@sema-agent/client-core 0.110.0 → 0.112.0

package/dist/i18n/messages.en.js

@@ -115,6 +115,13 @@ const EN = {
     'model.subagent.chainUnbound': "Subagent model {word} is not bound on this engine (neither it nor any tier below it has a model) — the subagent will run on its parent's model.",
     'model.subagent.bindingNotInCatalog': "Subagent model {word} is bound to a model that is not in this engine's model catalog — the subagent will run on its parent's model.",
     'model.subagent.ambiguous': "Subagent model {word} matches more than one model name that differ only in case — spell it exactly; the subagent will run on its parent's model.",
+    'model.subagent.call.ambiguous': "Subagent model {word} can't be used for this call: it matches more than one model name that differ only in case — spell it exactly.",
+    'model.subagent.call.tiersInert': "Subagent model {word} can't be used for this call: it is a tier word, but this engine has no model tiers configured.",
+    'model.subagent.call.chainUnbound': "Subagent model {word} can't be used for this call: it maps to tier {tier}, which has no model bound on this engine (nor does any tier below it).",
+    'model.subagent.call.bindingNotInCatalog': "Subagent model {word} can't be used for this call: its tier {tier} is bound to a model that is not in this engine's model catalog.",
+    'model.subagent.refused.notListed': "Subagent model {word} is not a model name, tier word or model id on this engine, so this agent is left out of the request (the engine refuses any request that carries it) — change the agent's model, or set it to `inherit`.",
+    'model.subagent.refused.notServed': "Subagent model {word} has no model behind it on this engine, so this agent is left out of the request (the engine refuses any request that carries it) — change the agent's model, or set it to `inherit`.",
+    'model.subagent.refused.disabled': "Subagent model {word} is disabled on this engine, so this agent is left out of the request (the engine refuses any request that carries it) — change the agent's model, or set it to `inherit`.",
     'model.catalogDefault.refused.named': 'A task that names no model would be refused: the engine cannot resolve a default model from its model configuration (the settings default is {name}) · Set a default model the engine can run, or add or fix one',
     'model.catalogDefault.refused.select': 'A task that names no model would be refused: the engine cannot resolve a default model from its model configuration (the settings default is a selection) · Change the selection, or add or fix a model the engine can run',
     'session.sync.pushRowBitsWriterSide': 'The session was pushed · At the destination it is a read-only mirror, so its title and pin stay with the side that writes it and were not changed there',
@@ -147,8 +154,11 @@ const EN = {
     'session.mcpReconnect.undeclared': 'This run declared no MCP servers, so there is nothing to re-dial ({server} is not part of this run){why}',
     'session.mcpReconnect.unsettled': "The MCP re-dial did not settle within the time this request waits, so there is no result yet: the re-dial was not cancelled and may still be running. Check the server's state before re-dialing it again — a second request that arrives after the dial has settled closes the connection and dials once more.",
     'session.mcpReconnect.reasonTail': ' — {reason}',
+    'session.mcpReconnect.transaction': 'Reconnecting closes the current connection before dialing again. On a healthy server this is a transaction, not a refresh: a failed re-dial leaves the server down and withdraws its tools from the model until a later re-dial succeeds.',
     'session.mcpFailure.reauthorizeSuffix': ' (re-authorize)',
     'session.mcpFailure.serverDownSuffix': ' (the server is down)',
+    'mcp.elicitation.refused.named': 'MCP server {server} asked for input through a form that cannot be shown here, so the request was declined.',
+    'mcp.elicitation.refused.unnamed': 'An MCP server asked for input through a form that cannot be shown here, so the request was declined.',
     'config.cloudLogin.accessDenied': 'Sign-in was declined.',
     'config.cloudLogin.expiredToken': 'The sign-in code expired before it was approved — start again.',
     'config.cloudLogin.invalidGrant': 'The Cloud sign-in can no longer be renewed — sign in again.',
@@ -201,6 +211,20 @@ const EN = {
     'onboard.plan.envNotObject': 'The settings file has an "env" that is not an object — not rewriting it.',
     'onboard.plan.envCatalogPresent': 'The engine is serving "{model}" from environment settings and the catalog has no enabled model; a first catalog model would replace the environment models. Add them to the catalog first.',
     'onboard.input.keyInFields': 'The model ID / base URL contains the API key — check the fields.',
+    'model.pool.add.duplicate': '"{model}" is listed twice in this batch with the same address — add it once.',
+    'model.pool.add.probeFailed': 'The provider rejected "{model}" (key, model name or reply format) — fix it and check again.',
+    'model.pool.add.probeUnverified': '"{model}" hasn\'t been checked against its provider (or the check couldn\'t finish) — check it again, or save it as unverified.',
+    'model.pool.add.pinMoved': 'The model list changed while "{name}" was being saved (its name or stored key moved) — nothing was added. Try again.',
+    'model.pool.notFound': 'There is no model named "{name}" in the model list.',
+    'model.pool.importEnv.notYet': 'The engine is serving "{model}" from its environment settings. This app can\'t copy environment models into the model list yet — add them by hand (address and key) first, then add more.',
+    'model.pool.tier.badGroup': 'A tier group name must start with a letter or digit and use only letters, digits, ".", "_" or "-".',
+    'model.pool.tier.noGroup': 'There is no tier group named "{group}".',
+    'model.pool.tier.groupExists': 'A tier group named "{group}" already exists.',
+    'model.pool.channel.badPick': 'The picked profile or models were not found in what this app read from that source.',
+    'model.pool.discover.status': 'The model list request answered HTTP {status}.',
+    'model.pool.discover.notList': 'The endpoint did not answer with a model list.',
+    'model.pool.discover.timeout': 'The model list request timed out.',
+    'model.pool.discover.unreachable': 'The endpoint could not be reached: {cause}',
     'onboard.refusal.input': 'The model setup is incomplete or not in the expected shape — nothing was saved.',
     'onboard.refusal.probeFailed': 'The provider did not accept this setup — nothing was saved.',
     'onboard.refusal.probeUnverified': "The provider couldn't be checked, so nothing was saved — try again, or save it as unverified.",
@@ -221,9 +245,9 @@ const EN = {
     'config.mcp.transportsNone': 'none',
     'config.mcp.transportInvalid': 'MCP server {name}{where} was not started: its transport setting cannot be used — {path} {problem}. Fix that setting for this server (or remove the server); the other MCP servers are unaffected.',
     'config.mcp.transportDegraded': 'MCP server {name}{where} was started without part of its transport settings, which cannot be used as written: {lost}. The rest of its settings are applied; fix the settings named above to get them applied too.',
-    'config.mcp.toolAxesInvalid': 'MCP server {name}{where} was not started: its toolAxes setting is not valid — {problem}. Fix the toolAxes entry for this server (or remove it); the other MCP servers are unaffected.',
+    'config.mcp.toolAxesInvalid': 'MCP server {name}{where} was started to read its tool list and then dropped: its toolAxes setting is not valid — {problem}. Fix the toolAxes entry for this server (or remove it); the other MCP servers are unaffected.',
     'config.mcp.toolAxesFallbackProblem': 'the declaration is not a valid set of per-tool safety settings',
-    'config.mcp.toolFacesInvalid': 'MCP server {name}{where} was not started: its toolFaces setting is not valid — {problem}. Fix the toolFaces entry for this server (or remove it); the other MCP servers are unaffected.',
