 3 / 3 / 3 | 2 / 2 / 2 | 0 / 0 / 0 |
**2 / 2 / 2** | 1 / 1 / 1 | 0 | 0 |
| plugin-audit | 102 / 100 / 102 | 3 / 3 / 3 | 2 / 2 / 2 | 1 / 1 / 1
(`environment_id.help`) | **3 / 3 / 3** | 1 / 1 / 1 | 0 | 0 |
| plugin-approvals | 113 / 112 / 134 | 17 / 17 / 16 | 0 / 0 / 0 | 0 / 0
/ 0 | **0** | 17 / 17 / 16 | 0 | 0 |
| plugin-security | 179 / 179 / 179 | 7 / 5 / 7 | 1 / 0 / 1 | 0 / 1 / 0
(es-ES `sys_position.description`) | **1 / 1 / 1** | 6 / 5 / 6 | 0 | 0 |

The before candidate counts equal the #20539 dev's raw counts exactly
(A2). After = at `5444bb130`, both instruments: each after-candidate set
is exactly the before set minus the re-translated paths (0 added), the
echo counts are unchanged (no new value equals its `en` leaf), and the
term scan and renamed-key check return 0. The penultimate-edit flags
after are the before set minus es-ES `sys_position.description`, plus
the 14 re-translated leaves that were candidates (their last edit is now
this PR, after `en` moved), which is the expected shape.

### The judgment rule

As in PR #20652. A leaf **contradicts** the current `en` when a reader
who acts on it would believe something about the current field or object
that `en` now says is false: `en` now denies what the leaf asserts; the
object was re-modelled, so the leaf describes a different thing; or the
leaf names the record's entity by a term a rename retired from it. Added
detail, narrowing, rewording, punctuation and title-casing are not
contradictions.

## Re-translated (18): before and after, with the `en` each now matches

(ja-JP / es-ES / zh-CN, in each bundle's existing terms: 署名シークレット /
カスタムヘッダー / アウトボックス / ケイパビリティ; secreto de firma / cabeceras
personalizadas / outbox / capacidades / entorno; 签名密钥 / 自定义请求头 / 发件箱 /
授权能力 / 环境.)

**`plugin-webhooks` · `sys_webhook.fields.definition_json.help`**: said
the JSON carries the full headers / auth / retry / payload config. `en`
says the opposite, on a security field. `en`: 「Serialised Webhook JSON
(see @objectstack/spec/automation/webhook) — timeout and the rest of the
authored envelope. Credentials are NOT stored here: the signing secret
lives in the encrypted `signing_secret` field and the custom headers in
the encrypted `headers_secret` field.」

- ja-JP: 「シリアライズされた Webhook JSON（@objectstack/spec/automation/webhook
参照）— ヘッダー/認証/リトライ/ペイロード設定を含む」 → 「シリアライズされた Webhook
JSON（@objectstack/spec/automation/webhook 参照）—
タイムアウトなど、作成されたエンベロープの残りの設定。認証情報はここには保存されません。署名シークレットは暗号化された
`signing_secret` フィールドに、カスタムヘッダーは暗号化された `headers_secret` フィールドに保存されます。」
- es-ES: 「JSON serializado de Webhook (consulte
@objectstack/spec/automation/webhook): configuración completa de
cabeceras/auth/reintentos/payload.」 → 「JSON serializado de Webhook
(consulte @objectstack/spec/automation/webhook): el tiempo de espera y
el resto del envelope definido. Las credenciales NO se almacenan aquí:
el secreto de firma se guarda en el campo cifrado `signing_secret` y las
cabeceras personalizadas, en el campo cifrado `headers_secret`.」
- zh-CN: 「序列化的 Webhook JSON（参见
@objectstack/spec/automation/webhook）——包含完整的 headers/auth/retry/payload
配置」 → 「序列化的 Webhook JSON（参见
@objectstack/spec/automation/webhook）——超时及所编写信封的其余配置。凭据不存储在此处：签名密钥保存在加密的
`signing_secret` 字段中，自定义请求头保存在加密的 `headers_secret` 字段中。」

