@epoch-agent/infra 0.1.0

package/dist/locales/en.yaml

@@ -0,0 +1,2757 @@
+# epoch-agent message catalog —— the one and only translation.
+#
+# zh.yaml is the baseline / source of truth; this file mirrors it key for key.
+# Adding a key here without adding it there (or vice versa) turns the
+# consistency test red, and so does dropping a `{placeholder}`.
+#
+# There is no third catalog, and none is planned —— see the scope statement at
+# the top of .agents/plans/40-i18n-plan.md before adding one.
+
+i18n:
+  locales_missing: 'locales directory not found; UI text will show as key paths'
+  catalog_missing: 'locales/{file} is missing; {lang} text falls back to the default language'
+  catalog_invalid: 'locales/{file} is not valid YAML ({reason}); fell back to built-in defaults'
+
+# Value checks for flags that take a value (cli/src/commands/run-overrides.ts).
+# Every one of these must say what to type next — the valid values, or "the task
+# is a positional argument". At the moment of the typo the user is not missing
+# "this value is wrong", they are missing "so how do I write it".
+flags:
+  provider_unknown: 'unknown --provider: {value}'
+  permission_unknown: 'unknown --permission: {value}'
+  choices: 'valid values: {choices}'
+  model_not_a_name: '{flag} does not look like a model name: {value}'
+  model_not_a_name_hint: 'Model ids are ASCII (letters, digits and - . _ : / @) with no spaces and no CJK. To send it to the model, pass it as a positional argument: epoch "{value}"'
+  base_url_invalid: '--base-url is not a valid http(s) URL: {value}'
+  base_url_invalid_hint: 'It should look like https://api.example.com/v1. To send it to the model, pass it as a positional argument: epoch "{value}"'
+
+# `--help` text for individual subcommands. A whole command moves at once —
+# never just the newly added flag: half-catalog, half-hardcoded help renders as
+# half English, half Chinese on a non-Chinese machine. Only `epoch web` has moved
+# so far (2026-08-14, the change that added --json).
+cli:
+  web:
+    summary: 'Start the local Web UI server (opens a browser by default)'
+    opt_port: 'Port to listen on (default {port}; 0 = let the OS pick)'
+    opt_host: 'Address to bind (default {host}; a non-loopback address requires --token)'
+    opt_token: 'Auth token (a fresh random one per start by default)'
+    opt_no_open: 'Do not open a browser'
+    opt_json: 'Print one JSON line on stdout (url / host / port / token) and route every other message to stderr. For host programs spawning the CLI; pair it with --port 0 so no port has to be hardcoded'
+  config:
+    summary: 'Manage provider and model configuration'
+    keys: 'provider / model / permission / shell / models.utility / budget.<field>'
+    keys_unset: 'model / permission / shell / models.utility / budget.<field>'
+    value: 'Value'
+    show: 'Show the current configuration (apiKey and other secrets are masked)'
+    opt_raw: 'Do not mask; print as-is'
+    path: 'Print the config file path (use it to confirm where multi-profile writes land)'
+    get: 'Read a single setting; exits 1 when unset'
+    set: 'Set a single setting'
+    unset: 'Remove a setting and fall back to the default'
+    secret: 'Show the credential storage backend; --export dumps credentials back to .env (plaintext, asks twice)'
+    opt_export: 'Write credentials back to ~/.epoch/.env (plaintext!)'
+    schema: 'Write the settings JSON Schema into <project root>/.epoch/schemas/ for editor completion and validation'
+    schema_paste_hint: 'Add this line at the top of .epoch/settings.json (relative path, no network):'
+  # The sandbox section of `epoch doctor` (plan 46 PR-2, cli/src/commands/status.ts).
+  # The sandbox is a *probed* value, not a configured one, so every line here comes
+  # from a real probe. `code_exec` and `terminal` get separate lines: they share the
+  # backends but not the boundary, and collapsing them into one "sandbox: enabled"
+  # is exactly the hole plan 46 exists to close.
+  doctor:
+    sandbox_head: 'Sandbox:'
+    sandbox_absent_tools: 'Neither code_exec nor terminal got OS-level isolation — no usable backend was detected on this machine'
+    sandbox_backend: 'Backend: {backend} ({platform})'
+    sandbox_code_exec: 'code_exec: {detail}'
+    sandbox_terminal: 'terminal ({mode}): enforcement {enforcement}'
+    sandbox_partial_devnull: 'Why partial: a POSIX shell needs /dev/null writable or it cannot even start'
+    sandbox_writable: 'Directories terminal may write to under workspace-write:'
+    sandbox_covers: 'Tools inside the sandbox: {tools}'
+    sandbox_excludes: 'Not in the sandbox (easily mistaken for being in it): {tools}'
+    # What to say once that list is empty (the normal case after plan 46 PR-4/PR-5).
+    # The second half is NOT optional: this is the one line on this screen that could
+    # be read as "terminal is safe now", and this tier only buys an OS-enforced
+    # *write* boundary — reads and network are both wide open.
+    sandbox_excludes_none: 'All three terminal paths (pipe / background / PTY) are inside the sandbox. Note it only governs writes: reads and network are unrestricted'
+
+  # The `epoch schedule` command family (plan 45 §6). Move a command's help text
+  # over **as a whole**: half catalog and half hardcoded reads as half English
+  # and half Chinese on a non-Chinese machine.
+  schedule:
+    summary: 'Manage scheduled tasks (the OS fires them; epoch does not need to stay open)'
+    add: 'Create a scheduled task and register it with the OS scheduler'
+    list: 'List all scheduled tasks'
+    show: 'Show every field of a task, including "what it will do without asking"'
+    enable: 'Enable a task'
+    disable: 'Disable a task (it stays in the OS scheduler, just stopped)'
+    rm: 'Delete a task and unregister it from the OS scheduler'
+    run: 'Run it once right now — no need to wait for the next trigger to find out it is broken'
+    logs: 'Show the last few runs'
+    fire: 'Invoked by the OS scheduler. You can run it too, but it is non-interactive: anything needing approval is recorded as an IOU'
+    doctor: 'Check that the tasks in the database and the ones registered with the OS still match'
+    arg_id: 'Task id (a leading prefix is enough)'
+    opt_name: 'Task name'
+    opt_prompt: 'The prompt — what the agent should do when it fires'
+    opt_daily: 'Every day at this time (HH:mm, 24-hour)'
+    opt_weekly: 'These weekdays, comma separated (MON,WED,FRI); needs --at'
+    opt_monthly: 'These days of the month, comma separated (1,15); needs --at'
+    opt_every: 'By interval: 5m/10m/15m/20m/30m/1h/2h/3h/4h/6h/8h/12h, anchored at midnight'
+    opt_once: 'Date for a one-shot run (YYYY-MM-DD); needs --at'
+    opt_at: 'Time of day (HH:mm). Required by --weekly / --monthly / --once'
+    opt_start: 'Start of the active window (inclusive)'
+    opt_end: 'End of the active window (inclusive)'
+    opt_workdir: 'Working directory. Defaults to ~/.epoch/automation/<id>/; it never inherits the current directory'
+    opt_model: 'Model for this task; omit to use the default'
+    opt_permission: 'Permission level — the same four words as the chat pill: plan / default / acceptEdits / bypass'
+    opt_allow_tool: 'Skip approval for this tool while unattended; repeatable'
+    opt_allow_operation: 'Skip approval for this operation type while unattended; repeatable'
+    opt_allow_rule: 'Skip approval for operations matching this rule while unattended; repeatable (e.g. terminal(git status))'
+    opt_max_turns: 'Maximum turns (default 20 — tighter than the interactive 50)'
+    opt_budget: 'Required: the most this single run may spend, in USD'
+    opt_timeout: 'Wall-clock timeout in minutes (default 15) — the only ruler that catches a hung command'
+    opt_disabled: 'Create it stopped instead of enabling it right away'
+    opt_bypass_ack: 'Acknowledge that under "skip all checks" the task will do anything without asking'
+    opt_fix: "Append this run's IOUs straight into the task allowlist"
+    opt_limit: 'How many recent runs to show'
+    opt_tail: 'Print the body of the most recent recording'
+    opt_home: 'Data directory for this run. Processes started by the OS scheduler cannot see EPOCH_HOME / EPOCH_PROFILE, so registration bakes this into the command line'
+    opt_repair: 'Re-register from the database (the database is the source of truth)'
+    opt_prune: 'Unregister OS tasks that no longer exist in the database'
+
+# Marketplace catalog could not be fetched (core/src/plugin/marketplace.ts).
+# `fetch_failed_private` is its own entry rather than an appended hint: a private
+# repo answers the raw URL with 404, which looks exactly like a typo — that
+# sentence is the most valuable part of this error.
+# Startup diagnostic: the plan approved in the resumed session is back in context
+# (runtime/src/build.ts). The plan outlives the process, but the card that showed
+# it was drawn by the previous one — without this line the user sees an empty
+# screen and a model that inexplicably follows some outline.
+plan:
+  restored: 'Restored the plan you approved last time'
+
+# The two startup diagnostics for session search (runtime/src/tools.ts).
+# The "all workspaces" line is only printed when the switch is on — that is a
+# decision to widen what the model can read, and the user should see it in
+# `epoch doctor`. The default (off) prints nothing; one more line would be noise.
+session_search:
+  unavailable: 'session store unavailable; session_search not registered'
+  all_workspaces: 'cross-workspace search enabled (config.sessionSearch.allWorkspaces)'
+
+# Server-side error bodies for `epoch web` (packages/server). The server can call
+# t() because runtime re-exports it — server may not depend on infra directly.
+web:
+  session_store_unavailable: 'session persistence is unavailable (SQLite did not start); this action cannot be performed'
+  title_required: 'title must be a non-empty string'
+  session_cooled: 'this session was cooled down (too many active sessions); reopen it and send again'
+  # `POST /api/sessions` could not build a session (the multi-session factory, plan 30 §6.3).
+  # 503 rather than 500: the service itself is fine, one of its dependencies is not
+  # configured yet. A 500 sends people off to restart the server; the actual next step
+  # is to configure a key — so the sentence has to say that.
+  session_unavailable: 'cannot create a new session: this process has no usable model provider (configure an API key and retry, or run epoch model)'
+  # `POST /api/sessions` was given an agent name this process does not know
+  # (the base for decision 20 ②). 400 rather than 404: the URL is fine, a value in
+  # the body is not (same shape as `bad-workspace`). And never silently fall back to
+  # "no role" — same criterion as `--agent`: the user named an identity, so running an
+  # agent with a different tool set is the worst possible outcome.
+  # The name has to appear in the sentence: the browser's copy of the agent list may
+  # be stale (the user just deleted a .md), and without the name the screen only says
+  # "no such agent" while the list in front of them still shows it.
+  session_unknown_role: 'no agent named "{role}" — the list on the capabilities page may be stale; refresh and pick again'
+  workspace_must_be_string: 'workspace must be a non-empty string (an absolute path on the server); omit the field entirely to bind no workspace'
+  workspace_locked: 'this session is already bound to a workspace and cannot be changed ({detail}). Start a new session to use another directory — switching mid-session would make the relative paths in earlier tool calls point at a different directory, with nothing in the record saying where the switch happened'
+  # The only refusal of `GET /api/sessions/:id/workspace` (decision 18, 2026-08-15).
+  #
+  # ⚠️ It is **not** the same thing as "this session uses no workspace", and that
+  # distinction is the whole reason the endpoint exists: bindings live in process
+  # memory and are never persisted, so a session left over from an earlier process
+  # has no record here. Answering "not bound" would put "no workspace" on screen —
+  # a lie about a session that spent yesterday working inside a real repository.
+  # The code reuses `not-live-session` (same as `rewind_not_live`): the user's next
+  # step is likewise "bring this session back into this process".
+  workspace_not_live: 'this process does not hold that session, so it cannot say where it is bound — workspace bindings live in process memory and are never persisted (bring the session back into this process to get an answer)'
+  # The refusals of the new `POST /api/sessions/:id/workspace` (plan 55 PR-1, 2026-08-17).
+  #
+  # The first two are about the **shape of the request body** (exactly one of two
+  # branches), which is why they are separate from `workspace_must_be_string`, which
+  # is about the path: that one's next step is "try another path", these two are
+  # "change which fields you sent". "Both branches given" must never pick one and run
+  # it — the two branches lead to two entirely different sessions.
+  workspace_bind_both: 'give either root or none, not both: the first means "bind to this directory", the second means "explicitly use no workspace" — they are mutually exclusive'
+  workspace_bind_neither: 'give either root (an absolute path on the server) or none: true (explicitly use no workspace)'
+  # ⚠️ This restates decision 18's "a binding cannot be changed" on the new endpoint,
+  # and it has to cover **both** "already bound to a directory" and "already chose no
+  # workspace". The latter looks like an empty slot, but it is a state the user
+  # explicitly picked (a member of the "Tasks" group in decision 18's sidebar).
+  # Letting it be changed means giving a workspace to a session that said it wanted
+  # none — after its earlier relative paths were already resolved somewhere else.
+  workspace_already_decided: "this session's workspace is already settled (either bound to a directory or explicitly set to none) and cannot be changed — start a new session to use another directory"
+  # The two refusals of `deferWorkspace` on `POST /api/sessions` (plan 55 PR-1).
+  # Both are **no silent downgrade**, same criterion as `workspace_must_be_string`
+  # above: quietly dropping a field the client explicitly sent hands it back a
+  # session that is not the one it thinks it asked for.
+  workspace_defer_with_root: 'give either workspace or deferWorkspace, not both: the first means "bind it at creation time", the second means "create it now and pick the directory later"'
+  workspace_defer_needs_create: 'deferWorkspace requires create: true — a request without create means "give me the existing session", whose workspace was settled at assembly time'
+  # The four refusals of `GET /api/workspaces/dirs` (plan 55 PR-2, 2026-08-17).
+  #
+  # ⚠️ **"no permission" and "does not exist" get separate sentences AND separate
+  # status codes** (403 / 404): this is the one place on this endpoint that must be
+  # split — the user's next step differs completely (fix permissions or use another
+  # entry point vs. go find where that directory actually is). Merged, the UI can
+  # only offer one hint that is wrong in both directions. All four carry the path:
+  # this is a local UI, and being specific beats being vague.
+  dirs_denied: 'no permission to list this directory: {path} (it is there, but this server process cannot read it)'
+  dirs_missing: 'no such path: {path}'
+  dirs_not_absolute: 'the directory to list must be an absolute path: {path} — there is no "current directory" on this route'
+  dirs_not_a_directory: 'that is a file, not a directory: {path} (pick the directory it lives in)'
+  # The five refusals of `POST /api/workspaces` (plan 55 PR-3, 2026-08-17).
+  #
+  # ⚠️ **"already exists" is a 409, not a reuse** — the most important line here.
+  # Pressing "New" and getting **somebody else's directory** is the most expensive
+  # mistake on this route: it may hold a CLAUDE.md, a git repo, all sorts of things,
+  # while the user believes they got an empty one. So the sentence has to offer both
+  # ways out (rename, or go pick it).
+  mkdir_exists: 'that directory already exists: {path} — pick another name, or go back to the list and select it ("New" never reuses an existing directory)'
+  # Say "no permission" outright rather than translating it into "could not create":
+  # the user's next step is either a different location or a permission change, and
+  # both start with knowing it was a permission problem.
+  mkdir_denied: 'no permission to create a directory here: {path}'
+  mkdir_parent_missing: 'the parent directory does not exist, so {path} cannot be created — create it first (this route never creates parents for you)'
+  mkdir_parent_not_absolute: 'the location to create in must be an absolute path: {parent}'
+  # A single segment only. Creating two levels (a/b) is two operations — accepting
+  # a/b would not cost one `recursive` flag, it would make "did that create one
+  # directory or two" something you have to read the implementation to know.
+  mkdir_bad_name: 'the directory name must be a single segment with no path separators, and cannot be . or ..: {name}'
+  # An errno we do not recognise. **Treat it as a 500** — calling an unfamiliar
+  # failure "bad path" sends the user off to fix an input that was fine.
+  mkdir_failed: 'could not create that directory: {path}'
+  # The two refusals of `POST /api/sessions/:id/plan` (the write half of plan 35).
+  #
+  # ⚠️ **`plan_mode_bootstrap_only` was deleted on 2026-08-16** (together with the
+  # `permission_` and `model_` members of the same family). It said "only the
+  # session opened first can enter plan mode", and plan mode became one per
+  # session in that round (plan 30 §14) — the 409 gate is gone, so the sentence
+  # can never be sent again. **Keeping it would be worse than deleting it**: a
+  # string with no call site can only be found to be false by a full-text search.
+  plan_mode_unavailable: 'this process has no plan mode (the permission layer did not start)'
+  plan_mode_bad_action: 'action must be one of {actions}'
+  # The two refusals of `POST /api/sessions/:id/permission` (decision 20 ③, 2026-08-15).
+  #
+  # ⚠️ `permission_bootstrap_only` was deleted on 2026-08-16, same reason as the
+  # plan one above. Worth recording: the old comment here argued they should stay
+  # **two keys** because "when the two scopes are narrowed independently, a merged
+  # sentence would start lying on one of the two paths". That call was right —
+  # the narrowing just arrived more tidily than expected: both went on one day.
+  permission_unavailable: 'this process has no permission layer, so the level cannot be changed (what you see is the value from the config file)'
+  # ⚠️ **This sentence must not mention a level being disabled by managed
+  # settings** — that is not a bad request but a legal one refused by policy on
+  # this machine, and it travels as 200 + `ok:false` (see
+  # `WirePermissionSetResponse`). This one only says "that is not a level name".
+  permission_bad_level: 'level must be one of {levels}'
+  # The four refusals of checkpoint rewind (the web half of plan 27).
+  #
+  # `not_live` is **a different thing** from the entry above, and only since
+  # 2026-08-15 can the two be told apart: this one says "this process does not
+  # hold a runtime for that session" (left over from an earlier process, or
+  # cooled down). Checkpoints are **per session** — as long as this process still
+  # holds it, it can be rewound. The user's next step is therefore "bring this
+  # session back", the opposite of the plan / model one.
+  rewind_not_live: 'this process does not hold that session, so it cannot be rewound — a rewind has to come from the process running it (bring the session back first)'
+  rewind_bad_turn: 'turnIndex must be a non-negative integer (take it from the checkpoint list)'
+  rewind_bad_scope: 'scope must be one of {scopes}'
+  # This one does **not** degrade silently to "overwrite nothing": a client that
+  # misspells it would believe the overwrite succeeded while the user's own edits
+  # are in fact still there. "Overwrite everything" is deliberately inexpressible here.
+  rewind_bad_overwrite: 'overwrite must be a list of file paths (the ones the user confirmed one by one); omit the field entirely if there is nothing to overwrite'
+  rewind_no_checkpoint: 'no checkpoint for turn {turn}'
+  # The five refusals of `POST /api/sessions/:id/settings` (the write half of plan 43 §7).
+  #
+  # ⚠️ There is deliberately **no** `not_live` entry here, unlike plan / rewind above:
+  # those two change the state of the session running in this process, while this one
+  # changes **a config file on disk** — which has nothing to do with which session is
+  # running. An extra gate would only stop people editing settings from a history session.
+  settings_write_bad_request: 'the body needs key (the dotted path of the setting), layer (one of {layers}) and value (string / number / boolean)'
+  settings_write_unknown_key: 'that key cannot be edited here. This path writes model and maxTurns only — every other setting has just the built-in and user layers, and putting it in a settings file does nothing'
+  settings_write_bad_value: "that value is outside this setting's domain (maxTurns must be a positive integer, for one), so nothing was written"
+  # Not overwriting is deliberate: a broken file is something the user is in the
+  # middle of editing, and stringifying a fresh one over it would delete that work.
+  # This sentence carries the path because the only next step is to edit it by hand.
+  settings_write_unwritable: 'this layer does not recognise how {path} is written (or the file is already broken), so it was left alone — please edit that file yourself'
+  settings_write_io: 'writing {path} failed: possibly no write permission, or the directory could not be created'
+  # The three rejections of `POST /api/sessions/:id/model` (plan 26, the web half).
+  #
+  # ⚠️ Only the ones where the *request itself* does not stand up live here.
+  # "cannot switch" (no credential / no image support / window too small) is
+  # **not here and must not be**: those three are a 200 + `ok:false` payload,
+  # and what travels the wire is a **code plus parameters** — the wording lives
+  # in the browser's two catalogs (`web.ui.model.rej_*`). The criterion is in
+  # the file header of `server/src/model.ts`.
+  #
+  # ⚠️ `model_bootstrap_only` and `model_unavailable` were both deleted on
+  # 2026-08-16. The first mirrors the plan/permission ones (model selection is
+  # one per session now, so the 409 gate is gone); the second was the body of the
+  # 503 `no-model-control` gate, and that gate is gone too — when the provider
+  # layer fails to come up this process builds **no sessions at all**, so the
+  # first gate answers 404. Criterion in the file header of `server/src/model.ts`.
+  model_bad_request: 'model must be a non-empty string (a model name, or provider/model); pass null to go back to the configured one'
+  # The single kind of rejection each of the two capability-page action endpoints
+  # has (plan 56).
+  #
+  # Both **must carry the name**, same reason as `session_unknown_role` above: the
+  # list the browser is holding may already be stale (mcp.json edited, a skill
+  # directory moved away, while this tab was opened before that). Without the name
+  # the screen just says "no such thing" while the list still shows it.
+  #
+  # ⚠️ For both, the next step is a **refresh**, not a retry — they say "the list
+  # you are holding has drifted from this process". "That attempt did not succeed"
+  # is a different thing: 200 + `ok:false`, worded in the browser's own catalogues
+  # (criterion on `WireMcpReconnectResponse`).