+    'config.mcp.toolFacesInvalid': 'MCP server {name}{where} was started to read its tool list and then dropped: its toolFaces setting is not valid — {problem}. Fix the toolFaces entry for this server (or remove it); the other MCP servers are unaffected.',
     'config.mcp.toolFacesFallbackProblem': 'the declaration is not a valid set of per-tool display and approval settings',
     'config.mcp.toolFacesUnreadable': 'the setting could not be read (a getter or proxy trap on it threw)',
     'config.mcp.elicitationInvalid': 'MCP server {name}{where} was not started: its elicitation setting must be true or false. Fix the elicitation entry for this server (or remove it); the other MCP servers are unaffected.',
@@ -232,7 +256,7 @@ const EN = {
     'config.mcp.entryNotObjectProblem': 'the entry is not an object (an object with a command or a url is expected)',
     'config.mcp.transportTypeUnsupported': 'this transport type cannot be carried on the request (only stdio and http are supported)',
     'config.mcp.transportIdentityBothSetProblem': 'both principalHeader and assertionHeader are set, and they name the same identity header — keep only one of the two',
-    'config.mcp.allowToolsInvalid': 'MCP server {name}{where} was not started: its allowTools setting cannot be used — {problem}. Fix the allowTools entry for this server (a list of tool-name strings); the other MCP servers are unaffected.',
+    'config.mcp.allowToolsInvalid': 'MCP server {name}{where} was started to read its tool list and then dropped: its allowTools setting cannot be used — {problem}. Fix the allowTools entry for this server (a list of tool-name strings); the other MCP servers are unaffected.',
     'config.mcp.allowToolsNotArray': '{path} must be an array of strings (got {got})',
     'config.mcp.allowToolsElementNotString': '{path} must be a string (got {got})',
     'config.mcp.allowToolsHole': '{path} is missing: a list with gaps is not allowed, every position must hold a string',
@@ -281,6 +305,7 @@ const EN = {
     'approval.rowUnresumable.askNotSurfaced': 'the pending row (task {taskId}) cannot be continued by this engine, so it is not surfaced as a card that can be answered: {sentence}',
     'approval.park.stillParked': '{gate} gate could not be answered: {reason} — the run is still parked on this approval.',
     'approval.park.refusedNotResumable': '{gate} gate could not be answered: {reason} — this engine cannot resume this approval as things stand; cancel the run if it is still parked.',
+    'approval.park.newerWorker': '{gate} gate could not be answered: {reason} — the run is still parked on this approval, but {wayOut}.',
     'approval.park.resume.card': '{gate} gate could not be answered: {reason} — the run is still parked on this approval: decide it on the card when it is shown again, or cancel the run.',
     'approval.park.resume.speak': '{gate} gate could not be answered: {reason} — the run is still parked on this approval: send a message to reopen the card, then decide it there, or cancel the run.',
     'approval.park.argsFromModelCall': "the pending approval record has no tool arguments that will run, so the arguments shown are the model's original call from the conversation — if they were changed after that call (for example by a hook), what runs differs from what is shown. Edits are not accepted on this card: the arguments shown are not the ones that will run",
@@ -288,14 +313,17 @@ const EN = {
     'approval.policyDeny.denyRule': 'Permission for this tool use was denied by a deny rule in the permission settings. {tail}',
     'approval.policyDeny.dontAsk': 'Permission for this tool use was denied: this session no longer asks for approval, so a call that would need approval is refused. {tail}',
     'approval.policyDeny.engineFloor': 'Permission for this tool use was denied by a safeguard on the engine side that permission settings cannot override. {tail}',
+    'approval.policyDeny.hook': 'Permission for this tool use was denied by a PermissionRequest hook. The action was NOT performed. Do not claim it succeeded, and do not retry it unchanged — report what was blocked, or suggest an alternative.',
     'approval.policyDeny.tail': 'The action was NOT performed. Do not claim it succeeded, and do not retry it in this session — report the limitation to the user, or suggest an alternative.',
     'approval.decision.grantChanged': 'The engine refused this approval because the skill grant it was bound to has changed since the card was shown · Nothing was decided and the request is still waiting, but approving it again will be refused the same way · Deny this request so the model can activate the skill again',
     'approval.decision.answerInvalid': 'The engine rejected the answer itself because it does not fit the question that was asked · Nothing was decided and the question is still waiting · Correct the answer and send it again',
-    'approval.editRefusal.line': 'That approval was NOT sent: this request does not expose its tool arguments here, so an edited approval cannot be applied. ' +
-        'The request is still waiting — approve or deny it as it is.',
+    'approval.editRefusal.stem': 'this request does not expose its tool arguments here, so an edited approval cannot be applied',
+    'approval.editRefusal.line': 'That approval was NOT sent: {stem}. The request is still waiting — approve or deny it as it is.',
+    'approval.editRefusal.parkReason': 'the card returned an edited approval, but {stem} — nothing was sent (the arguments are missing from the pending approval record, or replaced there by a size marker); approve or deny it as it is',
     'approval.decision.settledElsewhereContrary.deniedFirst': 'This request was already answered elsewhere and denied, so your approval did not take effect.',
     'approval.decision.settledElsewhereContrary.approvedFirst': 'This request was already answered elsewhere and approved, so your denial did not take effect.',
     'approval.decision.unconfirmedAfterRetry': "It is not known whether your answer took effect: an earlier attempt to send it was not confirmed, and by the time it was sent again the request was no longer waiting · Check the task's current state before acting on it",
+    'approval.decideAck.unconfirmed': "It is not known whether your answer took effect · Check the request's current state before answering it again",
     'notice.decide.rowUnrevivable': 'The engine can no longer recover this approval card, so neither approving nor denying it will take effect · The card can only be cleared on the server side — wait for that, or contact whoever operates the engine',
     'approval.askPark.autoReopenBlocked.policyInteractive': "The engine's admission policy refused to resume this parked step (run {run}), so sema will not put its card back on screen by itself. Switch to a permission mode this deployment allows, or ask whoever operates the deployment, then send a message to bring the card back.",
     'approval.askPark.autoReopenBlocked.policyPrint': "The engine's admission policy refused to resume this parked step (run {run}), so sema will not put its card back on screen by itself. Switch to a permission mode this deployment allows, or ask whoever operates the deployment, then send a message to bring the card back; or stop the run ({cancel}).",
@@ -420,6 +448,9 @@ const EN = {
     'resume.refusal.park.printHolds': '{head}{configMayReturn} The parked run still holds this session ({code}): cancel it ({cancel}), then submit the work again as a new task.{blocked}',
     'resume.refusal.park.interactiveEnded': '{head} The engine ended that parked run, so this conversation is free: send the work again as a new message.',
     'resume.refusal.park.interactiveBusy': '{head}{configMayReturn} The parked run keeps this conversation busy until it is cancelled.',
+    'resume.refusal.park.whyNewerEngine': 'it was parked by a newer engine version than this one',
+    'resume.refusal.park.interactiveNewerWorker': '{head}{configMayReturn} The parked run still holds this conversation, but {wayOut}.',
+    'resume.refusal.park.printNewerWorker': '{head}{configMayReturn} The parked run still holds this session ({code}), but {wayOut} ({cancel}).{blocked}',
     'resume.refusal.park.blockedPrint': 'sema will not put the card for run {run} back on screen by itself: this engine version refuses to resume it. Cancel the run ({cancel}) and submit the work again as a new task.',