**`plugin-webhooks` · `sys_webhook.description`**: said an HTTP
connector plugin executes the webhook. `69f1dfd5c` replaced that
executor in the source with the webhook auto-enqueuer and the shared
HTTP outbox (`service-messaging`), and no HTTP connector plugin exists
in the tree (`packages/plugins`, `packages/services`). The leaf also
omitted the `defineStack({ webhooks })` door, which is additive. `en`:
`Outbound HTTP webhook subscription. Declared in code via defineStack({
webhooks }) / defineWebhook() (materialized into rows on boot) or
authored directly in the Studio editor; dispatched by the webhook
auto-enqueuer onto the shared HTTP outbox.`

- ja-JP: 「送信 HTTP Webhook サブスクリプション。defineWebhook() またはスタジオエディタで作成し、HTTP
コネクタプラグインが実行します。」 → 「送信 HTTP Webhook サブスクリプション。コードでは defineStack({
webhooks }) / defineWebhook()
で宣言する（起動時に行として実体化）か、スタジオエディタで直接作成します。Webhook 自動エンキューアが共有 HTTP
アウトボックスへディスパッチします。」
- es-ES: 「Suscripción saliente de Webhook HTTP. Se crea mediante
defineWebhook() en código o con el editor de Studio; la ejecuta el
plugin del conector HTTP.」 → 「Suscripción saliente de Webhook HTTP. Se
declara en código mediante defineStack({ webhooks }) / defineWebhook()
(materializada en filas al arrancar) o se crea directamente con el
editor de Studio; el encolador automático de webhooks la despacha al
outbox HTTP compartido.」
- zh-CN: 「外发 HTTP Webhook 订阅。可在代码中通过 defineWebhook() 编写，或在 Studio
编辑器中维护；由 HTTP 连接器插件执行。」 → 「外发 HTTP Webhook 订阅。可在代码中通过 defineStack({
webhooks }) / defineWebhook() 声明（启动时物化为数据行），或直接在 Studio 编辑器中编写；由 Webhook
自动入队器分发到共享的 HTTP 发件箱。」

**`plugin-audit` · `sys_activity.fields.environment_id.label`**: the
v5.0 rename project to environment ships no alias. `en`: `Environment`

- ja-JP: 「プロジェクト」 → 「環境」
- es-ES: 「Proyecto」 → 「Entorno」
- zh-CN: 「项目」 → 「环境」

**`plugin-audit` · `sys_activity.fields.environment_id.help`**: same
rename; found by the term scan and the renamed-key check, invisible to
the since-last-edit instrument. `en`: `Environment context
(multi-environment deployments)`

- ja-JP: 「プロジェクトコンテキスト（マルチプロジェクトデプロイメント）」 → 「環境コンテキスト（マルチ環境デプロイメント）」
- es-ES: 「Contexto del proyecto (implementaciones multiproyecto).」 →
「Contexto del entorno (implementaciones multientorno).」
- zh-CN: 「项目上下文（多项目部署）」 → 「环境上下文（多环境部署）」

**`plugin-audit` · `sys_audit_log.fields.user_id.label`**: `7fe7e85d6`
gave `sys_audit_log` its own `actor` principal field (label Actor;
ADR-0014 D2) and relabelled the strict `sys_user` lookup `user_id` from
Actor to User, because a service-token action leaves `user_id` null and
records the principal in `actor`. The leaves still called `user_id` the
actor: es-ES showed two fields both labelled 「Actor」, and ja-JP (操作者
beside 実行者) and zh-CN (执行人 beside 操作者) showed two synonyms. `en`: `User`

- ja-JP: 「操作者」 → 「ユーザー」
- es-ES: 「Actor」 → 「Usuario」
- zh-CN: 「执行人」 → 「用户」

**`plugin-security` · `sys_position.description`**: the ADR-0090 P1
commit (`6d83431cf`) changed `en` from "Role definitions for RBAC access
control" to capability distribution; the translations were find-replaced
role to position and kept "for RBAC access control" (ADR-0090:
capability = `permission_set`, distribution = `position`, and the word
role is retired from UI copy). `en`: `Position definitions for
capability distribution (ADR-0090)`

- ja-JP: 「RBAC アクセス制御のためのポジション定義」 → 「ケイパビリティ配分のためのポジション定義（ADR-0090）」
- es-ES: 「Definiciones de puesto para el control de acceso RBAC」 →
「Definiciones de puesto para la distribución de capacidades (ADR-0090)」
- zh-CN: 「用于 RBAC 访问控制的岗位定义」 → 「用于分发授权能力的岗位定义（ADR-0090）」

The two closest calls on this side are `sys_webhook.description` and
`sys_audit_log.fields.user_id.label`; the reasons are above.

