finding(spec/objectql): injected system-column labels are hard-coded English, so every non-English tenant sees "Organization" / "Created By" on every business object

[baozhoutao]

Seam card filed from cloud#1904 (repo:cloud lane). That card fixed the consumer half — the AI-Studio build linter no longer reports these labels to the user, because the user cannot act on them. This card is the producer half: the labels really are unlocalised, measured on the tree, and only this repo can fix it.

Measured

packages/spec/src/data/injected-system-column-provenance.ts hard-codes an English label on every injected column, with no locale plumbing of any kind:

• AUDIT_FIELD_DEFS — Created At, Created By, Last Modified At, Last Modified By
• TENANT_SCOPE_FIELD_DEF — Organization
• OWNER_FIELD_DEF — Owner
• OWNING_BUSINESS_UNIT_FIELD_DEF — same shape (currently hidden: true, so not user-visible yet)

applySystemFields (packages/objectql/src/registry.ts) spreads those definitions verbatim onto every eligible object, and the /meta read exits merge them in via applyInjectedSystemColumns. So a tenant whose app is authored entirely in zh-CN gets a field list that reads 名称 / 阶段 / 金额 / Organization / Created By / Owner on every business object — in list views, detail layouts, filter pickers and lookup chips.

Observed downstream (cloud#1904)

On the 2026-09-03 zh-CN rig this was visible enough that the AI build agent surfaced it to the end user every single round, asking them to decide whether to translate fields they had never declared. The cloud side is fixed; the English labels themselves are still shipped.

Why this is not a one-line label swap — the constraint that makes it a spec decision

applySystemFields' own comment blocks the obvious fix:

the definitions must stay byte-identical to the shipped tables, because the #7859 Layer-0 guard and the #4326 round-trip strip both read them by exact identity. Do not add keys here; consumers ask the API.

So localisation cannot be done by mutating the definitions in place, and it cannot be done by adding a key to them either. It needs a deliberate answer to "where does a system column's display name come from, and who resolves it against the tenant locale" — a presentation-layer resolution at the read exit, an i18n key alongside the identity-stable definition, or an explicit ruling that these stay English. That is a packages/spec seat call, which is why this is filed rather than fixed.

Dedupe

Searched before filing. The nearby i18n cards do not cover the injected column definitions, and all are closed:

• auth 邮件（验证/重置）不按用户语言选模板：中文界面注册收到英文主题与正文 #14319 — auth email template selection by user language
• i18n: extract + gate declared action/UI labels (they leak English in a zh-CN workspace) #3370 — declared action/UI labels leaking English
• console: organization & invitation UI ships untranslated English in a zh locale (6 sites, incl. icon-only aria-labels) #8094, Console: AddressField sub-labels and placeholders are hardcoded English literals — an address field is untranslatable on any non-English console #5083, console: the tenant's server-side locale (/auth/me/localization) is fetched but never seeds the UI language — first login is always browser-or-en #5419 — console/objectui-side untranslated strings and locale seeding
• i18n: GET /i18n/locales declares a locale label as "Display name" but every producer sets it to the code #7634 — GET /i18n/locales label semantics

Related epic: cloud#1841 (its objectstack sub-cards are tracked as links, hence a standalone card here rather than a sub-issue).

Filed unassigned, no priority label — grading is the triage seat's call.

[os-zhuang]

Triage (R+146): lands in packages/spec/src/data/injected-system-column-provenance.ts ⇒ domain:spec. Graded Bug · priority:p2 · i18n.

Bug: nothing widens. Every eligible object is spread with hard-coded English display names, so a fully zh-CN app reads 名称 / 阶段 / 金额 / Organization / Created By / Owner.

priority:p2 — user-visible on every non-English tenant, on every business object, across list views, detail layouts, filter pickers and lookup chips. ⛔ Not p1: nothing breaks, no data is wrong, and the app is fully usable.

⭐ The downstream cost is measured, not argued. On the 2026-09-03 zh-CN rig it was visible enough that the AI build agent surfaced it to the end user every single round, asking them to decide whether to translate fields they never declared. cloud#1904 fixed the consumer half by suppressing the report — correctly, since the user cannot act on it — which means the English labels now ship with the one thing that noticed them switched off. ⇒ ⛔ Do not read cloud#1904's landing as this being smaller than it was.

⛔ Why this is not a one-line label swap — carry this into the dispatch

applySystemFields' own comment forbids both obvious routes:

the definitions must stay byte-identical to the shipped tables, because the #7859 Layer-0 guard and the #4326 round-trip strip both read them by exact identity. Do not add keys here; consumers ask the API.