     'resume.refusal.park.blockedInteractive': 'sema will not put the card for run {run} back on screen by itself: this engine version refuses to resume it. To free this conversation, send a message — sema then offers to cancel that run (if the card comes back instead, answer it first), after which you can send the work again as a new message.',
     'session.selfHeal.wayOut.interactive': 'run /clear to keep working in a fresh session',
@@ -461,6 +492,9 @@ const EN = {
     'session.selfHeal.injected.notDelivered': '{lead} was not delivered: this session was still busy with an earlier reply{id}, and there was no open card you could answer to free it{noView}. sema did not retry, so the model has not seen it.',
     'session.selfHeal.injected.redundant': '{lead} was not passed on: the reply it was about{id} resumed on its own after that decision, so it has nothing to add.',
     'session.selfHeal.injected.deferred': '{lead} is waiting: this session is busy with an earlier reply{id}, so sema kept the message and will send it as a new message once that reply has finished or paused.',
+    'session.selfHeal.injected.resendWithheldLeftConfirmed': '{lead} was not delivered: the earlier reply{id} let go of the conversation the message was meant for, but this screen switched to another conversation before sema could send it, and sema does not send it into a different conversation — the model has not seen it.',
+    'session.selfHeal.injected.resendWithheldUnconfirmed': '{lead} was not delivered: sema could not confirm that this screen is still on the conversation it was meant for, so it did not send it — the model has not seen it.',
+    'session.selfHeal.injected.resendWithheldLeftInferred': '{lead} was not delivered: the earlier reply{id} is now reported as finished in the conversation the message was meant for, but this screen switched to another conversation before sema could send it, and sema does not send it into a different conversation — the model has not seen it.',
     'session.selfHeal.decisionInFlight': 'The previous turn is parked {parkedOn} and your answer to that card is still on its way to the engine, so sema did not show the card again — answering it a second time would send a second decision. It did NOT cancel the run. Your message was NOT sent; send it again in a moment, once the engine has applied that decision.',
     'session.selfHeal.parkedOn.ask': 'waiting for your decision (run {taskId})',
     'session.selfHeal.parkedOn.plan': 'on a plan review (run {taskId})',
@@ -500,6 +534,17 @@ const EN = {
     'session.selfHeal.row.attach': '{disclosure} Your message was NOT sent; send it again once that run has finished.',
     'session.selfHeal.row.cancelled.confirmed': 'You chose to cancel run {taskId}. The engine confirmed it is no longer holding this session, so sema is sending your message now.',
     'session.selfHeal.row.cancelled.reported': 'You chose to cancel run {taskId}. The engine now reports that run as finished, so sema is sending your message now; if that run has not fully let go of the session yet, you may have to send it once more.',
+    'session.selfHeal.row.resendWithheldLeft.confirmed': 'Your message was NOT sent: run {taskId} no longer holds the conversation you typed it in, but this screen switched to another conversation before sema could send it again, and sema does not send a message into a different conversation. Switch back to that conversation and send it again if you still want it.',
+    'session.selfHeal.row.resendWithheldLeft.reported': 'Your message was NOT sent: run {taskId} is now reported as finished in the conversation you typed it in, but this screen switched to another conversation before sema could send it again, and sema does not send a message into a different conversation. Switch back to that conversation and send it again if you still want it (if that run has not fully let go of it yet, you may have to send it once more).',
+    'session.selfHeal.row.resendWithheldUnconfirmed': 'Your message was NOT sent: sema could not confirm that this screen is still on the conversation you typed it in, so it did not send it again — sending a message into a different conversation would be worse than not sending it. If this is still that conversation, send it again.',
+    'session.selfHeal.stopLeft.untouched': 'sema left run {taskId} alone: this screen switched to another conversation while sema was checking that run, and sema does not end a run for a conversation that is no longer on screen. That run may still hold the conversation it belongs to — switch back to that conversation, then {endRun}.',
+    'session.selfHeal.stopLeft.waiting.certain': 'Run {taskId} is waiting on a decision from you in the conversation it belongs to, and sema does not end a run that is waiting for your answer. This screen has switched to another conversation since — switch back to that conversation to answer it.',
+    'session.selfHeal.stopLeft.waiting.uncertain': 'Run {taskId} may be waiting on a decision from you in the conversation it belongs to — sema could not confirm that it is not — so sema left it alone. This screen has switched to another conversation since — switch back to that conversation to answer it; if nothing is waiting there, {endRun}.',
+    'session.selfHeal.stopLeft.ended.confirmed': 'Run {taskId} has ended — the engine confirmed it no longer holds the conversation it belongs to. This screen has switched to another conversation since — switch back to that conversation to send your message again.',
+    'session.selfHeal.stopLeft.ended.reported': 'Run {taskId} has ended — the engine reports it finished. This screen has switched to another conversation since — switch back to that conversation to send your message again.',
+    'session.selfHeal.stopLeft.nothingToEnd': 'Run {taskId} had already finished, so there was nothing to end. This screen has switched to another conversation since — switch back to that conversation to send your message again.',
+    'session.selfHeal.stopLeft.refused': 'sema could not end run {taskId}: the engine refused ({detail}), so nothing was ended. This screen has switched to another conversation since — switch back to the conversation that run belongs to and try again there: {endRun}.',
+    'session.selfHeal.stopLeft.notConfirmed': 'sema could not confirm that run {taskId} has let go of the conversation it belongs to, and this screen has switched to another conversation since. Switch back to that conversation to check there; to end it, {endRun}.',
     'session.selfHeal.row.cancelTimeout.aborted': 'sema asked the engine to cancel run {taskId} and you interrupted while it was still confirming ({waited} in). Cancelling is asynchronous, so that run may still be winding down and may still hold this session. Your message was NOT sent; send it again in a moment, or {wayOut}.',
     'session.selfHeal.row.cancelTimeout.unread': "sema asked the engine to cancel run {taskId} but could not read that run's state back within {waited}, so it cannot confirm whether the session was released. Your message was NOT sent; send it again in a moment (if that run really is gone it will just run), or {wayOut}.",
     'session.selfHeal.row.cancelTimeout.held': 'sema asked the engine to cancel run {taskId}, but that run still held this session {waited} later — cancelling is asynchronous and it may still be winding down. Your message was NOT sent; send it again in a moment, or {wayOut}.',
@@ -660,6 +705,21 @@ const EN = {
     'session.hostSettings.styleSafeMode': 'Safe mode is on, so the output style from your settings is not applied.',
     'session.hostSettings.styleOversize': 'Your output style was not applied to this request: together with the built-in product context it is longer than the {limit}-character limit. Shorten the style to apply it.',
     'session.hostSettings.styleUnreadable': 'Your output style could not be read as text, so it is not applied to this request.',