+  mcp_unknown_server: 'This process has no MCP server named "{name}" — connections are built from mcp.json at startup, so the list you are holding may be stale. Refresh and look again.'
+  skill_unknown: 'No skill named "{name}" — the capability page list may be stale. Refresh and look again.'
+  # The only rejection `POST /api/providers/:type/models` has. NOT "could not
+  # discover models" — that has four tiers and all of them are 200 + a `status`
+  # code, worded in the browser's own catalog (`web.ui.model.probe_*`).
+  provider_unknown: 'No provider named "{name}" is supported — the selectable set is a fixed list, so the one you are holding may be stale. Refresh and look again.'
+
+  # The five rejections of `POST /api/mcp` (2026-08-18). Worded like the mkdir
+  # trio (`mkdir_bad_name` and friends), **not** like the `/api/schedules` family:
+  # that one turns business validation into 200 + a list of **codes**, on the
+  # criterion "the same check should read as two different sentences on the CLI
+  # and in a form" — and this path has **no CLI counterpart** (there is no
+  # `epoch mcp add` anywhere in the repo).
+  #
+  # ⚠️ The {detail} in `mcp_add_unwritable` is **the underlying sentence verbatim**
+  # ("the top level is not a JSON object", "EACCES: permission denied", …); this
+  # layer does not rewrite it. It is the only thing on screen that can say what is
+  # actually wrong with the user's mcp.json.
+  #
+  # ⚠️ The name-clash line must spell out that **all three sources count** (the
+  # file, the host, plugins) — otherwise the user stares at an error about a name
+  # that appears nowhere in their own mcp.json.
+  #
+  # ⚠️ `mcp_add_lan_exposed` is the only line in this group with security meaning.
+  # Its three hard requirements are the same as `role_add_lan_exposed` (say why /
+  # say the way forward / never phrase it as "insufficient permissions"), but the
+  # **why half is not the same sentence, so do not copy it**: there it is "the body
+  # enters the context of every future turn", here it is "adding one writes a
+  # command that gets launched, and it governs every future epoch process on this
+  # machine". Copying says half of it.
+  #
+  # ⚠️ It is also **not shared** with `mcp_config_lan_exposed` (those three are
+  # deliberately shared): that sentence is about refusing even to *read*, because
+  # the env in that file is cleartext, and this path never sends a single byte of
+  # that file back. The two ways forward do coincide — because they really are the
+  # same two.
+  mcp_add_lan_exposed: 'MCP servers cannot be added in this mode — the server was bound outside the loopback interface with --host, so we cannot tell whether the browser sending this request is on this machine. Adding one writes "which executable to launch" into mcp.json; that server is started right away, and every future epoch run on this machine (including the CLI and the TUI) starts it too. Two ways forward: edit that file directly on the machine running the server, or drop --host and restart.'
+  mcp_add_bad_transport: 'Transport must be one of stdio / sse / http'
+  mcp_add_bad_name: 'The server name "{name}" cannot be used — it becomes part of the tool name verbatim, so only names starting with a letter or digit and made of letters, digits, _ and - are accepted (48 max). A hand-written mcp.json is not subject to this; only names added from the UI are.'
+  mcp_add_taken: 'There is already an MCP server named "{name}" (it may be in your mcp.json, or it may come from the host or a plugin) — pick another name. Nothing is overwritten and nothing is auto-renamed here: overwriting would delete the block you wrote by hand, and renaming would make the tool names disagree with what you typed.'
+  mcp_add_unwritable: 'Nothing was written to mcp.json — {detail}. Go and look at that file first.'
+
+  # `GET` / `PUT /api/mcp/config` and `POST /api/mcp/config/apply` (2026-08-18).
+  #
+  # ⚠️ There is **no** "not valid JSON" line in this group — that sentence is
+  # forwarded verbatim from runtime's `mcp_config.invalid_json` (it carries the
+  # character position from JSON.parse, and this layer cannot do better).
+  #
+  # ⚠️ `mcp_config_lan_exposed` is **shared by all three endpoints**, including the
+  # GET: the way forward is the same for all three, and three copies of one
+  # decision would drift. It must say why even *reading* is refused — the env in
+  # that file is cleartext, and the same file decides which executable is launched.
+  #
+  # ⚠️ `mcp_config_stale` must make clear that the next step is **not** a retry.
+  #
+  # ⚠️ `mcp_config_no_servers` guards against wiping out every MCP server with one
+  # slip, so it names the most common cause (`mcpServers` instead of `servers`) and
+  # says how to really empty the list.
+  mcp_config_lan_exposed: 'mcp.json can neither be viewed nor edited in this mode — the server was bound outside the loopback interface with --host, so we cannot tell whether the browser sending this request is on this machine. Environment variables in that file are stored in cleartext (they may hold secrets), and the same file decides which executable gets launched. Two ways forward: edit that file directly on the machine running the server, or drop --host and restart.'
+  mcp_config_unreadable: 'mcp.json could not be read — {detail}. Go and look at that file first.'
+  mcp_config_bad_body: 'This request body is wrong: text and revision must both be strings, and revision must be the one from the last read.'
+  mcp_config_stale: 'Nothing was written — the mcp.json on disk is no longer the one you read (your own editor may have just saved it, or the "Add server" form may have just inserted one). Writing over it would erase that change, so this stopped here: read it again and see what is on disk now.'
+  mcp_config_unwritable: 'Nothing was written to mcp.json — {detail}. Go and look at that file first.'
+  mcp_config_no_servers: 'Nothing was touched — the mcp.json on disk parses to zero servers and it comes with diagnostics: {detail}. Applying that would disconnect every MCP server you have, so this stopped here. The most common cause is writing the key as mcpServers instead of servers. If you really do want an empty list, write "servers": {} and press again.'
+
+  # `POST /api/roles` ("create an identity", 2026-08-18).
+  #
+  # ⚠️ Only **two** strings here, while that endpoint has six rejection branches —
+  # the other four (name / duplicate / tool names / not writable) are forwarded
+  # verbatim from the runtime side (`role_write.*`). Writing a second copy here
+  # would give the same rejection two wordings, and they would drift.
+  #
+  # ⚠️ `role_add_lan_exposed` is the whole point of that endpoint. Three hard
+  # requirements on the wording:
+  #   1. say **why** (the text enters the context of every future turn, and in this
+  #      mode we cannot tell who is sending the request);
+  #   2. say **the way out** (write the file on that machine / restart without
+  #      --host) — saying only "not allowed" leaves the user concluding it is broken;
+  #   3. **do not phrase it as "insufficient permissions"**: their credentials are
+  #      perfectly fine; it is this path that is closed in this mode.
+  role_add_lan_exposed: 'Identities cannot be created in this mode — the server was bound outside the loopback interface with --host, so we cannot tell whether the browser sending this request is on this machine. The body of an identity enters the context of every future turn (and its description enters the tool description of every delegation), so this path is only open under the default loopback binding. Two ways forward: go to the machine running the server and put a .md file in ~/.epoch/agents/, or drop --host and restart.'
+  role_add_bad_field: 'That field cannot be accepted: {detail}'
+
+  # The nine `/api/schedules*` endpoints (plan 45 PR-3).
+  #
+  # ⚠️ **This group only has two kinds: "this JSON is unreadable" and "the thing
+  # at this URL is not here".** Not one business validation lives here — an empty
+  # name, a 7-minute interval, "skip every check" without a workspace: those go
+  # out as 200 + `issues` (a list of **codes**), worded in the browser's own
+  # catalogue (`web.ui.auto.issue.*`). Two criteria: server-side Chinese never
+  # goes over the wire (same as `wire-settings`); and the same validation
+  # **ought to read differently** in the CLI and in the form — the CLI says
+  # "--budget is required", and there is no --budget in a form.
+  schedule_unknown: 'No scheduled task with id {id} — the list you are holding may be stale (another tab or the command line may have deleted it). Refresh and look again.'
+  schedule_run_unknown: 'This task has no run {runId} in its history — run history is capped (the most recent 20 per task), and older ones get pruned.'
+  schedule_bad_field: 'The {field} field has the wrong type (this JSON is unreadable — it is not that the value is unreasonable).'
+  schedule_bad_permission: 'Unknown permission level — this route only accepts the levels on the permission pill.'
+  schedule_bad_trigger: 'Cannot read this trigger: kind must be cron / interval / once, and each one must carry its own fields.'
+  schedule_bad_operation: 'allowOperations contains an unrecognised operation type. Only these are accepted: {types}'
+  schedule_create_incomplete: 'Creating a scheduled task needs at least these five: name / prompt / permission / trigger / maxBudgetUsd.'
+  # ⚠️ This line is the wire-side face of the one deliberate piece of friction in
+  # the whole plan (§3.5): the server **does not fill in a default**. A fake
+  # default would make "woke up to $40" our fault, so a client that forgets to
+  # send it gets a 400 instead.
+  schedule_budget_required: 'maxBudgetUsd is required and has no default — a fake default would make "woke up to $40" our fault.'
+  schedule_fix_needs_run: 'runId is required: the IOUs hang off one particular run, and the rules are read from that row in the database (rules echoed back in the request body are not accepted).'
+
+  # ---- Browser UI strings (plan 43 §2.9) ----
+  #
+  # This group is a different animal from the ones above: those are error bodies
+  # the server generates and sends over the wire; these are strings the frontend
+  # itself hard-codes. Vite compiles them into the web bundle at build time
+  # (`packages/web/vite/locales.ts`), and web's own `t()` reads them.
+  #
+  # ⚠️ After switching to English, the server-generated half (the entries above,
+  # diagnostic details, permission denial reasons) still follows the language of
+  # the `epoch web` process. A Chinese-locale server plus an English browser is
+  # therefore half-and-half. That is the **expected shape** for this round
+  # (plan 43, acceptance 31), not a missed translation.
+  ui:
+    conn:
+      connecting: 'Connecting'
+      open: 'Connected'
+      reconnecting: 'Reconnecting'
+      closed: 'Disconnected'
+
+    topbar:
+      untitled: 'Untitled session'
+      resyncing: 'Catching up'
+      # ⚠️ Used in two places: the aria-label/title of the topbar toggle, and the
+      # aria-label of the inspector `<aside>` (at ≤1180px it is a drawer, and
+      # focus lands on that root when it slides in). The toggle and the thing it
+      # toggles deliberately share one name.
+      inspector: 'Inspector'
+      # The sidebar toggle plus the sidebar `<aside>` aria-label — same as above.
+      # ⚠️ That toggle **only exists at ≤860px** (on wide screens the sidebar is a
+      # permanent column, so pressing it would change nothing on screen — decision
+      # 20 ①); the criterion is on `TopbarProps.sidebar` in `shell/topbar.tsx`.
+      # "Sessions sidebar", not "Menu": that column holds the session list, new
+      # session, capabilities, settings and usage, and "menu" would both fail to
+      # say what is in it and collide with the `.menu` popover primitive.
+      sidebar: 'Sessions sidebar'
+      # The line next to the model name in the topbar (plan 30 §10.4 item 2 → §6).
+      #
+      # ⚠️ 2026-08-16: both the key and the sentence changed. The old one
+      # (`model_one_per_process`) said "there is one model selection per process,
+      # go back to the session you opened first" — model selection is now one per
+      # session, so that half is a **lie**, and it goes away together with the
+      # code it quoted (`bootstrap-session-only`).
+      #
+      # What survives is the second half of the old sentence, and it was always
+      # the harmful one: this cell falls back to `config.model` (the default for
+      # this launch) only when **this process is not running that session**, and
+      # then it cannot say which model that session actually used.
+      # ⚠️ Never say "switch models elsewhere": that session is not running at
+      # all, so there is nowhere to switch it.
+      model_not_live: 'This session is not running in this process; the name here is the default model for this launch — it may not be the one it actually used.'
+
+    # The model-switch menu in the topbar (plan 26, the web half).
+    #
+    # ⚠️ This group is the *wording of the rejections*; what travels the wire is
+    # a code plus parameters (`WireModelRejection` / `WireModelCaveat`) — the
+    # server does not send a single word of prose. The criterion is in the file
+    # header of `server/src/model.ts`. The three rejections each say their own
+    # thing and must never collapse into one "cannot switch": their next steps
+    # are completely different (go configure a key / pick a model that reads
+    # images / clear the context first), and saying that next step is the entire
+    # point of these sentences.
+    model:
+      # This menu changes which model **this session is using right now** — not
+      # the settings-page value, which is the default for the next start-up.
+      label: 'Model this session is using right now'
+      trigger: '{model} — open to switch model'
+      current: '{provider} · in use'
+      reset: 'Back to the configured one'
+      # **There is no model list**; the criterion is in the file header of
+      # `shell/model-menu.tsx`: the set of names a provider accepts is open, so
+      # a closed list would omit exactly the ones users need to type by hand.
+      placeholder: 'Type a model name, then Enter'
+      rej_no_credential: 'no usable credential for {provider}, cannot switch. Set {env}, or run epoch model to configure it'
+      # The `envVar: null` case: that provider has no agreed environment variable
+      # name, and leaving the placeholder in would send the user off to set a
+      # variable literally called "null".
+      rej_no_credential_bare: 'no usable credential for {provider}, cannot switch. Run epoch model to configure it'
+      rej_images: '{model} does not read images, and this session already has some. Switching does not clear the context, so the next turn would be rejected by the provider'
+      rej_context: 'context is already at {used}, past the {model} window ({window}). Start a fresh session, or pick a model with a bigger window'
+      cav_context_tight: 'switched, but context is already at {used} — close to the {model} window ({window}), so it may not last many turns'
+      cav_no_tools: 'switched, but {model} does not support tool calls — it can only chat, and cannot read or write files'
+      # Provider picker + model suggestions (`web/src/model/picker.tsx`, shared by
+      # both surfaces).
+      #
+      # ⚠️ These are the five "what do we draw when discovery comes up short" tiers.
+      # NONE of them may be merged into one "no models available" — the next step
+      # differs per tier: wait / go configure a key / check the network / just type.
+      pick_provider: 'Provider'
+      pick_provider_none: 'Pick one…'
+      provider_no_key: '{label} (no key configured)'
+      probe_probing: 'Asking {provider} which models it has… no need to wait — you can just type one above.'
+      probe_no_key: 'No key configured for {provider}, so its model list cannot be fetched. Set {env}, or run epoch model.'
+      probe_no_key_bare: 'No key configured for {provider}, so its model list cannot be fetched. Run epoch model to set one up.'
+      probe_failed_cache: 'Could not reach {provider} (network / bad key / that base URL has no /models). Below is what was fetched last time, which may be stale — you can also just type a name.'
+      probe_failed_static: 'Could not reach {provider} (network / bad key / that base URL has no /models). Below is the built-in list, which may be stale — you can also just type a name.'
+      probe_empty: '{provider} returned no model names at all, and the built-in list is empty too — just type one.'
+      probe_ok: 'Got {count} from {provider}'
+      # ⚠️ This line is the VISIBLE form of "the model tier is not a closed list".
+      # Without it, a column of names reads as the complete set.
+      suggest_note: 'These are fetched suggestions, not the full set — new or self-hosted models will not be here. You can still just type one.'
+      refresh: 'Re-fetch'
+      refresh_hint: 'Bypass the cache and ask this provider again'
+
+    # The top row of the sidebar plus the workspace menu hanging off it (plan 30
+    # acceptance 8).
+    newsession:
+      # ⚠️ No "⌘N" chip, even though the design draft has one: browsers keep
+      # ⌘N / Ctrl+N for themselves (new window), the keydown never reaches the
+      # page, and preventDefault cannot stop it. Drawing an unpressable shortcut
+      # chip is the same thing as drawing a button that does nothing (decision
+      # 20 ①). Full reasoning in session/new-session.tsx.
+      open: 'New session'
+      # ✅ 2026-08-17 (plan 55 PR-1): the workspace menu that used to hang off this
+      # row **moved wholesale to the composer's bottom bar** (where decision 18 draws
+      # it), so its five lines moved with it, under
+      # `web.ui.composer.workspace_pick*` — `menu_label` / `here_current` /
+      # `no_workspace` / `no_workspace_detail` / `list_note`, wording unchanged.
+      #
+      # ⚠️ **Do not add new workspace copy here.** This row is now a plain action
+      # (one click gives you a new session) and says nothing about the directory —
+      # that is the bottom bar's job. Full reasoning in session/new-session.tsx.
+
+    # The directory picker (plan 55 PR-2, 2026-08-17) — the second-level view inside
+    # the workspace menu. This is what "Open a local folder" in the draft opens.
+    dirpick:
+      back: 'Back'
+      # The anchor screen. **Not "root"**: it lists three groups of "places you
+      # probably want" (home / the server process's cwd / known workspaces), not the
+      # filesystem root. Never make people start crawling from `/` — that is the one
+      # thing this kind of picker always gets shouted at for.
+      anchors: 'Common places'
+      up: 'Up one level'
+      # Deep directories genuinely take time, so draw this line instead of leaving a
+      # gap — a gap reads as "there is nothing here".
+      loading: 'Loading…'
+      # "This level has no subdirectories" is true, and it has a next step (pick this
+      # level itself).
+      empty: 'No subdirectories here — pick this one, or type a path below'
+      # ⚠️ **Truncation has to be said out loud**: silently cutting the list reads as
+      # "this is all of it", and the user will conclude their directory is not here.
+      # Reasoning lives on the server's `omitted` field.
+      omitted: '{count} more not listed at this level (1000 max per level) — type a path below to reach them'
+      # The "show hidden directories" checkbox (2026-08-18). ⚠️ Two strings, because
+      # they do not say the same thing: the plain one says "this is the rule this list
+      # follows", the one with the count adds a **checkable fact** — N were just held
+      # back at this level. Same reasoning as `omitted` above: silent filtering reads
+      # as "this machine has no such directory", and `~/.claude` is a directory people
+      # really do want to pick.
+      #
+      # ⚠️ Wording is "hidden directories", not "dot directories"/"dotfiles": the
+      # former is the word Finder and Explorer already taught the user. And **not
+      # "hidden files"** — this endpoint lists no files at all.
+      show_hidden: 'Show hidden directories (starting with .)'
+      show_hidden_count: 'Show hidden directories (starting with ., {count} here)'
+      # An unreadable row is **drawn but not clickable**. This goes in the title: a
+      # greyed button only says "you can't", not "why" — and the why comes from file
+      # permissions on the machine running the server.
+      unreadable: 'no permission to enter this directory: {path}'
+      into: 'Enter {name}'
+      # "I have worked here before". ⚠️ It is **not** "this is a git repository" —
+      # that would need a git call, and this level may hold a thousand directories.
+      known: 'visited'
+      # The second entry point. It costs nothing and covers two things you cannot
+      # click to: deep paths, and the case where the user already knows exactly where
+      # they want to go. (Dot directories used to be on that list too; since
+      # 2026-08-18 the checkbox above covers them — typing a path only occurs to
+      # someone who already knows what is missing.)
+      # ⚠️ **No pre-validation on this side** — validation belongs to the server's
+      # existing bind() gate; pre-validating means two copies of the same rule, and
+      # they always drift.
+      manual_label: 'Or type an absolute path'
+      manual_hint: 'e.g. /Users/you/work/repo'
+      manual_go: 'Use this'
+      # "New workspace" (plan 55 PR-3). The draft makes this a modal; here it is a
+      # row at the bottom of this view. Reasoning is decision 5 (the whole draft has
+      # exactly one modal left, and this is it): the picker is already open, and
+      # "where to create it" is precisely the level on screen — another overlay
+      # would just cover it up.
+      new_label: 'Create a directory here'
+      new_hint: 'e.g. my-project'
+      new_go: 'Create'
+      # ⚠️ This line has to be on screen **before** the button is pressed. The draft
+      # modal used to say "a newly created directory is trusted by default"; that
+      # half was ruled out (plan 55 §2.6, two criteria: the trust write path is
+      # deliberately kept off the wire; and "it is a freshly created empty
+      # directory" does not hold up — empty is only true right now, and the very
+      # first thing to happen is an agent writing into it). What the user expects
+      # about trust as they press this is exactly what this line corrects.
+      new_trust_note: 'A new directory is treated exactly like an existing one: untrusted — its .epoch/settings.json and CLAUDE.md will not take effect. Run epoch trust add to grant trust.'
+
+    # The new-session screen (design draft tpl-blank). ⚠️ A blank screen is an
+    # invitation, not an "no data" notice — so when messages cannot be sent it
+    # draws nothing at all. Reasoning in session/blank.tsx.
+    #
+    # ⚠️ 2026-08-18: this screen shrank to **just `title`**. The eyebrow, the
+    # lede, the three seeds and the session-scope note are all gone — the
+    # ledger for each is in the file header of session/blank.tsx. Short version:
+    # the three seeds were "too prescriptive" (the user's words), narrowing
+    # "what is this agent for" down to "it edits code", on the very first
+    # screen someone sees. **Do not add them back.**
+    blank:
+      title: 'What would you like to do?'
+
+    sidebar:
+      search: 'Search sessions'
+      capability: 'Identities · Skills · Connectors'
+      # The fourth destination in the top-level nav (plan 45 §7.1). **Placement
+      # is product hierarchy** (decision 14): buried in settings, scheduled tasks
+      # read as a config option.
+      automation: 'Automation'
+      settings: 'Settings'
+      session: 'Session'
+      usage_session: 'Session usage'
+      usage_run: 'Last run usage'
+      cost: 'Spend'
+      cost_of: '~${spent} / ${limit}'
+      cost_est: 'Estimate'
+      tasks: 'Background tasks'
+      tasks_of: '{running} running / {total}'
+      diagnostic: '{module}: {detail}'
+
+    slist:
+      # Three groups; the test is "what can this row actually say", not importance.