## Stale but not contradicting (listed, left as written)

| bundle · path | locales | what `en` did |
|---|---|---|
| webhooks · `sys_webhook.fields.triggers.help` | all three | Condensed
to "(bulk_* deliver a count, not a record)" when the `en` bundle began
tracking its source (`8af76aebf`). The leaf's longer "bulk_update /
bulk_delete fire on predicate writes and deliver a count" is still true
(the field's own source comment says the same). |
| audit · `sys_audit_log.fields.user_id.help` | all three | Widened
"null for system actions" to "null for non-user / service actions — see
actor". The leaf is narrower, not false. |
| approvals · `sys_approval_request.fields.status.options.*` (5),
`sys_approval_action.fields.action.options.*` (12) | 17 / 17 / 16 |
Moved from the machine value to a title (`pending` to `Pending`,
`request_info` to `Request Info`, `ooo_substitute` to `Out-of-Office
Substitution`). Every leaf already carried the meaning. Triage: not a
contradiction. |
| security · `sys_position.fields.managed_by.help`,
`sys_capability.fields.managed_by.help`,
`sys_permission_set.fields.managed_by.help` | all three | Added the
unified tri-state wording and the legacy aliases, or reworded. The
leaves' platform / package / admin reading is still true. |
| security · `sys_capability.description` | all three | Added the
ADR-0066 citation and named the two referencing keys. |
| security · `sys_position._actions.deactivate_position.confirmText` |
ja-JP, zh-CN (es-ES via the penultimate check) | Dropped "with the
position". |
| security · `sys_permission_set.fields.name.help` | all three | Added
that the name is the set's metadata identity and cannot be renamed
(clone instead). The leaf does not claim it can. This is the closest
call among the leaves left alone. |

## Dispatch hypotheses, measured

- **A1 held.** The ported instrument flags the known positive in all
three locales, and its counts at `6bff748bb` are 3/3/3, 3/3/3, 17/17/16
and 7/5/7.
- **A2 held as a lead.** The raw counts reproduce exactly. Meaning
judged per candidate: 5 of the 30 / 28 / 29 candidates contradict in
ja-JP / zh-CN, 4 in es-ES, plus one term-scan leaf per locale and one
penultimate-edit leaf in es-ES. The named likely positive
(`sys_activity.fields.environment_id.label`) is a positive in all three
locales (es-ES 「Proyecto」 too).
- **A3 held: values only.** `node scripts/check-i18n-bundles.mjs --write
--filter=plugin-NAME` for webhooks, audit, security and approvals
printed `regenerated` for each; the files were rewritten on disk and
`git status --porcelain` stayed empty, so the tooling owes no companion
or `en` change. Control (a commit-first ablation through
`scripts/ablation-replace.mjs`): with ja-JP
`sys_webhook.fields.definition_json.help` set to the `en` string,
`check-i18n-bundles --filter=plugin-webhooks` goes red,
`plugins/plugin-webhooks DRIFTED (1)`; the tool restored it (blob
`88583c2ea5f9` == HEAD, `git diff HEAD` empty).
- **A4 held.** Each changed plugin ships the new values in `dist` (built
at `5444bb130`). `plugin-webhooks`: the built chunk
`dist/translations-KQ72WOMS.js`, the module the plugin's `kernel:ready`
hook imports, was imported and its served value (after
`withSourceFallback`) read at each path: 6 of 6 equal the HEAD source
and differ from the base, and 3 unchanged-leaf controls equal.
`plugin-audit` and `plugin-security` inline their bundles: each locale's
object literal was cut out of `dist/index.mjs` and `dist/index.js` and
read by path: 24 of 24 rows equal the HEAD source and differ from the
base, and 12 controls equal. A plain byte grep was not a usable reading
here: esbuild escapes non-ASCII text, and the old short labels are
shared by other fields.