+    'session.hostSettings.allowKept.managed.inProgress.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet (sema keeps fetching it; allow rules apply once it arrives). Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.inProgress.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet (sema keeps fetching it; allow rules apply once it arrives). Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.failed.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet (this run will not fetch again; the next run retries). Run again to retry fetching it (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.failed.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet (this run will not fetch again; the next run retries). Run again to retry fetching it (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.unknown.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet. Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.unknown.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet. Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.generic.one': '{held} permissions.allow rule was not sent to the engine for this run because {why}; an allow rule from a settings file is only sent from a settings read with no problems. Fix the reported settings, then run again (deny and ask rules from this read, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.generic.other': '{held} permissions.allow rules were not sent to the engine for this run because {why}; an allow rule from a settings file is only sent from a settings read with no problems. Fix the reported settings, then run again (deny and ask rules from this read, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.why.problems': 'the settings read reported problems',
+    'session.hostSettings.allowKept.why.problemsWhere': 'the settings read reported problems ({where})',
+    'session.hostSettings.allowKept.why.counted.one': 'the settings read reported {count} problem',
+    'session.hostSettings.allowKept.why.counted.other': 'the settings read reported {count} problems',
+    'session.hostSettings.allowKept.why.countedWhere.one': 'the settings read reported {count} problem ({where})',
+    'session.hostSettings.allowKept.why.countedWhere.other': 'the settings read reported {count} problems ({where})',
+    'session.hostSettings.allowKept.why.unreadable': 'the health of this settings read could not be checked',
     'model.identity.lane.processEnv': 'the environment this client was started with',
     'model.identity.lane.settingsEnv': "this client's settings file",
     'model.identity.lane.modelCatalogFile': 'the local model catalog file',
@@ -671,6 +731,24 @@ const EN = {
     'model.identity.catalogAdoption.refused': '{lane} lists models, but the engine is reported to refuse this catalog as written, so none of them can serve as its default',
     'model.identity.catalogAdoption.notResolvable': 'no model name is configured for the local engine to start with — {clause}, and the engine does not start without one',
     'model.identity.catalogAdoption.notResolvableWithPartial': 'no model name is configured for the local engine to start with — {clause}, and {partial}, and the engine does not start without one',
+    'model.configGap.head.model': 'no model is configured yet',
+    'model.configGap.head.gatewayUrl': 'no model gateway base URL is configured',
+    'model.configGap.head.apiKey': 'no API key is configured',
+    'model.configGap.head.anthropicKey': 'no Anthropic key is configured (ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN)',
+    'model.configGap.head.incomplete': 'model configuration is incomplete',
+    'model.configGap.item.model': 'the model name (MODEL_ID)',
+    'model.configGap.item.gatewayUrl': 'the gateway base URL (MODEL_GATEWAY_BASEURL)',
+    'model.configGap.item.apiKey': 'the API key (MODEL_API_KEY)',
+    'model.configGap.item.anthropicKey': 'an Anthropic key (ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN)',
+    'model.configGap.lead.one': '{a} is not configured',
+    'model.configGap.lead.two': '{a} and {b} are not configured',
+    'model.configGap.lead.three': '{a}, {b} and {c} are not configured',
+    'model.configGap.reason.noModel': 'the engine does not start without a model name',
+    'model.configGap.reason.anthropicCatalog.one': "the model catalog's only enabled entry is on the anthropic channel, so the engine cannot serve it",
+    'model.configGap.reason.anthropicCatalog.other': "the model catalog's {count} enabled entries are all on the anthropic channel, so the engine cannot serve any of them",
+    'model.configGap.reason.gatewayCatalog.one': "the model catalog's only enabled entry has no base URL of its own, so the engine cannot serve it",
+    'model.configGap.reason.gatewayCatalog.other': "none of the model catalog's {count} enabled entries has a base URL of its own, so the engine cannot serve any of them",
+    'model.configGap.detail.withReason': '{missing} — {reason}',
     'notice.injectionLane.sentence': "On this engine's {lane} lane the tools run on a different machine than the engine, so the {items} sent with a task run there rather than on this machine — any that rely on programs or credentials on this machine will fail there",
     'notice.injectionLane.item.stdioMcp': 'local stdio MCP servers',
     'notice.injectionLane.item.credentialedMcp': 'MCP servers that use credentials from this machine',
@@ -701,7 +779,7 @@ const EN = {
     'notice.durableGate.exit.other': 'To use durable approval, a checkpoint store has to be available.',
     'notice.durableGate.exitAlt.forceDurableGate': 'Or ask whoever runs the deployment to drop the requirement for this account.',
     'notice.durableGate.exitAlt.durableApproval': 'Or run the task where a live approver is attached.',
-    'notice.memory.sessionPolluted': 'Memory for this session is marked externally exposed ({reason}). From here on, memory it writes may be held back for review instead of being saved to the long-term library; what each batch actually held back is announced separately.',
+    'notice.memory.sessionPolluted': 'A tool in this session can reach content from outside it ({reason}). From here on, memory it writes may be held back for review instead of being saved to the long-term library; what each batch actually held back is announced separately.',
     'notice.memory.harvestQuarantined.counts': 'Memory harvest held back entry files written or changed in this session instead of adding them to the long-term library — withheld {count}, moved aside for review {moved}, flagged for follow-up {escalated}; the last two counts can overlap.',
     'notice.memory.harvestQuarantined.indexOnly': "Memory harvest rolled this session's changes to the memory index back to where they started; no entry files were withheld.",
     'notice.memory.harvestQuarantined.indexAlso': 'The memory index was also rolled back.',
@@ -755,6 +833,8 @@ const EN = {
     'notice.sessionBox.idle.unavailable': '{peer} is unavailable.',
     'notice.sessionBox.idle.expired': '{peer} did not answer before the wait ran out.',
     'notice.sessionBox.idle.other': 'There is a status update from {peer}.',
+    'notice.resupply.truncated.one': 'This notice was shortened: the full record is {bytes} bytes, over the notice size limit, so 1 field was left out. The full content can still be viewed in the run record.',
+    'notice.resupply.truncated.other': 'This notice was shortened: the full record is {bytes} bytes, over the notice size limit, so {count} fields were left out. The full content can still be viewed in the run record.',
     'notice.peer.held.deliveredApproved': '{subject} was approved and delivered.',
     'notice.peer.held.deliveredRejudged': '{subject} was re-judged and delivered, because the policy now accepts it.',
     'notice.peer.held.droppedRejudged': '{subject} was approved, but the policy now refuses it, so it was dropped.',
@@ -912,6 +992,20 @@ const EN = {
     'notice.capability.mcpProbe.notReported': 'per-server MCP status face not reported by this engine — this says nothing about whether the face exists, so that path may not exist here (asking it may answer with a machine-readable route-not-found, though a timeout or an uncoded gateway answer says nothing either way); prefer the session panel last-leg roster where that panel carries one, and otherwise show this reason rather than an entry that cannot answer',
     'notice.capability.mcpProbe.absent': 'per-server MCP status face reported off on this deployment — this engine answers no readings there; this client does not guess why, and whether caller-supplied declarations are honored is a separate position with its own answer',