+      # ⚠️ 'Tasks' is decision 18's `none` state ("explicitly chose no workspace") —
+      # not a catch-all bucket. Sessions left over from an earlier process used to
+      # land here too, which announced a binding decision they never made.
+      tasks: 'Tasks'
+      spaces: 'Spaces'
+      # Third group (2026-08-18): the rows whose wire field says `unknown`.
+      #
+      # ⚠️ 2026-08-19 this group narrowed: the test moved from "`live: false` with
+      # no workspace" to the explicit `unknown` state on the wire, so it now holds
+      # only rows older than session-DB v7 (both columns NULL). Sessions that were
+      # bound to a space — or that explicitly chose no workspace — go back to their
+      # space / to Tasks after a restart. The line below is unchanged; it is now
+      # more accurate than it was.
+      unknown: 'Earlier sessions'
+      # Not decoration — this line is the whole reason the group exists. Same
+      # wording as the composer's cell (`composer.workspace_unknown_hint`).
+      unknown_hint: "This process can't say where these worked — not that they have none"
+      awaiting: 'Needs you'
+      running: 'Running'
+      # Shared by the sidebar row and the cross-session bar — same field
+      # (`WireSessionSummary.updatedAt`), so one string, not two.
+      # Was 'Started at' until 2026-08-16; session DB v4 added `updated_at`.
+      # Reads "last active", NOT "waiting for" — see the zh catalog for why.
+      updated_at: 'Last active'
+      count: '{count} sessions'
+      empty: 'No sessions yet'
+      no_match: 'No matching sessions'
+
+      # ---- Row overflow: delete / rename (acceptance 15 / 16, 2026-08-15) ----
+      acts: 'Actions for “{title}”'
+      rename: 'Rename'
+      rename_label: 'Session title'
+      rename_do: 'Save title'
+      delete: 'Delete session'
+      delete_ask: 'Delete “{title}”?'
+      # Says what goes with it, not "are you sure" — the last clause is the point:
+      # the files it changed stay on disk, they just can't be rewound any more
+      delete_what: 'Its conversation, its checkpoints and its workspace binding all go, and none of it comes back — the files it changed stay on disk, but they can no longer be rewound.'
+      delete_running: 'It has a turn running right now; deleting aborts that turn.'
+      # "abandoned", not "denied" — hub.unregister() calls relay.abandon(), so the
+      # tool calls waiting on those requests never receive a denial
+      delete_awaiting: '{count} request(s) are still waiting on you; deleting abandons them rather than denying them.'
+      delete_do: 'Delete'
+      cancel: 'Cancel'
+      err_gone: 'That session is already gone.'
+      err_title: 'The title cannot be empty.'
+      err_no_store: 'The session store on this machine did not start, so sessions cannot be renamed or deleted.'
+
+    inspector:
+      patch: 'Patch'
+      output: 'Output'
+      artifact: 'Artifacts'
+      plan: 'Plan'
+      close: 'Collapse'
+      no_patch: 'No file changes in this turn yet'
+      locate: 'Locate'
+      locate_folded: 'That row is not on the timeline right now — most likely a fold bar has it collapsed. Expand that section and this button works.'
+
+    output:
+      title: 'Background tasks'
+      loading: 'Loading tasks…'
+      empty: 'This session has no background tasks right now'
+      st_running: 'Running'
+      st_exited: 'Finished, exit code {code}'
+      st_killed: 'Stopped'
+      st_failed: 'Failed to start'
+      dur: '{value} elapsed'
+      out_bytes: '{bytes} of output'
+      no_output: 'This task has produced no output yet'
+      omitted: 'Only the tail is shown; {bytes} before it were not sent.'
+      truncated: 'This task’s output went over the cap, so the beginning was dropped — it is gone, here and everywhere else.'
+      sampled: 'For tasks still running this is a single sample: it is re-read when the turn state changes, so anything produced in between waits for the next read.'
+
+    art:
+      files: 'Workspace changes'
+      files_note: 'Files this session created or modified in the workspace.'
+      files_empty: 'This session has not changed any file in the workspace'
+      no_space: 'This session has no workspace, so there are no workspace changes to show. Sessions left over from a previous process land here too — workspace binding only lives in process memory.'
+      loading: 'Loading the list…'
+      thin: 'Rows replayed after a refresh only carry the path and the write count: file contents are not persisted, so they cannot be opened.'
+      created: 'created'
+      changed: 'changed'
+      lines: '{count} lines'
+      writes: 'written {count} times'
+      tools: 'Tool artifacts'
+      tools_note: 'Binaries produced by tools: screenshots, audio, downloads.'
+      tools_empty: 'None in this turn. Today only MCP tools produce them (image / audio / resource.blob).'
+      tool_gate: 'They pass four gates before entering the context: capability, size, spooling, cost. On a model that takes no images, falling back is the main path — files are still listed here, but only a sentence about them reaches the model.'
+      back: 'Back to list'
+      readonly: 'read-only'
+      copy_path: 'Copy path'
+      by_created: 'created by {tool}'
+      by_changed: 'changed by {tool}'
+      kind_binary: 'binary'
+      kind_charset: 'encoding unknown'
+      opaque_binary: 'This looks like binary: it carries NUL bytes, or unprintable characters take up a large share of it. Laid out as text it is a screenful of replacement characters, so the content is not shown here.'
+      opaque_charset: 'This content is not UTF-8 — it may be GBK, UTF-16 or another encoding, and it may just as well be binary. The raw bytes never reach the browser (a patch frame carries an already-decoded string), so which one it is cannot be told from here. Not knowing means not guessing, and not drawing it.'
+      lossy: '{count} byte sequences did not decode. This file is most likely not UTF-8, and the original text at those spots is gone for good.'
+      clip_lines: 'Only the first {shown} lines are shown; this file has {total} lines.'
+      clip_chars: 'Cut off on line {line} — that line is too long. This file has {total} lines.'
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      binary_note: 'These files cannot be viewed here — open them with the program your system uses.'
+
+    plan:
+      empty: 'No approved plan in this session yet'
+      empty_hint: 'A plan the model hands in has to be approved once on the panel above the composer; only the approved one stays here.'
+      loading: 'Loading the plan…'
+      note: 'This is the one currently in effect — a revised plan replaces it wholesale, no history is kept here. To see how it evolved, look for the exit_plan_mode calls on the timeline.'
+
+    banner:
+      dismiss: 'Got it'
+      session_gone: 'This conversation is gone on the server — most likely it restarted, and a restart starts a fresh session. This one is not coming back, but you can pick up in the new one.'
+      session_gone_open: 'Go to the current session'
+      session_gone_stuck: 'This conversation is gone on the server, and right now it cannot even tell us which session is still usable — the server process has most likely stopped. Check on it in your terminal.'
+
+    thread:
+      thinking_label: 'Reasoning'
+      # The two-line header on an assistant turn (`.mhead`, decision 8's *first*
+      # moment, 2026-08-15). It sat undrawn for two months because it needs two
+      # true things — who is running, and how much this turn will cost — and a
+      # top-level session had no role while the estimate under-counted Chinese by
+      # 2–2.7x. Both premises were fixed in this round.
+      #
+      # The number reads `~12k`, not `12,431` (as drawn): the footer's number is a
+      # measured value reported by the provider, this one is computed *before*
+      # sending, and printing it to the last digit is false precision.
+      head_estimate: 'expected {tokens} tokens'
+      # This badge must not be removed. The comment in the mockup's index.html says
+      # "swapping in a real tokenizer comes first if you want this badge gone" — that
+      # is a necessary condition, not a sufficient one; do not read it backwards. The
+      # sufficient condition is in the same mockup's thread.css on `.est`: tokens have
+      # three moments and only the pre-run one is a guess. A real tokenizer fixed how
+      # far off the number is, not whether it is a guess.
+      head_est_badge: 'estimate'
+      live_thinking: 'Thinking'
+      live_running: 'Generating a reply'
+      live_tool: 'Running a tool'
+      live_waiting: 'Waiting for the model'
+      live_approval: 'Waiting for your decision'
+      live_question: 'Waiting for your answer'
+      live_aborting: 'Stopping…'
+      live_spent: '{tokens} tokens so far'
+      queued: '{count} queued'
+      stop: 'Stop'
+      # Fold bar (2026-08-14). The three counts are why this row exists — see zh.yaml
+      fold_tools: '{count} calls'
+      fold_files: '{count} files'
+      fold_thoughts: '{count} thoughts'
+      fold_show: 'Show'
+      fold_hide: 'Hide'
+      gate: '{tool} is stopped here waiting for your decision. The chain below cannot pass this gate until then.'
+      tool_pending: 'Running'
+      tool_done: 'Done'
+      tool_error: 'Failed'
+      art_in: 'In the model context'
+      art_out: 'Not in the model context'
+      art_unknown: 'This stream does not say whether it entered the context'
+      art_tokens: '≈{count} tokens'
+      art_out_note: 'The model only received the line below; it never got the artifact itself.'
+      art_unknown_note: 'The gate verdict is not carried on this stream, so this is not guessing at it.'
+      art_no_file: 'Not spooled to disk — this artifact cannot be opened.'
+      art_download: 'Download {name}'
+      art_download_any: 'Download this artifact'
+      expand: 'Expand {count} more lines'
+      collapse: 'Collapse'
+      todo_title: 'Delivery checklist'
+      todo_count: '{done} / {total} done'
+      patch_of: 'Patch {path}'
+      patch_too_big: 'Too large to diff line by line; only the line counts are reported'
+      # The fourth state of a patch card: one side is not displayable text. Unlike
+      # the read-only preview (one whole file), a patch is a comparison — and the
+      # comparison itself goes wrong when one side decoded lossily, so this state
+      # reports no +N −M either. Full rationale in web/src/thread/patch.tsx.
+      patch_opaque_old: 'The version before this change cannot be drawn; the one after it is normal text.'
+      patch_opaque_new: 'The version after this change cannot be drawn.'
+      patch_opaque_both: 'Neither side of this change can be drawn.'
+      code: 'Code'
+      copy_code: 'Copy code'
+      copied: 'Copied'
+      note_model: 'Model: {model}'
+      note_compression: 'Context compressed ({count} messages)'
+      note_summary: 'Session ended after {duration}'
+
+      act_copy: 'Copy this reply'
+      act_rerun: 'Run this turn again'
+      act_quote: 'Quote this turn in the composer'
+      act_inspect: 'Open in the inspector'
+      facts_tokens: '{tokens} tokens'
+      facts_token_label: 'tokens'
+      facts_unknown: 'not reported'
+      facts_failover: 'failover'
+      facts_tools: '{count} tool calls'
+      facts_no_tools: 'no tools'
+      # The fifth action (the web half of plan 27). Text, not an icon: it is not an
+      # instant action (it opens a preview, you pick a scope and tick conflicts one
+      # by one), and it is the only one on this row that deletes files.
+      act_rewind: 'Rewind to before this turn'
+      # The mark a finished rewind leaves on the timeline. Note that "which turn"
+      # is NOT a field on WireRewindResponse — the quoted text comes from the
+      # timeline's own history (the turn the button was attached to), never from
+      # the response. Never write "turn N": turnIndex is a lazily assigned
+      # checkpoint number, not an ordinal of conversation turns.
+      rewound_to: 'Rewound to before the turn “{text}”'
+      rewound_here: 'Rewound to before this point'
+      # See the zh notes: this pair is for the failed branch only — the two lines
+      # above would be a lie there, and this mark sits on the causal timeline.
+      rewound_failed: 'Tried to rewind to before "{text}" — it did not go through'
+      rewound_failed_here: 'Tried to rewind to before this point — it did not go through'
+      # `title` for the little cancellation-reason chip (`.todo__why`). The reason
+      # text itself is the model's own words and never passes through here — this
+      # key only gives that text an identity.
+      #
+      # It is needed because a screen reader runs the two runs of text together:
+      # "Bump vitest while we're here you said don't touch versions" sounds like
+      # part of the task name. Visually the chip's box (and the fact that it
+      # trails a struck-through item) already says what it is; audibly nothing does.
+      #
+      # When there is no reason the whole chip is omitted, so this string never
+      # appears — we do not fall back to "no reason given" (decision 20 ①).
+      todo_why: 'Cancellation reason'
+
+      # "Nearly full" — the third of decision 8's three moments (2026-08-16), sitting
+      # after the "estimate" badge on the turn head. Four criteria are in the file
+      # header of web/src/thread/turn-head.tsx.
+      #
+      # Neither string may be written as a prediction ("will compact next turn"):
+      # the engine's numerator is the input+output accumulated step by step across
+      # this run, which is always >= the prompt estimate judged here. So the badge
+      # being lit does mean the engine is past the line, but the badge being absent
+      # does NOT mean nothing will be compacted. A prediction would make "no badge"
+      # read as "no compaction", which is false.
+      #
+      # Neither string may carry a number either. The `~64k` to its left is the very
+      # quantity being judged; the line itself (128,000 × 50% = 64,000) is printed by
+      # the settings screen.
+      head_ctx_line: 'at compaction line'
+      # Auto-compaction turned off, or the compressor never came up — for a user past
+      # the line the consequence is word for word the same: no automatic remedy. So it
+      # is the same sentence with a suffix, not a separate sentence.
+      head_ctx_off: 'at compaction line · no auto-compaction'
+
+    # The rewind preview panel (the web half of plan 27). The interaction is copied
+    # from the TUI's RewindPicker line by line — two hosts disagreeing on the
+    # defaults for this is the real risk.
+    rewind:
+      title: 'Rewind to before this turn'
+      loading: 'Reading this turn’s checkpoint…'
+      act_restore: 'restore'
+      act_delete: 'delete'
+      act_recreate: 'recreate'
+      act_skip: 'leave'
+      files_head: 'Will touch {count} file(s)'
+      files_none: 'Nothing to change (the files already match the snapshot)'
+      conflicts_head: '{count} file(s) changed after the agent left them — none are overwritten by default'
+      conflict_hint: 'Ticked ones get overwritten — those are your edits, not the agent’s'
+      drift_changed: 'changed since'
+      drift_unknown: 'old checkpoint, not sure'
+      scope_legend: 'What to rewind'
+      scope_files: 'Files only (the conversation stays, so it can try again)'
+      scope_conversation: 'Conversation only (the files stay)'
+      scope_both: 'Both'
+      scope_conversation_off: 'not supported by this checkpoint'
+      terminal_note: 'Only edits made by file tools are covered; files changed by commands run in the terminal are not'
+      incomplete: 'This checkpoint is incomplete (some files were never captured), so only part of it can be restored'
+      conversation_warn: 'I understand: rewinding the conversation really deletes the messages after this point — it is not undoable, and they are not merely hidden'
+      run: 'Rewind'
+      running: 'Rewinding…'
+      cancel: 'Cancel'
+      close: 'Got it'
+      failed: 'Rewind failed: {reason}'
+      failed_atomic: 'Not a single byte of the workspace was changed — the rewind is atomic, so a failure means nothing was touched.'
+      done_restored: '{count} file(s) restored'
+      done_deleted: '{count} file(s) deleted'
+      done_recreated: '{count} file(s) recreated'
+      done_nothing: 'Nothing to change (the files already matched the snapshot)'
+      done_skipped: '{count} of your own edits were not overwritten'
+      done_messages: '{count} message(s) deleted from the conversation (not undoable)'
+
+    dock:
+      title_permission: 'Needs your confirmation'
+      title_plan: 'Plan awaiting approval'
+      title_question: 'Needs a choice from you'
+      queue: '{count} more queued behind this'
+      queue_questions: '{count} more sets of questions'
+
+      act_file_read: 'read a file'
+      act_file_write: 'write a file'
+      act_command: 'run a command'
+      act_network: 'make a network request'
+      act_code_exec: 'run code in the sandbox'
+
+      fact_action: 'Action'
+      fact_target: 'Target'
+      fact_detail: 'Detail'
+      fact_reason: 'Reason'
+      target_none: '(none)'
+
+      allow_once: 'Allow once'
+      allow_session: 'Always allow this session'
+      allow_session_hint: 'until you quit'
+      allow_always: 'Allow permanently'
+      allow_always_hint: 'writes approvals.json'
+      deny: 'Deny'
+
+      plan_execute: 'Approve and execute'
+      plan_readonly: 'Approve, but stay read-only'
+      plan_revise: 'Let me revise it'
+      plan_execute_hint: 'permission returns to {level}'
+      plan_readonly_hint: "I'll do it myself"
+      plan_readonly_forced: 'you asked for read-only throughout'
+      note_label: 'Say what to change:'
+      note_placeholder: 'e.g. only touch core for now, leave tui alone'
+
+      q_free: 'None of these — my own answer:'
+      q_free_placeholder: '(optional) filling this in makes it the answer'
+      q_submit: 'Submit'
+      q_submit_partial: '{count} unanswered; it will be told you skipped them'
+      q_skip: 'Skip'
+      q_skip_hint: 'the model picks a default and says which'
+
+    crossbar:
+      approval_one: '“{title}” is waiting on one approval'
+      approval_n: '“{title}” is waiting on {count} approvals'
+      question_one: '“{title}” is waiting on one question'
+      question_n: '“{title}” is waiting on {count} questions'
+      cold: 'cooled'
+      cold_hint: 'the server is not holding it right now; opening it replays history'
+      more: '{count} more'
+      go: 'Go there'
+      # The caption for the age cell on the bar (2026-08-16). It used to read
+      # "Last active" (shared with the sidebar's `slist.updated_at`); it now reads
+      # the moment the session got blocked (`WireSessionSummary.pendingSince`), so
+      # the caption changed with it and the two cells no longer share a key.
+      # ⚠️ No placeholder — this is the title on the number, not a sentence around
+      # it. The number is `relativeTime()`'s "3 hours ago"; see zh.yaml for the
+      # judgement, including why the grain stops at minutes and not the mock's 2:07.
+      waited: 'Waiting since'
+
+    toast:
+      # Neutral on purpose — it covers both "finished cleanly" (green check) and
+      # "we don't know how it ended" (no sign at all). See zh.yaml for the judgement.
+      done: '“{title}” finished its run'
+      # The failure half (2026-08-15). One line per FinishReason, not one shared
+      # "didn't finish": hitting a budget cap and being refused by the model call
+      # for completely different follow-ups, and telling them apart without
+      # opening the session is the whole point of this corner.
+      max_turns: '“{title}” ran out of turns before finishing'
+      stalled: '“{title}” was going in circles and stopped'
+      aborted: '“{title}” was stopped mid-run'
+      filtered: '“{title}” was refused by the model'
+      budget: '“{title}” hit the budget cap and stopped early'
+      failed: '“{title}” hit an error'
+      go: 'View'
+
+    composer:
+      label: 'Message'
+      placeholder_idle: 'Say something… (Enter to send, Shift+Enter for a newline)'
+      placeholder_running: 'This turn is still running; what you send queues behind it'
+      placeholder_offline: 'Disconnected from the server, reconnecting…'
+      placeholder_approval: 'Waiting for you to confirm the action above'
+      placeholder_question: 'Waiting for you to answer the question above'
+      placeholder_no_session: 'No session yet'
+
+      # Four sentences for "you cannot write" (2026-08-15). ⚠️ One per cause,
+      # do NOT merge them: this used to be a single "history only" line, which is
+      # a concrete falsehood for the other three. Every line has to carry the
+      # next step — see `READONLY_KEY` in `composer/index.tsx`
+      #
+      # This one matters most: it is neither a history session nor one left over
+      # by a previous process — it is a freshly created session on a machine that
+      # is not configured yet. So the line also has to block the wrong next step
+      # (opening another session helps nothing: with no provider there is no live
+      # session anywhere). Wording matches the server's 503 for session creation
+      # (`web.session_unavailable` above) — same cause, likely seen both ways
+      placeholder_no_provider: 'No model provider is available on this machine — another session will not help; configure an API key (or run epoch model)'
+      # Left over from an earlier process AND unable to say where it worked
+      # (rows created before session store v7). Since 2026-08-19 "left over from
+      # an earlier process" alone no longer lands here: when the workspace
+      # decision was persisted, sending one message revives it server-side and
+      # the composer stays writable (rationale in web's `state/read-only.ts`).
+      # The wording narrowed with it — "history session, read only" would now be
+      # a concrete lie for the majority that can be resumed.
+      placeholder_history: 'This conversation cannot say where it used to work, so it cannot be picked back up — read it, or start a new one'
+      # The session is gone server-side. The exit lives on the banner, not here —
+      # this line only has to stop claiming it is a history session
+      placeholder_gone: 'This conversation is gone on the server; there is nothing to send to'
+      # The only hint beside the button, and it only shows while a turn is running
+      # (decision 22 ②: the hint changes, the button never does). The idle one used
+      # to read 'to send' right next to a button labelled Send; `placeholder_idle`
+      # above already says Enter sends, so it went away on 2026-08-18
+      hint_queue: 'to queue'
+      send: 'Send'
+      # Slash-command completion panel. This is the listbox's accessible name —
+      # screen readers announce it; nothing on screen shows it
+      commands_label: 'Custom slash commands'
+      # Heading above the expansion warnings. The warnings themselves are NOT
+      # here: they are engine text that varies with the user's own command file,
+      # so there is no finite set of codes to translate. See
+      # `WireCommandExpansion.warnings`
+      command_warnings: 'A few things to know about how /{name} expanded:'
+
+      attach: 'Add an image'
+      remove_attach: 'Remove {name}'
+      # The drop zone. Says what letting go will do, not that you are dragging —
+      # the user already knows the latter, they are the one doing it
+      drop_hint: 'Drop to add the image to this message'
+      # Placeholder while the file is being read. It sits inside a chip next to
+      # the file name, so it has to stay short
+      reading: 'reading…'
+      # Manual dismissal for the rejected list. Deliberately NOT a toast that
+      # disappears after three seconds: the user is mid-sentence, and an error
+      # that vanishes half-read is an error that was never said
+      reject_dismiss: 'Dismiss these'
+      no_workspace: 'No workspace'
+      # The third state (2026-08-15): **we asked, and this process says it cannot tell**.