## Verification (all at `5444bb130`, after merging `origin/main` at
`9a4b2bb38`)

The merge brought PR #20658, a comment-only edit that includes
`plugin-security/src/translations/index.ts`, a file this PR does not
edit.

- Build: `turbo run build --filter=@objectstack/cli...
--filter=@objectstack/plugin-webhooks...
--filter=@objectstack/plugin-audit...
--filter=@objectstack/plugin-security...`, 59/59 tasks, `VERDICT
command-exit 0`.
- `pnpm --filter` test, for the three changed plugins: plugin-webhooks
13 files / 160 tests passed; plugin-audit 25 files / 363 tests passed;
plugin-security 147 files / 3202 passed, 23 skipped (the translation
tests `bundle-ownership.test.ts` and
`position-rename-consistency.test.ts` included). `typecheck` for the
three: exit 0, each `check:test-typecheck: OK`.
- Gates: `node scripts/pm/dispatch-gates.mjs --commands` (no paths)
derived 57 commands against the real diff; the dispatch-time list had
56, and the one added is `pnpm check:logger-receiver-detach`. All 57
exit 0. `--ran` printed "57 derived famil(ies) accounted for — 57 run, 0
NOT-MEASURED". `pnpm check:dual-build-cjs-loads` first refused with exit
3 (nine packages outside this diff had no `dist/`). Those were built and
the gate re-ran: exit 0.
- The four roster families printed outside the runnable list: `node
scripts/check-changeset-fixed.mjs`, `pnpm check:authz-resolver`, `pnpm
check:error-code-casing`, `pnpm check:filter-alias-parity`, all exit 0.
- Named in the verdicts: `check:i18n` "OK (9 package(s) — all bundles in
sync, no undeclared authoring keys)"; `check:i18n-stale-fill` "OK (10
bundle set(s) — no new stale fills, 0 baselined)"; `check:nul-bytes` OK.
- Lint, narrowed to the nine edited bundles: `eslint --no-inline-config
--format json` read 9 files, 0 errors, 0 warnings.
`ESLint#isPathIgnored` answers `false` for all nine, read from the
repo's own config. The config enables no type-aware linting (no
`parserOptions.project`; `eslint.config.mjs` states it at lines
327-328), so a change to string values in these files cannot move the
verdict on any other file. The full `pnpm lint` is left to CI.

## Acceptance notes

- `position-rename-consistency.test.ts` matches the retired term as
`\brole?s?\b` / `\brol(es)?\b` / 角色 / ロール. None of those matches the
acronym RBAC, which is how `sys_position.description` kept "for RBAC
access control" in all three locales under a green ADR-0090 guard. This
PR fixes the values; the test's blind spot remains. It is outside this
card's file surface and is not changed here.
- The since-last-edit instrument cannot see a leaf whose KEY was renamed
with its value carried (here `project_id` to `environment_id`). The
renamed-key check above covers that shape. #20666 runs the same
instrument on the metadata-forms bundles and may want the same check.
- Instrument sources and outputs were run from the session scratchpad;
the widened instrument is the condensed one plus the four checks
described above.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/20653-stale-authored-plugin-bundle-leaves.md

