Best possible solution:

Land the generated baseline sync after exact-head CI/review, keeping native approvals UI raw copy tracked without broadening localization scope.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main has four literal native approvals UI strings while the raw-copy baseline omits them, and the check code fails when generated findings differ from the baseline.

Is this the best way to solve the issue?

Yes. For this legacy untranslated surface, adding the generated raw-copy entries is the narrowest maintainable fix; moving these labels into full localization would be broader than the reported gate repair.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 70de9ff20b3c.

Label changes:

• add P2: This is a bounded Control UI i18n gate repair that can affect release validation but does not change runtime behavior.
• add proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports the after-fix i18n check passing and ties the before-state failure to the release-gate job that found these four missing entries.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body reports the after-fix i18n check passing and ties the before-state failure to the release-gate job that found these four missing entries.

Label justifications:

• P2: This is a bounded Control UI i18n gate repair that can affect release validation but does not change runtime behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body reports the after-fix i18n check passing and ties the before-state failure to the release-gate job that found these four missing entries.
• proof: sufficient: Contributor real behavior proof is sufficient. The PR body reports the after-fix i18n check passing and ties the before-state failure to the release-gate job that found these four missing entries.

PR surface:

Source +28. Total +28 across 1 file.

What I checked:

• Scoped i18n policy allows this targeted generated-output fix: The UI guide says .i18n metadata should not be hand-edited unless a targeted generated-output fix is explicitly requested, and this PR is exactly a generated raw-copy baseline sync. (ui/AGENTS.md:8, 70de9ff20b3c)
• Current main contains the native approvals raw strings: The native exec approvals renderer includes Host-native policy, Read-only here. Edit from the companion app or CLI., Native, and Default action as literal UI text. (ui/src/pages/nodes/view-exec-approvals.ts:251, 70de9ff20b3c)
• Current baseline is missing the new native strings: The current baseline jumps from Case-insensitive glob patterns. to Defaults, from Host to Load exec approvals..., and from Pattern to Remove, so the four new native strings are not tracked on main. (ui/src/i18n/.i18n/raw-copy-baseline.json:3921, 70de9ff20b3c)
• The i18n check fails on baseline drift: syncControlUiRawCopyBaseline compares generated findings to the raw-copy baseline and throws control-ui raw-copy baseline drift detected in check mode when the files differ. (scripts/control-ui-i18n.ts:906, 70de9ff20b3c)
• PR diff adds exactly the four missing entries: The PR patch adds Default action, Host-native policy, Native, and Read-only here. Edit from the companion app or CLI. as html-text baseline entries for the native approvals view. (ui/src/i18n/.i18n/raw-copy-baseline.json:3921, baef858fd97d)
• Merged related PR introduced the raw strings: Git blame ties the native approvals UI strings to the merged native Windows exec approvals work, so this PR is a direct baseline follow-up rather than unrelated generated churn. (ui/src/pages/nodes/view-exec-approvals.ts:251, a7faec8ca1d0)

Likely related people:

• steipete: Peter Steinberger introduced the raw-copy i18n script and baseline in the current shallow history and also authored the merged native approvals UI strings that this PR tracks. (role: introduced behavior and recent area contributor; confidence: high; commits: 16348ddec3ad, a7faec8ca1d0; files: scripts/control-ui-i18n.ts, ui/src/i18n/.i18n/raw-copy-baseline.json, ui/src/pages/nodes/view-exec-approvals.ts)
• vincentkoc: Vincent Koc is co-author on the merged native Windows exec approvals work that added the UI surface whose raw strings now need baseline tracking. (role: adjacent owner; confidence: medium; commits: a7faec8ca1d0; files: ui/src/pages/nodes/view-exec-approvals.ts, ui/src/lib/nodes/index.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.