+      # ⚠️ Do not merge it with the line above — "No workspace" is a definite
+      # statement, and the bug this cell had for a whole round was exactly that:
+      # stating something definite (the bootstrap session's directory) when it did
+      # not know. There is only one cause: the session was left over from an earlier
+      # process and this process has not picked it back up (the server answers 409
+      # `not-live-session`). "Not asked yet" is not this state — then the cell is
+      # not drawn at all.
+      #
+      # ⚠️ 2026-08-19 the wording changed: the old line claimed "workspace bindings
+      # are not persisted", which is now false. Session DB v7 stores the user's
+      # original decision, and the sidebar puts the session back in its own space.
+      # What is not persisted is the binding itself — it runs the trust gate and
+      # only happens when this process actually picks the session back up — so this
+      # cell still cannot say what it is bound to *right now*. ⚠️ Do not rewire this
+      # cell to read the stored decision: it renders trust state and the instruction
+      # file list right next to it, and neither has been computed yet.
+      workspace_unknown: 'Workspace unknown'
+      workspace_unknown_hint: 'This session was left over from an earlier process and has not been picked back up here — so this process cannot say what it is bound to right now'
+      # 2026-08-16 this cell became the door to the workspace-diff screen (plan 30
+      # PR-3). ⚠️ It sits on its own line **after the absolute path**, so it does not
+      # repeat the path — it only names the destination. A hand cursor cannot say what
+      # clicking does, and a second ago this cell was just a path.
+      workspace_diff_hint: 'Open to see what has changed in this directory'
+
+      # The fourth state (plan 55 PR-1, 2026-08-17): **created, no directory picked
+      # yet** — this cell draws a picker, exactly where decision 18 puts it.
+      #
+      # ⚠️ Four of the five lines below **moved here from `web.ui.newsession.*`**
+      # (the picker moved from the sidebar row to this cell); the wording is
+      # unchanged. Moving the keys rather than referencing them in place: a key's
+      # prefix in this repo says **where it is drawn**, and someone editing these
+      # lines would go looking for a sidebar menu that no longer exists.
+      #
+      # The trigger. **Says "pick", not "none picked"**: the other three states in
+      # this cell state facts, this one is an action, and the verb is the clearest
+      # difference between them.
+      workspace_pick: 'Pick a workspace'
+      # The menu has no visible title; this is the name a screen reader announces.
+      workspace_pick_label: 'Which workspace this session works in'
+      # Decision 7: "two things at once in the same repository is the norm".
+      workspace_here_current: '{name} (current)'
+      # The detail line of the "no workspace" item. Its title reuses `no_workspace`
+      # above — the menu item and the text this cell shows afterwards must match
+      # word for word.
+      #
+      # ⚠️ This corrects the design draft's blank-screen line ("you can still chat
+      # without picking one; to touch files pick one below"), which is false: with
+      # no binding the AgentLoop runs in the workDir captured at assembly time
+      # (runtime/src/session-factory.ts). No workspace is not a sandbox that cannot
+      # touch files.
+      #
+      # The second sentence is new in 2026-08-17: this choice **is final** (the
+      # server answers 409 for `none`, same as an already-bound directory). Without
+      # it users would read this as a setting they can revisit.
+      workspace_none_detail: 'Runs in the directory the server process started in — not a sandbox that cannot touch files. This choice is final.'
+      # Where the list comes from and where it ends. "New workspace" and "Open a
+      # local folder" are in the draft but not in PR-1 (plan 55 PR-2 / PR-3).
+      workspace_pick_note: 'The list is the directories recently used on this machine. To start a session somewhere new, run epoch there once first.'
+      # "Open a local folder…" (plan 55 PR-2, 2026-08-17) — the draft menu's 4th item.
+      #
+      # ⚠️ The previous round ruled this item out as "no exit for this shape in a
+      # browser", because the browser cannot produce a server-side absolute path.
+      # **The first half is right; the second half conflated "let the browser pick"
+      # with "let the server tell the browser which directories exist"** — the latter
+      # is an ordinary read endpoint.
+      #
+      # The detail line names **which machine** it lists. That is not filler under
+      # `--host 0.0.0.0`: the machine in front of the user and the one running the
+      # agent need not be the same one.
+      workspace_browse: 'Open a local folder…'
+      workspace_browse_detail: 'Walk down to a directory, or type an absolute path (lists directories on the machine running epoch)'
+      permission: '{level} permissions'
+
+      # The plan-mode switch (the web entry point for plan 35, 2026-08-15).
+      # ⚠️ `plan_mode_why` is the only full sentence on this row, and the question
+      # it has to answer is "why can't I write files" — a chip that only says
+      # "Plan mode" cannot answer it
+      plan_mode: 'Plan mode'
+      plan_on_hint: 'Enter plan mode: the model researches read-only and hands you a plan to approve; it touches no files meanwhile'
+      plan_off_hint: 'Leave plan mode and go back to the permission level you were on'
+      plan_mode_why: 'Read-only: the model can look and search but cannot change files; you get an approval when it hands in the plan'
+      reject_not_image: '{name} is not an image; this round only takes images'
+      reject_too_big: '{name} is {size} MB, over the {max} MB limit'
+      reject_unreadable: '{name} could not be read'
+      # A folder was dropped. "Not an image" would be a true statement that sends
+      # the user the wrong way — told about a `shots/` full of screenshots it reads
+      # as "images are not accepted here". Only the drop layer knows (see drop.tsx)
+      reject_directory: '{name} is a folder — open it and drag the images inside'
+      # This message is too big to send. The limit is not the UI's number: it is the
+      # server's request-body limit, and going over it destroys the connection there.
+      # So this has to be said *before* send is pressed, with both exits named
+      too_big: 'This message is {size}; one message carries at most {max}. Drop an image, or shorten the pasted text'
+
+      # The identity chip on that row (decision 20 ② / plan 57 §3.6, 2026-08-17).
+      #
+      # The chip prints the identity name itself and nothing else, so both of these
+      # are the half it cannot say out loud: what it is, and how to cancel it.
+      #
+      # ⚠️ Both carry `{role}`: a screen-reader user walking the control list only
+      # hears "remove", and cannot tell this chip from an attachment chip next to it.
+      #
+      # `expert_chip_title` must say **every following message**, not "this one" —
+      # that is the one semantic difference between this chip and every other chip
+      # in the app (it sticks until the × is pressed).
+      expert_chip_title: 'Every following message is answered by "{role}" — press the × on the left to cancel'
+      # The **session-level** identity cell on the composer footer (2026-08-18).
+      # ⚠️ Different thing from the chip above; this title exists to say so —
+      # both render as just a name, and without it people look for an × here
+      # (there is none: the identity cannot be changed mid-session).
+      identity_title: 'This session runs as "{role}". It was set when the session was created and cannot be changed.'
+      expert_remove: 'Stop letting "{role}" take over'
+
+    # The **permission-level** menu on the row outside the box (decision 20 ③, 2026-08-15).
+    #
+    # ⚠️ Its own `perm` group rather than folded into `composer` above: these lines
+    # belong to the **permission model itself** (the five-level table in
+    # `core/src/permission/by-level.ts`), not to the composer. If the settings-page
+    # segmented control ever gets a write endpoint it uses the same sentences —
+    # the design mock uses one wording in both places, and two copies drifting
+    # apart shows up as one level described two different ways on two screens.
+    #
+    # ⚠️ **The raw value still prints on the chip** (`composer.permission`); these
+    # are the sentences **inside the menu**. No overlap: the chip carries the word
+    # the user would type after `--permission`, the menu says what it opens up.
+    perm:
+      # The menu's accessible name. Screen readers announce it; it is not on screen
+      menu_label: 'Permission level'
+      # The five levels and their one-line explanations. **The first four are taken
+      # verbatim from the design mock** (design/web-ui/index.html, #permMenu);
+      # `auto` follows the table in core/src/permission/by-level.ts — the mock has
+      # no such entry, and why five are drawn here is argued in the file header of
+      # composer/permission-menu.tsx
+      lvl_plan: 'Read-only'
+      lvl_plan_detail: 'It can look and think. To touch files or run commands it hands you a plan first'
+      lvl_default: 'Ask when needed'
+      lvl_default_detail: 'Anything the rule lists mark ask gets asked, one by one. The default'
+      lvl_accept_edits: 'Auto-accept edits'
+      lvl_accept_edits_detail: 'File edits stop asking; commands still ask'
+      # ⚠️ This line has to name the actual difference from the level above: not
+      # "a bit more automatic" but **files outside the workspace and the network
+      # open up too**, leaving only non-read-only commands behind a prompt
+      lvl_auto: 'Trust its judgement'
+      lvl_auto_detail: 'Reading, writing and network stop asking, outside the workspace too; commands still ask for the ones that change things'
+      # ⚠️ "the whole rail turns red, deliberately uncomfortable" is the mock's own
+      # wording — **do not soften it**: it is this level's only brake, and getting
+      # this level wrong is expensive
+      lvl_bypass: 'Skip every check'
+      lvl_bypass_detail: 'Nothing is ever asked. The whole rail turns red, deliberately uncomfortable'
+      # That level does not exist on this machine (managed `disableBypassPermissionsMode`).
+      #
+      # ⚠️ This sentence **must give both the why and where to look**, per the mock's
+      # `.btn--pick[data-locked]` note: greying an item only says "not clickable",
+      # and the why comes from a machine-level managed-settings.json the user cannot
+      # find anywhere else in the UI. Where that file lives and which other switches
+      # it turns on belong to the security centre screen — so this points there
+      # instead of reciting them inside a 12px caption
+      blocked_managed: 'This machine has enterprise managed settings, and they turn off the "Skip every check" level. See Settings › Security centre for details'
+
+    fatal:
+      unauthorized: 'No access credential'
+      unauthorized_hint: 'Go back to the terminal running epoch web and reopen the tokenised URL it printed.'
+      offline: 'Cannot reach the local service'
+
+    settings:
+      title: 'Settings'
+      back: 'Back to session'
+      security: 'Security'
+      pane_model: 'Model & provider'
+      pane_memory: 'Memory & context'
+      pane_budget: 'Budget'
+      # The bodies of these two panes are `web.ui.tools.*` / `web.ui.about.*` below.
+      # "Tools" sits right after the security centre (`PANES` in
+      # `settings/index.tsx`): that screen is the rules themselves, this one is what
+      # those rules add up to for each individual tool right now
+      pane_tools: 'Tools'
+      pane_about: 'About'
+      appearance: 'Appearance'
+      appearance_lede: 'Affects this browser on this machine only. It is not written to config.yaml and does not follow an account — we have no accounts.'
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      appearance_note: 'Light and dark only. Colour carries meaning in this design (state, syntax, additions and deletions, permissions), so it is not user-configurable.'
+      theme: 'Theme'
+      theme_field: 'Colour scheme'
+      theme_system: 'Follow system'
+      theme_light: 'Light'
+      theme_dark: 'Dark'
+      theme_hint: 'When following the system it tracks prefers-color-scheme live, no reload needed. The system is currently {now}.'
+      lang: 'Language'
+      lang_field: 'Interface language'
+      lang_system: 'Follow browser'
+      lang_zh: '中文'
+      lang_en: 'English'
+      lang_hint: 'This only switches the frontend own strings. Diagnostics and messages returned by the server follow the language of the epoch web process, so they stay in Chinese after you switch to English.'
+
+    # Setting provenance and editing (plan 43 §7): the model & provider /
+    # memory & context / budget panes.
+    #
+    # ⚠️ The rule for this whole block used to be **do not promise it can be
+    # edited** (there was not one write control). Since 2026-08-15 the model and
+    # maxTurns rows really are editable, so the rule is now two:
+    #
+    # 1. The rows that still cannot be edited keep pointing at where to change
+    #    them rather than at a control on this page — they are the vast majority
+    #    (SettingsFileSchema allows only three keys).
+    # 2. For the two that can, every sentence has to state the consequence:
+    #    whether the write will be overridden, when it takes effect, and which
+    #    value this process is still using. Drop any one of those and the reader
+    #    concludes that "saved" means "that is the value now", which is false.
+    set:
+      no_session: 'No session yet. The two project-level settings layers follow the workspace, and the workspace is bound per session — with no session there is no "which .epoch/settings.json" to answer.'
+      loading: 'Reading setting provenance…'
+      unset: 'Not set'
+      why: 'Why this value'
+      chain_win: 'wins'
+      g_other: 'Other'
+      # "There is a list of keys a project can override" **has to be on screen**.
+      # Without it, a reader sees that other rows have no chain and concludes
+      # "that row is not built yet", then writes a key into .epoch/settings.json
+      # that will never take effect.
+      overridable: 'Only these keys can be overridden by the project, project-local, command-line or managed layers: {keys}. Every other setting has just two layers, built-in and user — putting one in .epoch/settings.json does nothing, and startup diagnostics will report it as an unknown config key.'
+      overridable_perm: 'The permissions entry on that list is three lists (allow / ask / deny) merged as a union rather than an override, so its provenance is per rule — see Security › Permission rules.'
+      # The managed-lock line **says why it cannot be changed** rather than
+      # greying a control out: greying only says "you cannot click this", and the
+      # why is not discoverable anywhere else — it comes from a machine-level file.
+      managed_locked: 'This one is set by the managed settings on this machine; changing it at the user or project level has no effect. That file is not writable by an ordinary user — ask an administrator.'
+
+      # ---- Editing a row (the write half of plan 43 §7) ----
+      #
+      # Only the model and maxTurns rows draw these controls; every other row
+      # does not even get the "Edit" button.
+      edit: 'Edit'
+      cancel: 'Cancel'
+      save: 'Save'
+      new_value: 'New value'
+      write_layer: 'Write to'
+      # The dirty chip. It is the entire cost of the "nothing counts until you
+      # press save" rule — without it a reader assumes what they typed is already
+      # on disk.
+      dirty: 'Unsaved'
+      # ⚠️ These two are the most important sentences on this screen, and they are
+      # on it **before** save is pressed. Saying "that last one got overridden"
+      # afterwards is correctly ordered and completely useless.
+      # The two are worded separately because the next step differs: one is to
+      # write a higher layer, the other is to trust the directory.
+      futile_shadowed: 'Writing to {layer} will have no effect: {by} sets this too, and it ranks higher, so on load it overrides what you write here. To make it take effect, write to {by} or above.'
+      futile_untrusted: 'This workspace is not trusted yet, so settings in {layer} are dropped wholesale on load (deny rules are the one exception) — writing there does nothing. Trust the directory under Security › Workspace & trust first, or write to the user layer instead: it does not go through the trust gate.'
+      # The three sentences of the receipt. The second one (what this process is
+      # still using) cannot be dropped: the row above still prints the old value,
+      # and without it the reader thinks the UI failed to refresh.
+      wrote: 'Written to {layer}: {value}'
+      wrote_stale: 'This process read the config once at startup and never re-reads it, so it is still using {value} — restarting epoch web is what switches it to the value you just wrote. Starting a new session will not do it either; the config is one per process.'
+
+      # ---- Model & provider ----
+      # ⚠️ 2026-08-18 trimmed. See the zh comment: two of the three sentences
+      # explained how this screen draws itself. The source-layer badge on each row
+      # says the same thing without a sentence pointing at it.
+      lede_model: 'The model and provider this process is using right now. To change: edit ~/.epoch/config.yaml, or run epoch model.'
+      k_model: 'Main model'
+      k_models_utility: 'Utility model'
+      h_models_utility: 'Used for chores like compacting context and titling sessions. Unset means everything goes to the main model.'
+      k_fallback_model: 'Fallback model'
+      k_fallback_providers: 'Fallback chain'
+      h_fallback_providers: 'Tried in this order when the main provider is unreachable.'
+
+      # ---- Memory & context ----
+      lede_memory: 'The first two decide how much fits in a turn and how many steps it may take; the last two decide what happens when it no longer fits. Setting a context window larger than the model really has buys you a 400.'
+      k_context_length: 'Context window'
+      # ⚠️ Reworded 2026-08-17: the old line ("a configured value wins") had it
+      # backwards. Assembly uses `getCapability(config.model).contextLength`;
+      # this row only takes over when that lookup throws (the catch arm of
+      # runtime's `resolveModelCapability()`). Read literally, the old line told
+      # people they could raise this number to compress less often — it never
+      # takes effect, and the compression line below has always been computed
+      # from the window the engine actually compares against, not from this row.
+      h_context_length: 'Only used as a fallback when the model metadata cannot be read; when it can, metadata wins and a configured value has no effect. The compression line below uses the window the engine actually runs on.'
+      k_max_turns: 'Max steps per turn'
+      h_max_turns: 'How many tool calls the model may make in one turn. On reaching the cap it stops and finishes its answer.'
+      k_compression_enabled: 'Compact when nearly full'
+      h_compression_enabled: 'Compaction rewrites earlier messages into a summary; the originals stay in the session store and the model can search them back. A note is left in the thread afterwards.'
+      k_compression_threshold: 'Compact at'
+      h_compression_threshold: 'Compaction starts once the prompt reaches this fraction of the context window. Between 0 and 1.'
+
+      # The auto-compaction block (`settings/context-memory.tsx`).
+      # ⚠️ Same rule as the security centre: state the consequence, not the status word.
+      ctx_line: 'With this configuration, compaction starts once the prompt reaches {tokens} tokens — {percent}% of the {window}-token context window.'
+      ctx_line_caveat: 'That is the line itself. Just after a compaction, or once several compactions in a row have failed, crossing it will not compact yet.'
+      ctx_off: 'Auto-compaction is off. When a long session hits the context window there is no automatic rescue — that turn simply fails, and the context does not shrink on its own. Manual /compact is unaffected by this switch and still works.'
+      ctx_no_switch: 'These two rows cannot be changed here, same as the two above: only three keys can be overridden by project-level config (the list below), and compaction is not one of them — otherwise a repository could quietly let long sessions opened inside it run into the window. Change it by editing ~/.epoch/config.yaml yourself:'
+      ctx_restart: 'Restart the epoch web process for this to take effect — it reads the config once at startup and never re-reads it.'
+
+      # ---- Budget ----
+      lede_budget: 'Amounts only appear in the UI once a cap is configured. With no cap these rows read "Not set", which is also the default.'
+      k_budget_max_cost: 'Spend cap'
+      k_budget_max_tokens: 'Token cap'
+      h_budget_max_tokens: 'With both rulers configured, the gate reports whichever is tighter.'
+      k_budget_warn_at: 'Warn at'
+      h_budget_warn_at: 'Percent. Warns once, on crossing — not every turn.'
+      k_budget_unknown_pricing: 'When the model has no pricing data'
+      h_budget_unknown_pricing: 'block stops the call, warn lets it through with a warning. With no pricing data the cost is "unknown", not 0, and the two must be handled separately.'
+
+    # The security centre (plan 42 PR-3 / decision 16): sandbox + permissions +
+    # workspace trust + policy, on one screen.
+    #
+    # ⚠️ The rule for this whole block is **state the consequence, not the
+    # status word**. "Untrusted" tells a reader nothing; "nothing in its .epoch/
+    # is read" does. The reason this screen exists is to unfold the four
+    # heaviest, least-visible subsystems — unfolding them into jargon is not
+    # unfolding them.
+    sec:
+      # ⚠️ Reworded 2026-08-17. The old line claimed every item here is changed
+      # in a config file or on the command line — the permission mode is not.
+      # Its control sits on the composer row of this very UI
+      # (`composer/permission-menu.tsx`, decision 20 ③). Taken literally, the
+      # old line sent people to `config.yaml`, where the key decides which mode
+      # the *next* session starts in, not the one in front of them.
+      # ⚠️ 2026-08-18 trimmed. The old text spent two sentences on this page's
+      # read/write nature and its own index. Someone opening "Security" wants to
+      # know what the agent can touch. The 2026-08-17 note above still holds
+      # (the permission mode's entry point is special) — it now lives in
+      # `perm_where`, right next to that field.
+      lede: 'What this agent can touch right now, and what is holding it back.'
+      no_session: 'No session yet. Three things here are bound per session: the workspace, its trust verdict, and the project-level policy directory that follows that trust — with no session there is no "which one" to answer.'
+      loading: 'Reading security status…'
+
+      # ---- The four status cards ----
+      card_sandbox: 'Sandbox'
+      card_perm: 'Permission mode'
+      card_space: 'Workspaces'
+      card_rules: 'Active rules'
+      perm_d_managed: 'Locked by the managed layer; it cannot be changed on this machine.'
+      # ⚠️ Reworded 2026-08-17. "The result of merging every config layer" only
+      # held while nobody had touched the mode since the session opened. After
+      # one switch — or one trip in and out of plan mode — it pinned a config
+      # provenance onto a *runtime* value, and `settings/security-perm.tsx`
+      # item 3 says verbatim that this is worse than pinning none.
+      perm_d_local: 'The mode this session is running under right now — not the one written on disk.'
+      space_none: 'None known'
+      space_all_trusted: '{count} · all trusted'
+      space_untrusted: '{count} · {untrusted} untrusted'
+      space_at: 'Currently bound to {root}'
+      space_unbound: 'This session has no workspace.'
+      rules_n: '{count} permission · {policy} policy'
+      rules_none: 'None at all'
+
+      # ---- Sandbox ----
+      g_sandbox: 'Sandbox'
+      sb_field: 'Isolation backend'
+      sb_os: 'OS-level isolation ({backend})'
+      sb_process: 'Process isolation only ({platform})'
+      # ⚠️ When probing fails, **say probing failed**. Writing "enabled" here is
+      # the most expensive lie on this screen
+      sb_absent: 'Not probed'
+      sb_absent_d: 'The isolation layer itself did not come up, so it cannot even report what it found. This is not the same as "process isolation only".'