@@ -0,0 +1,35 @@
+---
+'@objectstack/plugin-webhooks': patch
+'@objectstack/plugin-audit': patch
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-webhooks,plugin-audit,plugin-security): the ja-JP, es-ES and zh-CN object help, descriptions and labels that contradicted their current English source are re-translated (#20653)
+
+Clause-②: no
+
+A translated object leaf that a translator wrote by hand is kept as written
+when its English source changes later, so some leaves went on saying what the
+old source said. On a ja-JP, es-ES or zh-CN console the `sys_webhook` record
+page told an admin that `definition_json` carries the full headers / auth /
+retry / payload configuration, where the English help says credentials are not
+stored there: the signing secret and the custom headers live in the encrypted
+`signing_secret` and `headers_secret` fields.
+
+Eighteen leaves (six paths, in all three locales) whose meaning contradicted
+the current English now match it:
+
+- `@objectstack/plugin-webhooks`: the `sys_webhook.definition_json` help (no
+  credentials in the JSON) and the `sys_webhook` description (dispatched by the
+  webhook auto-enqueuer onto the shared HTTP outbox, not executed by an HTTP
+  connector plugin; declared through `defineStack({ webhooks })` too);
+- `@objectstack/plugin-audit`: the `sys_activity.environment_id` label and help
+  (Environment, not Project), and the `sys_audit_log.user_id` label (User: the
+  object's separate `actor` field is the actor);
+- `@objectstack/plugin-security`: the `sys_position` description (positions
+  distribute capability, not definitions for RBAC access control).
+
+Leaves whose English source only gained detail, was reworded, or was
+title-cased (the `@objectstack/plugin-approvals` status and action options)
+are unchanged. Values only: no key is added or removed, and no provenance
+table changes.

packages/plugins/plugin-audit/src/translations/es-ES.objects.generated.ts

@@ -39,7 +39,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         }
       },
       user_id: {
-        label: "Actor",
+        label: "Usuario",
         help: "Usuario que realizó la acción (null para acciones del sistema)."
       },
       actor: {
@@ -175,8 +175,8 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
         help: "Enlace profundo opcional al destino de la actividad."
       },
       environment_id: {
-        label: "Proyecto",
-        help: "Contexto del proyecto (implementaciones multiproyecto)."
+        label: "Entorno",
+        help: "Contexto del entorno (implementaciones multientorno)."
       },
       metadata: {
         label: "Metadatos",

packages/plugins/plugin-audit/src/translations/ja-JP.objects.generated.ts

@@ -39,7 +39,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         }
       },
       user_id: {
-        label: "操作者",
+        label: "ユーザー",
         help: "アクションを実行したユーザー（システム操作の場合は null）"
       },
       actor: {
@@ -175,8 +175,8 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
         help: "アクティビティターゲットへのオプションのディープリンク"
       },
       environment_id: {
-        label: "プロジェクト",
-        help: "プロジェクトコンテキスト（マルチプロジェクトデプロイメント）"
+        label: "環境",
+        help: "環境コンテキスト（マルチ環境デプロイメント）"
       },
       metadata: {
         label: "メタデータ",

packages/plugins/plugin-audit/src/translations/zh-CN.objects.generated.ts

@@ -39,7 +39,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         }
       },
       user_id: {
-        label: "执行人",
+        label: "用户",
         help: "执行该操作的用户（系统操作时为 null）"
       },
       actor: {
@@ -175,8 +175,8 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
         help: "指向活动目标的可选深度链接"
       },
       environment_id: {
-        label: "项目",
-        help: "项目上下文（多项目部署）"
+        label: "环境",
+        help: "环境上下文（多环境部署）"
       },
       metadata: {
         label: "元数据",

packages/plugins/plugin-security/src/translations/es-ES.objects.generated.ts

@@ -18,7 +18,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
   sys_position: {
     label: "Puesto",
     pluralLabel: "Puestos",
-    description: "Definiciones de puesto para el control de acceso RBAC",
+    description: "Definiciones de puesto para la distribución de capacidades (ADR-0090)",
     fields: {
       label: {
         label: "Nombre visible"

packages/plugins/plugin-security/src/translations/ja-JP.objects.generated.ts

@@ -18,7 +18,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
   sys_position: {
     label: "ポジション",
     pluralLabel: "ポジション",
-    description: "RBAC アクセス制御のためのポジション定義",
+    description: "ケイパビリティ配分のためのポジション定義（ADR-0090）",
     fields: {
       label: {
         label: "表示名"

packages/plugins/plugin-security/src/translations/zh-CN.objects.generated.ts

@@ -18,7 +18,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
   sys_position: {
     label: "岗位",
     pluralLabel: "岗位",
-    description: "用于 RBAC 访问控制的岗位定义",
+    description: "用于分发授权能力的岗位定义（ADR-0090）",
     fields: {
       label: {
         label: "显示名称"