     'notice.capability.mcpProbe.present': 'per-server MCP status face on — this engine dials its own declared MCP servers on request, with no run, and a probe of caller-supplied declarations answers with the very same body shape',
+    'notice.capability.subject.storePosture': 'store posture',
+    'notice.capability.storePosture.unobserved': 'store posture not observed — the engine reports it on /v1/capabilities; this process has no usable capabilities reading cached for it, so whether this deployment persists its state is unknown',
+    'notice.capability.storePosture.notReported': 'store posture not reported by this engine; this does not say whether this deployment persists its state',
+    'notice.capability.storePosture.assembled': 'store {backend}',
+    'notice.capability.storePosture.assembledDeclared': 'store declared {declared}, running on {backend}',
+    'notice.capability.storePosture.durable': '{assembled} — durable: this replica persists its state, so it survives a restart',
+    'notice.capability.storePosture.notDurableHead': 'NOT durable',
+    'notice.capability.storePosture.memory': '{assembled} — {head}: this replica holds its state in memory and loses it on restart',
+    'notice.capability.storePosture.ephemeral': '{assembled} — {head}: the engine reports that this replica keeps state on storage that does not survive a restart',
+    'notice.capability.storePosture.unknown': "{assembled} — durability unknown: the engine reports that it cannot tell whether this replica's state survives a restart",
+    'notice.capability.storePosture.unrecognized': '{assembled} — durability unknown: the engine reported a durability word this client does not know yet: "{word}"',
+    'notice.capability.storePosture.degraded.dbUnreachable': '{line} (degraded: the declared database could not be opened at start-up, so the engine fell back rather than refusing to start)',
+    'notice.capability.storePosture.degraded.localUnwritable': '{line} (degraded: the default local file store could not be created — a read-only or full data directory is one possible cause, and this client cannot tell which applies)',
+    'notice.capability.storePosture.degraded.other': '{line} (degraded for a reason this client does not know yet: "{reason}")',
     'notice.capability.hands.noneStem': 'this leg of the run was assembled with NO built-in file-and-shell tools',
     'notice.capability.hands.noneTail': "so on this leg the model had no tool of the engine's own for editing files or running commands (tools mounted by other conditions, such as external servers, and sub-runs delegated to other legs are not covered by this reading)",
     'notice.capability.hands.noneLine': '{stem} — {why}, {tail}',
@@ -1247,6 +1341,7 @@ const EN = {
     'config.hooks.plan.reason.closedUntrusted': 'this workspace is not trusted, so no hooks run in it',
     'config.hooks.plan.reason.closedGovernanceUnreadable': 'the managed policy could not be read, so no hooks run this turn',
     'config.hooks.plan.reason.closedDisableAll': 'managed settings turn off all hooks (disableAllHooks)',
+    'config.hooks.plan.reason.noExecutor': 'neither the engine nor this client runs this event',
     'config.hooks.plan.keyNotRead.oneKey': '{layer}: {hooks} will not run — the connected server does not read the key {coordinates}. Remove the key, or use a server that reads it.',
     'config.hooks.plan.keyNotRead.manyKeys': '{layer}: {hooks} will not run — the connected server does not read the keys {coordinates}. Remove those keys, or use a server that reads them.',
     'config.hooks.plan.keyNotRead.more': '{shown} and {rest} more',
@@ -1298,6 +1393,79 @@ const EN = {
     'config.mods.rewrite.inputBy': 'Arguments changed by {by} before the call was let through',
     'config.mods.session.unreadable': "The mods used by this conversation's last run couldn't be read",
     'config.mods.session.unarmed': 'Mods show up here once this conversation has run on this engine',
+    'config.hooks.roster.unreadable': "This conversation's hooks plan couldn't be read",
+    'config.hooks.roster.unarmed': 'Hooks show up here once this app has this conversation open',
+    'config.localConfig.refused.invalidRequest': 'The change could not be read as a valid request — nothing was saved.',
+    'config.localConfig.refused.scopeUnreadable': "The configuration file can't be read, so it was not overwritten — nothing was saved.",
+    'config.localConfig.refused.scopeUnwritable': "This setting can't be saved in that file — it would not take effect there. Nothing was saved.",
+    'config.localConfig.refused.untrustedFolder': "This folder isn't trusted, so its settings files can't carry this setting — nothing was saved.",
+    'config.localConfig.refused.policyDenied': "Your organization's managed settings don't allow this change — nothing was saved.",
+    'config.localConfig.refused.notFound': 'The item to change was not found — nothing was saved.',
+    'config.localConfig.refused.alreadyExists': 'That item already exists — nothing was saved.',
+    'config.localConfig.refused.lockBusy': 'Another program is changing this configuration right now — nothing was saved. Try again in a moment.',
+    'config.localConfig.refused.lockFailed': "The configuration file couldn't be locked for writing (a permission or folder problem) — the file was not changed.",
+    'config.localConfig.refused.changedDuringWrite': 'Another program changed this configuration while saving — nothing was saved. Try again.',
+    'config.localConfig.refused.writeFailed': "The configuration file couldn't be written — the file was not changed.",
+    'config.localConfig.refused.notWritten': 'The change was not saved.',
+    'config.localConfig.refused.skillLockedByHigherLayer': "A higher-priority configuration sets this skill's state; it cannot be changed here.",
+    'config.localConfig.refused.skillManagedByPlugin': 'A plugin skill is managed with the plugin, not here.',
+    'config.localConfig.refused.skillLockedByAuthor': "This skill's own file turns model invocation off; its state cannot be changed here.",
+    'config.localConfig.refused.skillNameUnstorable': "Settings can't store an entry with this skill's name; rename its folder or file to configure it.",
+    'config.localConfig.refused.entryInUse': 'That model is still in use (as the default model, by a role, or in an old tier setting) — point those at another model first. Nothing was saved.',
+    'config.localConfig.refused.credentialUnpaired': "That model couldn't be reached with the key or address it has — nothing was saved.",
+    'config.localConfig.refused.envCatalogPresent': 'The engine is using the models set in its environment; adding one here would take those out of use. Import the environment models first — nothing was saved.',
+    'config.localConfig.refused.probeFailed': 'The provider showed that a model in this change is set up wrong (key, model name or reply format) — nothing was saved.',
+    'config.localConfig.refused.probeUnverified': "A model in this change hasn't been checked against its provider (or the check couldn't finish) — nothing was saved. Check it again, or save it as unverified.",
+    'config.localConfig.unavailable.engineIsRemote': "The Cloud engine is in use — local configuration doesn't apply to it. Switch to the local engine first.",
+    'config.localConfig.unavailable.notSingleUser': "This engine isn't confirmed to serve only you, so local configuration isn't used with it.",
+    'config.localConfig.unavailable.configHomeUnpinned': "This app hasn't settled which configuration folder to use, so local configuration is neither shown nor changed.",
+    'config.localConfig.unavailable.domainNotHosted': "This app doesn't offer this kind of configuration change on this device yet.",
+    'config.localConfig.unknown.commitUnconfirmed': "It isn't certain whether the change was saved — refresh to check.",
+    'config.localConfig.unknown.reportUnreadable': "The app's answer after saving couldn't be read, so it isn't certain whether the change was saved — refresh to check.",
+    'config.localConfig.applied.nextTurn': 'Saved. It takes effect from the next turn.',