+      sb_absent_long: 'The isolation layer did not come up, so it cannot even report what it found. This is not the same as "process isolation only" — that is a known conclusion, and this is an unknown.'
+      # The last three are **three different next steps**. `backend-missing`
+      # deliberately does not interpolate {backend}: its value there is none,
+      # and "install none" would send the reader down a hole
+      sb_os_isolated: '{backend} on {platform} really does hold it in; there is nothing more to explain here.'
+      sb_backend_unavailable: '{platform} should have an implementation, but the probe failed — the backend is there and will not start.'
+      sb_backend_missing: '{platform} has an implementation but the dependency is missing: Linux needs bubblewrap, or the kernel may have disabled unprivileged user namespaces.'
+      sb_platform_unsupported: '{platform} has no implementation at all (Windows would need AppContainer and Node has no binding), so installing anything will not help.'
+      sb_covers: 'Tools that go through the sandbox'
+      # ⚠️ `sb_covers_hint` dropped 2026-08-18. It explained that the list comes
+      # from the server rather than being hardcoded in the browser — a note for
+      # whoever maintains this screen, not for whoever reads it. The rule now
+      # lives in the comments of settings/security-sandbox.tsx.
+      sb_covers_none: 'No tool goes through the isolation layer.'
+      sb_excludes: 'Explicitly outside the sandbox'
+      sb_excludes_none: 'No tool is called out as being outside.'
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      sb_excludes_why: 'The terminal does not go through the sandbox — the dangerous-command table and the permission gate hold it back instead. "Sandbox on" does not cover it.'
+
+      # ---- Permission mode ----
+      g_perm: 'Permission mode'
+      perm_field: 'Current mode'
+      perm_unknown: 'unreadable'
+      # ⚠️ 2026-08-18 trimmed; the "who overrides whom" half moved to the rule
+      # table's own lede, where it is that table's first fact rather than this
+      # field's second one.
+      perm_hint: 'What to do by default when in doubt.'
+      # ⚠️ Rewritten 2026-08-17 (plan 56 §1.3). The previous wording was "merging
+      # the config layers discards provenance and leaves only a value" — **that is
+      # now false**: the source layer is available, and the "Default" row below
+      # carries it. The real reason was always a different one; here it is.
+      # ⚠️ 2026-08-18: dropped. It explained why a row has *no* badge — a question
+      # nobody on screen was asking. The rule it protected (never hang a config
+      # source layer on the runtime row) now lives in the comments of
+      # `settings/security-perm.tsx`.
+      managed_field: 'Managed settings'
+      managed_on: 'This machine has a managed settings file, and it overrides every other layer.'
+      # **`present: false` is the norm**, so this branch is a flat statement
+      # rather than a warning — a UI that defaults to looking "locked by IT"
+      # makes readers think the mode cannot be changed at all
+      managed_off: 'This machine has no managed settings. That is the norm.'
+      managed_rules_only: 'The managed layer turned on "managed permission rules only": the three lists from every other layer are discarded wholesale.'
+      managed_bypass_off: 'The managed layer disabled the "skip all checks" mode.'
+
+      # ---- Permission rules ----
+      g_rules: 'Permission rules'
+      rules_empty: 'There are no permission rules at all; every decision falls through to the mode above.'
+      rules_no_exec: 'An allow rule that permits arbitrary code execution (terminal(python:*) and the like) is rejected with a warning at load time: it would route around the entire permission system.'
+      shadow_lede: 'Some rules are covered by others:'
+      shadow_shadowed: '{rule} never takes effect — {by} covers it entirely.'
+      shadow_partial: '{rule} has a hole punched in it by {by}. This is often deliberate.'
+      shadow_redundant: '{rule} adds nothing — {by} in the same list is already broader.'
+      # Layer numbers copied verbatim from core/src/config/sources.ts
+      layer_builtin: '① built-in'
+      layer_plugin: '①ᐟ⁵ plugin'
+      layer_user: '② user'
+      # Environment variables are **not** in the layer table in the docs, because
+      # they are not a settings layer: they override config.yaml during config
+      # loading, in the same slot as the user level — so project level beats them.
+      layer_env: 'environment'
+      layer_project: '③ project'
+      layer_project_local: '④ project-local'
+      layer_cli: '⑤ command line'
+      layer_managed: '∞ managed'
+      # ⚠️ Both catalogs hold the same value here on purpose: `unknown` is not
+      # "could not find it", it has an exact meaning — the rule is written in
+      # config.yaml itself and belongs to no settings layer. Printing the
+      # filename is far more useful than "unknown"; opening it is the next step
+      layer_unknown: 'config.yaml'
+
+      # ---- Workspace and trust ----
+      g_space: 'Workspace and trust'
+      known_field: 'Known workspaces'
+      known_empty: 'No directory has been asked about trust yet.'
+      known_hint: 'Trust follows the directory, not the session: bind one directory to two sessions and there is still only one trust verdict.'
+      ws_current: 'current'
+      # Four cases, because level and trusted can disagree, and the disagreement
+      # is exactly what the user needs. "You refused it" and "never asked" lead
+      # to completely different next steps, so they cannot collapse into one
+      ws_trusted: 'Trusted; its .epoch/ is read.'
+      ws_gate_off: 'The trust gate is off entirely (trust.enabled is false), so it counts as trusted.'
+      ws_refused: 'You refused it. Nothing in its .epoch/ is read.'
+      ws_unknown: 'Never asked. Its .epoch/ is read only after epoch trust add.'
+      bound_field: 'Current workspace'
+      unbound: 'This session has no workspace — a real state, not a pending lookup. Relative paths have no base, and project-level config, roles and skills are all left unloaded.'
+      main_field: 'Main root {name}'
+      main_hint: 'Relative paths resolve against the main root only. Project-level .epoch/settings.json, agents/, skills/ and policies/ are discovered here and nowhere else.'
+      loaded_files: 'Convention files loaded:'
+      loaded_none: 'This root has no convention files.'
+      skipped_line: 'These convention files exist, and not a word of them was read.'
+      skipped_why: 'They go into the system prompt, so they pass the trust gate first. Trust this directory and they will load:'
+      extra_field: 'Extra directories'
+      layer_add_dir: '--add-dir'
+      extra_none: 'No extra directories.'
+      extra_desc: 'path allowance only'
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      extra_hint: 'These only widen what can be read and written. They are not a second workspace: relative paths, project config, agents and skills all resolve against the main root only.'
+      unloaded_extra: 'The extra directories contain convention files, and none of them are loaded:'
+      unloaded_extra_way: 'This differs from the main root: trusting will not load them either, because "convention files in extra directories need their own trust verdict" has not been built. To make them count, make that directory the main root, or fold their content into the main root convention file.'
+      trust_only_deny: 'In an untrusted repository only the deny list of its permission rules applies — it can subtract, never add.'
+      trust_not_permission: 'Trust does not change the permission mode. It answers only "may files in this directory influence my instructions", never "should this action ask you" — the rule table above always decides that.'
+
+      # ---- Policy rules ----
+      g_policy: 'Policy rules'
+      policy_lede: 'A different thing from the permission rule table above: permission rules govern "should this ask me", policy rules govern "what does this tool touching this path count as" — and a deny can carry a sentence you wrote to the user.'
+      policy_none: 'No policy directory takes part in the scan.'
+      policy_user: 'User level, follows this machine.'
+      policy_project: 'Project level, follows the current workspace — another session means another repository.'
+      policy_n: '{count} rules'
+      policy_skipped: '{dir} was not loaded at all — that workspace is untrusted.'
+      policy_skipped_why: 'Not "deny only": not one rule was read.'
+      policy_asym: 'This is asymmetric with permissions, which is worth stating outright: permissions keep deny when untrusted, policy is dropped wholesale. Within one [[rule]] the tool name, path pattern and decision are bound together and deny_message is shown to the user verbatim — leaving a "deny still applies" opening would mean rewriting the semantics of somebody else rules one by one.'
+
+      # ---- Audit trail ----
+      #
+      # The sections above answer "what are the rules"; this one answers "what
+      # actually happened under them".
+      # NOTE: with zero entries the whole section is not drawn (decision 20 ①),
+      # which is why there is no empty-state string here — it is not missing.
+      g_audit: 'What it decided'
+      audit_lede: 'Verdicts made by the permission layer this run, newest first.'
+      # This line is the most important one in the section — do not drop it. It
+      # states what this ledger records and what it does not.
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      audit_scope: 'Only decisions the permission layer actually made — not every risky action.'
+      audit_col_at: 'Time'
+      audit_col_tool: 'Tool'
+      audit_col_type: 'Type'
+      audit_col_target: 'Target'
+      audit_col_outcome: 'Verdict'
+      audit_col_code: 'Reason'
+      audit_granted: 'Allowed'
+      audit_denied: 'Blocked'
+      audit_dropped: '{dropped} earlier entries have been evicted — this table keeps at most 500. What you see is not all of it.'
+      audit_ephemeral: 'This ledger lives only inside the running server process: never written to disk, never exported, never sent to telemetry. It is gone when the process exits, so it is not a complete history.'
+      # Twelve reason codes. Each has to answer "where do I look next", rather
+      # than restating the code in words.
+      audit_code_dangerous_command: 'Matched the dangerous-command list'
+      audit_code_sensitive_path: 'Matched the sensitive-path list'
+      audit_code_obfuscated: 'Command is obfuscated and nobody could confirm it non-interactively'
+      audit_code_rule_match: 'Matched a permission rule'
+      audit_code_policy_rule: 'Matched a policy rule'
+      audit_code_approval_cache: 'You already made the same decision for this target'
+      audit_code_sandbox_isolation: 'Decided by the measured sandbox isolation level'
+      audit_code_level_default: 'No rule matched, so it fell through to the permission level'
+      audit_code_headless_preauthorized: 'Non-interactive, matched the pre-authorization list'
+      audit_code_headless_unauthorized: 'Non-interactive, not pre-authorized'
+      audit_code_user_approved: 'You approved it'
+      audit_code_user_denied: 'You denied it'
+
+      # ---- Appended 2026-08-16 ----
+      #
+      # At the tail of this group rather than beside perm_hint: this round may only
+      # append to web.ui.sec.*, and inserting mid-group collides with other branches.
+      # On-screen order is decided by settings/security-perm.tsx, not by line order.
+      #
+      # This line landed once "should the mode cell grow a segmented control" was
+      # actually decided. The answer is **no** (argued in full in the file header of
+      # settings/security-perm.tsx, "three things deliberately not drawn" #1: that
+      # control already lives on the composer row, and the segmented control the
+      # design mock puts on the settings screen answers a different value).
+      # This screen's shape for a control it does not draw is "state the fact, then
+      # name the real path to change it" — this is that sentence.
+      #
+      # ⚠️ The "takes effect immediately, not written to disk" half cannot be dropped:
+      # every other row on this page answers "what is on disk / what happens next
+      # launch". Without it the user reads a mode switch as setting a new default
+      # (decision 20 ④).
+      # ⚠️ 2026-08-18 rewritten; it now covers **both rows** (and absorbed
+      # `perm_two_rows`). "Takes effect immediately" must stay — every other row on
+      # this page answers "what is on disk", so without it a mode switch reads as
+      # "I changed the default".
+      perm_where: 'Change the top one from the row under the composer — it takes effect immediately. The bottom one is where new sessions start: edit ~/.epoch/config.yaml and restart.'
+
+      # ---- Appended 2026-08-17 (plan 56 §1.3) ----
+      #
+      # The permission mode goes from one cell to two rows. ⚠️ **The second row is
+      # always drawn, not "only when the two differ"** — drawing it conditionally
+      # means users never learn there are two values here, and the first time it
+      # shows up they read it as something having gone wrong.
+      #
+      # "Now / Default" are short enough to align on a fixed-width column, and that
+      # alignment is the whole point: the eye has to spot the difference at a glance.
+      # Do not expand them into "Current mode / Default mode".
+      perm_now: 'Now'
+      perm_default: 'Default'
+      # Printed only when the two really differ — it explains **this particular
+      # difference**, it is not one of the two rows. Drawn unconditionally it would
+      # be a lie on the vast majority of (never-switched) sessions
+      perm_now_changed: '(changed in this session)'
+      # ⚠️ `perm_two_rows` dropped 2026-08-18. Both things it said now have closer
+      # owners: the two words above name the rows, and `perm_where` covers where to
+      # change each. Full reasoning in `settings/security-perm.tsx`.
+
+    # The capability screen (plan 42 PR-1).
+    #
+    # `g_*` are the source-layer group titles, shared by all three panes;
+    # `g_*_roles` / `g_*_skills` / `g_*_conn` are that group's note, written
+    # **per pane** — what a user looks for in the note line is always "where on
+    # disk does this group live", and the three panes do not share a directory.
+    cap:
+      title: 'Capabilities'
+      back: 'Back to session'
+      experts: 'Identities'
+      skills: 'Skills'
+      connectors: 'Connectors'
+      search: 'Search names, descriptions, tool names'
+      no_session: 'No session yet. These three panes follow the session — the "Project" layer depends on which workspace it is bound to.'
+      loading: 'Loading…'
+
+      experts_lede: 'An identity is a prompt, a tool set and a turn limit. The main agent hands work off with delegate_task; each sub-agent runs under its own identity in a separate context and only hands back the conclusion.'
+      skills_lede: 'Skills are progressively disclosed: only the one line below enters the context, and the body is read only when the model decides it is relevant. So the number at the end of each row is what it costs you every turn.'
+      connectors_lede: 'Connectors are where tools come from. The built-in ones ship with the program and cannot fail to connect; the MCP ones are yours to configure, which is why they carry a state.'
+
+      g_builtin: 'Built-in'
+      g_plugin: 'Plugins'
+      g_host: 'Host'
+      g_user: 'Mine'
+      g_project: 'Project'
+      g_mcp: 'MCP'
+
+      g_builtin_roles: 'Present out of the box, nothing to configure. Any of them can be overridden by a same-named entry in a layer below.'
+      g_plugin_roles: 'Brought in by installed plugins, from each plugin own agents/ directory.'
+      g_user_roles: '.md files under ~/.epoch/agents/ — one set per machine, shared by every project.'
+      g_project_roles: '.md files under this repository .epoch/agents/. They travel with the repository and override same-named entries above.'
+      g_host_roles: 'Shipped by the application this engine is embedded in; their names carry the prefix that application chose. They never show up in epoch plugin list — you did not install them, and only that application own UI can manage them.'
+
+      g_user_skills: 'One directory per skill under ~/.epoch/skills/, with the body in SKILL.md.'
+      g_plugin_skills: 'Brought in by installed plugins; their names are prefixed with the plugin name.'
+      g_project_skills: 'From this repository .epoch/skills/. They travel with the repository.'
+      g_host_skills: 'Shipped by the application this engine is embedded in; their names carry the prefix that application chose. They are upgraded together with that application, so they are read-only here.'
+
+      g_builtin_conn: 'Tool plugins compiled into the program. Only the tool count is shown, not every name — spelling out thirty-odd of them would push the MCP servers below off the screen.'
+      g_mcp_note: 'What you configured in ~/.epoch/mcp.json. Their tool names carry an mcp__<server>__ prefix.'
+      g_host_conn: 'Shipped by the application this engine is embedded in. They are not in your mcp.json, so you can neither edit nor remove them — only that application own UI can. Their names carry the prefix it chose, so their tool names start with mcp__<prefix>__<server>__.'
+      # The plugin group (plan 44 PR-3). It differs from the row above in exactly
+      # one way, and that difference is the whole reason this string exists: you
+      # *can* do something about these. Name both commands, or it reads the same
+      # as the "you cannot touch this" group.
+      g_plugin_conn: 'Brought in by an installed plugin, from the mcp.json at its own root. Names are prefixed with the plugin name, so their tool names start with mcp__<plugin>__<server>__. You cannot edit their contents, but epoch plugin list tells you which plugin brought them and epoch plugin disable turns the whole thing off.'
+
+      project_locked_roles: 'This workspace is not trusted yet, so we never read its .epoch/agents/ — which means we cannot even tell you how many there are. Trust it and come back.'
+      locked_line: 'This workspace is not trusted yet; none of its skills were read.'
+      locked_why: 'This is not "read then disabled" — that directory was never opened at all, which is why not even a count can be listed here.'
+      locked_gate: 'What the gate stops: you clone a repository, and whatever it carries in .epoch/ should not reach the model context before you have looked at it.'
+
+      summon: 'Use'
+      overrides_builtin: 'Overrides the built-in of the same name'
+      stat_tools: 'Tools'
+      stat_turns: 'Turn limit'
+      unlimited: 'unrestricted'
+      turns_global: 'global'
+      toolset: 'Tool set'
+      toolset_n: 'Tool set ({count})'
+      unlimited_hint: 'It declares no tools, so it gets every tool available this round.'
+      list_sep: ', '
+      narrowed: 'Some tools declared by {role} were outside the range of the layer above and have been dropped: {cut}. A tool allowlist can only narrow, never widen.'
+
+      skill_tokens: '{tokens} tokens'
+      no_toggle: 'There is no "turn this skill off" switch: as long as the file is in the directory, the line above enters the context. To drop one, move its directory away.'
+
+      # The skill-body screen (plan 56 §1.2).
+      #
+      # ⚠️ `skill_view_no_count` is the most important line on that screen, and it
+      # is **always drawn**: the thing users most easily get wrong is "did opening
+      # this count as using it?". It did not — that route does not touch the stats,
+      # and the score only counts times the model actually used it. It says "will
+      # not affect its score" rather than "does not count": the latter is our
+      # implementation word, the former is the consequence the user cares about.
+      # ---- Import skills (plan 42 §六, 2026-08-18) ----
+      # ⚠️ import_hint_local is the most important line on this screen, and it is
+      # always drawn, above the input: the mistake users make here is assuming
+      # this is an upload box. The full rationale for not accepting uploads is in
+      # core/src/skill/import.ts.
+      import_entry: 'Import a skill'
+      import_title: 'Import a skill'
+      import_lede: 'Import from the machine running the server. Accepts a folder containing SKILL.md, a two-level category/name skill tree, a .zip of either, or a single .md with frontmatter.'
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      import_hint_local: 'Give a path on the machine running the server — this route does not accept uploads.'
+      import_placeholder: '/Users/you/skills/my-skill'
+      import_path_label: 'Absolute path to import'
+      import_look: 'See what is there'
+      import_browse: 'Browse directories'
+      import_browse_off: 'Collapse'
+      import_pick_here: 'Use this directory'
+      import_count: 'Will import {count} skill(s) ({form})'
+      import_form_markdown: 'a single .md'
+      import_form_skill-dir: 'one skill folder'
+      import_form_tree: 'a skill tree'
+      import_form_archive: 'an archive'
+      import_files: '{files} extra file(s) · {bytes} bytes'
+      import_no_desc: '(no description — it will not appear usefully in <available_skills>, so the model is unlikely to pick it)'
+      import_conflict_refuse: ' ⚠️ A user-level skill of this name exists; this one will not be imported'
+      import_conflict_shadowed: ' ⚠️ A project-level skill of this name exists; importing it has no effect (project-level wins)'
+      import_confirm: 'Import these {count}'
+      import_issues: 'Worth a look:'
+      import_skipped: 'Skipped:'
+      import_done: 'Imported {count}, skipped {skipped}'
+      import_failed: 'Nothing can be imported from that path'
+      import_again: 'Import another'
+      skill_view: 'View body'
+      skill_back: 'Back to skills'
+      skill_view_no_count: 'Looking at this will not affect its score — that tally only counts times the model actually used it.'
+      # The truncation line goes **above** the body: finding out halfway through
+      # that you are not reading all of it is too late
+      skill_truncated: 'This SKILL.md is large ({bytes} bytes in total); below is only the first stretch of it. Open the file directly to read the whole thing.'
+      skill_bytes: '{bytes} bytes in total'
+
+      tool_count: '{count} tools'
+      # ⚠️ Changed 2026-08-18: this used to read "Add one to ~/.epoch/mcp.json, or
+      # run epoch mcp add" — and **`epoch mcp add` does not exist anywhere in the
+      # repo** (`epoch mcp` only has list / status / login / logout). A line that
+      # tells people to run something that cannot be run. It now points at the
+      # button this screen actually has.
+      mcp_empty: 'No MCP server configured yet. Use "Add server" above, or edit ~/.epoch/mcp.json directly.'
+      mcp_connected: 'Connected'
+      mcp_failed: 'Unreachable'
+      mcp_login: 'Login required'
+      mcp_retries: 'Retried {count} times.'
+      mcp_failed_why: 'Its tools are entirely unavailable this round. After fixing mcp.json you have to restart epoch web for it to reconnect.'
+      mcp_login_why: 'It is reachable but not authorised — reconnecting will not help however many times you try. Run this in a terminal:'
+
+      # The reconnect button (plan 56 §1.1).
+      #
+      # ⚠️ `mcp_reconnect_scope` is **always drawn, right next to the button** —
+      # this screen is session-scoped (the capability page fetches by :id) while
+      # MCP connections are process-wide. The user has to know **before pressing**
+      # that this touches other sessions, not be told afterwards (decision 20 ①:
+      # what is said about an action belongs where the action is taken).
+      #
+      # ⚠️ It also spells out that reconnecting does not re-read mcp.json: underneath
+      # it goes through the client built at startup. So this cures "the other end
+      # restarted / the network hiccuped", not "I just edited the config" — the
+      # latter still needs a restart, which is exactly what mcp_failed_why says.
+      mcp_reconnect: 'Reconnect'
+      mcp_reconnecting: 'Reconnecting…'
+      mcp_reconnect_scope: 'This affects every session in this process, not just the one you are looking at — the MCP connection is shared by the whole process. It reconnects using the mcp.json read at startup, so if you changed the config you still need a restart.'