packages/plugins/plugin-webhooks/src/translations/es-ES.objects.generated.ts

@@ -18,7 +18,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "Webhook",
     pluralLabel: "Webhooks",
-    description: "Suscripción saliente de Webhook HTTP. Se crea mediante defineWebhook() en código o con el editor de Studio; la ejecuta el plugin del conector HTTP.",
+    description: "Suscripción saliente de Webhook HTTP. Se declara en código mediante defineStack({ webhooks }) / defineWebhook() (materializada en filas al arrancar) o se crea directamente con el editor de Studio; el encolador automático de webhooks la despacha al outbox HTTP compartido.",
     fields: {
       id: {
         label: "ID de webhook"
@@ -69,7 +69,7 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       },
       definition_json: {
         label: "Definición",
-        help: "JSON serializado de Webhook (consulte @objectstack/spec/automation/webhook): configuración completa de cabeceras/auth/reintentos/payload."
+        help: "JSON serializado de Webhook (consulte @objectstack/spec/automation/webhook): el tiempo de espera y el resto del envelope definido. Las credenciales NO se almacenan aquí: el secreto de firma se guarda en el campo cifrado `signing_secret` y las cabeceras personalizadas, en el campo cifrado `headers_secret`."
       },
       headers_secret: {
         label: "Cabeceras personalizadas",

packages/plugins/plugin-webhooks/src/translations/ja-JP.objects.generated.ts

@@ -18,7 +18,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "ウェブフック",
     pluralLabel: "ウェブフック",
-    description: "送信 HTTP Webhook サブスクリプション。defineWebhook() またはスタジオエディタで作成し、HTTP コネクタプラグインが実行します。",
+    description: "送信 HTTP Webhook サブスクリプション。コードでは defineStack({ webhooks }) / defineWebhook() で宣言する（起動時に行として実体化）か、スタジオエディタで直接作成します。Webhook 自動エンキューアが共有 HTTP アウトボックスへディスパッチします。",
     fields: {
       id: {
         label: "Webhook ID"
@@ -69,7 +69,7 @@ export const jaJPObjects: NonNullable<TranslationData['objects']> = {
       },
       definition_json: {
         label: "定義",
-        help: "シリアライズされた Webhook JSON（@objectstack/spec/automation/webhook 参照）— ヘッダー/認証/リトライ/ペイロード設定を含む"
+        help: "シリアライズされた Webhook JSON（@objectstack/spec/automation/webhook 参照）— タイムアウトなど、作成されたエンベロープの残りの設定。認証情報はここには保存されません。署名シークレットは暗号化された `signing_secret` フィールドに、カスタムヘッダーは暗号化された `headers_secret` フィールドに保存されます。"
       },
       headers_secret: {
         label: "カスタムヘッダー",

packages/plugins/plugin-webhooks/src/translations/zh-CN.objects.generated.ts

@@ -18,7 +18,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
   sys_webhook: {
     label: "Webhook",
     pluralLabel: "Webhook",
-    description: "外发 HTTP Webhook 订阅。可在代码中通过 defineWebhook() 编写，或在 Studio 编辑器中维护；由 HTTP 连接器插件执行。",
+    description: "外发 HTTP Webhook 订阅。可在代码中通过 defineStack({ webhooks }) / defineWebhook() 声明（启动时物化为数据行），或直接在 Studio 编辑器中编写；由 Webhook 自动入队器分发到共享的 HTTP 发件箱。",
     fields: {
       id: {
         label: "Webhook ID"
@@ -69,7 +69,7 @@ export const zhCNObjects: NonNullable<TranslationData['objects']> = {
       },
       definition_json: {
         label: "定义",
-        help: "序列化的 Webhook JSON（参见 @objectstack/spec/automation/webhook）——包含完整的 headers/auth/retry/payload 配置"
+        help: "序列化的 Webhook JSON（参见 @objectstack/spec/automation/webhook）——超时及所编写信封的其余配置。凭据不存储在此处：签名密钥保存在加密的 `signing_secret` 字段中，自定义请求头保存在加密的 `headers_secret` 字段中。"
       },
       headers_secret: {
         label: "自定义请求头",