+    'config.localConfig.applied.engineReload': 'Saved. The engine picks it up when it next reloads its configuration, usually within a minute.',
+    'config.localConfig.applied.nextEngineStart': 'Saved. It takes effect the next time the local engine starts.',
+    'config.localConfig.applied.unchanged': 'Already set this way — nothing needed to change.',
+    'config.localConfig.preview.nextTurn': 'Not saved yet. Once saved, it takes effect from the next turn.',
+    'config.localConfig.preview.engineReload': 'Not saved yet. Once saved, the engine picks it up when it next reloads its configuration.',
+    'config.localConfig.preview.nextEngineStart': 'Not saved yet. Once saved, it takes effect the next time the local engine starts.',
+    'config.localConfig.preview.unchanged': 'Already set this way — saving would change nothing.',
+    'config.localConfig.residue.orphanKeySlot': 'A stored key slot was left with no model using it; it does nothing.',
+    'config.localConfig.residue.legacyTierGroupsLeft': 'The old tier settings were left in the settings file; they are no longer used.',
+    'config.localConfig.disclosure.decidedBy': 'The setting in effect comes from {layer}.',
+    'config.localConfig.disclosure.shadowed': 'This setting is overridden by {layer}, so it has no effect for now.',
+    'config.localConfig.disclosure.tierGroupOverridden': 'Some tier groups in your old settings share a name with groups already in {layer}; the ones in {layer} were kept and the old ones were not copied over.',
+    'config.localConfig.disclosure.tierGroupOverriddenNamed': 'These tier groups in your old settings share a name with groups already in {layer}; the ones in {layer} were kept and the old ones were not copied over: {names}.',
+    'config.localConfig.layer.userSettings': 'your user settings',
+    'config.localConfig.layer.projectSettings': "this project's shared settings",
+    'config.localConfig.layer.localSettings': "this project's local settings",
+    'config.localConfig.layer.globalConfig': "this app's state file",
+    'config.localConfig.layer.projectMcp': "this project's MCP server file",
+    'config.localConfig.layer.models': 'the model catalog',
+    'config.localConfig.layer.deploymentMcp': "the engine's MCP server declaration",
+    'config.localConfig.layer.policySettings': "your organization's managed settings",
+    'config.localConfig.layer.other': 'another settings file',
+    'config.localConfig.refused.nameUnusable': 'That server name can\'t be used — nothing was saved.',
+    'config.localConfig.refused.nameReserved': 'That server name is reserved by the app\'s own built-in server — nothing was saved.',
+    'config.localConfig.refused.mcpEntryInvalid': 'The server entry has problems that would keep it from loading — nothing was saved.',
+    'config.localConfig.refused.ambiguousScope': 'A server with that name is configured in more than one place; choose which one to change — nothing was saved.',
+    'config.localConfig.refused.credentialsNeedReentry': 'The server\'s address or command changed, so the secrets stored for it must be entered again or removed — nothing was saved.',
+    'config.localConfig.refused.baseConflict': 'This server\'s configuration changed after it was shown — nothing was saved. Refresh and try again.',
+    'config.mcpServers.notice.shadowed': 'A server with the same name in the {scope} configuration takes precedence over this one.',
+    'config.mcpServers.notice.endpointDiffers': 'A server with the same name in the {scope} configuration points somewhere else.',
+    'config.mcpServers.notice.deploymentWins': 'The engine\'s own deployment declares a server with this name; the deployment\'s server is used instead.',
+    'config.mcpServers.notice.envMissing': 'These variables are not set, so they stay as written: {names}.',
+    'config.mcpServers.notice.narrowingWouldConflict': 'Other places ({scopes}) declare a different tool list for this name; the server will not load until they agree.',
+    'config.mcpServers.withheld.narrowingConflict': 'Not loaded: the places that configure this server disagree on its tool list.',
+    'config.mcpServers.withheld.narrowingInvalid': 'Not loaded: a tool list for this server is written incorrectly in one of the places that configure it.',
+    'config.mcpServers.withheld.layerUnreadable': 'Not loaded: a configuration file that can add or limit MCP servers could not be read, so no MCP servers are loaded until it is fixed.',
+    'config.mcpServers.withheld.policyLocked': 'Not loaded: your organization\'s managed settings only allow the MCP servers it provides.',
+    'config.mcpServers.problem.nameReserved': 'This name belongs to the app\'s own built-in server.',
+    'config.mcpServers.approvalsWithheld': 'MCP approvals written in {layer} are not used because this folder is not trusted.',
+    'config.mcpServers.probe.removed': 'Nothing to test: this change removes the server.',
+    'config.mcpServers.probe.notActive': 'Nothing to test: the server would not be active after this change.',
+    'config.mcpServers.probe.envMissing': 'Not tested: some variables the server uses are not set.',
+    'config.mcpServers.probe.editRefusal': 'Not tested: the change itself could not be accepted.',
     'follow.notFollowed.headRun': 'This screen is no longer following run {taskId}{reason}{ending}{exit}',
     'follow.notFollowed.headTurn': "This screen is no longer following this turn's run{reason}{ending}{exit}",
     'follow.notFollowed.reason.exhaustedDraining': ": the engine instance serving it was going down when its last event stream closed, and this client's re-attach allowance has run out.",
@@ -1383,6 +1551,7 @@ const EN = {
     'localEngine.down.spawnRefused': 'The local engine was not started: the preparation step did not pass.',
     'localEngine.down.stopFailed': 'The old local engine did not stop in time, so it was not replaced.',
     'localEngine.down.crashLoop': 'The local engine keeps stopping unexpectedly, so automatic restarts are paused.',
+    'localEngine.down.exitedOnce': 'The local engine exited after it started, and Sema does not restart it automatically.',
     'localEngine.down.highWaterUnreadable': 'The record of the newest engine version used on this machine cannot be read, so the local engine is not started; check the engine data directory.',
     'localEngine.crashLoop.retry': 'The local engine keeps stopping unexpectedly; Sema tries again in about {seconds} seconds.',
     'localEngine.crashLoop.stopped': 'The local engine keeps stopping unexpectedly; Sema has stopped retrying on its own. Restart it manually.',
@@ -1409,11 +1578,80 @@ const EN = {
     'localEngine.restartOutcome.pendingBusy': 'Other sessions are using the local engine; it restarts once nothing is using it.',
     'localEngine.restartOutcome.failedPrepare': 'The local engine was not restarted; the current engine keeps running.',
     'localEngine.restartOutcome.failedDown': 'The local engine could not be restarted: {detail}',
+    'localEngine.swapGuard.newer': 'The local engine (version {running}) was started by a newer Sema than this one ({own}), so Sema keeps it running instead of replacing it with an older engine.',
+    'localEngine.swapGuard.newer.highWater': "This machine's local engine data was last used by a newer Sema (engine version {running}) than this one ({own}), so Sema does not start an older engine on it.",
+    'localEngine.swapGuard.newer.cliUpdate': 'To apply the change, run `sema update`.',
+    'localEngine.swapGuard.newer.appUpdate': 'To apply the change, update this app.',
+    'localEngine.swapGuard.hold': 'The local engine is not replaced yet: work still waiting on it may not continue on the replacement.',
+    'localEngine.swapGuard.unknown': 'Sema cannot tell whether the running local engine is newer than this Sema, so it is not replaced unless you confirm.',
+    'localEngine.swapGuard.parked.one': 'One approval card is still waiting for an answer.',
+    'localEngine.swapGuard.parked.oneSession': '{count} approval cards are still waiting for an answer in one session.',
+    'localEngine.swapGuard.parked.manySessions': '{count} approval cards are still waiting for an answer across {sessions} sessions.',
+    'localEngine.swapGuard.parked.failed': 'Whether approval cards are still waiting for an answer could not be read.',