+      mcp_reconnect_after_login: 'Run the login above first, then press here — new credentials only take effect after a reconnect.'
+
+      # The "Add server" screen (2026-08-18).
+      #
+      # ⚠️ `mcp_add_scope` is **always drawn, right next to the submit button** —
+      # same criterion as `mcp_reconnect_scope` above, but **this sentence has to
+      # reach one notch further**: reconnecting changes one connection in this
+      # process, adding changes the **on-disk ~/.epoch/mcp.json**, which every
+      # future epoch process on this machine (CLI / TUI / other hosts) will see.
+      # Copying the reconnect wording would say only half of it.
+      #
+      # ⚠️ `mcp_add_env_hint` says something unflattering but true: env lands on
+      # disk in plaintext. That is what mcp.json has always been; this path does
+      # not make it worse, and does not quietly make it better either — hiding it
+      # would let users believe a secret typed into the UI got encrypted.
+      #
+      # ⚠️ `mcp_add_offline` is **not a failure**: the config is on disk, the other
+      # end just is not up. Calling it a failure makes users try again, and trying
+      # again runs straight into "that name is taken".
+      #
+      # ⚠️ `mcp_add_locked`: when the server is bound outside the loopback
+      # interface, the top of this group shows **this paragraph, not a greyed-out
+      # button** (the "Add server" button is not drawn at all). Three hard
+      # requirements identical to `role_add_locked`, but the **why half belongs to
+      # this path alone**:
+      #   1. why — adding one writes "which executable to launch" into mcp.json,
+      #      and it governs every future epoch process on this machine (that half
+      #      is already in `mcp_add_scope`; **do not drop it here**);
+      #   2. two ways forward (edit that file on that machine / drop --host and
+      #      restart) — "not allowed" alone leaves the user concluding it is broken;
+      #   3. never phrase it as "insufficient permissions": their credentials are
+      #      fine; it is this path that is closed in this mode.
+      #
+      # ⚠️ **Do not copy role_add_locked** (that one is about writing into the
+      # system prompt), and do not copy mcp_cfg_locked either (that one is about
+      # refusing even to read, because env is cleartext). Two of these three appear
+      # on screen at the same time, so a copied sentence becomes a half-true one.
+      mcp_add: 'Add server'
+      mcp_add_title: 'Add an MCP server'
+      mcp_add_name: 'Server name'
+      mcp_add_name_hint: 'Becomes part of the tool names (mcp__<name>__…), so only letters, digits, _ and - are accepted.'
+      mcp_add_transport: 'Transport'
+      mcp_add_command: 'Executable'
+      mcp_add_args: 'Arguments (one per line)'
+      mcp_add_url: 'URL'
+      mcp_add_env: 'Environment variables (one KEY=value per line)'
+      mcp_add_env_hint: 'These lines are written to mcp.json in plaintext. Do not put secrets here — that path is epoch mcp login, where credentials are stored encrypted.'
+      mcp_add_scope: 'This is written to ~/.epoch/mcp.json — not just this conversation, and not just this process: every future epoch run on this machine (including the CLI and the TUI) will see it. It is connected right away, so its tools are usable this round.'
+      mcp_add_submit: 'Add it'
+      mcp_add_submitting: 'Connecting…'
+      mcp_add_cancel: 'Cancel'
+      mcp_add_done: 'Written to {path}.'
+      mcp_add_offline: 'The config was added, but this server is unreachable right now — the card above says why. If the config is right, press Reconnect once the other end is up.'
+      mcp_add_locked: 'MCP servers cannot be added from the UI in this mode: the server was bound outside the loopback interface with --host, and we cannot confirm your browser is on the machine running it. Adding one writes "which executable to launch" into mcp.json — that server is started right away, and every future epoch run on this machine (including the CLI and the TUI) starts it too, not just this conversation. To add one: edit ~/.epoch/mcp.json directly on that machine, or drop --host and restart.'
+
+      # The "see its config" screen — the raw mcp.json editor (2026-08-18).
+      #
+      # ⚠️ `mcp_cfg_scope` is **always drawn, above the buttons** (same criterion as
+      # mcp_add_scope), but it has to say **one thing more**: this screen can delete
+      # a server, and deleting one silently takes away capability other sessions are
+      # relying on. So it separates the two actions — save touches the file on disk,
+      # apply touches every session in this process.
+      #
+      # ⚠️ `mcp_cfg_saved` must **always be followed** by one of `mcp_cfg_not_live` /
+      # `mcp_cfg_apply_dirty`: "Written to X" on its own reads as "it took effect",
+      # and this request never touched a single connection in this process.
+      #
+      # ⚠️ `mcp_cfg_locked` follows the three hard requirements of role_add_locked
+      # (why / way forward / no blame), but for a **different reason**: the env in
+      # that file is cleartext, and the file also decides what gets executed.
+      #
+      # ⚠️ The five action lines are **explanations, not labels**: after pressing
+      # Apply the user must see at a glance which server was disconnected and which
+      # was left alone. `mcp_cfg_act_skipped` also has to state the timing gap.
+      mcp_cfg_open: 'See its config'
+      mcp_cfg_title: 'Edit mcp.json'
+      mcp_cfg_path: 'Config file path:'
+      mcp_cfg_dirty: 'Unsaved'
+      mcp_cfg_loading: 'Reading that file…'
+      mcp_cfg_absent: 'This file does not exist yet — the lines below are a template, not your content. It is only created for real when you press Save.'
+      mcp_cfg_editor: 'Contents of mcp.json'
+      mcp_cfg_locked: 'mcp.json can neither be viewed nor edited in this mode — the server was bound outside the loopback interface with --host, so we cannot tell whether the browser sending this request is on this machine. Environment variables in that file are stored in cleartext (they may hold secrets), and the same file decides which executable gets launched. Two ways forward: edit that file directly on the machine running the server, or drop --host and restart.'
+      mcp_cfg_reload: 'Read it again (discards your current edits)'
+      mcp_cfg_scope: 'There are two actions on this screen and they change different things. Save only writes ~/.epoch/mcp.json — every future epoch run on this machine (including the CLI and the TUI) reads it. Apply to this process is what touches the live connections, and that affects every session in this process, not just the one you are looking at. Once a server is removed, sessions using it can no longer call its tools from the next turn on.'
+      mcp_cfg_save: 'Save'
+      mcp_cfg_saving: 'Writing…'
+      mcp_cfg_apply: 'Apply to this process'
+      mcp_cfg_applying: 'Applying…'
+      mcp_cfg_apply_dirty: 'Save first — Apply reads what is on disk, and your version has not been written yet.'
+      mcp_cfg_close: 'Collapse'
+      mcp_cfg_saved: 'Written to {path}.'
+      mcp_cfg_not_live: 'The servers in this process are still running with the config read at startup — press "Apply to this process", or let it take effect on the next start.'
+      mcp_cfg_applied: 'MCP in this process has been rearranged to match what is on disk:'
+      mcp_cfg_applied_none: 'Nothing changed — what is on disk matches the servers running in this process verbatim.'
+      mcp_cfg_act_added: 'newly connected'
+      mcp_cfg_act_reconnected: 'config changed, reconnected with the new one'
+      mcp_cfg_act_removed: 'disconnected; its tools are unavailable from this turn on'
+      mcp_cfg_act_skipped: 'this name is taken by the host or a plugin, so it was not added in this process — your server wins on the next start'
+      mcp_cfg_act_unchanged: 'untouched (config unchanged)'
+
+      # The "create an identity" screen (2026-08-18) — the last of the three
+      # columns to get a write path.
+      #
+      # ⚠️ `role_add_locked` is the important one: when the server is bound outside
+      # the loopback interface, the top of this column shows **this paragraph, not a
+      # greyed-out button**. Three hard requirements:
+      #   1. say **why** (the text enters the context of every future turn, and in
+      #      this mode we cannot confirm the browser is on that machine);
+      #   2. say **the way out** (write the file on that machine / drop --host and
+      #      restart) — saying only "not allowed" leaves the user concluding it is
+      #      broken;
+      #   3. **do not phrase it as "insufficient permissions"**: their credentials
+      #      are perfectly fine; it is this path that is closed in this mode.
+      #
+      # ⚠️ `role_add_scope` is **always drawn, right above the submit button** (same
+      # as mcp_add_scope). It says **one extra thing that only this path has**: the
+      # text being written enters the model's context. Without that half sentence,
+      # users read "create an identity" as "add a local config entry".
+      #
+      # ⚠️ `role_add_desc_hint` must spell out that this field is **written for the
+      # main agent**. Otherwise users write a self-introduction, the main agent
+      # never delegates to the identity, and nothing on screen explains why.
+      #
+      # ⚠️ `role_add_tools_hint` must spell out that **empty = unrestricted**. An
+      # empty list means "none" elsewhere on this screen (the env field above);
+      # here it means the opposite.
+      role_add: 'New identity'
+      role_add_title: 'Create an identity'
+      role_add_name: 'Name'
+      role_add_name_hint: 'Lowercase letters, digits and hyphens only. It is both the file name and the word used to delegate work.'
+      role_add_desc: 'When to delegate to it'
+      role_add_desc_hint: 'This sentence is written for the main agent, not as a self-introduction — it decides whether to hand work over based on it, so describe when it should be used. It also enters the tool description of every delegation.'
+      role_add_prompt: 'Body'
+      role_add_prompt_hint: 'The passage this identity reads while it works. Leaving it empty is fine — then it only changes the identity line and the tool boundary.'
+      role_add_tools: 'Tool whitelist (one per line)'
+      role_add_tools_hint: 'Empty = unrestricted, it gets every tool available this round. Listing names restricts it to those. The names must match the ones on Settings › Tools.'
+      role_add_turns: 'Turn limit'
+      role_add_turns_hint: 'Empty = follow the global setting. 1 to 200.'
+      role_add_scope: 'This creates a .md file in ~/.epoch/agents/ — not just for this conversation, and not just for this process: every future epoch run on this machine (including the CLI and the TUI) will see it. ⚠️ Both passages above enter the model context ("when to delegate to it" on every single turn), so what you write here carries the same weight as what you say in a conversation.'
+      role_add_submit: 'Create it'
+      role_add_submitting: 'Writing…'
+      role_add_cancel: 'Cancel'
+      role_add_done: 'Written to {path} — go to that file to keep editing the body.'
+      role_add_locked: 'Identities cannot be created from the UI in this mode: the server was bound outside the loopback interface with --host, and we cannot confirm your browser is on the machine running it. The body of an identity enters the context of every future turn (and its "when to delegate to it" line enters the tool description of every delegation), so this path is only open under the default loopback binding. To add one: put a .md file in ~/.epoch/agents/ on that machine, or drop --host and restart.'
+
+      copy_cmd: 'Copy'
+
+      trusted_at: 'Trusted {root}'
+      untrusted_at: 'Not trusted {root}'
+      no_workspace: 'This session has no workspace bound'
+
+      summon_prefill: 'Have {role} do: '
+
+      open_session: 'New session'
+      open_session_here: 'Start a new session run by {role} in {root}; the conversation you are in stays exactly where it is'
+      open_session_nows: 'Start a new session run by {role}, with no workspace bound either; the conversation you are in stays exactly where it is'
+      open_session_failed: 'Could not start the session: {detail}'
+
+      # The card's third action (plan 57 §3.6, 2026-08-17): the **per-message** one —
+      # no prefill, no new session, it just pins this card to the chip on the
+      # composer. Which gate each of the three paths takes is documented on
+      # `ExpertsProps.canSummon`.
+      #
+      # The verb is picked to match the handoff marker written into the history
+      # (`agent_role.handoff`, "From this message on, \"x\" takes over."): whoever
+      # presses this button reads the same words in the transcript a moment later,
+      # and with two different verbs they cannot tell that line was their own doing.
+      take_over: 'Let it take over'
+      # Three words cannot carry the consequence, so title / aria-label spell it out.
+      # **"this conversation is untouched" may not be dropped**: of the three actions
+      # on this screen one edits the composer and one starts a whole new session,
+      # and this is the only one where nothing happens at all
+      take_over_title: 'From your next message on, "{role}" answers; this conversation is untouched'
+      # Already this one. The button stays, turns into a state and greys out — this
+      # screen covers the conversation entirely, so the chip is nowhere in sight and
+      # "which one is taking over" can only be said here
+      take_over_on: 'Taking over'
+      # ⚠️ The second half is **required**: the only way out is the × on the chip in
+      # the composer (the single such exit in the app), and it is invisible from this
+      # screen. Without it the user hunts this card for a switch that is not there
+      take_over_on_title: '"{role}" is taking over the messages that follow — to cancel, go back to the conversation and press the × on the chip above the composer'
+
+    # The workspace-diff screen (plan 30 PR-3, 2026-08-16).
+    #
+    # ⚠️ None of the five notes may be merged — the server itself keeps them as five
+    # distinct codes. These three pairs are the tempting ones, and each pair points
+    # the user at a completely different next step:
+    #
+    # - `no_workspace` (this session has no directory) vs `no_changes` (the directory
+    #   has nothing in it): the first calls for starting a session bound to a
+    #   directory, the second means "that is the expected answer".
+    # - `no_workspace_history` (this process has no record for this session) vs
+    #   `no_changes`: the first is **we cannot answer**, the second is **there is
+    #   genuinely nothing**.
+    # - `not_a_git_repo` is **not an error** — it means the source changed (falling
+    #   back to "paths this session touched"), so it legitimately shows up alongside
+    #   the other codes.
+    diff:
+      title: 'Workspace changes'
+      back: 'Back to session'
+      reload: 'Read again'
+      # Say plainly that nothing moves until you press it: this screen does not poll
+      # (rationale in the header of workspace/diff.tsx)
+      reload_hint: 'Read this directory again — this screen does not refresh itself'
+      loading: 'Reading…'
+      # ⚠️ This may only say "the request never landed". Every other failure (no
+      # workspace bound, not a git repo, a read that blew up) comes back as a 200
+      # with a note, and never reaches this branch
+      failed: 'Could not read this session’s workspace changes — the request never reached the local server.'
+      pick: 'Pick a file on the left.'
+      # The git source is **wider than "what this session changed"**, and that has to
+      # be said out loud: seeing a file you just edited yourself, the first reading is
+      # "the model touched it"
+      scope_git: 'This lists every uncommitted change in the directory relative to git HEAD — including your own edits and other programs’, not just this session’s.'
+      status_added: 'added'
+      status_modified: 'modified'
+      status_deleted: 'deleted'
+
+      note_no_changes: 'This directory has no uncommitted changes.'
+      # Always shows up together with the checkpoint fallback, so it has to finish the
+      # thought: what are you looking at instead?
+      note_not_a_git_repo: 'This directory is not a git repository, so what is listed here is the paths this session touched through the file tools.'
+      # "this process does not know" — **not** "nothing changed"
+      note_no_workspace_history: 'This process holds no file record for this session (most likely it was left behind by an earlier process), so the changed files cannot be listed.'
+      note_no_workspace: 'This session has no workspace bound, so there is no directory to look at. Changing directory means starting a new session.'
+      note_truncated: 'Too many files changed; only the first {count} are listed here.'
+
+      # The three "cannot be drawn" cases. **The short label and the why are two
+      # separate entries** — the label has to fit the end of a file-tree row, the why
+      # has to be long enough to actually explain.
+      #
+      # ⚠️ Why `omit_binary`’s why is not here: it is the same thing the read-only
+      # preview says, and the single source of truth for that is
+      # `web.ui.art.opaque_binary` above (wired up in inspector/content.ts).
+      omit_binary: 'binary'
+      omit_binary_sized: 'binary, {bytes}'
+      omit_too_large: 'too large'
+      omit_too_large_sized: 'too large, {bytes}'
+      omit_too_large_why: 'This file is over the 512 KB per-file limit, so neither side’s contents were fetched — that is why there is no diff here, not because nothing changed.'
+      # ⚠️ This has to name **which side** is missing, and why the current contents are
+      # not substituted for it: doing that would draw a "nothing changed" diff, which
+      # is exactly what the server flags this case to avoid
+      omit_no_snapshot: 'no before-state'
+      omit_no_snapshot_why: 'This directory is not a git repository, and no snapshot was kept of how the file looked before this session touched it — so all we know is that it changed, not which lines.'
+
+    # Settings pane six, "Tools" (`settings/tools.tsx`,
+    # `GET /api/sessions/:id/tools`).
+    #
+    # This screen answers exactly one question: **of the tools sent to the model
+    # this turn, who is blocking each one right now**.
+    #
+    # ⚠️ Every string in this group has to hold the same line: the three axes
+    # (rule → level → sandbox) **do not look at arguments**. The safety baseline
+    # (sensitive paths, dangerous commands) runs ahead of them and can only speak
+    # once a real call arrives carrying real arguments. So `axes` is not a
+    # disclaimer, it is the **definition** of this table — without it, users take
+    # the table to mean "will this call go through", which is not a question it
+    # can answer.
+    #
+    # One more: the four `v_*` words go through the catalog, while the security
+    # centre's rule table prints its four raw in English. Deliberately different —
+    # that screen prints the token you type into a config file, this one prints a
+    # conclusion, and the fourth case ("depends") appears in no config file at all
+    # (rationale on VERDICT_LABEL in tools.tsx).
+    tools:
+      no_session: 'No session yet, so this table cannot be computed — the verdicts are worked out against one session’s current permission level. Start a session and come back.'
+      loading: 'Reading…'
+      lede: 'Every tool sent to the model this turn: where it came from, what it does, how many times this session called it, and who is blocking it right now.'
+      axes: '"Who is blocking it" is computed on three axes: the parenthesis-free rules in the permission table first, then the permission level, and for code execution one more pass over the sandbox. None of the three looks at arguments — the sensitive-path and dangerous-command layer sits ahead of them and can only decide once a real call arrives with real arguments. So whether one specific call gets blocked is not something this table can answer.'
+      # This screen reads once and then stops (the ⚠️ in the header of tools.tsx),
+      # so "which level this was computed against" has to be printed: without it a
+      # stale table and a current one look exactly alike
+      level_line: 'Computed against the "{level}" level. This screen reads once and stops — after changing the level from the composer, you have to leave this section and come back for it to recompute.'
+      level_unknown: 'This session’s permission level could not be read, so the "who is blocking it" column could not be computed this time.'
+      # Two causes, two sentences. Merged into one, the first (start another
+      # session and it is fine) reads as the second (this process is broken)
+      ungraded_no_session: 'This session’s permission level could not be read (most likely the session was left behind by an earlier process), so nothing below is graded — only the tools themselves are listed.'
+      ungraded_no_layer: 'This process did not send the permission verdicts down (its permission layer never came up), so nothing below is graded — only the tools themselves are listed.'
+      # With no verdicts the table is not grouped by type: the type comes down the
+      # same path and falls back to "command" when the server cannot read it, so
+      # grouping by it would paint an "every tool is a command" fiction
+      g_all: 'All tools'
+
+      # The five operation types. Groups run loosest to tightest (read → write →
+      # command → network → code execution); rationale on TYPE_ORDER in tools.tsx
+      t_file_read: 'Read files'
+      t_file_write: 'Write files'
+      t_command: 'Run commands'
+      t_network: 'Network access'
+      t_code_exec: 'Execute code'
+      # The engine added a type this build has not claimed yet — dropping those
+      # rows looks exactly like "nothing happened", so they land here instead
+      # (same rationale as orphans in the config panes)
+      t_other: 'Other'
+
+      col_tool: 'Tool'
+      col_source: 'Source'
+      col_desc: 'What it does'
+      col_gate: 'Who blocks it'
+      col_calls: 'Calls'
+
+      v_allow: 'allowed'
+      v_ask: 'asks first'
+      v_deny: 'denied'
+      # The fourth case: at this level the verdict for this tool depends on the
+      # arguments. That is a truth, not a warning — hence the neutral colour
+      # rather than warning yellow (rationale in the header of settings-tools.css)
+      v_depends: 'depends'
+      # The fifth: no `gate` at all. "It is blocked" and "we cannot tell" have to
+      # be two different sentences
+      v_none: 'no verdict'
+
+      # The "who decided" half-sentence, three axes and three phrasings. Merging
+      # them leaves nothing to explain with (rationale in the JSDoc on
+      # `WireToolGateAxis`)
+      by_none: 'not graded'
+      by_sandbox: 'sandbox isolation'
+      by_level: '{level} level'
+      # Fallback for a missing rule string. Inventing one has a very concrete
+      # cost: the user goes looking for it in their own config file and it is not
+      # there
+      by_rule: 'a rule'
+      cond: '{count} argument-scoped rules could change this'
+
+      # The only exit from this pane. It points at "where to change it", not
+      # "click here to change it": the security centre is read-only too, and the
+      # real path to adding a rule runs through a config file — `perm_where` says
+      # that, and it is not copied a second time here
+      how_to_block: 'To block a tool, add a deny rule to the permission table. Rules only count once they are in a config file, and this interface never writes config — the security centre shows which rules exist today and which layer each came from.'
+      goto_rules: 'Open the rule table'
+      mcp_note: 'Tools from MCP servers are in this table too, named mcp__<server>__<tool>. The Source column says which server each one came from.'
+
+    # Settings pane seven, "About" (`settings/about.tsx`). Its data rides down on
+    # the first-paint `GET /api/config`, so this pane has no sessionId — and
+    # therefore no "no session yet" state.
+    #
+    # It exists for one reason: **when something goes wrong, screenshotting this
+    # screen beats describing the symptoms**. Every entry follows from that — a
+    # field earns its place if pasting it into an issue saves a round trip.
+    about:
+      loading: 'Reading…'
+      lede: 'When something goes wrong, paste a screenshot of this into the issue — it beats describing the symptoms.'
