2 files changed, 16 insertions, 4 deletions
diff --git a/config/locales/en.json b/config/locales/en.json
index c8ec474..7877f20 100644
--- a/config/locales/en.json
+++ b/config/locales/en.json
@@ -1,12 +1,17 @@
 {
   "app.starting": "Starting agent.",
-  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}. Start an elevated terminal and ensure the Base Filtering Engine service is running.",
+  "app.preflight_failed": "Sandbox preflight failed before bind: operation={operation}; error_code={error_code}; platform={platform}; application_profile={profile}; BFE={bfe}; helper={helper}; helper_version={version}. Restore the Release Bundle or start the Base Filtering Engine service.",
   "app.ready.http": "Agent is ready for MCP requests. endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "Agent stdio transport is ready. protocol={protocol}; pid={pid}; logs={logs}",
   "config.invalid": "Invalid configuration: {message}",
   "locale.invalid": "Invalid locale: {message}",
   "cli.invalid": "Invalid command line: {message}",
   "app.io_error": "Startup I/O failed: {message}",
+  "runtime.platform.elevation_cancelled": "Windows elevation was cancelled. The current Task failed; the MCP Server is still running. Detail: {message}",
+  "runtime.platform.elevation_failed": "Windows elevation failed. The current Task failed; the MCP Server is still running. Detail: {message}",
+  "runtime.platform.helper_incompatible": "The bundled elevated helper is missing or incompatible. Restore the Release Bundle. Detail: {message}",
+  "runtime.platform.ipc_rejected": "The elevated helper connection was rejected by the Sandbox Broker. Detail: {message}",
+  "runtime.platform.network_apply_failed": "The Windows network Task Resource could not be applied safely. Detail: {message}",
   "show.configuration": "Configuration: {path}",
   "show.applied": "Applied: {value}",
   "show.fingerprint": "Fingerprint: {value}",
@@ -15,7 +20,7 @@
   "show.not_applied": "not-applied",
   "show.matched": "matched",
   "show.changed": "changed",
-  "show.platform": "Platform: not probed; startup performs the full privileged preflight",
+  "show.platform": "Platform: not probed; startup performs read-only platform and helper validation",
   "show.filesystem": "FILESYSTEM",
   "show.filesystem_columns": "TYPE\tLOGICAL\tRESOLVED\tACCESS\tSTATUS",
   "show.execution": "EXECUTION",
@@ -49,6 +54,7 @@
   "runtime.policy_repeated": "The same sandbox policy denial occurred again, so replanning was stopped.",
   "runtime.replan_unchanged": "Replanning did not change the incomplete task plan.",
   "runtime.policy_resolution.filesystem": "Review the Workspace or Mount and its required Filesystem Capability in YAML, then run agent-mcp apply.",
+  "runtime.policy_resolution.acl": "Use a root owned by the current user or grant that user WRITE_DAC. Elevation does not bypass this requirement.",
   "runtime.policy_resolution.process": "Use an Alias declared in execution.entries, an allowed Runtime Component, or a development Workspace Artifact; review and apply changed identity in YAML.",
   "runtime.policy_resolution.network": "Review the selected Network access mode and endpoint list; the Agent cannot widen it during a Task.",
   "runtime.policy_resolution.default": "Review the YAML permission matrix with agent-mcp show, then run agent-mcp apply.",
diff --git a/config/locales/ja.json b/config/locales/ja.json
index 708bf47..96eb3a6 100644
--- a/config/locales/ja.json
+++ b/config/locales/ja.json
@@ -1,12 +1,17 @@
 {
   "app.starting": "エージェントを起動しています。",
-  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; administrator={administrator}; BFE={bfe}; WFP transaction={transaction}; WFP add/delete={filters}。管理者権限のターミナルで起動し、Base Filtering Engineサービスを確認してください。",
+  "app.preflight_failed": "待受開始前のSandbox診断に失敗しました: operation={operation}; error_code={error_code}; platform={platform}; application_profile={profile}; BFE={bfe}; helper={helper}; helper_version={version}。Release Bundleを復元するかBase Filtering Engineサービスを確認してください。",
   "app.ready.http": "MCPリクエストを受け付けられます。endpoint={endpoint}; protocol={protocol}; stateless={stateless}; legacy_initialize_fallback={fallback}; pid={pid}; logs={logs}",
   "app.ready.stdio": "stdio transportでMCPリクエストを受け付けられます。protocol={protocol}; pid={pid}; logs={logs}",
   "config.invalid": "設定が不正です: {message}",
   "locale.invalid": "ロケールが不正です: {message}",
   "cli.invalid": "コマンドラインが不正です: {message}",
   "app.io_error": "起動時のI/O処理に失敗しました: {message}",
+  "runtime.platform.elevation_cancelled": "Windowsの権限昇格が拒否されました。当該Taskは失敗しましたがMCP Serverは継続しています。詳細: {message}",
+  "runtime.platform.elevation_failed": "Windowsの権限昇格に失敗しました。当該Taskは失敗しましたがMCP Serverは継続しています。詳細: {message}",
+  "runtime.platform.helper_incompatible": "同梱された昇格用Executableが存在しないか互換性がありません。Release Bundleを復元してください。詳細: {message}",
+  "runtime.platform.ipc_rejected": "昇格用Executableとの接続をSandbox Brokerが拒否しました。詳細: {message}",
+  "runtime.platform.network_apply_failed": "WindowsのNetwork Task Resourceを安全に適用できませんでした。詳細: {message}",
   "show.configuration": "設定: {path}",
   "show.applied": "適用済み: {value}",
   "show.fingerprint": "fingerprint: {value}",
@@ -15,7 +20,7 @@
   "show.not_applied": "未適用",
   "show.matched": "一致",
   "show.changed": "変更あり",
-  "show.platform": "Windows preflight: 未実行（Server起動時に管理者権限で完全検査）",
+  "show.platform": "Windows preflight: 未実行（Server起動時にread-onlyのPlatform/helper検査）",
   "show.filesystem": "FILESYSTEM権限",
   "show.filesystem_columns": "種別\t論理PATH\t解決済みPATH\tアクセス\t状態",
   "show.execution": "EXECUTION権限",
@@ -49,6 +54,7 @@
   "runtime.policy_repeated": "同一のSandbox Policy拒否が再発したため、再計画を停止しました。",
   "runtime.replan_unchanged": "再計画後も未完了のタスク計画が変更されませんでした。",
   "runtime.policy_resolution.filesystem": "YAMLのWorkspaceまたはMountと必要なFilesystem Capabilityを確認し、agent-mcp applyを実行してください。",
+  "runtime.policy_resolution.acl": "現在のユーザーが所有するrootを使用するか、そのユーザーへWRITE_DACを付与してください。昇格でこの要件を迂回することはありません。",
   "runtime.policy_resolution.process": "execution.entriesのAlias、許可されたRuntime Component、またはdevelopment Workspace Artifactを使用し、変更されたidentityはYAMLで確認してapplyしてください。",
   "runtime.policy_resolution.network": "Network access modeとendpoint一覧を確認してください。AgentはTask中に許可範囲を拡張できません。",
   "runtime.policy_resolution.default": "agent-mcp showでYAMLの権限マトリックスを確認し、agent-mcp applyを実行してください。",