+    'localEngine.swapGuard.parked.unsupported': 'Whether approval cards are still waiting for an answer cannot be read from this engine.',
+    'localEngine.swapGuard.wayOut.interactive': 'Answer waiting cards first, or confirm to replace the engine now.',
+    'localEngine.swapGuard.wayOut.print': 'This command keeps using the current engine; open Sema interactively to answer waiting cards or to replace it.',
+    'localEngine.swapGuard.told.one': 'The local engine was replaced; the approval card that was still waiting may no longer be answerable. If it says it cannot continue, send that turn again.',
+    'localEngine.swapGuard.told.other': 'The local engine was replaced; {count} approval cards that were still waiting may no longer be answerable. If one says it cannot continue, send that turn again.',
+    'localEngine.swapGuard.told.unknown': 'The local engine was replaced; approval cards that were still waiting, if any, may no longer be answerable. If one says it cannot continue, send that turn again.',
+    'engine.unavailable.line': '[sema] engine-fatal · {tag} — {head}, so nothing can reach a model on this session: {detail}. {fix}',
+    'engine.unavailable.lineNoDetail': '[sema] engine-fatal · {tag} — {head}, so nothing can reach a model on this session. {fix}',
+    'engine.unavailable.lineNoFix': '[sema] engine-fatal · {tag} — {head}, so nothing can reach a model on this session: {detail}',
+    'engine.unavailable.lineBare': '[sema] engine-fatal · {tag} — {head}, so nothing can reach a model on this session.',
+    'engine.unavailable.lineRefusedUse': '[sema] engine-fatal · {tag} — {head}, so nothing was sent to a model on this session: {detail}',
+    'engine.unavailable.lineRefusedUseNoDetail': '[sema] engine-fatal · {tag} — {head}, so nothing was sent to a model on this session.',
+    'engine.unavailable.head.notRunning': 'the sema engine is not running',
+    'engine.unavailable.head.refused': 'the sema engine refused to start',
+    'engine.unavailable.head.notAnswering': 'the sema engine is not answering',
+    'engine.unavailable.head.noHealthyAnswer': 'the sema engine has not given a healthy answer',
+    'engine.unavailable.head.drainStuck': 'the previous sema engine has not finished stopping',
+    'engine.unavailable.head.addressRefused': 'sema did not connect to the engine named in SEMA_ENGINE_URL',
+    'engine.unavailable.head.versionRefused': 'an engine is running, but this sema refused to use it',
+    'engine.unavailable.head.unknown': 'the sema engine is unavailable',
+    'engine.unavailable.again.session': 'start sema again',
+    'engine.unavailable.again.command': 'run the command again',
+    'engine.unavailable.again.app': 'open this app again',
+    'engine.unavailable.retry.session': 'restart sema to retry',
+    'engine.unavailable.retry.command': 'run the command again to retry',
+    'engine.unavailable.fix.diagnose': 'Fix: run `sema doctor` to diagnose, or {retry}.',
+    'engine.unavailable.fix.modelSetup': 'Fix: run `sema onboard` to finish model setup, then {again}.',
+    'engine.unavailable.fix.credentialConflict': 'Fix: unset one of the two and keep the one your endpoint expects, then {again}.',
+    'engine.unavailable.fix.credentialMalformed': 'Fix: run `sema cloud login` to sign in again (it rewrites the file sema manages), or `sema cloud logout` to stop using it; if you set {tokenFile} yourself, fix that file. Then {again}.',
+    'engine.unavailable.fix.credentialMultiTenant': 'Fix: give the engine the worker pull token ({token}, or one bare line in the file {tokenFile} names), or unset REQUIRE_PRINCIPAL for a single-user engine, then {again}.',
+    'engine.unavailable.fix.credential': 'Fix: correct the sign-in credential the engine named, then {again}.',
+    'engine.unavailable.wait.respond': 'wait for it to respond',
+    'engine.unavailable.wait.healthy': 'wait for it to give a healthy answer',
+    'engine.unavailable.wait.exit': 'wait for it to exit',
+    'engine.unavailable.fix.waitPid': 'Fix: {wait} and {again}, or stop it yourself (kill {pid}) and {again}.',
+    'engine.unavailable.fix.wait': 'Fix: {wait} and {again}, or stop that engine process yourself and {again}.',
+    'engine.bootRefusal.withWaysOut': 'The local engine refused to start: {reason} {waysOut}',
+    'engine.bootRefusal.withFix': 'The local engine refused to start: {reason} {fix}',
+    'engine.bootRefusal.waysOut': 'Ways out: (1) {newer} — {separate}; (2) {restore}; (3) {repair}.',
+    'engine.bootRefusal.who.sema': 'a newer sema',
+    'engine.bootRefusal.who.semaAtLeast': 'a newer sema (its engine is version {version} or later)',
+    'engine.bootRefusal.who.app': 'a newer version of this app',
+    'engine.bootRefusal.who.appAtLeast': 'a newer version of this app (its engine is version {version} or later)',
+    'engine.bootRefusal.who.build': 'a newer build',
+    'engine.bootRefusal.who.buildAtLeast': 'a newer build (engine {version} or later)',
+    'engine.bootRefusal.newer.update': '{who} has used this data folder: update this sema with `sema update` and {again}, or start that newer sema again',
+    'engine.bootRefusal.newer.projectLocal': '{who} has used this data folder: update the copy of sema installed in this project where it was installed, then {again}; or start that newer sema again',
+    'engine.bootRefusal.newer.devTree': '{who} has used this data folder: switch this working tree to the newer build, then {again}; or start that newer sema again',
+    'engine.bootRefusal.newer.app': '{who} has used this data folder: update this app, or start that newer version again',
+    'engine.bootRefusal.newer.unknown': '{who} has used this data folder: start that newer sema again',
+    'engine.bootRefusal.newer.deployment': '{who} wrote this data root: deploy that build',
+    'engine.bootRefusal.separate.embedded': 'to keep using this sema on this computer, start it with its own configuration folder: `{key}=<another-folder> sema` (it starts without your settings and sessions)',
+    'engine.bootRefusal.separate.app': 'to keep using this version, start it with its own configuration folder (`{key}=<another-folder>`); it starts without your settings and sessions',
+    'engine.bootRefusal.separate.deployment': 'to run this older build on this machine, give it its own data root (LOCAL_DATA_ROOT)',
+    'engine.bootRefusal.restore': 'put back a copy of {folder} made before the newer engine first opened it, then {again} (also the way out when a file named above is damaged; changes made after that copy are lost)',
+    'engine.bootRefusal.restoreDeployment': 'restore the data-root backup taken before the upgrade, then start this build (also the way out when a file named above is damaged)',
+    'engine.bootRefusal.folder.default': 'the engine-data folder in your sema configuration folder',
+    'engine.bootRefusal.repair': 'if a file named above could not be read at all (an I/O error such as EACCES), repair access to it (permissions, disk) and {again}',
+    'engine.bootRefusal.repairDeployment': 'if a file named above could not be read at all (an I/O error such as EACCES), repair access to it (permissions, mount, disk) and restart',
     'session.devices.repoint.done': "Done: this machine's device record and sessions now follow the new engine address. The device kept its identity — nothing was enrolled again.",
     'session.devices.repoint.unverified': "Nothing was changed: the new address could not be confirmed to hold this device. If it is the same engine, check that you are signed in as the device's owner and try again. Otherwise enroll this machine again at the engine's own address, then remove the old device from the engine's device list.",
     'session.devices.repoint.undetermined': "Nothing was changed: a check against the new address could not be read, so it is not known whether this device is registered there. Try again. Or enroll this machine again at the engine's own address, then remove the old device from the engine's device list.",
     'session.devices.repoint.partial': 'The device record now follows the new address, but not every session could be updated. Run the same command again to finish — sessions that were already updated are left as they are.',