+
+      g_machine: 'This machine'
+      k_version: 'Version'
+      # Three facts on one line rather than three: this line exists to be copied
+      # out whole
+      version_line: 'epoch {version} · Node {node} · {platform}'
+      k_home: 'Data directory'
+      home_hint: 'Sessions, config and logs all live here. Set EPOCH_HOME to move the lot somewhere else.'
+      k_db: 'Session database'
+      # The most common answer to "where did my sessions go" is on this line: a
+      # different profile
+      db_hint: 'Every session’s record is in this one file. It follows the data directory and the profile — switching profile means switching to an entirely separate set of data.'
+      k_profile: 'Profile'
+      # The wire omits this key entirely when it equals the default, so the row is
+      # not drawn. Its presence is itself the information: your paths differ from
+      # everyone else’s
+      profile_hint: 'Chosen with EPOCH_PROFILE or --profile. The default profile does not draw this row — seeing it here means the two paths above differ from everyone else’s.'
+
+      g_diag: 'Startup diagnostics'
+      diag_lede: 'What this process checked as it came up. The sidebar only draws the ones with a problem; this is all four kinds.'
+      # No entries is **not** "all clear": a healthy module still records an ok.
+      # The two have to be two different sentences
+      diag_none: 'This process sent no diagnostics at all. That is not the same as "all clear" — a module that self-checked records an ok even when nothing is wrong.'
+      # ⚠️ `detail` is server-generated prose and follows the server process’s own
+      # language: with the browser switched to English this line stays Chinese.
+      # Expected (acceptance 31), same rationale as the sidebar. Chinese uses a
+      # full-width colon with no space, English a half-width one with a space —
+      # which is the whole reason this key exists
+      diag_line: '{module}: {detail}'
+
+      # No update check, but the route to upgrading still has to be named: the
+      # command depends on how you installed, and the code that can tell lives in
+      # the CLI layer, out of the web server’s reach. So this gives a command you
+      # can type, not a button that spins and then has nothing to say
+      # (decision 20 ①)
+      # ⚠️ 2026-08-18 trimmed — see the zh comment for the ledger.
+      update_note: 'Run this in a terminal: it checks for a new version and tells you how to upgrade:'
+
+    # The Automation screen (plan 45 PR-3). Two tabs: scheduled tasks / run history.
+    #
+    # ⚠️ This section deliberately does NOT hold the eight outcomes, the frequency
+    # summaries, the weekdays, or the four permission-level words — those live in
+    # `schedule.*` and `web.ui.perm.lvl_*`, shared with the CLI and the composer
+    # pill. Criterion: the same thing must not read two ways on two paths (full
+    # reasoning in `packages/web/src/automation/labels.ts`).
+    auto:
+      title: 'Automation'
+      back: 'Back to session'
+      tab_tasks: 'Scheduled tasks'
+      tab_runs: 'Run history'
+      loading: 'Loading…'
+      dismiss: 'Got it'
+
+      # The banner at the top. The slot is kept from the screenshot, but the
+      # wording is swapped for the truth — WorkBuddy's "do not shut down your
+      # computer or quit the client" is exactly what we are here to remove (§2.4).
+      # The three variants are probed from `capability`, not hard-coded.
+      notice_os: 'You do not need to keep epoch running — the OS scheduler wakes these tasks up. But occurrences due while the machine is off, or while nobody is logged in, are skipped and never caught up.'
+      notice_unsupported: 'This platform cannot register scheduled tasks with the OS scheduler yet (Windows and macOS only for now). Tasks can be created, but nothing will fire them.'
+      # ⚠️ This line is the one thing §2.6 really has to hold: when the host has
+      # no headless entry point, say **"quit the app and it stops"** out loud.
+      # Never dress it up as "enabled".
+      # ⚠️ No markdown here — plain text, see the zh catalog.
+      notice_host: 'This app has no headless entry point the OS scheduler can wake. Scheduled tasks only run while the app is open: quit the app and they stop.'
+
+      # Empty state. **One sentence and one button; no template cards** (the six
+      # templates belong to PR-4).
+      empty_title: 'Start your first automation'
+      empty_hint: "Have the agent do one thing for you on a schedule: sweep the repo, round up this week's PRs, scan for stale docs. Each run leaves something you can read."
+      new: 'New task'
+
+      mark_host: 'Runs only while the app is open'
+      never_run: 'Never run'
+      next_none: 'Will not fire again'
+      next_at: 'Next {when}'
+      last_at: 'Last {status} · {when}'
+      run_now: 'Run once now'
+      enable: 'Enable'
+      disable: 'Disable'
+      edit: 'Edit'
+      remove: 'Delete'
+      # ⚠️ This confirmation must say the OS registration goes with it: that state
+      # lives outside epoch, and the user can see it in Task Scheduler / LaunchAgents.
+      remove_confirm: 'Delete "{name}"? Its registration in the OS scheduler goes with it. Run recordings are kept.'
+
+      # ---- Form ----
+      form_new: 'New scheduled task'
+      form_edit: 'Edit scheduled task'
+      f_name: 'Name'
+      f_prompt: 'Prompt'
+      f_prompt_hint: 'What the agent should do when it fires. Say what it should leave behind — nobody will be there to ask.'
+      f_workdir: 'Workspace (optional)'
+      f_workdir_hint: 'Absolute path on the server'
+      # ⚠️ "Optional" still has to land on a **definite** directory: leaving it
+      # empty does not mean "the server process cwd" — the cwd the OS scheduler
+      # hands us is not ours to choose.
+      f_workdir_note: "Left empty, it runs in ~/.epoch/automation/<task id>/. It does **not** inherit any terminal's current directory."
+      f_workdir_default: '~/.epoch/automation/<task id>/'
+      f_model: 'Model (optional)'
+      f_model_hint: 'Empty uses the configured one'
+      f_kind: 'Frequency'
+      k_daily: 'Daily'
+      k_weekly: 'Weekly'
+      k_monthly: 'Monthly'
+      k_interval: 'Every N'
+      k_once: 'Once'
+      f_at: 'Time'
+      f_date: 'Date'
+      f_every: 'Interval'
+      f_weekdays: 'Days of week'
+      f_days: 'Days of month'
+      f_days_hint: '1, 15'
+      f_days_note: 'The 31st does not fire in short months — that is the native behaviour on both platforms.'
+      f_start: 'Active from (optional)'
+      f_end: 'Active until (optional)'
+      f_permission: 'Permission level'
+      # ⚠️ The §3.4 rule-3 acknowledgement. **Name the workspace in it** — an
+      # "I understand" with no object acknowledges nothing.
+      f_bypass_ack: 'I understand: this task will do anything without asking inside {workDir}, including deleting files and running arbitrary commands.'
+      f_turns: 'Max turns'
+      f_timeout: 'Timeout (minutes)'
+      f_timeout_note: 'The only ruler that catches "a command hung" — turns and spend both stop growing there.'
+      f_budget: 'Max spend per run (USD)'
+      # ⚠️ This line explains the one deliberate piece of friction in the whole
+      # plan (§3.5 / §12.2). A required field with no reason behind it just gets
+      # a random number typed into it — and this friction exists precisely to
+      # make the user think about that number once, at creation time.
+      # **Do not soften it.**
+      f_budget_why: 'Required, and we give no default: nobody is watching this task, and a fake default would make "woke up to $40" our fault.'
+      save_and_run: 'Save and run once'
+      save_only: 'Save only'
+      cancel: 'Cancel'
+      blocked_budget: 'Enter a budget above 0 to save'
+      blocked_bypass: 'Tick the acknowledgement to save'
+
+      # ---- Unattended allowlist ----
+      allow_title: 'This task will do these without asking'
+      allow_lede: 'The permission level answers "does this need a human"; this list answers "it does, but nobody is there — which ones can go through anyway". Listed one by one so you can see them before you save.'
+      # ⚠️ These two read **opposite** reasons, and the read-only one carries an
+      # extra half sentence: what it denies is not a missing grant, so it never
+      # becomes an IOU and adding a rule will never be consulted.
+      allow_off_plan: 'The read-only level has no authorisation surface at all, so no list is needed. ⚠️ What it denies is **not a missing grant**: it never becomes an IOU, and adding rules here will not help — change the level instead.'
+      allow_off_bypass: 'Under "skip every check" this list means nothing: the task will do anything without asking. Leaving a list that looks live would make you think you still have a boundary.'
+      allow_ops: 'Whole operation classes'
+      allow_tools: 'Whole tools (one per line)'
+      allow_tools_hint: 'terminal'
+      allow_rules: 'Rules (one per line)'
+      allow_rules_hint: "terminal(git status)\nfile_write(./reports/**)\nmcp__github__*"
+      allow_rules_note: 'A connector goes in as mcp__<server>__*; "only write this directory" goes in as file_write(<dir>/**).'
+      allow_scope: 'This list applies to this task only and is not affected by the global non-interactive allowlist.'
+
+      # ---- Registration outcome ----
+      reg_warn_source: "What got registered is this checkout's path — move or delete the repository and this task will fail."
+      reg_unsupported: 'This platform cannot register scheduled tasks yet (Windows and macOS only for now), so nothing will fire it.'
+      reg_npx: 'An epoch run through npx cannot register scheduled tasks: its entry point lives in a temporary cache, and one cache clear kills the task.'
+      reg_no_runner: 'This app has no headless entry point the OS scheduler can wake, so this task only runs while the app is open.'
+      reg_backend_error: 'The OS scheduler reported an error: {detail}'
+
+      # ---- Run history ----
+      runs_empty_none: 'No runs yet — there is not a single scheduled task. Create one in the "Scheduled tasks" tab.'
+      runs_empty_never: 'No runs yet. It will fire on its own when due; if you cannot wait, hit "Run once now" over in the tasks tab.'
+      run_manual: 'manual'
+      run_meta: '{turns} turns · ${cost}'
+      run_orphan: '(task deleted)'
+      just_ran: 'Just ran: {status}'
+      replay_show: 'View recording'
+      replay_hide: 'Hide recording'
+      replay_loading: 'Loading recording…'
+      replay_none: 'No recording for this one (no session was started, or retention has pruned it).'
+      replay_truncated: 'This recording is long; only the first {count} frames are drawn.'
+
+      # ---- IOUs ----
+      # ⚠️ This block and `allow_off_plan` above are **deliberately two different
+      # sentences**: the next step for an IOU is adding a rule (the button
+      # below), while a level-decided denial would never consult that rule — the
+      # only meaningful move there is changing the level.
+      pending_header: '{count} operations should have asked you, but nobody was there (IOUs)'
+      pending_rule: '→ {rule}'
+      pending_no_rule: '(no exact rule can be derived for this one)'
+      pending_fix: 'Add to the allowlist'
+      pending_fixed: '✓ Added {count}: {rules}'
+      pending_fixed_none: 'Nothing was added — no exact rule can be derived for these, and hard-coding one would only put a dead rule in the list.'
+
+      # ---- Validation results (the server sends codes; this is this screen''s wording) ----
+      #
+      # ⚠️ **Deliberately not shared with `schedule.issue.*`**: that group names
+      # command-line flags (`--budget`, `--max-turns`), and there is no such
+      # thing in a form. The criterion was written down in core's
+      # `schedule/types.ts` long before this screen existed.
+      issue:
+        name_empty: 'Give it a name'
+        prompt_empty: 'Say what it should do when it fires — a scheduled task with no prompt does nothing'
+        permission_unknown: 'Unknown permission level: {detail}'
+        work_dir_missing: 'This directory does not exist: {detail}'
+        budget_missing: 'Enter a number above 0 (currently {detail})'
+        max_turns_invalid: 'Must be a whole number between 1 and 1000 (currently {detail})'
+        timeout_invalid: 'Must be positive and at most 24 hours (currently {detail} ms)'
+        trigger_time_invalid: 'The time must be written HH:mm (currently {detail})'
+        trigger_weekdays_empty: 'Pick at least one day'
+        trigger_days_invalid: 'Days of month must be between 1 and 31 ({detail})'
+        trigger_interval_invalid: 'That interval will not work ({detail} minutes) — only divisors of 60 and whole hours are allowed, because macOS can only enumerate times and an interval that does not divide evenly drifts at each hour boundary'
+        trigger_once_date_invalid: 'The date must be written YYYY-MM-DD and must be a day that exists (currently {detail})'
+        trigger_once_past: 'That moment has already passed; saving it would never fire ({detail})'
+        date_range_invalid: 'The active range is wrong: {detail}'
+        date_range_on_once: 'A run-once task cannot carry an active range — it is a date already'
+        rule_invalid: '{detail}'
+        bypass_needs_workdir: 'This level must be bound to a workspace — "skip every check" plus an undefined directory is the literal meaning of "unbounded"'
+        bypass_workdir_too_broad: 'The workspace for this level cannot be the home directory or the filesystem root (currently {detail})'
+        bypass_needs_limits: 'Under this level, budget / turns / timeout must all have values'
+        bypass_not_confirmed: 'This level needs the acknowledgement ticked first'
+
+# Workspaces (decision 18: one bound per session). Both groups are user-facing:
+# `recent_*` goes into startup diagnostics, `bind_*` goes straight into the
+# 400 / 409 body of `POST /api/sessions`.
+workspace:
+  recent_unreadable: 'could not read the recent-workspaces list {path} ({reason}); treating it as empty for this run'
+  recent_not_object: 'the recent-workspaces list {path} is not a JSON object at the top level; treating it as empty'
+  recent_bad_version: 'the recent-workspaces list {path} declares version {version}, this build only understands {expected}; treating it as empty'
+  recent_not_array: '`workspaces` in {path} is not an array; treating the list as empty'
+  recent_dropped: 'the recent-workspaces list {path} had {count} malformed entries, which were ignored'
+  recent_write_failed: 'could not write the recent-workspaces list {path}: {reason}'
+  bind_not_absolute: 'a workspace must be an absolute path: {path}'
+  bind_missing: 'no such directory: {path}'
+  bind_not_a_directory: 'not a directory: {path}'
+  bind_locked: 'session {sessionId} is already bound to {current} and cannot be changed to {next}'
+  # The persisted copy did not make it (session DB v7, 2026-08-19). This does NOT
+  # block the bind — the workspace is bound and this run works fine; what is lost
+  # is "still knowing where it worked after a restart". So the wording has to say
+  # what failed AND what follows from it: next launch the user sees that session
+  # fall into "Earlier sessions", and they need to be able to connect the two.
+  decision_write_failed: "could not record session {sessionId}'s workspace decision in the session database ({reason}) — this run is unaffected, but after a restart it will not know which space it belongs to"
+
+# Host preset (runtime/src/host-preset.ts, plan 54 §6). The whole group goes into
+# the startup diagnostics.
+#
+# There is exactly one criterion behind the wording: **"configured but had no
+# effect" is the only way this feature fails**, and before this group it failed
+# in complete silence — the host passes `hostPreset`, then sees a bare
+# `Provider: no usable credential`, with nothing anywhere saying "but I did
+# preset one". So every line answers "what happened to this item": written
+# (which file, which keys), not written (the user already has it), or broken
+# (why).
+#
+# The `kept` lines are **ok, not warn**: not overwriting the user's choice is
+# this feature working correctly, not a problem.
+host_preset:
+  wrote: 'wrote {path}: {keys}'
+  kept: 'the user already configured these in {path}, left untouched: {keys}'
+  write_failed: 'could not write {path} ({reason}); this item did not take effect'
+  home_unwritable: 'could not create the data directory {path} ({reason}); no part of the preset took effect'
+  section_inline: '{section} in {path} uses inline (flow) syntax, and inserting fields would corrupt it — that section was not preset'
+  nothing_to_do: 'every item in the preset was already in place; nothing was written'
+  secret_stored: 'the API key went to the injected secret store ({name}), never to disk'
+  secret_kept: 'the secret store already holds {name}; the preset key did not overwrite it'
+  secret_failed: 'could not store the API key in the secret store ({name}: {reason}); there is no usable credential this run'
+  secret_not_needed: '{provider} does not take an API key; the one in the preset was ignored'
+  mcp_wrote: 'wrote these MCP servers to {path}: {names}'
+  mcp_kept: '{path} already has MCP servers with these names, left untouched: {names}'
+  mcp_unreadable: 'could not read {path} ({reason}); none of the preset MCP servers were written — that file is yours and we will not overwrite it'
+  mcp_no_servers: '{path} has no `servers` section (did you write `mcpServers`?); none of the preset MCP servers were written'
+  workspaces_wrote: 'added to the known-workspaces list: {roots}'
+  workspaces_kept: 'these are already in the known-workspaces list; their order was left alone: {roots}'
+  workspace_not_absolute: 'a known workspace must be an absolute path, skipped: {path}'
+
+# Diagnostics for loading `~/.epoch/keybindings.json` (core/src/config/keybindings.ts).
+# All three mean "this line of yours did not take effect", so each must name the key
+# involved — the user needs that exact string to go and fix the file. Key names are
+# spelled the way the config spells them (`ctrl+l`, not `Ctrl+L`) so they can be
+# copy-pasted.
+keybindings:
+  bad_chord: '{key} is not a recognizable key; this binding was ignored'
+  reserved: '{key} is reserved and cannot be rebound (it is the escape hatch when things hang); this binding was ignored'
+  conflict: '{key} is already bound to {first}; this binding was ignored'
+
+marketplace:
+  fetch_failed: 'failed to fetch {url}: HTTP {status}'
+  fetch_failed_private: 'failed to fetch {url}: HTTP {status}. Either the address is wrong or it is private — marketplace catalogs are fetched without any credentials; for a private one, clone it locally and run epoch plugin marketplace add ./that-directory'
+  fetch_error: 'failed to fetch {url}: {reason}'
+
+# Runtime text for scheduled tasks (plan 45). The command help lives above under
+# `cli.schedule`.
+#
+# Two hard rules about wording:
+#   1. The four permission words are **verbatim the chat pill's** (design note 20)
+#      — the user learned them once already; a second vocabulary means learning
+#      two names for the same thing
+#   2. "skipped" and "failed" never share a mark. Showing "the previous run was
+#      still going, so this one was skipped" as a red cross sends the user
+#      hunting for a failure that never happened
+schedule:
+  list_header: 'Scheduled tasks:'
+  list_empty: 'No scheduled tasks yet.'
+  list_empty_hint: 'Create one: epoch schedule add --name "daily sweep" --prompt "…" --daily 09:00 --budget 0.50'
+  col_next: 'next'
+  col_last: 'last'
+  disabled_mark: 'disabled'
+  yes: 'yes'
+  no: 'no'
+  field_enabled: 'Enabled'
+  field_trigger: 'Frequency'
+  field_window: 'Active window'
+  field_next: 'Next run'
+  field_workdir: 'Working directory'
+  field_model: 'Model'
+  field_permission: 'Permission level'
+  field_limits: 'Three rulers'
+  field_backend: 'Registered in'
+  field_prompt: 'Prompt'
+  field_last_run: 'Last run: {when}'
+  limits_value: 'at most {turns} turns · at most {budget} USD · killed after {minutes} minutes'
+  allowlist_header: 'This task will do the following without asking:'
+  allowlist_empty: '(the list is empty — anything needing approval becomes an IOU and the run ends)'
+  allowlist_scope_note: 'This list applies to this task only; the global non-interactive allowlist does not affect it.'
+  allowlist_bypass: 'Permission level is "skip all checks": the list means nothing here — the task will do anything without asking.'
+  allowlist_readonly: 'Permission level is "read-only": zero authorization surface by construction, no list needed.'
+  created: '✓ Created and registered: {name} ({id})'
+  created_next: 'Run it once now and find out what authorization it is missing: epoch schedule run {id}'
+  ask_name: 'Task name'
+  ask_prompt: 'What should the agent do when it fires'
+  ask_at: 'What time each day (HH:mm)'
+  ask_budget: 'Most this single run may spend, in USD'
+  ask_permission: 'Permission level'
+  permission:
+    plan: 'read-only'
+    default: 'ask when needed'
+    accept_edits: 'auto-accept edits'
+    bypass: 'skip all checks'
+    auto: 'auto-allow'
+  trigger:
+    daily: 'every day at {at}'
+    weekly: 'every {days} at {at}'
+    monthly: 'day {days} of every month at {at}'
+    every_minutes: 'every {n} minutes'
+    every_hours: 'every {n} hours'
+    once: '{date} {at} (once)'
+  weekday:
+    sun: 'Sun'
+    mon: 'Mon'
+    tue: 'Tue'
+    wed: 'Wed'
+    thu: 'Thu'
+    fri: 'Fri'
+    sat: 'Sat'
+  status:
+    ok: 'ok'
+    failed: 'failed'
+    denied: 'missing authorization'
+    timeout: 'timed out'
+    budget: 'limit reached'
+    skipped_overlap: 'skipped (previous run still going)'
+    skipped_window: 'skipped (outside the active window)'
+    missed: 'missed'
+  drift:
+    missing_in_os: 'in the database, not in the OS (registration lost)'
+    orphan_in_os: 'in the OS, not in the database (uninstall leftover)'
+    spec_mismatch: 'in both, but they disagree'
+    never_registered: 'the database row claims it was registered but carries no OS identifier'
+  issue:
+    name_empty: 'the name cannot be empty'
+    prompt_empty: 'the prompt cannot be empty — a scheduled task without one does nothing'
+    permission_unknown: 'unknown permission level: {detail}'
+    work_dir_missing: 'working directory does not exist: {detail}'
+    budget_missing: '--budget is required and must be positive (got {detail})'
+    max_turns_invalid: '--max-turns must be an integer between 1 and 1000 (got {detail})'
+    timeout_invalid: '--timeout must be positive and at most 24 hours (got {detail} ms)'
+    trigger_time_invalid: 'the time must be HH:mm (got {detail})'
+    trigger_weekdays_empty: 'the weekly schedule needs at least one day'
+    trigger_days_invalid: 'days of the month must be between 1 and 31 ({detail})'
+    trigger_interval_invalid: 'the interval must divide 60 or be a whole number of hours (got {detail} minutes) — launchd can only enumerate instants, so an interval that does not divide 60 drifts at every hour boundary'
+    trigger_once_date_invalid: 'the date must be YYYY-MM-DD and must be a day that exists (got {detail})'
+    trigger_once_past: 'that moment has already passed; saving it would never fire ({detail})'
+    date_range_invalid: 'bad active window: {detail}'
+    date_range_on_once: 'a one-shot task cannot carry an active window — it is a single date already'
+    rule_invalid: '{detail}'
+    bypass_needs_workdir: '"skip all checks" must be bound to a workspace — that level plus an undecided directory is the literal meaning of "unbounded"'
+    bypass_workdir_too_broad: 'the workspace for "skip all checks" cannot be your home or the filesystem root (got {detail})'
+    bypass_needs_limits: 'under "skip all checks" the budget, turn and timeout limits are all mandatory'
+    bypass_not_confirmed: '"skip all checks" needs an explicit acknowledgement: add --i-understand-bypass'
+  run_start: 'Running: {name}'
+  run_meta: '{turns} turns · {cost} USD{manual}'
+  run_manual: ' · manual'
+  fire_missing: 'no task {id} in the database; did nothing'
+  fire_disabled: '{id} is disabled; did nothing'
+  pending_header: '{n} operations were denied because nobody was there to ask (IOUs):'
+  pending_line: '{tool} {target}'
+  pending_fix: 'add this rule: {rule}'
+  fix_hint: 'Add these to the allowlist so the next run does not stall: epoch schedule run {id} --fix'
+  fix_done: '✓ Appended {n} rules to the allowlist'
+  fix_none: 'nothing could be appended automatically (no exact rule can be derived from these)'
+  logs_empty: 'No runs recorded yet.'