⇒ ⛔ Localisation cannot be done by mutating the definitions in place, and it cannot be done by adding a key to them either. A dev who starts by editing AUDIT_FIELD_DEFS will take two guards red and will be right to stop.

The question this card actually asks

Where does a system column's display name come from, and who resolves it against the tenant locale? Three shapes, and the card names them without choosing:

1. presentation-layer resolution at the read exit (applyInjectedSystemColumns), leaving the identity-stable definitions untouched;
2. an i18n key alongside the definition, resolved by consumers;
3. an explicit ruling that these stay English.

⛔ Routed as work, not escalated, per the filer's own reading that this is a packages/spec seat call. ⚠️ If the chosen shape adds authorable or published surface — option 2 most likely does — that is Clause-② and the contract-review tier, and if the seat concludes the answer is option 3 (a deliberate product statement that platform columns are English), that is a product decision and goes to the decision inbox. Say which at claim time rather than at PR time.

⭐ Option 1 is the only one that is obviously compatible with the byte-identity constraint, since it never touches the definitions. Worth establishing first whether the read exit has the tenant locale in hand — if it does not, that is the real size of this card.

⛔ OWNING_BUSINESS_UNIT_FIELD_DEF is hidden: true and therefore not user-visible today. Fix it with the rest for consistency, ⛔ but do not count it as part of the harm.

⚠️ The dedupe is stated and checked (#14319, #3370, #8094, #5083, #5419, #7634 — all closed, none covering the injected definitions). Re-verify before filing anything adjacent.

---

Generated by Claude Code

[claude]

Claim: PM loop round R1 — domain:spec seat, session_01M59rPZZFzqhfMUPFqqZTkf, 2026-09-05T04:03Z. Branch claude/issue-14972-injected-system-column-labels-localised, mode:subagent, tier claude-fable-5-1 (= CONTRACT_REVIEW_TIER).

Clause-②: yes (provisional, per the triage note's own instruction to say which at claim time). Content limb: the triage names one shape (an i18n key alongside the identity-stable definitions) that would widen published surface, and one (a product statement that platform columns stay English) that is a decision-inbox matter; the shape this seat expects — rows added to the module-private SYSTEM_FIELD_LABELS table in packages/spec/src/system/i18n-resolver.ts — widens nothing. Declared yes so the dispatch runs at the contract tier; the in-seat review after delivery decides on the real diff (a declaration overturned by the tier review is the mechanism working, per the 2026-09-01 ruling). Path limb: packages/spec/src/** hits.

Seat readings (origin/main 581d8f84c, 2026-09-05T04:00Z) — the premise is narrower than the card's title: packages/spec/src/system/i18n-resolver.ts:2094 already carries a built-in label table for the injected columns (owner_id, created_at, created_by, updated_at, updated_by in en / zh-CN / ja-JP / es-ES), applied by builtinSystemFieldLabel (:2108, one call site :2244) only while a field still carries its injected English default — the path that renders created_at as 创建时间 in #14882's own reproduction. The tenant-scope column (Organization, hidden: true on its definition), the owner column as the definition names it, and Owning Business Unit are the rows to measure. Definitions in packages/spec/src/data/injected-system-column-provenance.ts are byte-identity guarded (objectql/src/registry.ts:494-496) and are NOT edited.

File face: packages/spec/src/system/i18n-resolver.ts (the SYSTEM_FIELD_LABELS / builtinSystemFieldLabel region only — disjoint from PR #15707's header and ResolveOptions docblock hunks, which land first; the dev merges main before opening the PR) · packages/spec/src/system/i18n-resolver.test.ts · one @objectstack/spec changeset. ⛔ Not touched: the definitions file above; the generated i18n bundles (held with PR #15626); packages/metadata-protocol / packages/metadata-core read exits (engine lane — PR #15395 / #14147 is in flight on metadata-protocol/src/protocol.ts; if the producer turns out to live there the dev STOPS and reports instead of editing). Targeted in-flight check on that basis: no intersection declared.

Dedup reading handed to the dev (MCP search_issues 2026-09-05T04:01Z, 4 results, #14972 the in-set control; #8195 · #7634 · #5083 closed and unrelated) — the card's own list (#14319 · #3370 · #8094 · #5083 · #5419 · #7634, all closed) stands.

---

Generated by Claude Code