-    'session.devices.repoint.storeFailed': "The device record could not be moved, so nothing was changed. Run the command again; if it keeps failing, enroll this machine again at the engine's own address.",
+    'session.devices.repoint.storeFailed': "The device record could not be confirmed as moved, so no session was touched. Run the same command again; if it keeps failing, enroll this machine again at the engine's own address.",
     'session.devices.repoint.refused.addressInvalid': 'Nothing was changed: an address is not usable. Give the full https:// address of the engine (plain http:// is only accepted for this machine).',
     'session.devices.repoint.refused.sameAddress': 'Nothing was changed: the new address is the same engine address as the old one.',
     'session.devices.repoint.refused.recordAbsent': 'Nothing was changed: this machine has no device record for the old address.',
@@ -1421,5 +1659,58 @@ const EN = {
     'session.devices.repoint.refused.recordUnreadable': 'Nothing was changed: a device record could not be read, so it was left alone.',
     'session.devices.repoint.refused.targetOccupied': 'Nothing was changed: this machine already has a different device record for the new address.',
     'session.devices.repoint.refused.unarmed': 'Nothing was changed: this app is not set up to move the device record and its sessions.',
+    'session.devices.repoint.refused.rosterUnbound': 'Nothing was changed: this app is not set up to read the device list at the new address, so the move cannot be checked. This is a setup problem in the app, and trying again will not fix it.',
+    'attachments.withheld.toolsElsewhere.row': "the tools in this session do not work on this machine's files",
+    'attachments.withheld.toolsLocationUnconfirmed.row': "could not confirm that the tools in this session work on this machine's files",
+    'attachments.withheld.toolsElsewhere.model': "the tools in this session do not work on the files of the machine this client runs on, so the client did not attach that machine's copy; it may differ from the file the tools read and change, or the file may exist only where the tools run",
+    'attachments.withheld.toolsLocationUnconfirmed.model': "the client could not confirm that the tools in this session work on the files of the machine it runs on, so it did not attach that machine's copy; it may differ from the file the tools read and change, or the file may exist only where the tools run",
+    'attachments.localCopy.model': "The user shared this from the machine this client runs on: it is that machine's copy, and any path shown with it is a path on that machine. The tools in this session may not work on that machine's files, so the file they read and change may differ or may not exist.",
+    'session.compaction.canceled': 'Compaction canceled.',
+    'localEngine.health.answer.unansweredTimeout': 'did not answer in time',
+    'localEngine.health.answer.unansweredNetwork': 'could not be reached',
+    'localEngine.health.answer.ok': 'answered with status "ok"',
+    'localEngine.health.answer.notOkHttp': 'answered HTTP {http}',
+    'localEngine.health.answer.notOkStatus': 'answered HTTP {http} but not with status "ok"',
+    'centerTrust.refusal.badInput': 'This check was given a value it cannot read; that is a defect in the client, not in what you entered.',
+    'centerTrust.refusal.empty': 'No address was given.',
+    'centerTrust.refusal.tooLong': 'The address is too long (at most {addressMax} characters, and at most {authorityMax} for the host part).',
+    'centerTrust.refusal.unsafeCharacter': 'The address contains whitespace, a control character or a backslash.',
+    'centerTrust.refusal.scheme': 'The address must be written in full, starting with `https://` for an invitation link, or with `http://` or `https://` for a center address.',
+    'centerTrust.refusal.userinfo': 'The address must not carry a user name or password before the host.',
+    'centerTrust.refusal.percentInHost': 'The host part of the address must not contain percent-encoding.',
+    'centerTrust.refusal.unparseable': 'The address is not a parseable http(s) URL.',
+    'centerTrust.refusal.query': 'The address must not carry a query (`?`).',
+    'centerTrust.refusal.fragment': 'The address must not carry a fragment (`#`); only an invitation link may end with a `#ca=` list of fingerprints.',
+    'centerTrust.refusal.trailingDot': 'The host name must not end with a dot.',
+    'centerTrust.refusal.ipNotCanonical': 'An IP address must be written in its standard form (for example `127.0.0.1`, not a shortened or hexadecimal form).',
+    'centerTrust.refusal.plaintextRemote': 'Plain `http://` is allowed only for this machine; a remote center must use `https://`.',
+    'centerTrust.refusal.path': 'The address path is not allowed: an invitation link takes no path, and a center address path must not start with `//` or contain `.` or `..` segments.',
+    'centerTrust.refusal.fingerprint': 'A fingerprint must be `sha256:` followed by 64 hexadecimal digits (an invitation link takes lowercase digits only).',
+    'centerTrust.refusal.tooManyFingerprints': 'At most {fingerprintsMax} fingerprints can be given.',
+    'centerTrust.refusal.prefix': 'A fingerprint must start with `sha256:`.',
+    'centerTrust.refusal.parserUnavailable': "This client cannot read certificates on this platform, so it cannot pin the center's certificate.",
+    'centerTrust.refusal.bodyTooLarge': "The center's certificate answer is larger than {bodyMax} bytes.",
+    'centerTrust.refusal.bodyNotJson': "The center's certificate answer is not valid UTF-8 JSON.",
+    'centerTrust.refusal.bodyShape': "The center's certificate answer does not have the expected shape.",
+    'centerTrust.refusal.servedCount': 'The center must serve from 1 to {servedMax} certificates.',
+    'centerTrust.refusal.certificateTooLarge': 'A certificate from the center is longer than {pemMax} characters.',
+    'centerTrust.refusal.certificateNotCanonical': 'A certificate from the center is not exactly one certificate in standard PEM form (64-character lines, LF line ends) with standard DER lengths.',
+    'centerTrust.refusal.certificateUnparseable': 'A certificate from the center could not be read on this platform.',
+    'centerTrust.refusal.servedDuplicate': 'The center served the same certificate more than once.',
+    'centerTrust.refusal.namedNotServed': 'A fingerprint you gave does not match any certificate the center serves.',
+    'centerTrust.refusal.anchorNotSelfSigned': 'A certificate you named is not self-signed, so it cannot be pinned as a trust anchor.',
+    'centerTrust.refusal.unconfiguredWithFingerprints': 'You gave fingerprints, but the center says it has no certificate authority configured.',
+    'centerTrust.refusal.cancelled': "Fetching the center's certificates was cancelled.",
+    'centerTrust.refusal.timedOut': "Fetching the center's certificates timed out (each attempt waits at most {roundSec} seconds).",
+    'centerTrust.refusal.transportFailed': 'The center could not be reached to fetch its certificates.',
+    'centerTrust.refusal.contentType': "The center's certificate answer is not JSON (wrong content type).",
+    'centerTrust.refusal.caUnavailable': 'The center reports that its certificate authority is unavailable right now.',
+    'centerTrust.refusal.endpointMissing': 'The center does not offer certificates for pinning (it may be an older version).',
+    'centerTrust.refusal.unexpectedStatus': 'The center answered the certificate request with an unexpected status.',
+    'centerTrust.refusal.retryAfterUnusable': 'The center asked to retry later without a usable wait time, so the client stopped.',
+    'centerTrust.refusal.retryAfterTooLong': 'The center asked to wait more than {waitCapSec} seconds before retrying, so the client stopped; try again later.',
+    'centerTrust.refusal.retriesExhausted': 'The center kept asking to retry; the client stopped after {attemptsMax} attempts.',
+    'centerTrust.refusal.budgetExhausted': "Fetching the center's certificates used up its {budgetSec}-second time budget.",
+    'centerTrust.refusal.unknown': "The center's certificate could not be checked.",
 };
 export const EN_MESSAGES = Object.freeze(EN);