+  logs_recording: '── most recent recording ({path})'
+  enabled_done: '✓ Enabled: {name}'
+  disabled_done: '✓ Disabled (the task stays in the OS scheduler, just stopped): {name}'
+  removed: '✓ Deleted and unregistered: {name}'
+  removed_logs_kept: 'The recordings are kept in {dir}/; delete them yourself if you want them gone'
+  doctor_clean: '✓ Checked {n}; the database and the OS agree'
+  doctor_found: 'Found {n} disagreements:'
+  doctor_hint: '--repair re-registers from the database (the database is the source of truth); --prune removes OS orphans'
+  doctor_unsupported: 'Scheduled tasks are not supported on this platform yet (Windows and macOS for now)'
+  doctor_repaired: '✓ Re-registered: {name}'
+  doctor_repair_failed: '✗ Could not re-register: {name} ({detail})'
+  doctor_pruned: '✓ Unregistered: {id}'
+  doctor_prune_failed: '✗ Could not unregister: {id} ({detail})'
+  err_not_found: 'no task {id}'
+  err_not_found_hint: 'Run epoch schedule list to see what exists'
+  err_ambiguous: 'the prefix {id} matches more than one task; be more specific:'
+  err_invalid: 'This task has problems and nothing was saved:'
+  err_no_trigger: 'a frequency is required: --daily / --weekly / --monthly / --every / --once'
+  err_many_triggers: 'only one frequency may be given'
+  err_at_required: '--weekly / --monthly / --once need --at HH:mm'
+  err_weekday: 'unrecognized weekday: {value}'
+  err_every: 'unknown --every: {value}'
+  err_every_hint: 'Only these (they are exactly what both platforms can express): {values}'
+  err_permission: 'unknown --permission: {value}'
+  err_operation: 'unknown --allow-operation: {value}'
+  err_budget: '--budget must be a positive number: {value}'
+  err_budget_hint: 'There is deliberately no default: a fake one would make "woke up to 40 dollars" our fault'
+  err_missing_flags: 'required values are missing and there is no terminal here to ask'
+  err_missing_flags_hint: 'At minimum give --name --prompt --budget and a frequency (--daily and friends)'
+  err_npx: 'An epoch run through npx cannot register scheduled tasks — its entry point lives in a temporary cache, so one cache clean breaks the task'
+  err_npx_hint: 'Install it first: npm i -g @epoch-agent/cli'
+  err_no_host_runner: 'This host has no headless entry point the OS scheduler can invoke, so scheduled tasks only run while the app is open'
+  err_no_host_runner_hint: 'To make them run after the app is closed, the host must provide scheduleRunner (see docs/EMBEDDING.md)'
+  err_platform_unsupported: 'Registering scheduled tasks is not supported on this platform yet (Windows and macOS for now)'
+  err_backend: 'the OS scheduler reported an error: {detail}'
+  warn_source_entry: '⚠ The path registered points at this checkout; moving or deleting the repo will break this task'
+
+# Skill scanning (core/src/skill/scan.ts). See the zh catalog for the reasoning:
+# the four source labels are separate entries because the sentence mentions two
+# of them and the two languages order them differently.
+skill:
+  scope_user: 'user-level'
+  scope_project: 'project-level'
+  scope_plugin: 'plugin'
+  scope_host: 'host-injected'
+  scope_override: 'The {scope} skill "{name}" shadows a same-named {previous} skill'
+  # ---- Import from a local directory (plan 42 §六, 2026-08-18) ----
+  # The gate rationale lives in core/src/skill/import.ts: this path accepts a
+  # server-local **path**, never uploaded bytes. Every string below answers
+  # "which one did not make it, and why" — silent skipping is the worst failure
+  # mode here, because the user walks away believing the import worked.
+  import_no_system: 'The skill system did not start this run, so there is nowhere to import into. Check the Skill entries in the startup diagnostics'
+  import_not_absolute: 'An absolute path is required — a relative one resolves against the server process cwd, which you cannot see from the browser'
+  import_missing: 'Cannot find {path}'
+  import_empty: 'No importable skill under {path} (expected a .md with frontmatter, a folder containing SKILL.md, or either of those zipped up)'
+  import_stale: 'That directory changed after you previewed it — import cancelled. Take another look, then confirm'
+  import_conflict: 'A user-level skill named "{name}" already exists; this one was not imported (no overwriting). To replace it, delete the copy under ~/.epoch/skills first'
+  import_dup_in_batch: 'More than one skill in this batch is named "{name}"; only the first was kept — skill names are globally unique, different categories still collide'
+  import_skipped_entry: '{entry} is not something a skill directory may contain (only SKILL.md plus the references / templates / scripts / assets subdirectories); skipped just this entry'
+  import_skipped_special: '{entry} is not a regular file (a symlink or similar) and was skipped — files in a skill directory do get read'
+  import_too_many_files: 'This skill carries too many files; the rest were not copied — check that you pointed at a skill directory and not a whole repository'
+  import_read_failed: 'Read failed: {reason}'
+  import_write_failed: 'Write failed: {reason}'
+  import_bad_name_empty: 'The skill name is empty'
+  import_bad_name_long: 'The skill name is too long (over {max} characters); it has to work as a directory name'
+  import_bad_name_dots: 'A skill name cannot be . or ..'
+  import_bad_name_char: 'The skill name "{name}" contains characters that cannot be used in a directory name (< > : " / \ | ? * and control characters). The colon in particular separates the plugin/host prefix — a user-level skill taking it would masquerade as a plugin skill'
+  import_bad_name_trailing: 'The skill name "{name}" ends with a dot or a space — on Windows such a directory can be created but not opened'
+
+# Capabilities injected by an embedding host (runtime/src/build.ts, plan 44 §2.1).
+# All of these go into the startup diagnostics — see the zh catalog for why each
+# one has to name the offending entry.
+host_capabilities:
+  loaded: '{namespace}: {roles} identity/identities, {skillDirs} skill directory/directories, {mcpServers} MCP server(s) (the first two get the {namespace}: prefix, servers get {namespace}__ — a server name ends up inside a tool name, and tool names cannot contain a colon)'
+  bad_role_name: 'Identity "{name}" has an invalid name (lowercase letters, digits and hyphens only, and it may not start with a hyphen); that one was skipped, the rest were injected as usual'
+  duplicate_role: 'Identity "{name}" appears more than once in this batch; only the first one was kept'
+  empty_namespace: 'The namespace is empty, so nothing was injected — without it there is no prefix to apply, and an unprefixed injection can shadow a built-in role'
+  bad_namespace: 'The namespace "{namespace}" is invalid (lowercase letters, digits and hyphens only, and it may not start with a hyphen); nothing was injected'
+  skill_dir_relative: 'The skill directory {path} is not an absolute path and was skipped — relative paths resolve against the engine process cwd, which the host does not control'
+  # Three more from plan 44 PR-2 (the connector row). Server names are validated
+  # more strictly than mcp.json ones because they end up verbatim inside a tool
+  # name — say so, or the host only sees "my server did not come up".
+  bad_mcp_name: 'MCP server "{name}" has an invalid name (lowercase letters, digits and hyphens only, and it may not start with a hyphen); that one was skipped, the rest were injected as usual. These names are validated more strictly than the ones in mcp.json because a server name ends up verbatim inside a tool name'
+  duplicate_mcp: 'MCP server "{name}" appears more than once in this batch; only the first one was kept'
+  mcp_name_taken: 'MCP server "{name}" collides with one already present in the user mcp.json; the host-injected one was skipped — the line the user wrote themselves wins'
+
+# Startup diagnostic for the agent role table (wireAgentRoles in
+# runtime/src/build.ts, plan 18). Assembled segment by segment because the
+# segments depend on what is present — see the zh catalog for the reasoning.
+agent_roles:
+  tally: '{total} available ({parts}, same-named ones merged)'
+  tally_builtin: '{count} built-in'
+  tally_user: '{count} user'
+  tally_project: '{count} project'
+  tally_plugin: '{count} from plugins'
+  tally_host: '{count} from the host'
+
+# Per-message identity handoff marker (plan 57 §2.3 / §3.5).
+# ⚠️ These two are the body only — the "the system is speaking" prefix is NOT
+# here. It lives in packages/protocol/src/system-note.ts (SYSTEM_NOTE_PREFIX) and
+# runtime/src/agent-session.ts prepends it. Do not add any prefix back into these
+# two sentences: that yields a doubled prefix, and nothing anywhere goes red.
+# See the zh catalog for the reasoning.
+#
+# ⚠️ `handoff_cleared` says "identity" where it used to say the old word, and the
+# zh twin now repeats 「身份」 twice in one sentence — that is deliberate. Before
+# the rename each half of that sentence used a different noun for the same thing,
+# which read as two. Do not swap either one back out for a synonym.
+agent_role:
+  handoff: 'From this message on, "{role}" takes over.'
+  handoff_cleared: 'From this message on, no identity is pinned; back to this session default.'
+
+# User-facing strings for the plugin side (plan 44 PR-3 / PR-4).
+#
+# Two groups, kept together because they must agree with each other: `mcp_*` are
+# problems the pre-install preview reports while scanning mcp.json
+# (core/src/plugin/inventory.ts); `n_*` are the numbers `epoch plugin list`
+# prints afterwards (cli/src/commands/plugin.ts).
+#
+# `n_*` are deliberately terse — they are joined with ` · ` onto the line that
+# already carries the plugin name and version. Use --verbose for the breakdown.
+plugin:
+  mcp_not_json: 'mcp.json is not valid JSON ({reason}); the whole file was ignored'
+  mcp_not_object: 'The top level of mcp.json must be an object; the whole file was ignored'
+  # Anyone copying a config over from Claude Desktop hits this one. The wording
+  # deliberately matches parseMcpConfig in plugin-mcp — same mistake, one answer.
+  mcp_wrong_key: 'Found an `mcpServers` field; epoch reads `servers`, please rename the key'
+  mcp_no_servers: 'mcp.json has no `servers` field, so there are no MCP servers to use'
+  mcp_servers_not_object: '`servers` must be an object (server name → config); the whole file was ignored'
+  # The ⚠ is here for the same reason as the hook row: these start subprocesses.
+  # Deliberately not phrased as "a security risk" — a plugin that can carry hooks
+  # could already start arbitrary subprocesses. This line answers "how many more
+  # processes will run on my machine once this is installed".
+  preview_mcp: '⚠ {count} MCP server(s): {names} — each is a separate process, started when epoch starts'
+  n_commands: '{count} cmd'
+  n_roles: '{count} roles'
+  n_skills: '{count} skills'
+  n_hooks: '{count} hooks'
+  n_deny: '{count} deny'
+  n_mcp: '{count} MCP'
+  brings_nothing: '(brings nothing)'
+
+# Startup diagnostics for plugin-provided MCP servers
+# (runtime/src/plugin-mcp-servers.ts, plan 44 PR-3).
+#
+# Same reasoning as the host_capabilities group: "it was brought in but never
+# came up" is the only failure mode here, and neither the plugin author nor the
+# user is watching — so name the offending server and say why these names are
+# validated more strictly than the ones in mcp.json.
+# Where the text scanner gave up while splicing a server into the user's
+# hand-written mcp.json (runtime/src/mcp-config-write.ts, 2026-08-18).
+#
+# ⚠️ These five **are our own diagnoses, so they get translated**; the other half
+# of the same path (`EACCES` / `ENOENT` and friends) is Node's own wording and is
+# **forwarded verbatim, untranslated**. Both land in the {detail} of
+# `web.mcp_add_unwritable`. That is not an inconsistency — the criterion is
+# "who said this sentence".
+mcp_write:
+  not_object: 'the top level is not a JSON object'
+  top_unreadable: 'the top-level object cannot be read through (most likely a missing comma or quote)'
+  servers_not_object: '`servers` is not an object'
+  servers_unreadable: 'the `servers` object cannot be read through'
+  mcp_servers_key: 'this config uses the `mcpServers` key while epoch reads `servers`; rename the key first, then add'
+  invalid: 'the configuration is not valid'
+
+# Writing mcp.json in full (runtime/src/mcp-config-file.ts, 2026-08-18).
+#
+# ⚠️ One string only, and it is the **one** content problem that stops a save:
+# not valid JSON. Do not add "missing command" / "unknown key" here — those save
+# just fine and travel in the response's issues (see protocol's
+# WireMcpConfigIssue).
+#
+# ⚠️ {why} is the raw English sentence thrown by JSON.parse ("Unexpected token }
+# in JSON at position 42") and is **forwarded verbatim, never translated**: it is
+# the only thing on screen that says which character is wrong.
+mcp_config:
+  invalid_json: 'Nothing was written — this content is not valid JSON: {why}'
+
+# Creating a role definition file (core's `agent-role/create.ts`, 2026-08-18).
+#
+# ⚠️ `roundtrip` is the important one here: it says "the file I generated cannot be
+# read back by our own loader" — meaning **not a single byte was written**, rather
+# than "it was written badly". The wording must point at "reword it / write the file
+# by hand", not at "try again".
+#
+# ⚠️ `taken` must carry the reason for not overwriting and not auto-renaming, same
+# judgement as `web.mcp_add_taken`: the body of a role file is prose the user wrote,
+# so overwriting deletes it; and the name becomes the word used to delegate work
+# (the `role` argument of delegate_task).
+role_write:
+  bad_name: 'The identity name "{name}" cannot be used — lowercase letters, digits and hyphens only, and it may not start with a hyphen. This name is both the file name and the word used to delegate work (the `role` argument of delegate_task, the value of --agent), which is why it is validated strictly.'
+  taken: 'There is already an identity named "{name}" — pick another name. Nothing is overwritten and nothing is auto-renamed here: overwriting would delete the prose you wrote in that file, and renaming would make the word used to delegate work disagree with what you typed.'
+  roundtrip: 'Nothing was written — our own loader cannot read back the file that was generated ({why}). Most likely a passage in the description or the body breaks the YAML; reword it and try again, or write the file by hand in ~/.epoch/agents/.'
+  roundtrip_generic: 'it reads back as nothing'
+  # ⚠️ The duplicate sentence must name **which layer** holds the name: colliding with
+  # a built-in leaves only "pick another name", while colliding with a project-level
+  # one also lets the user edit that file in their own repo. Just saying "name taken"
+  # would make someone who collided with `general` go looking for an invisible file
+  # in their own ~/.epoch/agents/.
+  dup_in_table: 'There is already an identity named "{name}" (from {layer}), so that name is unavailable — pick another. Nothing is overwritten and nothing is auto-renamed here: overwriting a built-in identity would also replace the default target for delegated work, and renaming would make the word used to delegate work disagree with what you typed.'
+  layer_builtin: 'the built-in set'
+  layer_user: 'your own ~/.epoch/agents/'
+  layer_project: "this workspace's .epoch/agents/"
+  layer_plugin: 'an installed plugin'
+  layer_host: 'the application embedding this engine'
+  unknown_tools: 'These tool names do not exist: {tools}. They are not in the tool table — fix the typo, or take a look at Settings › Tools if you are unsure what is available. (Writing them anyway would not fail: it would leave a warning in the next startup diagnostics and silently give this identity fewer tools than you asked for.)'
+  blocked_tools: 'No identity can be given {tools} — those are a hard floor (they prevent recursive delegation and privilege escalation), not something this whitelist got wrong. Remove them from the tools field.'
+
+plugin_mcp:
+  unreadable: 'Could not read {path} ({reason}); none of the MCP servers this plugin carries were started'
+  bad_name: 'MCP server "{name}" from plugin {plugin} has an invalid name (lowercase letters, digits and hyphens only, and it may not start with a hyphen); that one was skipped, the rest are unaffected. These names are validated more strictly than the ones in ~/.epoch/mcp.json because a server name ends up verbatim inside a tool name sent to the model — one invalid name gets the entire tool table rejected'
+  name_taken: 'MCP server "{name}" collides with one that is already present (from the user mcp.json or from the host); the plugin one was skipped — whichever came first wins'
+
+# Long-task goals (plan 52) — every string the `/goal` command family prints.
+#
+# ## Why this group is in the catalog while the `blocked` reason text is not
+#
+# Different readers; the criterion lives in the file header of
+# `core/src/goal/wording.ts`. This group is **UI** (what the user sees after
+# typing `/goal`); that one is **record + model input** (it lands in the goals
+# table and in the system prompt). If the latter followed the UI language, two
+# consecutive blocked records in one session could be in two languages — and
+# they are meant to be grepped.
+#
+# ## Every refusal must say what to type next
+#
+# `refuse_busy` names `/goal clear`, `refuse_no_goal` says how to create one,
+# `refuse_bad_budget` gives the range. Without that half sentence the user is
+# left with a "no" plus a reason they cannot act on, and retypes the same thing.
+goal:
+  usage: |-
+    /goal <objective>       set a completion criterion for this long task ({rounds}-round budget by default)
+    /goal                   show the current goal, rounds used, and whether it is blocked
+    /goal edit <objective>  reword it (rounds and phase are left alone)
+    /goal budget <n>        change the round budget (1 to {max})
+    /goal pause / resume    hold / release
+    /goal done <evidence>   report completion yourself; evidence is required
+    /goal clear             drop the goal
+  none: |-
+    This session has no goal yet.
+
+    A goal answers "**what counts as done here, and how many rounds may it
+    take**" — useful for long tasks, especially ones you hand off and walk away
+    from: hitting the budget leaves a record of where it got stuck instead of
+    just "the model went quiet".
+
+    {usage}
+  status: |-
+    Goal      {objective}
+    Phase     {phase}
+    Rounds    {used} / {max}{extra}
+  phase_active: 'running'
+  phase_paused: 'on hold (rounds do not advance)'
+  phase_blocked: 'blocked'
+  phase_complete: 'complete'
+  extra_blocked: |-
+
+    Blocked   [{code}] {message}
+    Once that is handled, `/goal resume` releases it; `/goal budget <n>` buys more rounds.
+  extra_complete: |-
+
+    Evidence  {evidence}
+    To start the next thing, just `/goal <new objective>` — a completed goal is replaced.
+  extra_paused: |-
+
+    `/goal resume` releases it.
+  extra_active: ''
+  created: 'Goal set: {objective} ({max}-round budget). Each message you send is one round; running out turns it into "blocked", not "complete".'
+  edited: 'Goal reworded to: {objective}. Rounds and phase untouched ({used}/{max}) — to start over, `/goal clear` and create a new one.'
+  budget_set: 'Budget is now {max} rounds ({used} used).'
+  budget_set_exhausted: 'Budget is now {max} rounds but {used} are already used — it just turned blocked. Raise the budget to keep going.'
+  paused: 'On hold. Rounds no longer advance; the goal itself is kept.'
+  resumed: 'Released, running against the goal again ({used}/{max}).'
+  completed: 'Recorded as complete. Evidence: {evidence}'
+  cleared: 'Goal cleared.'
+  clear_noop: 'There was no goal to clear.'
+  startup_blocked: '⚠ The previous goal is blocked [{code}]: {message} (`/goal` for details, `/goal resume` to release)'
+  refuse_busy: 'There is already an unfinished goal ({phase}). A session holds one goal at a time — `/goal clear` first, or `/goal edit` the current one.'
+  refuse_no_goal: 'This session has no goal. Set one with `/goal <objective>`.'
+  refuse_empty_objective: 'The objective cannot be empty. Write one sentence describing what counts as done, e.g. `/goal wire the inspector panel to background task output`.'
+  refuse_objective_too_long: 'That objective is too long (max {max} characters). It is a **completion criterion**, not the plan itself — steps belong in `/plan`.'
+  refuse_bad_budget: 'The budget must be an integer between 1 and {max}.'
+  refuse_empty_evidence: 'Reporting completion requires evidence: `/goal done <why this counts as done>`. If you cannot state it, it is not done.'
+  refuse_wrong_phase: 'That cannot be done from the current phase ({phase}). Run `/goal` to see where it stands.'
+  refuse_unavailable: 'Goal storage is unavailable (the session database did not come up); see `/diagnostics`.'